Skip to content

build(deps): bump next from 15.5.15 to 16.2.4 in the next-react group across 1 directory#7

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/next-react-5c623bd62f
Open

build(deps): bump next from 15.5.15 to 16.2.4 in the next-react group across 1 directory#7
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/next-react-5c623bd62f

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 27, 2026

Bumps the next-react group with 1 update in the / directory: next.

Updates next from 15.5.15 to 16.2.4

Release notes

Sourced from next's releases.

v16.2.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#92713)
  • Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#92631)
  • Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)
  • Compiler: Support boolean and number primtives in next.config defines (#92731)
  • turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#92725)
  • Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)
  • Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92828)
  • Adding more system info to the 'initialize project' trace (#92427)

Credits

Huge thanks to @​Badbird5907, @​lukesandberg, @​andrewimm, @​sokra, and @​mischnic for helping!

v16.2.3

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

  • Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)
  • Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)
  • Deduplicate output assets and detect content conflicts on emit (#92292)
  • Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
  • turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @​icyJoseph, @​sokra, @​wbinnssmith, @​eps1lon and @​ztanner for helping!

v16.2.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • backport: Move expanded adapters docs to API reference (#92115) (#92129)
  • Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#92130)
  • [create-next-app] Skip interactive prompts when CLI flags are provided (#91840)
  • next.config.js: Accept an option for serverFastRefresh (#91968)
  • Turbopack: enable server HMR for app route handlers (#91466)
  • Turbopack: exclude metadata routes from server HMR (#92034)
  • Fix CI for glibc linux builds
  • Backport: disable bmi2 in qfilter #92177
  • [backport] Fix CSS HMR on Safari (#92174)

... (truncated)

Commits
  • 2275bd8 v16.2.4
  • e073983 Adding more system info to the 'initialize project' trace (#92427)
  • 8a540b5 Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92...
  • 2f5343f Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)
  • 2ad9d3f turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during ...
  • 6f3808e Compiler: Support boolean and number primtives in next.config defines (#92731)
  • fbc7684 Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)
  • 805d758 Turbopack: fix filesystem watcher config not applying follow_symlinks(false) ...
  • 1056fae chore: Bump reqwest to 0.13.2 (#92713)
  • d5f649b v16.2.3
  • Additional commits viewable in compare view

@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 27, 2026

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot changed the title build(deps): Bump next from 15.5.15 to 16.2.4 in the next-react group build(deps): Bump next from 15.5.15 to 16.2.4 in the next-react group across 1 directory Apr 27, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/next-react-5c623bd62f branch 3 times, most recently from 76ac79c to 3983449 Compare April 28, 2026 04:18
@dependabot dependabot Bot changed the title build(deps): Bump next from 15.5.15 to 16.2.4 in the next-react group across 1 directory build(deps): bump next from 15.5.15 to 16.2.4 in the next-react group across 1 directory Apr 28, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/next-react-5c623bd62f branch 3 times, most recently from e6179ae to 1b4bca5 Compare April 28, 2026 19:33
marmar9615-cloud added a commit that referenced this pull request Apr 28, 2026
Adds the design-first artifacts for v0.5.0 — Signed Manifests:

- docs/designs/signed-manifests.md (full design doc covering threat
  model, manifest signing model, JCS canonicalization, Ed25519
  default, key set publication, rotation/revocation, freshness,
  verification failure modes, schema/SDK/scanner/MCP/CLI impact,
  backward compatibility, migration plan, and test plan).
- docs/adr/0002-signed-manifests.md (architecture decision record
  with five rejected and one deferred alternative).
- docs/issues/v0.5.0-signed-manifests.md (in-tree mirror of GitHub
  tracking issue #31).

Updates the supporting docs to reflect that v0.4.0 has shipped on
npm via Trusted Publishing and that v0.5.0 signed manifests are
now in design (not yet runtime):

- docs/roadmap.md — v0.4.0 marked shipped; v0.5.0 marked in design.
- docs/v1-readiness.md — criterion #7 (signed manifests) flipped
  to "design in progress"; #1, #2, #3 (Trusted Publishing /
  provenance) flipped to "yes" since v0.4.0 published.
- docs/threat-model.md — T1 expanded into T1.a/b/c/d sub-vectors
  and pointed at the v0.5.0 design as its mitigation.
- docs/security-configuration.md — adds a "Signed manifests
  (v0.5.0 — design only, not yet runtime)" section listing the
  proposed env vars without enforcing them.
- docs/production-readiness.md — bottom-line note now refers to
  v0.4.0 and points at the in-progress design.
- AGENTS.md / CLAUDE.md / README.md — small status notes; no
  bloat.

No runtime change. No package version bump. No publish. No tag.
No release. Unsigned manifests still validate against the v0.1
manifest spec. All safety invariants intact (confirmation gate,
origin pinning, target-origin allowlist, audit redaction, stdio
stdout hygiene, HTTP transport auth/origin checks).

Verified locally with npm run typecheck:clean (clean), npm test
(196/196), npm run build (all packages), npm run pack:dry-run
(all six packages OK at 0.4.0).

Tracking: #31

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/next-react-5c623bd62f branch from 1b4bca5 to 0a2f255 Compare April 28, 2026 22:54
Bumps the next-react group with 1 update in the / directory: [next](https://github.com/vercel/next.js).


Updates `next` from 15.5.15 to 16.2.4
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.5.15...v16.2.4)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.2.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: next-react
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/next-react-5c623bd62f branch from 0a2f255 to dfd28c5 Compare May 4, 2026 18:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants