fix: update next to 16.2.11, brace-expansion, and postcss to resolve CVEs

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

Updated multiple vulnerable dependencies:

• next 16.2.6 → 16.2.11 (direct runtime dependency)
  • CVE-2026-64641 / GHSA-m99w-x7hq-7vfj: DoS in App Router using Server Actions
  • CVE-2026-64642 / GHSA-6gpp-xcg3-4w24: Middleware/Proxy bypass with Turbopack
  • CVE-2026-64643 / GHSA-955p-x3mx-jcvp: Unauthenticated disclosure of internal Server Function endpoints
  • CVE-2026-64644 / GHSA: Cache poisoning in App Router
  • CVE-2026-64645 / GHSA-p9j2-gv94-2wf4: SSRF in rewrites via attacker-controlled destination hostname
  • CVE-2026-64646 / GHSA: Multiple moderate severity issues
  • CVE-2026-64647 / GHSA: Additional App Router security issues
  • CVE-2026-64648 / GHSA: Authorization issues
  • CVE-2026-64649 / GHSA-89xv-2m56-2m9x: SSRF in Server Actions on custom servers
  • Dependabot alerts: https://github.com/warpdotdev/commands.dev/security/dependabot/106 https://github.com/warpdotdev/commands.dev/security/dependabot/107 https://github.com/warpdotdev/commands.dev/security/dependabot/108 https://github.com/warpdotdev/commands.dev/security/dependabot/109 https://github.com/warpdotdev/commands.dev/security/dependabot/110 https://github.com/warpdotdev/commands.dev/security/dependabot/111 https://github.com/warpdotdev/commands.dev/security/dependabot/112 https://github.com/warpdotdev/commands.dev/security/dependabot/113 https://github.com/warpdotdev/commands.dev/security/dependabot/114
• brace-expansion 1.1.12 → 1.1.17, 2.0.2 → 2.1.3 (transitive dev dependency, updated via npm audit fix)
  • CVE-2026-13149 / GHSA-3jxr-9vmj-r5cp: DoS via exponential-time expansion
  • Dependabot alerts: https://github.com/warpdotdev/commands.dev/security/dependabot/104 https://github.com/warpdotdev/commands.dev/security/dependabot/105
• postcss 8.5.10 → 8.5.25 (devDependency + override, updating pinned version)
  • GHSA-6g55-p6wh-862q: Arbitrary file read via sourceMappingURL
  • GHSA-r28c-9q8g-f849: Path traversal via Previous Source Map Auto-Loading
• eslint-config-next 16.2.6 → 16.2.11 (aligned with next version)

Verification: npm install succeeds cleanly; brace-expansion patched to 1.1.17/2.1.3 in package-lock.json; next at 16.2.11; postcss at 8.5.25.

Highlight the risky code / where the dependency was used

• next is the core framework (pages/, components/, next.config.js). The 16.2.6→16.2.11 bump is a patch-level update within the same minor; review Next.js release notes for any behavioral changes.
• postcss is used by Tailwind CSS and autoprefixer for CSS processing (postcss.config.js, tailwind.config.js).
• brace-expansion is a transitive dev-only dependency (eslint toolchain); no runtime impact.

Special instructions for this PR

This is a patch-level next.js update (16.2.6 → 16.2.11). Verify that the site builds correctly with npm run build before merging if you want extra confidence.

AFTER YOU MERGE

No post-merge steps required.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
commands-dev	Ready	Preview	Jul 29, 2026 8:30pm

[dannyneira]

Dependency-only update looks safe based on diff scope and current PR status. Approving.

[dannyneira]

Approved, but merge is currently blocked because this branch no longer merges cleanly with base. Please rebase/update branch, then it can be merged.