chore(deps): update npm patch dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@next/env (source)	16.0.5 -> 16.0.7
lefthook	2.0.4 -> 2.0.8
next (source)	16.0.5 -> 16.0.7
react (source)	19.2.0 -> 19.2.1
react-dom (source)	19.2.0 -> 19.2.1
vitest (source)	4.0.14 -> 4.0.15

---

Release Notes

vercel/next.js (@​next/env)

v16.0.7

Compare Source

Please see CVE-2025-66478 for additional details about this release.

v16.0.6

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• bump the browserslist version to silence a warning in CI (#​86625)

Credits

Huge thanks to @​lukesandberg for helping!

evilmartians/lefthook (lefthook)

v2.0.8

Compare Source

• fix: do not escape custom templates in command replacement (#​1213) by @​joevin-sql-docto

v2.0.7

Compare Source

• fix: prefer using lefthook from the $PATH (#​1211) by @​joevin-sql-docto

v2.0.6

Compare Source

• feat: save original executable location in hooks (#​1208) by @​mrexox
• docs: encourage python install using pipx (#​1207) by @​franzramadhan

v2.0.5

Compare Source

• feat: add optional args to scripts (#​1206) by @​mrexox
• deps: November 2025 (#​1200) by @​mrexox
• chore: upgrade golangci-lint to 2.6.1, add modernize (#​1190) by @​scop
• chore: publish artifact attestations (#​1189) by @​scop

vercel/next.js (next)

v16.0.7

Compare Source

v16.0.6

Compare Source

facebook/react (react)

v19.2.1: 19.2.1 (December 3rd, 2025)

Compare Source

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #​35277)

vitest-dev/vitest (vitest)

v4.0.15

Compare Source

   🚀 Experimental Features

• cache: Add opt-out on a plugin level, fix internal root cache  -  by @​sheremet-va in #​9154 (a68f7)
• reporters: Print import duration breakdown  -  by @​sheremet-va in #​9105 (122ff)

   🐞 Bug Fixes

• Keep built-in id as is in bun and deno  -  by @​sheremet-va in #​9117 (075ab)
• Use optimizeDeps.rolldownOptions to fix depreated warning + fix ssr.external: true  -  by @​hi-ogawa in #​9121 (fd8bd)
• Fix external behavior with deps.optimizer  -  by @​hi-ogawa in #​9125 (4c754)
• Very minor typo in "Chrome DevTools Protocol"  -  by @​HowToTestFrontend in #​9146 (20997)
• browser: Run toMatchScreenshot only once when used with expect.element  -  by @​macarie in #​9132 (0d2e7)
• coverage: Istanbul provider to not break source maps  -  by @​AriPerkkio in #​9040 (e4ca9)
• deps: Update dependency tinyexec to v1  -  in #​9122 (fd786)
• docs: Remove --browser.provider from docs  -  by @​sheremet-va in #​9115 (120b3)
• expect: Preserve currentTestName in extended matchers  -  by @​macarie in #​9106 (e4345)
• pool: Terminate workers on CTRL+c forceful exits  -  by @​AriPerkkio in #​9140 (d57d8)
• reporters: Show project in github reporter  -  by @​sheremet-va in #​9138 (bb65e)
• spy: Do not mock overriden method, if parent was automocked  -  by @​sheremet-va in #​9116 (1a246)
• web-worker: MessagePort objects passed to Worker.postMessage work when clone === "native"  -  by @​whitphx in #​9118 (deee8)

    View changes on GitHub

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.