chore(deps): bump the npm_and_yarn group across 3 directories with 1 update#5886
chore(deps): bump the npm_and_yarn group across 3 directories with 1 update#5886dependabot[bot] wants to merge 1 commit into
Conversation
…update Bumps the npm_and_yarn group with 1 update in the /apps/docs directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /apps/sim directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/emcn directory: [next](https://github.com/vercel/next.js). Updates `next` from 16.2.6 to 16.2.11 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.6...v16.2.11) Updates `next` from 16.2.6 to 16.2.11 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.6...v16.2.11) Updates `next` from 16.2.6 to 16.2.11 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.6...v16.2.11) --- updated-dependencies: - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryLow Risk Overview This is a patch-level dependency update; 16.2.11 includes security backports (Server Actions DoS/SSRF, middleware bypass with Turbopack + single locale, rewrite SSRF, fetch-cache confusion, image optimizer DoS, and related fixes). No application source changes are in the diff. Reviewed by Cursor Bugbot for commit 6faee7c. Bugbot is set up for automated code reviews on this repo. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6faee7c. Configure here.
| ], | ||
| "overrides": { | ||
| "next": "16.2.6", | ||
| "next": "16.2.11", |
There was a problem hiding this comment.
Security bump leaves Next unpatched
High Severity
Workspace next entries move to 16.2.11, but the root package.json still overrides next and @next/env to 16.2.6, and bun.lock still resolves next@16.2.6. In this Bun monorepo, root overrides win, so installs keep the vulnerable release and the High-severity Next.js patches do not apply. The apps/sim override also bumps next while leaving @next/env at 16.2.6.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 6faee7c. Configure here.
Bumps the npm_and_yarn group with 1 update in the /apps/docs directory: next.
Bumps the npm_and_yarn group with 1 update in the /apps/sim directory: next.
Bumps the npm_and_yarn group with 1 update in the /packages/emcn directory: next.
Updates
nextfrom 16.2.6 to 16.2.11Release notes
Sourced from next's releases.
Commits
9beca08v16.2.113c48c7a[16.x] Fix Turbopack middleware matcher with i18n single localeac1eff3[16.x] Improve performance of checking valid MPA form submissions9a4651e[16.x] EnforceserverActions.bodySizeLimitfor Server Actions in Edge runtimeb512063[16.x] Set correct origin for internal redirects in custom serverd303326[16.x] Ensure exotic rewrite param values are properly encoded73b9487[16.x] fix(fetch-cache): key fetch(Request, init) by the effective requestbf9d17f[16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodiesfe28768[16.x] fix(next/image): improve performance of detectContentType()d8afb8d[16.x] Performance improvements when decoding React Server function payloadsUpdates
nextfrom 16.2.6 to 16.2.11Release notes
Sourced from next's releases.
Commits
9beca08v16.2.113c48c7a[16.x] Fix Turbopack middleware matcher with i18n single localeac1eff3[16.x] Improve performance of checking valid MPA form submissions9a4651e[16.x] EnforceserverActions.bodySizeLimitfor Server Actions in Edge runtimeb512063[16.x] Set correct origin for internal redirects in custom serverd303326[16.x] Ensure exotic rewrite param values are properly encoded73b9487[16.x] fix(fetch-cache): key fetch(Request, init) by the effective requestbf9d17f[16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodiesfe28768[16.x] fix(next/image): improve performance of detectContentType()d8afb8d[16.x] Performance improvements when decoding React Server function payloadsUpdates
nextfrom 16.2.6 to 16.2.11Release notes
Sourced from next's releases.
Commits
9beca08v16.2.113c48c7a[16.x] Fix Turbopack middleware matcher with i18n single localeac1eff3[16.x] Improve performance of checking valid MPA form submissions9a4651e[16.x] EnforceserverActions.bodySizeLimitfor Server Actions in Edge runtimeb512063[16.x] Set correct origin for internal redirects in custom serverd303326[16.x] Ensure exotic rewrite param values are properly encoded73b9487[16.x] fix(fetch-cache): key fetch(Request, init) by the effective requestbf9d17f[16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodiesfe28768[16.x] fix(next/image): improve performance of detectContentType()d8afb8d[16.x] Performance improvements when decoding React Server function payloadsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.