fix(KNO-12386): upgrade Next.js 16.1.4 → 16.2.2

[kylemcd]

Summary

Upgrades Next.js from 16.1.4 to 16.2.2 in the lock file to resolve 5 security vulnerabilities flagged by Aikido (1 high, 2 medium, 2 low).

• Ticket: KNO-12386
• Aikido: Details

What changed

• Lock file only — next was already declared as ^16.1.4 in package.json, so 16.2.2 is within the existing semver range
• No code changes required

Why this is safe

This is a minor version bump (16.1.4 → 16.2.2). The 16.2.x release notes contain no user-facing breaking changes — primarily internal improvements (Turbopack, error page redesign, React upgrade, build optimizations). All new features are opt-in via experimental flags.

Type-checking (tsc) passes with identical results before and after the upgrade (pre-existing .next/types errors only).

[linear]

KNO-12386 [Docs] Small upgrade for Next.js

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Apr 2, 2026 4:52pm

[cursor]

Risk HIGH: Upgrades Next.js from 16.1.4 to 16.2.2 by updating yarn.lock to resolve security vulnerabilities.

Reasons

• yarn.lock is modified, which triggers HIGH risk per classification rules regardless of diff size
• Dependency version changes can introduce subtle runtime behavior changes even within semver-compatible ranges
• The change upgrades a core framework dependency (Next.js) that affects the entire build and rendering pipeline
• The diff is small (81+/71-, 1 file) and stays within the declared ^16.1.4 semver range, which limits actual risk in practice
• The PR author provides clear justification that type-checking passes and no breaking changes are present in the 16.2.x release notes

Notes

• Verify the Vercel preview deployment builds and renders correctly — this is the most important signal for a lock-file-only Next.js bump
• Confirm no regressions in page rendering, especially dynamic routes and API routes
• The author notes this resolves 5 security vulnerabilities (1 high, 2 medium, 2 low) flagged by Aikido — worth confirming those CVEs are addressed in 16.2.2
• Since package.json is unchanged and Next.js was already declared as ^16.1.4, this is a low-friction upgrade despite the HIGH classification

  

_{Sent by Cursor Automation: Docs PR classifier}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cjbell]

should this be in the package.json as well?