Skip to content

Bump next from 16.2.6 to 16.3.5 - #265

Open
dependabot[bot] wants to merge 4 commits into
mainfrom
dependabot/npm_and_yarn/next-16.3.4
Open

dependabot[bot] wants to merge 4 commits into
mainfrom
dependabot/npm_and_yarn/next-16.3.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026 •

Copy link
Copy Markdown
Contributor

Bumps next from 16.2.6 to 16.3.5.

Release notes

Sourced from next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

... (truncated)

Commits
  • ca2c75e v16.3.5
  • 14fb290 [backport] Fix use cache prerender signal retention (#98448)
  • 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
  • 4b56cee [16.3.x] Backport docs fixes (#98317)
  • 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
  • 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
  • 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
  • d9eac96 [16.3.x] next/image: skip 0-byte entries when initializing disk LRU cache (#9...
  • 84b35fe [test] Fix 16.3 deploy test assertions (#98133)
  • 14f9c1a [16.3.x][ci] Run flake detection and new deploy tests when merged and on back...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026
@netlify

netlify Bot commented Sep 11, 2026 •

Copy link
Copy Markdown

❌ Deploy Preview for servicestart failed. Why did it fail? →

Name Link
🔨 Latest commit cf88e64
🔍 Latest deploy log https://app.netlify.com/projects/servicestart/deploys/6abb11fabc5d5400083cbb49

Bumps [next](https://github.com/vercel/next.js) from 16.2.6 to 16.3.5.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.6...v16.3.5)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.3.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump next from 16.2.6 to 16.3.4 Bump next from 16.2.6 to 16.3.5 Sep 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/next-16.3.4 branch from 6197fa2 to eda5f85 Compare September 14, 2026 15:30
Next 16.3 runs the TypeScript 6 checker during next build, which rejects
the deprecated target=es5 (TS5107) and fails the build. ES2017 is the
target Next's own tsconfig template uses; the compiler never emits
(noEmit), so this only changes type-checking.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VeYmbN1aRFTdeZM8vU2cC3

shaply commented Sep 28, 2026

Copy link
Copy Markdown
Contributor

Merged main and pushed 47a5e69. With next resolving to 16.3.x, next build runs the TypeScript 6 checker and fails on the deprecated "target": "es5" (TS5107). I changed tsconfig.json to target ES2017, which is what Next's own template uses. noEmit is on, so this only affects type-checking. CI is green, and the full Chromium E2E suite passed locally on 16.3.5.

This is also why build and every E2E shard fail on the other npm Dependabot PRs: package.json pins "next": "latest", so each regenerated lockfile pulls in 16.3.5. Once this merges, rebasing those PRs should turn them green.


Generated by Claude Code

This branch was successfully deployed

1 active deployment
Preview — cf88e641 Deployed Sep 29, 2026 by shaply via migrate-db #738
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants