Update Next.js and override brace-expansion for security advisoriesfeature/instant-locale-switch

The dependency audit reports a critical Next.js advisory for releases before
16.3.6 (remote code execution in next/og ImageResponse) and high-severity
denial-of-service advisories for brace-expansion before 5.0.12. The site does
not import next/og, but production runs the affected Next.js release.

- next and eslint-config-next: 16.3.3 to 16.3.8.
- brace-expansion: the lockfile resolves 1.1.21 within its range; the 5.x
  line, which minimatch pins to 5.0.9, is overridden to 5.0.12 in the
  workspace until minimatch depends on a fixed release.

pnpm audit reports no known vulnerabilities. Prettier, eslint, the type
check, the tests and the production build pass.

1 files changed, 3 insertions, 3 deletions

diff --git a/apps/web/package.json b/apps/web/package.json
index fef38d7..26497af 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -18,17 +18,17 @@
     "format": "prettier --write ."
   },
   "dependencies": {
-    "next": "16.3.3",
+    "next": "16.3.8",
     "react": "19.2.8",
     "react-dom": "19.2.8"
   },
   "devDependencies": {
-    "c8": "12.0.0",
     "@types/node": "24.10.1",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
+    "c8": "12.0.0",
     "eslint": "9.39.2",
-    "eslint-config-next": "16.3.3",
+    "eslint-config-next": "16.3.8",
     "prettier": "3.8.2",
     "typescript": "6.0.3"
   }