## Summary - replace stale dependabot PR #263 with a clean remediation path from current `main` - bump `apps/registry` `next` from `16.1.6` to `16.2.3` for the CVE-2026-23869 backport release - bump `packages/ui` `postcss` from `^8.5.6` to `^8.5.10` for the non-bundler `</style>` XSS fix ## Context - #263 is stale and now fails CI on an outdated branch state instead of the dependency update itself - repo policy requires an issue-linked PR body, so the replacement PR needs a canonical issue reference ## Sources - Next.js v16.2.3 release note: https://vercel.com/changelog/summary-of-cve-2026-23869 - PostCSS 8.5.10 changelog: https://github.com/postcss/postcss/releases/tag/8.5.10
Summary
mainapps/registrynextfrom16.1.6to16.2.3for the CVE-2026-23869 backport releasepackages/uipostcssfrom^8.5.6to^8.5.10for the non-bundler</style>XSS fixContext
Sources