Context: The `nextjs` package declares `"next": "^16.1.1"` as a peer dependency. Next.js 16.1.1 through 16.1.6 are vulnerable to two High-severity CVEs: CVE-2026-23864 (DoS via RSC memory exhaustion, fixed in 16.1.5) and CVE-2026-27979 (PPR unbounded request buffering, fixed in 16.1.7). Raising the floor to 16.1.7 closes both.
Steps:
1. Open `packages/nextjs/package.json` -- change `"next": "^16.1.1"` to `"next": ">=16.1.7"`
2. Run `yarn install` and verify no peer conflicts
3. Update CI matrix to test minimum version 16.1.7
4. Run full test suite
5. Update CHANGELOG
Acceptance criteria:
`next` peer dependency floor is `>=16.1.7` in `packages/nextjs/package.json`
CI passes with Next.js 16.1.7 as the minimum tested version
CHANGELOG entry references both CVEs
Risks: Teams on Next.js 16.1.1--16.1.6 will need to upgrade. Given both CVEs are High severity, this is the correct forcing function.