[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
eslint-config-next (source)	15.5.9 → 16.4.5
next (source)	15.5.9 → 16.4.5

---

Release Notes

vercel/next.js (eslint-config-next)

v16.4.5

Compare Source

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#​100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#​100619)
• [lts-active] Revert "Optimize strict module factory chunks (#​98421)" (#​100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#​100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#​100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#​100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#​100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

v16.4.3

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Fix extensionless Google font URLs in both bundlers (#​100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#​100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#​95732)" (#​100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#​100123)
• [lts-active] test: Pin react-virtualized (#​100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#​100572)
• [lts-active] Keep OpenTelemetry request traces together (#​100349, #​100294, #​100324, #​100350, #​100552, #​100583) (#​100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#​100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

v16.4.2

Compare Source

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#​99644, #​99732, #​99649) by @​lukesandberg in #​100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#​98823, #​99910, #​100091) by @​sokra in #​100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in #​100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in #​100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in #​100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in #​100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in #​100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in #​100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v16.4.0

Compare Source

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #​75682
• fix(scripts): correct typo in rm.mjs error message: #​87015
• docs: improve clarity and punctuation in README: #​86096
• Fix debug build paths Pages Router support entries: #​93529
• bundle-analyzer: record historical snapshots on each analyze run: #​93520
• fix: detect proxy.ts correctly with compound pageExtensions: #​93246
• feat(turbopack): support false values for resolveAlias config: #​93331

Misc Changes

• docs: correction to dynamicParams migration: #​96624
• docs: proxy event argument: #​96435
• docs: remove experimental note from runtime prefetching: #​96615
• Preserve per-segment prefetching after dynamic navigation: #​96583
• Rename static generation stream option to waitForAllReady: #​96564
• Remove obsolete static generation plumbing: #​96563
• [turbopack] Drop dead writes to exports: #​96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #​96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #​96549
• [turbopack] Strip leading BOM before parsing CSS: #​96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #​96550
• docs: use relative doc links in instant-navigation error pages: #​96672
• Turbopack: terminate failed plugin worker threads: #​96592
• Fix HTML-limited bot matching in prerender bypass rules: #​96584
• [ci] Fix create_release_branch for new repo permissions: #​96641
• test: skip action module instance deploy test: #​96629
• docs: quote the dynamicParams build error in a blockquote: #​96633
• [react-sync] Open pull requests as the bot that authors the commits: #​96682
• [Bench] Fixes for pure Fizz bench: #​96771
• Derive foreground cache revalidation from the consumer: #​96731
• Fix race when navigating Back before hydration: #​96252
• docs: present each Skill as steps in the AI agents guide: #​96751
• Reuse completed cache entries for the rest of a request: #​96727
• Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #​96735
• Remove WorkStore execution mode: #​96674
• Remove cache revalidation execution mode reads: #​96670
• Separate App Route render and prerender pipelines: #​96662
• Remove App Page execution mode reads: #​96660
• test: fix missing await in css-chunking test: #​96725
• docs (Skills): stop assuming app/ at the root and port 3000: #​96696
• Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #​95808
• Use Tailwind Turbopack loader in create-next-app: #​96606
• docs: instant navigation quick start with an adoption prompt: #​96663
• Separate App Page render and prerender pipelines: #​96659
• Move App Router execution intent to entrypoints: #​96640
• Pass explicit render capabilities through App Render: #​96576
• Pass explicit prefetch hint policy through App Render: #​96572
• Replace WorkStore isStaticGeneration with executionMode: #​96570
• docs: document ! exclusion and src/ prefix for --debug-build-paths: #​96703
• Change loadManifest to return undefined with handleMissing: #​96530
• Refactor server from CacheNodeSeedData -> TransportData: #​96679
• Unify full/partial navigation response types: #​96439
• Unify RouteTree and CacheNodeSeedData on the client: #​96406
• Consolidate Promise.withResolvers polyfills: #​96772
• [ci] Open automated update pull requests with nextjs-bot: #​96683
• Require Cache Components for Instant Navigation testing: #​96745
• Fix use cache over- and under-invalidation in dev: #​96235
• Fix which pages the dev server announces, and when: #​96250
• docs: update redirected links to current targets: #​96723
• Fix(deployment-id): prevent exception on old webkit: #​94604
• [fragment-scroll] Remove config.experimental.appNewScrollHandler: #​95602
• [turbopack] Enable reexport-unknown execution test: #​96774
• ci: stop publishing @​vercel/devlow-bench: #​96887
• fix(turbopack): name the module in the non-ESM-placeable error, and stop duplicating the importer in traces: #​96560
• fix(turbopack): support type: 'text' in rules, and error on binding imports of non-ESM modules: #​96558
• Lint devlow-bench with the root eslint config: #​96871
• Remove turbopack/packages and relocate devlow to packages/: #​96860
• Flush pending revalidations for forwarded action error responses: #​96945
• Handle Server Actions on dynamic PPR fallback routes: #​96932
• Turbopack: Improve how DiskWatcher is configured and fix polling watcher bugs: #​96440
• Turbopack: Allow DiskWatcher to use a mocked DiskFileSystem, add a small unit test: #​96353
• [turbopack] Add e2e test that uses component chunks + workers: #​96556
• [turbopack] Support experimental.serverMinification & expand experimental.turbopackMinify: #​96578
• Add a turbopackChunking documentation page for pages router: #​96698
• [turbopack] Don't run Webpack tests on Turbopack-only changes: #​96656
• [turbopack] Enable the shared runtime by default: #​96778
• [turbopack] Enable CJS tree shaking by default: #​96779
• refactor: clean up places that needlessly list all RenderStages: #​96907
• Fix the documented invocation for generating tests non-interactively: #​96896
• Make NextConfigComplete typing more accurate: #​96700
• Upgrade to swc 75: #​96702
• docs: link View Transitions skill on skills.sh and clarify the example prompt: #​96863
• [ci] Reset the turbopack deploy test project in the weekly cron: #​96822
• docs: add authentication with Cache Components guide and iron-session example: #​95802
• [turbopack] Fix a potential deadlock in scope_and_block: #​95695
• Remove the turbopack-build-events trace span, use next build instead: #​96746
• docs: add export const dynamic = 'force-static' to Route Handlers example on Static Exports: #​96964
• [turbopack] Follow re-exports for side-effect free async modules: #​95993
• [turbopack] Treat constants with values referencing other values as unsafe: #​96190
• [refactor] Rename encodeCacheTag to encodeHeaderSafe: #​96936
• Fix formatting of Google Fonts section in documentation: #​88447
• Fixing a bug - typo issue fixed: #​97141
• examples: fix Webiny API env variable name: #​97134
• docs: fix Link prefetch grammar and Client Components wording: #​97132
• Use emitted app entries for post-build processing: #​97139
• docs(mdx): fix package name in .md handling section: #​97131
• [turbopack] Reduce native React Compiler work: #​96820
• docs: rename repo to repository for consistency: #​87849
• Fix typo in Data Access Layer section: #​87202
• docs: runtime prefetching -> optimizing prefetching: #​96934
• [CC] Track APIs that cause incompatible static/app shells: #​97040
• Fix client component loading span timing: #​96455
• Trace development route compilation: #​96454
• Prefix 'use cache' debug logs with the full directive: #​97037
• Revert "[turbopack] Enable CJS tree shaking by default (#​96779)": #​97018
• Revert "[turbopack] Follow re-exports for side-effect free async modules": #​97009
• [fragment-scroll] Rename ScrollAndMaybeFocusHandler to ScrollHandler: #​96828
• Trace development route preparation: #​96453
• test: cleanup Turbopack snapshot config: #​97013
• Remove unused htmlLimitedBots from renderOpts: #​96701
• fix(turbopack): point at the glob that matched a file with no module type: #​96561
• [turbopack] Bail CJS tree-shaking on var x = module.exports = {}: #​97130
• docs: server client and directives: #​96145
• docs: clarify client cache freshness after hydration: #​97180
• docs: create client-side fetching guide: #​96341
• Turbopack: accept a module type argument for import.meta.glob: #​96991
• docs: align Cache Components authentication guide title: #​97143
• test: re-enable a few more passing NFT unit cases: #​97017
• [turbopack] Do the CJS analysis needed for scope hoisting: #​95826
• Remove legacy PPR code paths: #​96868
• Use Cache Components as the internal PPR signal: #​96827
• Make legacy PPR paths explicit: #​96753
• fix: typos in code comments: #​97137
• Fix spelling in two comments: #​97136
• Decouple loader tree construction from children ordering: #​97192
• Bump lightningcss: #​97159
• Update gh-stack skill guidance: #​97163
• [test] Unflake use-cache-custom-handler-dev tests: #​97187
• Forward a build-container pin to deploy-test deployments: #​97191
• Fix shared Turbopack runtime initialization race: #​97215
• Fix stale data after navigation despite revalidation: #​95439
• [turbopack] Only use the shared runtime by default on canary: #​97208
• test: fix 'ouput' typo in parseIdsFromCliOutput: #​97266
• Add the mtime fallback back: #​97268
• Allow issue participants to request reopening: #​96947
• [turbopack] Document clusters for chunking: #​97267
• Link to issues in the contribution guide and discourage trivial PRs: #​97188
• Stop serializing hmr version state: #​97146
• [turbopack] Add clusters to chunking heuristics: #​95157
• [test] Redirect the deployment host in-process for proxy deploy tests: #​97260
• [test] Unflake two cache-components-dev-streaming assertions: #​97246
• [test] Unflake use-cache-default-profile-expire-zero tests: #​97250
• Allow running ncc before pnpm build: #​97234
• Invalidate deferred Webpack entry sources: #​97205
• Unify how a response's shell and full payloads are written: #​96878
• Convert per-segment prefetches to NavigationFlightResponse format: #​96877
• Unify how server responses are written into the client cache: #​96876
• Convert tree prefetches to NavigationFlightResponse format: #​96788
• fix(next/image): skip 0-byte entries when initializing disk LRU cache: #​94068
• Update authentication diagram URL: #​97320
• Add a script for adopting fork pull requests: #​97252
• Migrate napi-rs bindings from v2 to v3: #​95412
• Upgrade React from 11eddecd-20260805 to 22e4f993-20260811: #​97249
• Add RDC compression rollout controls: #​97247
• [testmode] Fix infinite recursion in testmode passthrough fetch: #​96525
• Turbopack: add imports_wildcard NFT unit test: #​97373
• Turbopack: improve chunk_item_content docs: #​97370
• test: Reenable i18n-api-support deploy test for Turbopack with adapters: #​96898
• Trace instrumentation startup: #​97296
• Trace route module preparation: #​97295
• Trace route module loading: #​97318
• fix(deps): bump satori and @vercel/og: #​97276
• [test] Cover 'use cache: private' in route handlers: #​97349
• Fix missing Pages runtime in adapter Pages API outputs: #​96819
• docs: align SPA guide reducer example with React conventions: #​97341
• Update blob version.: #​97342
• Upgrade React from 22e4f993-20260811 to eb8feb71-20260814: #​97382
• Adopt SelectedMetadata for metadata rendering: #​97387
• fix(next/image): reject empty image on read/write to disk cache : #​97278
• Turbopack: remove stale manifests for deleted routes: #​97333
• Turbopack: make unreachable codegen more generic: #​97385
• Wait for back-before-hydration recoveries in the browser: #​97321
• Extract metadata resolution primitives: #​97388
• test: update React 18 redbox snapshot: #​97415
• Remove server route matcher stack: #​94157
• Anchor the async local storage instances to global symbols: #​97255
• test: deflake use-cache-size-zero warm reload: #​97421
• Scaffolding for concurrentRouterQueue flag: #​97413
• Reorganize client router modules: #​97402
• fix(turbo-persistence): allow 32-bit usize conversion: #​97288
• test: restore missing NFT exports* unit fixtures: #​97459
• [ci] Fix backport canary release dispatch: #​97383
• turbo-tasks-backend: Enforce that tasks exist when accessing them: #​96043
• turbo-tasks-backend: add persistence delete/tombstone plumbing for GC: #​95975
• turbo-persistence: add key-value tombstones for MultiValue families: #​96929
• Trace lazy App Route module loading: #​97439
• [ci] Wait for the next version to be available on npm before deploy tests: #​97460
• docs: fix stale Dev Overlay README link in contributing guide: #​97486
• docs: app router reference accuracy: #​97477
• test: Don't wait trying to load non-existing images: #​97488
• test: cover dynamic APIs with i18n base path: #​97367
• style(examples): remove redundant justify-content declaration: #​97222
• docs: rename Vercel Edge Config to Global Config in redirecting guide: #​97456
• fix: improve form accessibility by associating labels with inputs: #​96335
• [docs] fix: grammar typos in linking and navigating guide: #​95544
• fix(examples): correct error message typo: #​97223
• docs: fix typos in example links: #​97149
• Model prerenders as render candidates: #​97431
• Turbopack: support character class ranges in regex: #​97502
• docs: warn when catching permanentRedirect: #​97496
• Remove the development debug channel persistence: #​97510
• Stop the browser from restoring stale pages in development: #​97505
• Turbopack: gracefully handle outputFileTracingIncludes matching a symlink: #​97507
• docs: mention Valibot as validation library option in forms guides: #​97468
• [PPF] Remove unstable_eager: #​97524
• [PPF] Do not mark complete shell requests as partial: #​97503
• fix: add accessible label to icon-only link: #​96334
• Fix stale cross-references in skills/: #​97566
• docs: generateMetadata values should be serializable with use cache: #​97551
• Move preview props into separate manifest: #​96004
• docs: adjust interactive app guide: #​97558
• Turbopack: allow TURBOPACK_PRINT_CHUNK_GROUPS in release builds: #​97515
• [test] Point next-image-legacy images at a reachable endpoint: #​97545
• test: improve error-on-next-codemod-comment flakiness: #​97553
• Turbopack: cross-module constants: #​90300
• test: better isolate concurrent-install suite: #​97546
• docs: outlining and lcp: #​96942
• Turbopack: More aggressively debounce filesystem watch events if we detected changes to node_modules: #​96116
• docs: document metadata pagination field: #​95509
• docs: document deploymentId build ID override and Pages Router skew in 16.2: #​97645
• Upgrade React from eb8feb71-20260814 to eafeac09-20260819: #​97636
• Turbopack: rename to use turbopack: no side effects: #​94427
• refactor: move useDynamic{Route,Search}Params to reduce snapshot churn: #​97360
• [PPF] unstable_navigation(): #​96908
• [PPF] Scaffold unstable_navigation(): #​97236
• docs: Explicit cache output description: #​97548
• Improve Cache Components sync IO migration guidance: #​97572
• [test] Use a non-native stub for the server externals list test: #​97614
• Avoid GitHub API rate limits for create-next-app examples: #​97612
• [test] Cover the prerender worker-thread backend with an addon we control: #​97543
• [test] Convert the prerender-native-module suite to local fixture packages: #​97542
• [test] Replace the turbopack-reports sqlite3 dependency with a local addon fixture: #​97541
• [test] Drop the dead sqlite3 build approval from the sharp-basic suite: #​97540
• Remove HmrTarget: #​97253
• Keep HMR instructions typed until serialization: #​96569
• Serialize frozen collections by value only: #​96686
• feat(turbopack): isolate HMR listeners across microfrontends: #​95997
• Turbopack: deduplicate Pages Router app chunks: #​97664
• [react-sync] Check assignability before assigning the actor: #​97638
• fix: preserve trailing slash during export MPA fallback: #​97613
• Turbopack: Split the read and write codepath data structures for symlinks: #​97395
• Turbopack: Show last modified file when waiting for the filesystem to settle: #​97648
• docs: fix parallelRouteKey parameter name in useSelectedLayoutSegment(s): #​97710
• Turbopack: Avoid cloning paths in fs watcher if the path is already in a map: #​97655
• Remove generated error codes: #​97687
• [PPF] Instant validation for unstable_navigation(): #​97309
• Turbopack: trace graceful-fs calls: #​97694
• Migrate some async blocks to async closures: #​97666
• turbo-tasks: add scope_unbounded, a scoped execution primitive that allows more work to be discovered: #​95974
• test: make app-document-import-order more robust: #​97682
• Add a Turbopack error for missing root layouts: #​97639
• Improve Partial Prefetching adoption checks: #​97637
• test: stabilize poisoned proxy error overlay: #​97609
• docs: correct the upper stale bound for App Shell exclusion in cacheLife: #​97653
• docs: Adapters entry page lists its children pages twice: #​97677
• [PPF] unstable_prefetch(): #​97622
• [PPF] Scaffold unstable_prefetch(): #​97618
• docs: clarify beforeInteractive placement for root layouts: #​97643
• fix(turbopack): give eager import.meta.glob values the ESM namespace: #​96559
• introduce an options struct for constructing backend storage: #​97284
• [devtools] Fix indicator dragging on touch screens: #​97723
• Add next/cache-handlers types entrypoint: #​97592
• Remove unused return values from getPageStaticInfo: #​97661
• [turbopack] defer NFT module content hashes: #​97773
• test: deflake basePath external navigation: #​97611
• docs(adapters): document assetsHashes and routing.middlewareMatchers: #​96536
• Migrate remaining async blocks to async closures: #​97701
• Turn off the adapter route collapses by default: #​97774
• Serve a run of fallback shells from one route entry: #​97738
• [test] Capture the route table for apps with several param shapes: #​97728
• Stop emitting a separate route entry for a dynamic route's RSC form: #​97726
• Stop emitting a redundant route per prefetch segment: #​97720
• [test] Capture the dynamic routes a build passes to an adapter: #​97719
• turbo-tasks: compile conditional cell updates once, not per cell type: #​97763
• Turbopack: add unit test coverage for FileSystemPath::hash_file: #​97743
• Record fallback cache lifetime for blocking PPR routes: #​97821
• Document catchError for the Pages Router: #​97748
• clippy: allow needless late init where it makes sense: #​96410
• Turbopack: emit/collect: #​96631
• docs: note that response headers must be set before calling handle() in a custom server: #​97693
• Deduplicate the regress, wat/wasmparser and base64 dependencies: #​97762
• perf: split cold TurboMalloc accounting paths: #​97767
• turbo-tasks: execute scheduled tasks inline when they are read: #​96808
• Revert "Record fallback cache lifetime for blocking PPR routes (#​97821)": #​97835
• Sweep stale Turbopack output from distDir on dev startup: #​97591
• Fix metadata prefetch cache key for search params: #​97729
• Turbopack: Improve file existence error handling in realpath_with_links and in module resolution: #​97717
• Write traces with buffered synchronous IO: #​96874
• fix(wasm): don't enable SWC's plugin host for wasm targets: #​97859
• fix(turbopack-node): make process_pool inert on wasm: #​97858
• fix(turbopack): make the SWC wasm-plugin backend native-only: #​97857
• fix(turbopack-trace-utils): skip the ctrl-c handler on wasm: #​97856
• refactor(turbopack-cli-utils): replace crossterm with owo-colors: #​97855
• fix(turbo-tasks-fs): create symlinks through the WASI API on wasi: #​97854
• fix(turbo-tasks): compile EventListener::wait on wasm: #​97853
• fix(turbo-rcstr): allow the napi feature on wasm targets: #​97852
• fix(next-napi-bindings): detect the target, not the host, in build.rs: #​97576
• Stop printing a stack frame for error message text: #​97829
• docs: clarify revalidateTag profile expire semantics: [#​97836](https:/

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
torah-dl	Ready	Preview	Nov 5, 2026 8:04pm UTC

[polylane]

Warning

Polylane has not assessed the latest changes on this pull request.

_{Polylane did not analyse 144f112 for production impact. See the assessment history in Polylane.}

Previous verdicts (10)

Head	Verdict	Analysis
f633eab	Not assessed
3074855	Not assessed
33283b4	Not assessed
51e9f96	Not assessed
fc23376	Not assessed
3e6c79d	Not assessed
744b6e4	Not assessed
cbe43d2	Not reviewed
b3a85c0	Not reviewed
d214554	Not reviewed