fix(deps): patch Next.js and PostCSS vulnerabilities

Author: iamjr15

AGENTS.md

@@ -14,7 +14,7 @@ source tree on July 13, 2026; the repository now contains V2 code only.
 | Layer | Choice |
 |---|---|
 | Backend | Cloudflare Workers + Durable Objects + Workflows |
-| Frontend | Next.js 16.2.10 + React 19.2.7 + Tailwind 4.3.2 + shadcn 4.6.0 + AI Elements + Streamdown on Vercel |
+| Frontend | Next.js 16.2.11 + React 19.2.7 + Tailwind 4.3.2 + shadcn 4.6.0 + AI Elements + Streamdown on Vercel |
 | Agent framework | Mastra 1.51.0 on Vercel AI SDK v6.0.205 |
 | Sandbox | Daytona per-user sandboxes via REST-over-fetch |
 | Browser | Stagehand v3.7.0 LOCAL inside the Daytona sandbox snapshot |

CLAUDE.md

@@ -14,7 +14,7 @@ Direct competitors: Manus (generalist async agent), HappyCapy (GUI workstation +
 |---|---|
 | Language | **TypeScript** everywhere. No Python in backend. Python lives only inside the Daytona sandbox. |
 | Backend runtime | **Cloudflare Workers + Durable Objects + Workflows** |
-| Frontend | **Next.js 16.2.10 + React 19.2.7 + Tailwind 4.3.2 + shadcn CLI 4.6.0 + AI Elements + Streamdown** on Vercel |
+| Frontend | **Next.js 16.2.11 + React 19.2.7 + Tailwind 4.3.2 + shadcn CLI 4.6.0 + AI Elements + Streamdown** on Vercel |
 | Agent framework | **Mastra 1.51.0** on top of **Vercel AI SDK v6.0.205** |
 | Sandbox | **Daytona Sandboxes** via REST-over-fetch (no SDK in Workers; `packages/tools-code/src/daytona-client.ts`) — one persistent sandbox per user with isolated project folders |
 | Browser automation | **Stagehand v3.7.0 LOCAL mode** inside the Daytona sandbox image |

infra/containers/sandbox/app-generators/package-lock.json

@@ -6,6 +6,6 @@
     "node": "22.22.2"
   },
   "dependencies": {
-    "create-next-app": "16.2.10"
+    "create-next-app": "16.2.11"
   }
 }

infra/containers/sandbox/app-generators/package.json

@@ -14,7 +14,7 @@
     "format": "biome format --write"
   },
   "dependencies": {
-    "next": "16.2.10",
+    "next": "16.2.11",
     "react": "19.2.7",
     "react-dom": "19.2.7"
   },

infra/containers/sandbox/app-templates/next/package.json

@@ -5,5 +5,5 @@ allowBuilds:
   sharp: false
 
 overrides:
-  'postcss@<8.5.10': 8.5.15
+  'postcss@<8.5.18': 8.5.18
   'sharp@<0.35.0': 0.35.0