[dependabot]

Bumps the patch-and-minor group with 4 updates: next, @opennextjs/cloudflare, postcss and wrangler.

Updates next from 16.3.8 to 16.4.0

Release notes

Sourced from next's releases.

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682
• fix(scripts): correct typo in rm.mjs error message: #87015
• docs: improve clarity and punctuation in README: #86096
• Fix debug build paths Pages Router support entries: #93529
• bundle-analyzer: record historical snapshots on each analyze run: #93520
• fix: detect proxy.ts correctly with compound pageExtensions: #93246
• feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

• docs: correction to dynamicParams migration: #96624
• docs: proxy event argument: #96435
• docs: remove experimental note from runtime prefetching: #96615
• Preserve per-segment prefetching after dynamic navigation: #96583
• Rename static generation stream option to waitForAllReady: #96564
• Remove obsolete static generation plumbing: #96563
• [turbopack] Drop dead writes to exports: #96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #96549
• [turbopack] Strip leading BOM before parsing CSS: #96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
• docs: use relative doc links in instant-navigation error pages: #96672
• Turbopack: terminate failed plugin worker threads: #96592
• Fix HTML-limited bot matching in prerender bypass rules: #96584
• [ci] Fix create_release_branch for new repo permissions: #96641
• test: skip action module instance deploy test: #96629
• docs: quote the dynamicParams build error in a blockquote: #96633
• [react-sync] Open pull requests as the bot that authors the commits: #96682
• [Bench] Fixes for pure Fizz bench: #96771
• Derive foreground cache revalidation from the consumer: #96731
• Fix race when navigating Back before hydration: #96252
• docs: present each Skill as steps in the AI agents guide: #96751
• Reuse completed cache entries for the rest of a request: #96727
• Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
• Remove WorkStore execution mode: #96674
• Remove cache revalidation execution mode reads: #96670
• Separate App Route render and prerender pipelines: #96662
• Remove App Page execution mode reads: #96660
• test: fix missing await in css-chunking test: #96725
• docs (Skills): stop assuming app/ at the root and port 3000: #96696
• Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808
• Use Tailwind Turbopack loader in create-next-app: #96606
• docs: instant navigation quick start with an adoption prompt: #96663
• Separate App Page render and prerender pipelines: #96659
• Move App Router execution intent to entrypoints: #96640

... (truncated)

Commits

• e273d5b v16.4.0
• fdf41d6 [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...
• c3e76ad v16.4.0-canary.63
• 47c6cc8 Document next analyze export in the package bundling guide (#99735)
• 5b10604 Revert stabilization of forbidden() and unauthorized() (#99734)
• f3a6f97 Preserve configured output directories during static export (#99507)
• b22e5a2 Rename skill to next-bundle-optimizer and document its usage (#99731)
• 74dc549 [turbo-tasks-backend] Clean up task state before publishing execution complet...
• ccf8c15 v16.4.0-canary.62
• b8c7c7f Improve static route error guidance (#99724)
• Additional commits viewable in compare view

Updates @opennextjs/cloudflare from 1.20.7 to 1.20.10

Release notes

Sourced from @​opennextjs/cloudflare's releases.

@​opennextjs/cloudflare@​1.20.10

Patch Changes

• #1426 66b4a2d Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.9

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.9

• #1419 8327c21 Thanks @​Adnan-Husayn! - fix: set the image Content-Type from the format produced by the Images binding

  The Images binding can fall back to another format than the requested one, i.e. from AVIF to WebP for large images. /_next/image responses were labelled with the requested format, so the Content-Type could disagree with the image bytes.

• #1420 afea1a0 Thanks @​cpruijsen! - fix: skip route directories matching the loadManifest globs

  opennextjs-cloudflare build no longer fails with EISDIR or an unresolved import when an App Router route directory matches an internal manifest glob. Only manifest files are now inlined.

• #1423 a515128 Thanks @​Adnan-Husayn! - fix: do not log Failed to copy for packages whose exports is a string

@​opennextjs/cloudflare@​1.20.9

Patch Changes

• #1416 63cbece Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.8

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.8

• #1416 63cbece Thanks @​vicb! - fix: isolate module-loading cache signals between requests

  Prevent Next.js 15.4 and newer Cache Components from failing under concurrent traffic with Cannot perform I/O on behalf of a different request when module-loading timers cross Cloudflare Worker request contexts.

@​opennextjs/cloudflare@​1.20.8

Patch Changes

• #1411 1551d6f Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.7

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.7

• #1411 31009e1 Thanks @​vicb! - chore: require Next.js 15.5.27 or 16.3.8

  Raise the supported Next.js version floor to 15.5.27 and 16.3.8 to include the latest security fixes.

Changelog

Sourced from @​opennextjs/cloudflare's changelog.

1.20.10

Patch Changes

• #1426 66b4a2d Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.9

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.9

• #1419 8327c21 Thanks @​Adnan-Husayn! - fix: set the image Content-Type from the format produced by the Images binding

  The Images binding can fall back to another format than the requested one, i.e. from AVIF to WebP for large images. /_next/image responses were labelled with the requested format, so the Content-Type could disagree with the image bytes.

• #1420 afea1a0 Thanks @​cpruijsen! - fix: skip route directories matching the loadManifest globs

  opennextjs-cloudflare build no longer fails with EISDIR or an unresolved import when an App Router route directory matches an internal manifest glob. Only manifest files are now inlined.

• #1423 a515128 Thanks @​Adnan-Husayn! - fix: do not log Failed to copy for packages whose exports is a string

1.20.9

Patch Changes

• #1416 63cbece Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.8

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.8

• #1416 63cbece Thanks @​vicb! - fix: isolate module-loading cache signals between requests

  Prevent Next.js 15.4 and newer Cache Components from failing under concurrent traffic with Cannot perform I/O on behalf of a different request when module-loading timers cross Cloudflare Worker request contexts.

1.20.8

Patch Changes

• #1411 1551d6f Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.7

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.7

• #1411 31009e1 Thanks @​vicb! - chore: require Next.js 15.5.27 or 16.3.8

  Raise the supported Next.js version floor to 15.5.27 and 16.3.8 to include the latest security fixes.

Commits

• 37ede26 Version Packages (#1421)
• 66b4a2d chore: bump @opennextjs/aws to 4.1.9 (#1426)
• 82486c8 refactor: write next-env.mjs in a single call (#1422)
• a515128 fix: do not log Failed to copy for packages whose exports is a string (#1...
• e6d87c9 chore: bump dependencies (#1424)
• afea1a0 fix: skip route directories matching the loadManifest globs (#1420)
• 8327c21 fix: set the image Content-Type from the format produced by the Images bind...
• a8db8c2 Version Packages (#1418)
• 63cbece chore: bump @opennextjs/aws to 4.1.8 (#1416)
• dd91200 Version Packages
• Additional commits viewable in compare view

Updates postcss from 8.5.28 to 8.5.29

Release notes

Sourced from postcss's releases.

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Commits

• a7a1f34 Release 8.5.29 version
• b55a36d Update dependencies
• 7647a81 Escape </style> in output of non-Root nodes (#2163)
• 7ac9026 Do not split list.comma() and list.space() on separators inside comments (#2162)
• ebffa97 Add postcss-smooth-corners plugin
• 57d6401 Speed up source map cleaning
• 7e46a03 Speed up parser
• 7f5c417 Improve </style> protection for the case when beffore nodes have different parts
• 7ba9051 Fix useless ESLint warning
• 12b4161 Update dependencies
• Additional commits viewable in compare view

Updates wrangler from 4.146.0 to 4.149.0

Release notes

Sourced from wrangler's releases.

wrangler@4.149.0

Minor Changes

• #16036 9a58244 Thanks @​edevil! - Support temporary event accounts in R2 and Containers commands

  wrangler r2 and wrangler containers commands now accept the hidden --temporary flag, so accounts created for an event can manage buckets, objects and containers directly. Every command that supports --temporary now also accepts a hidden --event-code flag, so the first command a participant runs can create the event account:

  wrangler r2 bucket create my-bucket --temporary --event-code <code>

  R2 and Containers are only available on event accounts. R2 custom domains, Sippy, external container registries and wrangler cloudchamber commands still require a logged-in account.

Patch Changes

• #16139 2d1d563 Thanks @​cpojer! - Update esbuild to 0.28.2

  Align esbuild dependency with tooling using the latest 0.28 patch so package managers can share one installation instead of downloading a second native binary.

• #15632 85b14e7 Thanks @​petebacondarwin! - Honor Retry-After directives during static asset uploads

  Static asset uploads now pause retries and pending uploads until the latest outstanding deadline requested by the API. A per-request limiter also keeps gateway retries at the reduced concurrency after the pause ends, preventing a deployment from immediately overloading a constrained asset service again.

• #16098 fe607f9 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  sharp	0.35.4	0.35.5

• #16093 ad7ff45 Thanks @​DiogoSantoss! - Document that addresses catch-all entries must use the zone apex

  A *@domain entry in addresses must use the zone apex, such as *@example.com. The zone catch-all also receives mail for every subdomain in the zone that has no literal rule.

• #16102 757faa6 Thanks @​tlq5l! - Keep Preview secrets when deploying to an existing Preview

  Secrets added to a Preview with wrangler preview secret put or wrangler preview secret bulk were lost the next time wrangler preview ran, because each new deployment was created from the Wrangler config, --var and --secrets-file values only.

  wrangler preview now carries over the secrets of the Preview's latest deployment. A value passed in this deployment (--secrets-file, --var or a previews binding with the same name) still replaces the existing secret, and wrangler preview secret delete removes one.

• #15617 93c1069 Thanks @​jpatel3! - Stop the update check from recommending deprecated versions

  Previously, the "update available" notice shown by wrangler and @cloudflare/vite-plugin always pointed at whichever version was tagged latest on npm, even after that version had been deprecated for shipping a bug. Deprecated versions are now never recommended: if the latest release has been deprecated, the newest non-deprecated stable release below it is suggested instead, or nothing at all if you are already on it.

  The check now reads the npm registry directly instead of going through the update-check package, which discarded the deprecation information. The on-disk cache location and one-hour refresh interval are unchanged.

• #16003 6947df3 Thanks @​oddharsh! - Ship using and await using declarations to the runtime as written, for smaller Worker bundles

  Workers and Pages Functions that use explicit resource management no longer carry about 1 KB of bundled helper code to emulate it. workerd supports using and await using natively at every compatibility date, so wrangler deploy, wrangler versions upload and Pages Functions builds now leave these declarations untouched.

• #15958 82acf3c Thanks @​breken-ai! - Apply each action's own condition in wrangler r2 bucket lifecycle add

... (truncated)

Commits

• 84c4e95 Version Packages (#16099)
• 82acf3c [wrangler] Apply each action's own condition in r2 bucket lifecycle add (#1...
• 757faa6 [wrangler] Keep Preview secrets when deploying to an existing Preview (#16102)
• 85b14e7 [deploy-helpers] respect Retry-After during asset uploads (#15632)
• 6947df3 [wrangler][vite-plugin] Preserve using declarations when bundling (#16003)
• 9a58244 [wrangler] Support temporary event accounts in R2 and Containers commands (#1...
• 540f084 Version Packages (#16034)
• 42c7219 [wrangler] Fix r2 object put and r2 bulk put storing a different key in local...
• 2dde890 [wrangler] Clarify secret version errors and support versions bulk deletions ...
• b4e1299 [wrangler] Add --source-namespace and --source-repo-name for artifacts.repo q...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.