chore(deps-dev): bump eslint-config-next from 15.5.18 to 16.2.12

[dependabot]

Bumps eslint-config-next from 15.5.18 to 16.2.12.

Release notes

Sourced from eslint-config-next's releases.

v16.2.12

What's Changed

• Backport/docs fixes 16.2 - July round by @​icyJoseph in vercel/next.js#96031
• [Backport] Fixes to support TypeScript 7 by @​lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

... (truncated)

Commits

• 2234717 v16.2.12
• 9beca08 v16.2.11
• 9dadfd6 v16.2.10
• 534d9c1 [16.2.x] Release pipeline updates (#95160)
• 6e1a94d [16.2.x][ci]: fix release script to not strip newlines (#94640)
• f37fad9 v16.2.9
• 6f16804 v16.2.8
• 411c455 v16.2.7
• ee6e79b v16.2.6
• 766148f v16.2.5
• Additional commits viewable in compare view

[cloudflare-workers-and-pages]

Deploying agent-render with    Cloudflare Pages

Latest commit:	95662e6
Status:	✅  Deploy successful!
Preview URL:	https://e7685821.agent-render.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-esli-2dne.agent-render.pages.dev

View logs

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• package.json - dev dependency version bump only (eslint-config-next 15.5.18 → 16.2.11)
• package-lock.json - generated lock file (skipped)

This is a Dependabot major version bump of the eslint-config-next dev dependency (15.x → 16.x), which includes security fixes per the PR release notes. No application source code is changed. As a dev-only tooling dependency, it does not affect the static client shell, the fragment transport, or any runtime shipping path. No issues found in the changed code.

---

_{Reviewed by glm-5.2-short · Input: 16.2K · Output: 1.2K · Cached: 102.8K}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint-config-next@​15.5.18 ⏵ 16.2.12	+1		+2

View full report