chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates

[dependabot]

Bumps the npm_and_yarn group with 3 updates in the / directory: next, fast-uri and find-my-way.

Updates next from 16.2.10 to 16.2.11

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

Commits

• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• fe28768 [16.x] fix(next/image): improve performance of detectContentType()
• d8afb8d [16.x] Performance improvements when decoding React Server function payloads
• Additional commits viewable in compare view

Updates fast-uri from 3.1.3 to 3.1.4

Release notes

Sourced from fast-uri's releases.

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

Commits

• 6aeece6 Bumped v3.1.4
• 2d50fba fix: reject literal backslash in URI authority
• See full diff in compare view

Updates find-my-way from 9.6.0 to 9.7.0

Release notes

Sourced from find-my-way's releases.

v9.7.0

What's Changed

• fix: backtrack on regex param mismatch by @​mcollina in delvedor/find-my-way#427
• fix: apply root path fallback for optional params in off() by @​aquie00t in delvedor/find-my-way#428
• ci: add node v26 to test matrix by @​aquie00t in delvedor/find-my-way#435
• perf(host): cache regex lookup results in HostStorage by @​aquie00t in delvedor/find-my-way#436
• chore: bump inquirer from 13.4.3 to 14.0.2 in the dev-dependencies group by @​dependabot[bot] in delvedor/find-my-way#437
• chore: bump fastify/github-action-merge-dependabot from 3.12.0 to 3.15.0 by @​dependabot[bot] in delvedor/find-my-way#438
• chore: bump @​types/node from 25.9.4 to 26.1.0 in the dev-dependencies group by @​dependabot[bot] in delvedor/find-my-way#440
• fix: prevent done from being called multiple times on async constraint errors by @​deepview-autofix in delvedor/find-my-way#425
• fix: align isParamSafe state in findRoute with _on by @​deepview-autofix in delvedor/find-my-way#424
• chore: bump actions/checkout from 6 to 7 by @​dependabot[bot] in delvedor/find-my-way#439
• fix: avoid crash on undefined regex capture during route lookup by @​bianyifan in delvedor/find-my-way#441

New Contributors

• @​aquie00t made their first contribution in delvedor/find-my-way#428
• @​deepview-autofix made their first contribution in delvedor/find-my-way#425
• @​bianyifan made their first contribution in delvedor/find-my-way#441

Full Changelog: delvedor/find-my-way@v9.6.0...v9.7.0

Commits

• 827248e Bumped v9.7.0
• b9d7bf1 Merge branch 'main' of github.com:delvedor/find-my-way
• b7b5657 fix: avoid crash on undefined regex capture during route lookup (#441)
• 4263d82 chore: bump actions/checkout from 6 to 7 (#439)
• 66d3015 fix: align isParamSafe state in findRoute with _on (#424)
• 75e4728 fix: prevent done from being called multiple times on async constraint errors...
• 902a02d chore: bump @​types/node in the dev-dependencies group (#440)
• b803e4e chore: bump fastify/github-action-merge-dependabot from 3.12.0 to 3.15.0 (#438)
• e63cb77 chore: bump inquirer from 13.4.3 to 14.0.2 in the dev-dependencies group (#437)
• 992c1df perf(host): cache regex lookup results in HostStorage (#436)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.