chore(deps): bump next from 14.2.33 to 16.1.5#133
chore(deps): bump next from 14.2.33 to 16.1.5#133dependabot[bot] wants to merge 1 commit intodevelopfrom
Conversation
Bumps [next](https://github.com/vercel/next.js) from 14.2.33 to 16.1.5. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.2.33...v16.1.5) --- updated-dependencies: - dependency-name: next dependency-version: 16.1.5 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
|
1 similar comment
|
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
🤖 Augment PR SummarySummary: Updates the Portal app’s Next.js dependency to a newer major release (Next 16.1.5), primarily to pick up upstream security fixes. Changes:
Technical Notes: This is a major Next.js upgrade; CI should validate build/runtime behavior and confirm compatibility with the app’s React/Node versions and any 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| "mux-embed": "^4.12.0", | ||
| "nanoid": "^5.0.7", | ||
| "next": "^14.2.32", | ||
| "next": "^16.1.5", |
There was a problem hiding this comment.
This is a major Next.js upgrade (14 → 16); it’s worth verifying that the app’s react/react-dom and Node versions satisfy Next 16’s peer/runtime requirements. Also double-check any next.config.* options and middleware/app-router behavior the portal relies on still behave the same after the bump.
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| "mux-embed": "^4.12.0", | ||
| "nanoid": "^5.0.7", | ||
| "next": "^14.2.32", | ||
| "next": "^16.1.5", |
There was a problem hiding this comment.
Minor metadata mismatch: the PR title says this bumps Next from 14.2.33, but this package.json entry was 14.2.32. If intentional that’s fine, but it can make auditing/version tracking confusing.
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Greptile OverviewGreptile SummaryThis PR upgrades Next.js from 14.2.33 to 16.1.5, a major version jump that includes critical security fixes addressing CVE-2025-59471, CVE-2025-59472, and CVE-2026-23864. The upgrade also brings improvements to Turbopack, bug fixes for LRU cache and middleware redirects, and new image optimization features. Key Changes:
Potential Breaking Changes:
Testing Required:
Confidence Score: 2/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant D as Dependabot
participant PM as Package Manager (pnpm)
participant NX as Next.js Runtime
participant IMG as Image Optimization
participant SEC as Security Layer
D->>PM: Update next from 14.2.33 to 16.1.5
PM->>PM: Resolve dependencies
PM->>PM: Add sharp image library dependencies
PM->>PM: Update Sentry integration references
Note over NX: Application Runtime Changes
NX->>NX: Load new Next.js 16 core
NX->>NX: Initialize Turbopack improvements
NX->>SEC: Apply CVE-2025-59471 patches
NX->>SEC: Apply CVE-2025-59472 patches
NX->>SEC: Apply CVE-2026-23864 patches
Note over IMG: Image Configuration Impact
NX->>IMG: Read images.domains config (deprecated)
IMG-->>NX: Warning: Use remotePatterns instead
IMG->>IMG: Enforce 50MB max response body
IMG->>IMG: Load sharp for optimization
Note over NX: Breaking Change Risks
NX->>NX: Check Pages Router compatibility
NX->>NX: Verify middleware behavior
NX->>NX: Validate API routes
Note over D: Testing Required
D-->>D: Manual testing needed for images
D-->>D: Manual testing needed for auth flows
D-->>D: Manual testing needed for video features
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| "mux-embed": "^4.12.0", | ||
| "nanoid": "^5.0.7", | ||
| "next": "^14.2.32", | ||
| "next": "^16.1.5", |
There was a problem hiding this comment.
Verify compatibility of next 16.1.5 with React 18.3.1. Next.js 16 introduced changes to React compatibility and may require testing all interactive features.
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/portal/package.json
Line: 43:43
Comment:
Verify compatibility of `next` 16.1.5 with React 18.3.1. Next.js 16 introduced changes to React compatibility and may require testing all interactive features.
How can I resolve this? If you propose a fix, please make it concise.
Additional Comments (1)
Prompt To Fix With AIThis is a comment left during a code review.
Path: apps/portal/next.config.js
Line: 27:29
Comment:
The `images.domains` configuration is deprecated in Next.js 16. Should migrate to `images.remotePatterns` instead:
```suggestion
images: {
remotePatterns: [
{
protocol: 'https',
hostname: 'storage.googleapis.com',
},
{
protocol: 'https',
hostname: 'lh3.googleusercontent.com',
},
],
},
```
How can I resolve this? If you propose a fix, please make it concise. |
|
|
Superseded by #142. |
Bumps next from 14.2.33 to 16.1.5.
Release notes
Sourced from next's releases.
... (truncated)
Commits
acba4a6v16.1.5e1d1fc6Add maximum size limit for postponed body parsing (#88175)500ec83fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)1caaca3feat(next/image)!: addimages.maximumResponseBodyconfig (#88183)522ed84Sync DoS mitigations for React Flight8cad197[backport][cna] Ensure created app is not considered the workspace root in pn...2718661Backport/docs fixes (#89031)5333625Backport/docs fixes 16.1.5 (#88916)60de6c2v16.1.45f75d22backport: Only filter next config if experimental flag is enabled (#88733) (#...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Upgrade Next.js from 14.2.33 to 16.1.5 to pick up security patches and bug fixes. This major bump requires Node 20.9+ and tightens next/image response limits.
Written for commit 01b1cde. Summary will update on new commits.