Bump next from 16.2.3 to 16.2.11 in /docs by dependabot[bot] · Pull Request #1745 · evroon/bracket

dependabot · 2026-07-28T02:56:40Z

Bumps next from 16.2.3 to 16.2.11.

Release notes

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Backport documentation fixes for v16.2 (#93804)

[backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)

[backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)

[backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)

[backport] Encode non-ASCII characters in cache tags at construction (#93918)

[backport] Fix server action forwarding loop with middleware rewrites (#93919)

[backport] Turbopack: switch from base40 to base38 hash encoding (#93932)

[ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

[backport] Fix "type: module" in project dir when using standalone or adapters (#94050)

[backport] Propagate adapter preferred regions (#94200)

[16.2.x] Don't drop FormData entries (#94240)

[backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @eps1lon, @icyJoseph, @unstubbable, @mischnic, @bgw, @timneutkens, and @lukesandberg for helping!

... (truncated)

Commits

9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
fe28768 [16.x] fix(next/image): improve performance of detectContentType()
d8afb8d [16.x] Performance improvements when decoding React Server function payloads
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

cloudflare-workers-and-pages · 2026-07-28T02:57:31Z

Deploying bracket-frontend with Cloudflare Pages

Latest commit:	`a3e10c7`
Status:	✅ Deploy successful!
Preview URL:	https://5aa1c235.bracket-abd.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-docs-6nxw.bracket-abd.pages.dev

View logs

cloudflare-workers-and-pages · 2026-07-28T02:58:41Z

Deploying bracket-docs with Cloudflare Pages

Latest commit:	`a3e10c7`
Status:	✅ Deploy successful!
Preview URL:	https://2448eabd.bracket-docs.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-docs-fnm5.bracket-docs.pages.dev

View logs

Bumps [next](https://github.com/vercel/next.js) from 16.2.3 to 16.2.11. - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.3...v16.2.11) --- updated-dependencies: - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

evroon · 2026-07-28T12:22:47Z

@copilot fix ci

…ockfile baseline-browser-mapping@2.11.5 was published too recently, violating pnpm's minimumReleaseAge supply-chain policy. Use 2.11.4 (published 2026-07-26) which is compatible with all packages requiring it (next@16.2.11 requires ^2.9.19, browserslist requires ^2.8.25/^2.9.0).

Copilot · 2026-07-28T12:26:34Z

@copilot fix ci

The CI was failing because baseline-browser-mapping@2.11.5 was published too recently (2026-07-27T16:25), violating pnpm's minimumReleaseAge supply-chain policy. Fixed by downgrading to baseline-browser-mapping@2.11.4 (published 2026-07-26) in docs/pnpm-lock.yaml — all packages requiring it (next@16.2.11, browserslist@4.28.x) accept ^2.9.x or lower, so 2.11.4 is fully compatible. (commit Fix CI: downgrade baseline-browser-mapping from 2.11.5 to 2.11.4 in lockfile)

evroon · 2026-07-28T12:43:57Z

@copilot replace eslint in /docs by oxlint and remove pnpm-workspace.yml

Copilot · 2026-07-28T12:48:52Z

@copilot replace eslint in /docs by oxlint and remove pnpm-workspace.yml

Done. Changes in the latest commit:

Removed eslint and eslint-config-next devDependencies and .eslintrc.json
Added oxlint@1.75.0 (pinned to avoid the minimumReleaseAge CI policy issue with 1.76.0 which was published ~21h ago)
Added "lint": "oxlint ." script and wired it into test-check
Removed pnpm-workspace.yaml
Updated pnpm-lock.yaml accordingly (removes ~2800 lines of eslint deps)

codecov · 2026-07-28T12:53:12Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.66%. Comparing base (366c4c4) to head (a3e10c7).
⚠️ Report is 55 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1745      +/-   ##
==========================================
- Coverage   94.80%   94.66%   -0.14%     
==========================================
  Files         120      120              
  Lines        4387     4387              
==========================================
- Hits         4159     4153       -6     
- Misses        228      234       +6

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

evroon · 2026-07-28T13:22:32Z

@copilot fix ci by making sure sharp doesnt get installed

…ncies

Copilot · 2026-07-28T13:30:31Z

@copilot fix ci by making sure sharp doesnt get installed

Added docs/pnpm-workspace.yaml with ignoredOptionalDependencies: [sharp]. This tells pnpm to skip sharp entirely (it's an optional dependency of next), removing all @img/sharp-* entries from the lockfile and eliminating the ERR_PNPM_IGNORED_BUILDS CI error.

Copilot

Pull request overview

Updates the docs site’s Next.js dependency to a patched version while adjusting the docs toolchain configuration around linting and optional dependency installation.

Changes:

Bump next in docs/package.json from ^16.2.3 to ^16.2.11.
Replace ESLint (eslint/eslint-config-next + .eslintrc.json) with oxlint and wire it into test-check.
Add docs/pnpm-workspace.yaml to ignore installing the optional dependency sharp.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
docs/pnpm-workspace.yaml	Configures pnpm to ignore `sharp` as an optional dependency during installs.
docs/package.json	Bumps Next.js and switches JS/TS linting from ESLint to `oxlint`, updating scripts accordingly.
docs/.eslintrc.json	Removes the Next.js ESLint configuration as part of the linting tool change.

Comments suppressed due to low confidence (1)

docs/package.json:50

This update removes ESLint + eslint-config-next (and the repo’s Next.js ESLint presets) in favor of oxlint. Since eslint-config-next provides Next-specific rules (e.g., core-web-vitals) that oxlint does not replicate 1:1, please confirm this is intentional and that equivalent coverage is provided (or re-add/update eslint-config-next alongside the Next bump).

    "autoprefixer": "^10.4.19",
    "markdownlint-cli2": "^0.22.0",
    "markdownlint-rule-relative-links": "^5.1.0",
    "oxlint": "1.75.0",

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    "lint": "oxlint .",
    "test": "pnpm run prettier:write && pnpm markdownlint-cli2 --fix --config .markdownlint-cli2.mjs",
-    "test-check": "pnpm run prettier:check && pnpm markdownlint-cli2 --config .markdownlint-cli2.mjs",
+    "test-check": "pnpm run prettier:check && pnpm run lint && pnpm markdownlint-cli2 --config .markdownlint-cli2.mjs",


dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 28, 2026

dependabot Bot mentioned this pull request Jul 28, 2026

Bump next from 16.2.3 to 16.2.6 in /docs #1682

Closed

github-actions Bot enabled auto-merge (squash) July 28, 2026 02:56

dependabot Bot force-pushed the dependabot/npm_and_yarn/docs/next-16.2.11 branch from 21bcf7c to 3afbe2a Compare July 28, 2026 11:58

Copilot started work on behalf of evroon July 28, 2026 12:23 View session

auto-merge was automatically disabled July 28, 2026 12:26
Head branch was pushed to by a user without write access

Copilot finished work on behalf of evroon July 28, 2026 12:26

Copilot AI requested a review from evroon July 28, 2026 12:26

Copilot started work on behalf of evroon July 28, 2026 12:44 View session

Replace eslint with oxlint in docs, remove pnpm-workspace.yaml

93a8b3a

Copilot finished work on behalf of evroon July 28, 2026 12:49

github-actions Bot enabled auto-merge (squash) July 28, 2026 12:52

Copilot started work on behalf of evroon July 28, 2026 13:23 View session

Fix CI: prevent sharp from being installed via ignoredOptionalDepende…

a3e10c7

…ncies

auto-merge was automatically disabled July 28, 2026 13:30
Head branch was pushed to by a user without write access

Copilot finished work on behalf of evroon July 28, 2026 13:30

evroon requested a review from Copilot July 28, 2026 13:34

github-actions Bot enabled auto-merge (squash) July 28, 2026 13:34

Copilot started reviewing on behalf of evroon July 28, 2026 13:34 View session

github-actions Bot merged commit 29fa324 into master Jul 28, 2026
10 checks passed

github-actions Bot deleted the dependabot/npm_and_yarn/docs/next-16.2.11 branch July 28, 2026 13:36

Copilot AI reviewed Jul 28, 2026

View reviewed changes

Navigation Menu

Bump next from 16.2.3 to 16.2.11 in /docs - #1745

Bump next from 16.2.3 to 16.2.11 in /docs#1745
github-actions[bot] merged 4 commits into
masterfrom
dependabot/npm_and_yarn/docs/next-16.2.11

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

evroon commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

evroon commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

codecov Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

evroon commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.2.11

v16.2.10

v16.2.9

v16.2.8

v16.2.7

Core Changes

Credits

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying bracket-frontend with Cloudflare Pages

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying bracket-docs with Cloudflare Pages

Uh oh!

evroon commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

evroon commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

codecov Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

evroon commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jul 28, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jul 28, 2026 •

edited

Loading

codecov Bot commented Jul 28, 2026 •

edited

Loading