Update npm package next to v16 [SECURITY]
#8334
Conversation
PR SummaryUpgrades Next.js across the repo with associated lockfile changes.
Written by Cursor Bugbot for commit b55d723. This will update automatically on new commits. Configure here. |
github-actions
bot
added
area/deps
🤖 Augment PR SummarySummary: Updates Next.js to v16.0.10 across the repo to pick up upstream security fixes. Changes:
Technical Notes: This is a major Next.js upgrade, so it’s worth validating any Next-adjacent tooling/peer deps (e.g., 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| "material-ui-popup-state": "4.1.0", | ||
| "millify": "6.1.0", | ||
| "next": "15.5.10", | ||
| "next": "16.0.10", |
There was a problem hiding this comment.
With next bumped to 16, @next/bundle-analyzer is still pinned to 15.5.9; can we confirm this combination is supported (or that the analyzer isn’t used here) to avoid peer-dep/install or build-time issues?
🤖 Was this useful? React with 👍 or 👎
| "eslint": "9.39.2", | ||
| "graphql": "16.11.0", | ||
| "next": "15.5.10", | ||
| "next": "16.0.10", |
There was a problem hiding this comment.
The PR description for CVE-2025-59472 recommends upgrading to 16.1.5 to mitigate; can we confirm 16.0.10 fully addresses the vulnerability alert for our deployment mode (especially if PPR/minimal mode is enabled)?
🤖 Was this useful? React with 👍 or 👎
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| "material-ui-popup-state": "4.1.0", | ||
| "millify": "6.1.0", | ||
| "next": "15.5.10", | ||
| "next": "16.0.10", |
There was a problem hiding this comment.
Webpack config ignored due to Turbopack default change
Medium Severity
Upgrading next to 16.0.10 changes the default bundler for next dev from webpack to Turbopack. The project's next.config.js contains custom webpack configuration including @svgr/webpack for SVG handling, async WASM support, and custom resolve aliases—none of which will be applied when Turbopack runs. The dev script still runs plain next dev without the --webpack flag, so development server functionality will break. Either the dev script needs --webpack flag or equivalent Turbopack configuration (turbopack.rules) needs to be added.
1 participant
This PR contains the following updates:
15.5.10->16.0.10Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2025-59472
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the
Next-Resume: 1header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:Unbounded request body buffering: The server buffers the entire POST request body into memory using
Buffer.concat()without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.Unbounded decompression (zipbomb): The resume data cache is decompressed using
inflateSync()without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.Both attack vectors result in a fatal V8 out-of-memory error (
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.To be affected, an application must run with
experimental.ppr: trueorcacheComponents: trueconfigured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
Release Notes
vercel/next.js (next)
v16.0.10Compare Source
Please see the Next.js Security Update for information about this security patch.
v16.0.9Compare Source
v16.0.8Compare Source
Core Changes
Credits
Huge thanks to @huozhi for helping!
v16.0.7Compare Source
Please see CVE-2025-66478 for additional details about this release.
v16.0.6Compare Source
Core Changes
Credits
Huge thanks to @lukesandberg for helping!
v16.0.5Compare Source
Core Changes
Credits
Huge thanks to @lucasadrianof for helping!
v16.0.4Compare Source
Core Changes
Credits
Huge thanks to @devjiwonchoi, @sokra and @ztanner for helping!
v16.0.3Compare Source
Core Changes
next dev --inspect: #85037b4455a6e-20251027to4f931700-20251029: #85518cacheLifetypes out of the webpack plugin and into the dev bundler directly: #85539'use cache'in page/layout component: #855194f931700-20251029to561ee24d-20251101: #85670'next'plugin: #85749561ee24d-20251101to67f7d47a-20251103: #8576267f7d47a-20251103tof646e8ff-20251104: #85772f646e8ff-20251104todd048c3b-20251105: #85819dd048c3b-20251105tofa50caf5-20251107: #85906'use cache'call stacks: #85966fa50caf5-20251107to52684925-20251110: #85980Misc Changes
opt-level = sfor not frequently used crates: #85426experimental.cacheLife: #85467createSandbox: #85507--debug-build-pathsinstead ofNEXT_PRIVATE_APP_PATHS: #85504completion.rsa bit: #84863maxRetriesandhardErrorparameters: #85536cells are created inresolve_rawto make cell allocation order deterministic.: #85525assert*->waitFor*when the util is not instant: #85450RegExp-like implementations incheck: #85537after()tests: #85566test/integration/in flake detection tests: #85590run-for-changescript: #85619extern crateandmacro_usesyntax: #85778NEXT_TEST_PREFER_OFFLINEininstall-native.mjs: #85850next-core/src/next_client_reference/visit_client_reference.rs: #85843non_operation_vc_strongly_consistentfeature usage from next-api: #85874turbo-tasks-macros-sharedcrate intoturbo-tasks-macros: #85917next.browserWithResponse(): #85911'use cache'functions to reduce function allocations: #85904font-familydeclaration: #85913Auth0Link: #85953cacheLife&cacheTagin client: #85872cacheLife&cacheTag: #85875sharpandunrs-resolver: #83168evaluateto take module_graph: #85971encryptActionBoundArgs/decryptActionBoundArgsimports: #86015Credits
Huge thanks to @kdy1, @eps1lon, @SyMind, @bgw, @swarnava, @devjiwonchoi, @ztanner, @ijjk, @huozhi, @icyJoseph, @acdlite, @unstubbable, @gnoff, @gusfune, @vercel-release-bot, @lukesandberg, @sokra, @hayes, @shuding, @wyattjoh, @marjan-ahmed, @timneutkens, @ajstrongdev, @zigang93, @mischnic, @Nayeem-XTREME, @hamirmahal, @eli0shin, @tessamero, @gaojude, @jamesdaniels, @georgesfarah, and @timeyoutakeit for helping!
v16.0.2Compare Source
v16.0.1Compare Source
Core Changes
includeon Windows: #85400next-jscondition from middleware, proxy, and instrumentation: #85321prefetch={true}functionality: #854112bcbf254-20251020to6160773f-20251023: #85277Origin: nullheaders: #85402useActionQueue: #85459Misc Changes
use cache: remotedocs: #85145Credits
Huge thanks to @icyJoseph, @wyattjoh, @devjiwonchoi, @arnabsen, @remcohaszing, @denesbeck, @gaojude, @mhart, @eps1lon, @jesuistuan, @codr, @InfiniteCodeMonkeys, @gnoff, @ztanner, @wbinnssmith, @styfle, @acdlite, @ale-grosselle, and @mischnic for helping!
v16.0.0Compare Source
Core Changes
6b70072c-20250909to886b3d36-20250910: #83650886b3d36-20250910tof3a80361-20250911: #83696f3a80361-20250911to93d7aa69-20250912: #8372993d7aa69-20250912to8a8e9a7e-20250912: #83742@next/eslint-plugin-next: #83763next.config.mtsfor Node.js native TS resolver: #835568a8e9a7e-20250912to5e0c951b-20250916: #838505e0c951b-20250916to128abcfa-20250917: #83906srcPagefor templates whennext.routeis unavailable: #83911128abcfa-20250917to84af9085-20250917: #83959import ... with {type: "bytes"}: #8389684af9085-20250917tod415fd3e-20250919: #84003next internal trace: #83907publicRuntimeConfigandserverRuntimeConfig: #83944ssgPageRoutesin the file tree: #84104experimental.cacheComponentsconfig: #84121images.minimumCacheTTLfrom 1 min to 4 hours: #84105d415fd3e-20250919to1eca9a27-20250922: #84093.turboconfig object: #84109experimental.isolatedDevBuildfortest-experimental-dev: #84099publicRuntimeConfigandserverRuntimeConfig(#83944)": #841671eca9a27-20250922toe2332183-20250924: #84189get_errorsMCP endpoint: #84161e2332183-20250924tob0c1dc01-20250925: #84248get_page_metadataMCP endpoint: #84211isReactCompilerRequiredcheck when we must run Babel anyways: #84103config.turbopack.moduleIdstoconfig.experimental.turbopackModuleIds: #84230b0c1dc01-20250925todf38ac9a-20250926: #84276config.turbopack.moduleIdstoconfig.experimental.turbopackModuleIds: #84230b0c1dc01-20250925todf38ac9a-20250926: #84276df38ac9a-20250926tod15d7fd7-20250929: #84347reactCompileroption: #82251d15d7fd7-20250929toef889445-20250930: #84383unstable_rootParams: #84373ef889445-20250930to548235db-20251001: #84416548235db-20251001to1bd1f01f-20251001: #84417metadataBaseto be a string URL in addition toURLinstance: #842971bd1f01f-20251001to86181134-20251001: #84427Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Renovate Bot.