chore(deps): bump next from 16.3.8 to 16.4.3 in /frontend #256

Merged

dependabot[bot] merged 1 commit from dependabot/npm_and_yarn/frontend/next-16.4.3 into develop

2026-11-10 17:33:37 +00:00

dependabot[bot] commented

2026-11-01 14:54:30 +00:00

(Migrated from github.com)

Bumps next from 16.3.8 to 16.4.3.

Release notes

Sourced from next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[lts-active] Fix extensionless Google font URLs in both bundlers (#100277)

[lts-active] Don't load the app-page runtime in proxy.ts (#100423)

[lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)

[lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)

[lts-active] test: Pin react-virtualized (#100545)

[lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)

[lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)

[lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @mischnic, @lukesandberg, @acdlite, @eps1lon, and @sokra for helping!

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: https://github.com/vercel/next.js/compare/v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

Show compiler plugin warning in more situations: #75682

fix(scripts): correct typo in rm.mjs error message: #87015

... (truncated)

Commits

29bbeab v16.4.3
5117201 [lts-active] Avoid loading standalone React in server bootstrap (#100610)
37d603b [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #1...
cf9d27d [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (...
3f6a632 [lts-active] test: Pin react-virtualized (#100545)
f715bba [lts-active][cd] Gate release bot credentials behind GitHub environments (#10...
c864c78 [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
f3ff943 [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
f697cf5 [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
2864b17 v16.4.2
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [next](https://github.com/vercel/next.js) from 16.3.8 to 16.4.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.4.3</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[lts-active] Fix extensionless Google font URLs in both bundlers (<a href="https://redirect.github.com/vercel/next.js/issues/100277">#100277</a>)</li> <li>[lts-active] Don't load the app-page runtime in proxy.ts (<a href="https://redirect.github.com/vercel/next.js/issues/100423">#100423</a>)</li> <li>[lts-active] Revert "Turbopack: loader change invalidation (<a href="https://redirect.github.com/vercel/next.js/issues/95732">#95732</a>)" (<a href="https://redirect.github.com/vercel/next.js/issues/100438">#100438</a>)</li> <li>[lts-active][cd] Gate release bot credentials behind GitHub environments (<a href="https://redirect.github.com/vercel/next.js/issues/100123">#100123</a>)</li> <li>[lts-active] test: Pin react-virtualized (<a href="https://redirect.github.com/vercel/next.js/issues/100545">#100545</a>)</li> <li>[lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (<a href="https://redirect.github.com/vercel/next.js/issues/100572">#100572</a>)</li> <li>[lts-active] Keep OpenTelemetry request traces together (<a href="https://redirect.github.com/vercel/next.js/issues/100349">#100349</a>, <a href="https://redirect.github.com/vercel/next.js/issues/100294">#100294</a>, <a href="https://redirect.github.com/vercel/next.js/issues/100324">#100324</a>, <a href="https://redirect.github.com/vercel/next.js/issues/100350">#100350</a>, <a href="https://redirect.github.com/vercel/next.js/issues/100552">#100552</a>, <a href="https://redirect.github.com/vercel/next.js/issues/100583">#100583</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/100542">#100542</a>)</li> <li>[lts-active] Avoid loading standalone React in server bootstrap (<a href="https://redirect.github.com/vercel/next.js/issues/100610">#100610</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/mischnic"><code>@mischnic</code></a>, <a href="https://github.com/lukesandberg"><code>@lukesandberg</code></a>, <a href="https://github.com/acdlite"><code>@acdlite</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, and <a href="https://github.com/sokra"><code>@sokra</code></a> for helping!</p> <h2>v16.4.2</h2> <h2>What's Changed</h2> <ul> <li>[lts-active] turbo-tasks snapshot consistency fixes (<a href="https://redirect.github.com/vercel/next.js/issues/99644">#99644</a>, <a href="https://redirect.github.com/vercel/next.js/issues/99732">#99732</a>, <a href="https://redirect.github.com/vercel/next.js/issues/99649">#99649</a>) by <a href="https://github.com/lukesandberg"><code>@lukesandberg</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/100002">vercel/next.js#100002</a></li> <li>[lts-active] Turbopack: backport Pages Router dev module graph chaining (<a href="https://redirect.github.com/vercel/next.js/issues/98823">#98823</a>, <a href="https://redirect.github.com/vercel/next.js/issues/99910">#99910</a>, <a href="https://redirect.github.com/vercel/next.js/issues/100091">#100091</a>) by <a href="https://github.com/sokra"><code>@sokra</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/100008">vercel/next.js#100008</a></li> <li>[lts-active] fix(next-code-frame): snap visible window to char boundaries by <a href="https://github.com/lukesandberg"><code>@lukesandberg</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/100212">vercel/next.js#100212</a></li> <li>[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by <a href="https://github.com/lukesandberg"><code>@lukesandberg</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/100209">vercel/next.js#100209</a></li> <li>[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by <a href="https://github.com/lukesandberg"><code>@lukesandberg</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/100217">vercel/next.js#100217</a></li> <li>[lts-active] Backport docs fixes since v16.4.0 by <a href="https://github.com/icyJoseph"><code>@icyJoseph</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/100246">vercel/next.js#100246</a></li> <li>[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by <a href="https://github.com/lukesandberg"><code>@lukesandberg</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/100211">vercel/next.js#100211</a></li> <li>[lts-active] Backport additional documentation fixes since v16.4.0 by <a href="https://github.com/aurorascharff"><code>@aurorascharff</code></a> in <a href="https://redirect.github.com/vercel/next.js/pull/100262">vercel/next.js#100262</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/vercel/next.js/compare/v16.4.1...v16.4.2">https://github.com/vercel/next.js/compare/v16.4.1...v16.4.2</a></p> <h2>v16.4.1</h2> <p>This release contains security fixes for the following advisories:</p> <p>Critical:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr">Unauthenticated Remote Code Execution in <code>use cache</code> functions returning typed arrays</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw">Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used</a></li> </ul> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r">Denial of Service in App Router using Server Actions</a></li> </ul> <h2>v16.4.0</h2> <p>Check out the <a href="https://nextjs.org/blog/next-16-4">16.4 announcement post</a> to get an overview of the changes.</p> <h3>Core Changes</h3> <ul> <li>Show compiler plugin warning in more situations: <a href="https://redirect.github.com/vercel/next.js/issues/75682">#75682</a></li> <li>fix(scripts): correct typo in rm.mjs error message: <a href="https://redirect.github.com/vercel/next.js/issues/87015">#87015</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/29bbeab09981148ade186e8599ecdede15abc281"><code>29bbeab</code></a> v16.4.3</li> <li><a href="https://github.com/vercel/next.js/commit/5117201d795c7a4d185bad044cef545be0b4e504"><code>5117201</code></a> [lts-active] Avoid loading standalone React in server bootstrap (<a href="https://redirect.github.com/vercel/next.js/issues/100610">#100610</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/37d603bf4d91cd4ecf97b9090b1dde61d84a2296"><code>37d603b</code></a> [lts-active] Keep OpenTelemetry request traces together (<a href="https://redirect.github.com/vercel/next.js/issues/100349">#100349</a>, <a href="https://redirect.github.com/vercel/next.js/issues/100294">#100294</a>, <a href="https://redirect.github.com/vercel/next.js/issues/1">#1</a>...</li> <li><a href="https://github.com/vercel/next.js/commit/cf9d27d96c7d9efa5b7ba0a5a30d2817b01364e7"><code>cf9d27d</code></a> [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (...</li> <li><a href="https://github.com/vercel/next.js/commit/3f6a632d413e57004718297543677caea7219ba4"><code>3f6a632</code></a> [lts-active] test: Pin react-virtualized (<a href="https://redirect.github.com/vercel/next.js/issues/100545">#100545</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/f715bba5e2d7ce4f76cb41d2ed06ee44ac71dc9a"><code>f715bba</code></a> [lts-active][cd] Gate release bot credentials behind GitHub environments (<a href="https://redirect.github.com/vercel/next.js/issues/10">#10</a>...</li> <li><a href="https://github.com/vercel/next.js/commit/c864c78fb14b79f47c152e17d7fce64f3b88f1db"><code>c864c78</code></a> [lts-active] Revert "Turbopack: loader change invalidation (<a href="https://redirect.github.com/vercel/next.js/issues/95732">#95732</a>)" (<a href="https://redirect.github.com/vercel/next.js/issues/100438">#100438</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/f3ff943085e07643be8ab18435611d6c259e8cb2"><code>f3ff943</code></a> [lts-active] Don't load the app-page runtime in proxy.ts (<a href="https://redirect.github.com/vercel/next.js/issues/100423">#100423</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/f697cf5db456a846ea2f83ef16a85d34afbda3d5"><code>f697cf5</code></a> [lts-active] Fix extensionless Google font URLs in both bundlers (<a href="https://redirect.github.com/vercel/next.js/issues/100277">#100277</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/2864b1772c37242a9b40ab4d366eb7d368c2a070"><code>2864b17</code></a> v16.4.2</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.3.8...v16.4.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=next&package-manager=npm_and_yarn&previous-version=16.3.8&new-version=16.4.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/NBISweden/sda-download-ui/network/alerts). </details>

aaperis (Migrated from github.com) approved these changes

2026-11-10 17:33:24 +00:00