[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
eslint-config-next (source)	16.3.8 → 16.4.6
next (source)	16.3.8 → 16.4.6

---

Release Notes

vercel/next.js (eslint-config-next)

v16.4.6

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Pin Tailwind to 4.3.3 in create-next-app and tests (#​101061, #​101176) (#​101307)
• [lts-active] Automatically compress route handler responses if not already compressed (#​101280)
• [lts-active] Turbopack GC fixes for dev (#​100279, #​100370) (#​101308)

Credits

Huge thanks to @​lukesandberg and @​eps1lon for helping!

v16.4.5

Compare Source

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#​100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#​100619)
• [lts-active] Revert "Optimize strict module factory chunks (#​98421)" (#​100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#​100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#​100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#​100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#​100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

v16.4.3

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Fix extensionless Google font URLs in both bundlers (#​100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#​100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#​95732)" (#​100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#​100123)
• [lts-active] test: Pin react-virtualized (#​100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#​100572)
• [lts-active] Keep OpenTelemetry request traces together (#​100349, #​100294, #​100324, #​100350, #​100552, #​100583) (#​100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#​100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

v16.4.2

Compare Source

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#​99644, #​99732, #​99649) by @​lukesandberg in #​100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#​98823, #​99910, #​100091) by @​sokra in #​100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in #​100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in #​100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in #​100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in #​100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in #​100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in #​100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v16.4.0

Compare Source

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #​75682
• fix(scripts): correct typo in rm.mjs error message: #​87015
• docs: improve clarity and punctuation in README: #​86096
• Fix debug build paths Pages Router support entries: #​93529
• bundle-analyzer: record historical snapshots on each analyze run: #​93520
• fix: detect proxy.ts correctly with compound pageExtensions: #​93246
• feat(turbopack): support false values for resolveAlias config: #​93331

Misc Changes

• docs: correction to dynamicParams migration: #​96624
• docs: proxy event argument: #​96435
• docs: remove experimental note from runtime prefetching: #​96615
• Preserve per-segment prefetching after dynamic navigation: #​96583
• Rename static generation stream option to waitForAllReady: #​96564
• Remove obsolete static generation plumbing: #​96563
• [turbopack] Drop dead writes to exports: #​96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #​96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #​96549
• [turbopack] Strip leading BOM before parsing CSS: #​96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #​96550
• docs: use relative doc links in instant-navigation error pages: #​96672
• Turbopack: terminate failed plugin worker threads: #​96592
• Fix HTML-limited bot matching in prerender bypass rules: #​96584
• [ci] Fix create_release_branch for new repo permissions: #​96641
• test: skip action module instance deploy test: #​96629
• docs: quote the dynamicParams build error in a blockquote: #​96633
• [react-sync] Open pull requests as the bot that authors the commits: #​96682
• [Bench] Fixes for pure Fizz bench: #​96771
• Derive foreground cache revalidation from the consumer: #​96731
• Fix race when navigating Back before hydration: #​96252
• docs: present each Skill as steps in the AI agents guide: #​96751
• Reuse completed cache entries for the rest of a request: #​96727
• Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #​96735
• Remove WorkStore execution mode: #​96674
• Remove cache revalidation execution mode reads: #​96670
• Separate App Route render and prerender pipelines: #​96662
• Remove App Page execution mode reads: #​96660
• test: fix missing await in css-chunking test: #​96725
• docs (Skills): stop assuming app/ at the root and port 3000: #​96696
• Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #​95808
• Use Tailwind Turbopack loader in create-next-app: #​96606
• docs: instant navigation quick start with an adoption prompt: #​96663
• Separate App Page render and prerender pipelines: #​96659
• Move App Router execution intent to entrypoints: #​96640
• Pass explicit render capabilities through App Render: #​96576
• Pass explicit prefetch hint policy through App Render: #​96572
• Replace WorkStore isStaticGeneration with executionMode: #​96570
• docs: document ! exclusion and src/ prefix for --debug-build-paths: #​96703
• Change loadManifest to return undefined with handleMissing: #​96530
• Refactor server from CacheNodeSeedData -> TransportData: #​96679
• Unify full/partial navigation response types: #​96439
• Unify RouteTree and CacheNodeSeedData on the client: #​96406
• Consolidate Promise.withResolvers polyfills: #​96772
• [ci] Open automated update pull requests with nextjs-bot: #​96683
• Require Cache Components for Instant Navigation testing: #​96745
• Fix use cache over- and under-invalidation in dev: #​96235
• Fix which pages the dev server announces, and when: #​96250
• docs: update redirected links to current targets: #​96723
• Fix(deployment-id): prevent exception on old webkit: #​94604
• [fragment-scroll] Remove config.experimental.appNewScrollHandler: #​95602
• [turbopack] Enable reexport-unknown execution test: #​96774
• ci: stop publishing @​vercel/devlow-bench: #​96887
• fix(turbopack): name the module in the non-ESM-placeable error, and stop duplicating the importer in traces: #​96560
• fix(turbopack): support type: 'text' in rules, and error on binding imports of non-ESM modules: #​96558
• Lint devlow-bench with the root eslint config: #​96871
• Remove turbopack/packages and relocate devlow to packages/: #​96860
• Flush pending revalidations for forwarded action error responses: #​96945
• Handle Server Actions on dynamic PPR fallback routes: #​96932
• Turbopack: Improve how DiskWatcher is configured and fix polling watcher bugs: #​96440
• Turbopack: Allow DiskWatcher to use a mocked DiskFileSystem, add a small unit test: #​96353
• [turbopack] Add e2e test that uses component chunks + workers: #​96556
• [turbopack] Support experimental.serverMinification & expand experimental.turbopackMinify: #​96578
• Add a turbopackChunking documentation page for pages router: #​96698
• [turbopack] Don't run Webpack tests on Turbopack-only changes: #​96656
• [turbopack] Enable the shared runtime by default: #​96778
• [turbopack] Enable CJS tree shaking by default: #​96779
• refactor: clean up places that needlessly list all RenderStages: #​96907
• Fix the documented invocation for generating tests non-interactively: #​96896
• Make NextConfigComplete typing more accurate: #​96700
• Upgrade to swc 75: #​96702
• docs: link View Transitions skill on skills.sh and clarify the example prompt: #​96863
• [ci] Reset the turbopack deploy test project in the weekly cron: #​96822
• docs: add authentication with Cache Components guide and iron-session example: #​95802
• [turbopack] Fix a potential deadlock in scope_and_block: #​95695
• Remove the turbopack-build-events trace span, use next build instead: #​96746
• docs: add export const dynamic = 'force-static' to Route Handlers example on Static Exports: #​96964
• [turbopack] Follow re-exports for side-effect free async modules: #​95993
• [turbopack] Treat constants with values referencing other values as unsafe: #​96190
• [refactor] Rename encodeCacheTag to encodeHeaderSafe: #​96936
• Fix formatting of Google Fonts section in documentation: #​88447
• Fixing a bug - typo issue fixed: #​97141
• examples: fix Webiny API env variable name: #​97134
• docs: fix Link prefetch grammar and Client Components wording: #​97132
• Use emitted app entries for post-build processing: #​97139
• docs(mdx): fix package name in .md handling section: #​97131
• [turbopack] Reduce native React Compiler work: #​96820
• docs: rename repo to repository for consistency: #​87849
• Fix typo in Data Access Layer section: #​87202
• docs: runtime prefetching -> optimizing prefetching: #​96934
• [CC] Track APIs that cause incompatible static/app shells: #​97040
• Fix client component loading span timing: #​96455
• Trace development route compilation: #​96454
• Prefix 'use cache' debug logs with the full directive: #​97037
• Revert "[turbopack] Enable CJS tree shaking by default (#​96779)": #​97018
• Revert "[turbopack] Follow re-exports for side-effect free async modules": #​97009
• [fragment-scroll] Rename ScrollAndMaybeFocusHandler to ScrollHandler: #​96828
• Trace development route preparation: #​96453
• test: cleanup Turbopack snapshot config: #​97013
• Remove unused htmlLimitedBots from renderOpts: #​96701
• fix(turbopack): point at the glob that matched a file with no module type: #​96561
• [turbopack] Bail CJS tree-shaking on var x = module.exports = {}: #​97130
• docs: server client and directives: #​96145
• docs: clarify client cache freshness after hydration: #​97180
• docs: create client-side fetching guide: #​96341
• Turbopack: accept a module type argument for import.meta.glob: #​96991
• docs: align Cache Components authentication guide title: #​97143
• test: re-enable a few more passing NFT unit cases: #​97017
• [turbopack] Do the CJS analysis needed for scope hoisting: #​95826
• Remove legacy PPR code paths: #​96868
• Use Cache Components as the internal PPR signal: #​96827
• Make legacy PPR paths explicit: #​96753
• fix: typos in code comments: #​97137
• Fix spelling in two comments: #​97136
• Decouple loader tree construction from children ordering: #​97192
• Bump lightningcss: #​97159
• Update gh-stack skill guidance: #​97163
• [test] Unflake use-cache-custom-handler-dev tests: #​97187
• Forward a build-container pin to deploy-test deployments: #​97191
• Fix shared Turbopack runtime initialization race: #​97215
• Fix stale data after navigation despite revalidation: #​95439
• [turbopack] Only use the shared runtime by default on canary: #​97208
• test: fix 'ouput' typo in parseIdsFromCliOutput: #​97266
• Add the mtime fallback back: #​97268
• Allow issue participants to request reopening: #​96947
• [turbopack] Document clusters for chunking: #​97267
• Link to issues in the contribution guide and discourage trivial PRs: #​97188
• Stop serializing hmr version state: #​97146
• [turbopack] Add clusters to chunking heuristics: #​95157
• [test] Redirect the deployment host in-process for proxy deploy tests: #​97260
• [test] Unflake two cache-components-dev-streaming assertions: #​97246
• [test] Unflake use-cache-default-profile-expire-zero tests: #​97250
• Allow running ncc before pnpm build: #​97234
• Invalidate deferred Webpack entry sources: #​97205
• Unify how a response's shell and full payloads are written: #​96878
• Convert per-segment prefetches to NavigationFlightResponse format: #​96877
• Unify how server responses are written into the client cache: #​96876
• Convert tree prefetches to NavigationFlightResponse format: #​96788
• fix(next/image): skip 0-byte entries when initializing disk LRU cache: #​94068
• Update authentication diagram URL: #​97320
• Add a script for adopting fork pull requests: #​97252
• Migrate napi-rs bindings from v2 to v3: #​95412
• Upgrade React from 11eddecd-20260805 to 22e4f993-20260811: #​97249
• Add RDC compression rollout controls: #​97247
• [testmode] Fix infinite recursion in testmode passthrough fetch: #​96525
• Turbopack: add imports_wildcard NFT unit test: #​97373
• Turbopack: improve chunk_item_content docs: #​97370
• test: Reenable i18n-api-support deploy test for Turbopack with adapters: #​96898
• Trace instrumentation startup: #​97296
• Trace route module preparation: #​97295
• Trace route module loading: #​97318
• fix(deps): bump satori and @vercel/og: #​97276
• [test] Cover 'use cache: private' in route handlers: #​97349
• Fix missing Pages runtime in adapter Pages API outputs: #​96819
• docs: align SPA guide reducer example with React conventions: #​97341
• Update blob version.: #​97342
• Upgrade React from 22e4f993-20260811 to eb8feb71-20260814: #​97382
• Adopt SelectedMetadata for metadata rendering: #​97387
• fix(next/image): reject empty image on read/write to disk cache : #​97278
• Turbopack: remove stale manifests for deleted routes: #​97333
• Turbopack: make unreachable codegen more generic: #​97385
• Wait for back-before-hydration recoveries in the browser: #​97321
• Extract metadata resolution primitives: #​97388
• test: update React 18 redbox snapshot: #​97415
• Remove server route matcher stack: #​94157
• Anchor the async local storage instances to global symbols: #​97255
• test: deflake use-cache-size-zero warm reload: #​97421
• Scaffolding for concurrentRouterQueue flag: #​97413
• Reorganize client router modules: #​97402
• fix(turbo-persistence): allow 32-bit usize conversion: #​97288
• test: restore missing NFT exports* unit fixtures: #​97459
• [ci] Fix backport canary release dispatch: #​97383
• turbo-tasks-backend: Enforce that tasks exist when accessing them: #​96043
• turbo-tasks-backend: add persistence delete/tombstone plumbing for GC: #​95975
• turbo-persistence: add key-value tombstones for MultiValue families: #​96929
• Trace lazy App Route module loading: #​97439
• [ci] Wait for the next version to be available on npm before deploy tests: #​97460
• docs: fix stale Dev Overlay README link in contributing guide: #​97486
• docs: app router reference accuracy: #​97477
• test: Don't wait trying to load non-existing images: #​97488
• test: cover dynamic APIs with i18n base path: #​97367
• style(examples): remove redundant justify-content declaration: #​97222
• docs: rename Vercel Edge Config to Global Config in redirecting guide: #​97456
• fix: improve form accessibility by associating labels with inputs: #​96335
• [docs] fix: grammar typos in linking and navigating guide: #​95544
• fix(examples): correct error message typo: #​97223
• docs: fix typos in example links: #​97149
• Model prerenders as render candidates: #​97431
• Turbopack: support character class ranges in regex: #​97502
• docs: warn when catching permanentRedirect: #​97496
• Remove the development debug channel persistence: #​97510
• Stop the browser from restoring stale pages in development: #​97505
• Turbopack: gracefully handle outputFileTracingIncludes matching a symlink: #​97507
• docs: mention Valibot as validation library option in forms guides: #​97468
• [PPF] Remove unstable_eager: #​97524
• [PPF] Do not mark complete shell requests as partial: #​97503
• fix: add accessible label to icon-only link: #​96334
• Fix stale cross-references in skills/: #​97566
• docs: generateMetadata values should be serializable with use cache: #​97551
• Move preview props into separate manifest: #​96004
• docs: adjust interactive app guide: #​97558
• Turbopack: allow TURBOPACK_PRINT_CHUNK_GROUPS in release builds: #​97515
• [test] Point next-image-legacy images at a reachable endpoint: #​97545
• test: improve error-on-next-codemod-comment flakiness: #​97553
• Turbopack: cross-module constants: #​90300
• test: better isolate concurrent-install suite: #​97546
• docs: outlining and lcp: #​96942
• Turbopack: More aggressively debounce filesystem watch events if we detected changes to node_modules: #​96116
• docs: document metadata pagination field: #​95509
• docs: document deploymentId build ID override and Pages Router skew in 16.2: #​97645
• Upgrade React from eb8feb71-20260814 to eafeac09-20260819: #​97636
• Turbopack: rename to use turbopack: no side effects: #​94427
• refactor: move useDynamic{Route,Search}Params to reduce snapshot churn: #​97360
• [PPF] unstable_navigation(): #​96908
• [PPF] Scaffold unstable_navigation(): #​97236
• docs: Explicit cache output description: #​97548
• Improve Cache Components sync IO migration guidance: #​97572
• [test] Use a non-native stub for the server externals list test: #​97614
• Avoid GitHub API rate limits for create-next-app examples: #​97612
• [test] Cover the prerender worker-thread backend with an addon we control: #​97543
• [test] Convert the prerender-native-module suite to local fixture packages: #​97542
• [test] Replace the turbopack-reports sqlite3 dependency with a local addon fixture: #​97541
• [test] Drop the dead sqlite3 build approval from the sharp-basic suite: #​97540
• Remove HmrTarget: #​97253
• Keep HMR instructions typed until serialization: #​96569
• Serialize frozen collections by value only: #​96686
• feat(turbopack): isolate HMR listeners across microfrontends: #​95997
• Turbopack: deduplicate Pages Router app chunks: #​97664
• [react-sync] Check assignability before assigning the actor: #​97638
• fix: preserve trailing slash during export MPA fallback: #​97613
• Turbopack: Split the read and write codepath data structures for symlinks: #​97395
• Turbopack: Show last modified file when waiting for the filesystem to settle: #​97648
• docs: fix parallelRouteKey parameter name in useSelectedLayoutSegment(s): #​97710
• Turbopack: Avoid cloning paths in fs watcher if the path is already in a map: #​97655
• Remove generated error codes: #​97687
• [PPF] Instant validation for unstable_navigation(): #​97309
• Turbopack: trace graceful-fs calls: #​97694
• Migrate some async blocks to async closures: #​97666
• turbo-tasks: add scope_unbounded, a scoped execution primitive that allows more work to be discovered: #​95974
• test: make app-document-import-order more robust: #​97682
• Add a Turbopack error for missing root layouts: #​97639
• Improve Partial Prefetching adoption checks: #​97637
• test: stabilize poisoned proxy error overlay: #​97609
• docs: correct the upper stale bound for App Shell exclusion in cacheLife: #​97653
• docs: Adapters entry page lists its children pages twice: #​97677
• [PPF] unstable_prefetch(): #​97622
• [PPF] Scaffold unstable_prefetch(): #​97618
• docs: clarify beforeInteractive placement for root layouts: #​97643
• fix(turbopack): give eager import.meta.glob values the ESM namespace: #​96559
• introduce an options struct for constructing backend storage: #​97284
• [devtools] Fix indicator dragging on touch screens: #​97723
• Add next/cache-handlers types entrypoint: #​97592
• Remove unused return values from getPageStaticInfo: #​97661
• [turbopack] defer NFT module content hashes: #​97773
• test: deflake basePath external navigation: #​97611
• docs(adapters): document assetsHashes and routing.middlewareMatchers: #​96536
• Migrate remaining async blocks to async closures: #​97701
• Turn off the adapter route collapses by default: #​97774
• Serve a run of fallback shells from one route entry: #​97738
• [test] Capture the route table for apps with several param shapes: #​97728
• Stop emitting a separate route entry for a dynamic route's RSC form: #​97726
• Stop emitting a redundant route per prefetch segment: #​97720
• [test] Capture the dynamic routes a build passes to an adapter: #​97719
• turbo-tasks: compile conditional cell updates once, not per cell type: #​97763
• Turbopack: add unit test coverage for FileSystemPath::hash_file: #​97743
• Record fallback cache lifetime for blocking PPR routes: #​97821
• Document catchError for the Pages Router: #​97748
• clippy: allow needless late init where it makes sense: #​96410
• Turbopack: emit/collect: #​96631
• docs: note that response headers must be set before calling handle() in a custom server: #​97693
• Deduplicate the regress, wat/wasmparser and base64 dependencies: #​97762
• perf: split cold TurboMalloc accounting paths: #​97767
• turbo-tasks: execute scheduled tasks inline when they are read: #​96808
• Revert "Record fallback cache lifetime for blocking PPR routes (#​97821)": #​97835
• Sweep stale Turbopack output from distDir on dev startup: #​97591
• Fix metadata prefetch cache key for search params: #​97729
• Turbopack: Improve file existence error handling in realpath_with_links and in module resolution: #​97717
• Write traces with buffered synchronous IO: #​96874
• fix(wasm): don't enable SWC's plugin host for wasm targets: #​97859
• fix(turbopack-node): make process_pool inert on wasm: [#​97858](https://redirec

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!