chore(deps): update nextjs monorepo to v16.3.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@next/eslint-plugin-next (source)	16.2.5 → 16.3.2
eslint-config-next (source)	16.2.5 → 16.3.2

---

Release Notes

vercel/next.js (@​next/eslint-plugin-next)

v16.3.2

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#​97357)
• [backport] Fix catch-all index page being served for every other slug (#​97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#​97353) (#​97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#​97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#​97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#​97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

Compare Source

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in #​96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in #​96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in #​96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in #​96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in #​96900
• [backport] Bump @​swc/helpers by @​mischnic in #​96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in #​97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in #​97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in #​97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in #​97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in #​97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in #​97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in #​97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in #​97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in #​97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in #​97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in #​97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in #​97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in #​97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#​94905) by @​gaojude in #​97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.0

Compare Source

v16.2.12

Compare Source

v16.2.11

Compare Source

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.2.10

Compare Source

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Compare Source

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Compare Source

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#​93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#​93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#​93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#​93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#​93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#​93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#​93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#​94164)
• [backport] Fix "type: module" in project dir when using standalone or adapters (#​94050)
• [backport] Propagate adapter preferred regions (#​94200)
• [16.2.x] Don't drop FormData entries (#​94240)
• [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#​94284)

Credits

Huge thanks to @​eps1lon, @​icyJoseph, @​unstubbable, @​mischnic, @​bgw, @​timneutkens, and @​lukesandberg for helping!

v16.2.6

Compare Source

[!NOTE]
This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

• fix: preserve HTTP access fallbacks during prerender recovery (#​92231)
• Fix fallback route params case in app-page handler (#​91737)
• Fix invalid HTML response for route-level RSC requests in deployment adapter (#​91541)
• Patch setHeader for direct route handlers (#​93101)
• Include deployment id in cacheHandlers keys (#​93453)
• Fix double-encoding of URL pathname parts in client param parsing (#​93491)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
breval	Ready	Preview	Aug 21, 2026 12:04pm