[dependabot]

Bumps the patch-and-minor group with 5 updates:

Package	From	To
@types/node	26.6.2	26.6.4
motion	13.4.3	13.5.0
next	16.3.6	16.3.8
@opennextjs/cloudflare	1.20.6	1.20.7
wrangler	4.139.0	4.146.0

Updates @types/node from 26.6.2 to 26.6.4

Commits

• See full diff in compare view

Updates motion from 13.4.3 to 13.5.0

Changelog

Sourced from motion's changelog.

[13.5.0] 2026-10-01

Added

• spring: Now accepts negative bounce (0--1) to define overdamped springs.

Changed

• <m>: 20% smaller.
• useSpring: 10% smaller.
• scroll/useScroll: Use main thread for all offset animations.

Fixed

• Ensure warning and error messages are cleaned from production build.
• Ensure values are never rendered before they've been resolved.

[13.4.7] 2026-09-30

Changed

• scroll/useScroll: More offsets are now hardware accelerated via ViewTimeline.

Fixed

• animate: Reduced size of Motion Studio introspection call.
• useTransform: Accelerated values now correctly clamp.
• scroll/useScroll: Ensure offsets work the same across the JS main thread and ViewTimeline.
• scroll/useScroll: Remove ScrollTimeline/ViewTimeline observer in favour of main-thread scroll tracking.

[13.4.6] 2026-09-29

Fixed

• AnimatePresence: mode="wait" no longer drops new children if exit completes during a React transition.

[13.4.5] 2026-09-28

Fixed

• layout: Fix relative child jumping when parent interrupts layout animation.
• AnimatePresence: Can no longer drop a child added while another exit animation completes.
• Reorder: Only clear Reorder.Group's reorder guard when values change.
• spring/useSpring: 5% smaller.

[13.4.4] 2026-09-25

Changed

• scroll: 44% smaller.

... (truncated)

Commits

• 38d4566 v13.5.0
• b3f9b6d Updating changelog
• 780e0e4 Merge pull request #3875 from motiondivision/cursor/m-bundle-budget-7253
• 142e8c9 Merge pull request #3871 from motiondivision/cursor/spring-follow-path-a7d3
• fe843a5 Merge pull request #3863 from motiondivision/cursor/spring-negative-bounce-b15d
• 6f0a174 Merge remote-tracking branch 'origin/main' into cursor/m-bundle-budget-7253
• 64b140b Merge remote-tracking branch 'origin/main' into cursor/spring-follow-path-a7d3
• 7406c59 Raise the useSpring size budget for negative bounce
• 03b8bbc Merge remote-tracking branch 'origin/main' into cursor/spring-negative-bounce...
• 8a15fb2 Merge pull request #3861 from motiondivision/cursor/scroll-page-offset-native...
• Additional commits viewable in compare view

Updates next from 16.3.6 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

• Server-Side Request Forgery in Image Optimization

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
• Pending use cache fill can leak Draft Mode content into regular responses and persisted pages
• Cache leak across root param values in nested 'use cache' functions

Low:

• Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

Commits

• b0fad0d v16.3.8
• 719e4c6 [lts-active] Scope response cache keys to their source route (#218)
• e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
• 40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
• 2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
• bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
• 8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
• e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
• 4c20699 v16.3.7
• 2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
• See full diff in compare view

Updates @opennextjs/cloudflare from 1.20.6 to 1.20.7

Release notes

Sourced from @​opennextjs/cloudflare's releases.

@​opennextjs/cloudflare@​1.20.7

Patch Changes

• #1403 dc3c0ab Thanks @​aa-sikkkk! - fix: replace the whole loadCustomCacheHandlers body so Next.js 16.3 chunks don't throw ReferenceError

  Next.js 16.3 rewrote loadCustomCacheHandlers: the declaration that binds cacheHandlers now also binds cacheMaxMemorySize, and the native method body consumes both. The composable cache patch replaced only that declaration, so on the minified runtime chunks (dist/compiled/next-server/*.runtime.prod.js) the surviving native code referenced bindings that were no longer declared. Every request to the Worker then failed with ReferenceError: <minified identifier> is not defined inside loadCustomCacheHandlers (site-wide 500s on Next.js 16.3.x), while builds stayed green because the unminified next-server.js short-circuits on if (!cacheHandlers) return before the orphaned binding is read.

  The patch now replaces the whole method body while preserving its signature and wires the composable cache registry to the static require() as before, so no native reference to a dropped binding can survive. The rule still matches pre-16.3 chunks, so older Next.js versions are unaffected.

• #1399 2b3e3a1 Thanks @​JT1974! - fix: throw MODULE_NOT_FOUND from the stub of a missing optional dependency

  With React 18, every Pages Router page rendered by the Worker failed with TypeError: Cannot read properties of undefined (reading 'contexts'), caused by Error: Missing optional dependency "react-dom/server.edge". React 18 has no react-dom/server.edge, and Next.js falls back to react-dom/server.browser only when the error carries the MODULE_NOT_FOUND code. The stub now sets that code, so the fallback works again.

• #1406 8ea9eb9 Thanks @​mgarbacz! - fix: only rename esbuild's __require helper, not __require properties

  Restoring esbuild's __require helper to a bare require was a text replacement over the whole bundle, so it also rewrote unrelated __require members. @rollup/plugin-commonjs emits exports.__require lazy-init wrappers, whose declarations the replacement never matched — leaving the two halves disagreeing and throwing TypeError: __webpack_require__(...).require is not a function when such a package was imported during SSR. Packages built that way (for example smartystreets-javascript-sdk) 500'd every route. The rename now skips property accesses.

• #1404 ca4415b Thanks @​vicb! - chore: require Next.js 15.5.26 or 16.3.6

  Raise the supported Next.js version floor to 15.5.26 and 16.3.6. Next.js 16.2.0 through 16.3.5 are affected by the critical next/og remote code execution vulnerability CVE-2026-94545.

• #1404 ca4415b Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.6

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.6

Changelog

Sourced from @​opennextjs/cloudflare's changelog.

1.20.7

Patch Changes

• #1403 dc3c0ab Thanks @​aa-sikkkk! - fix: replace the whole loadCustomCacheHandlers body so Next.js 16.3 chunks don't throw ReferenceError

  Next.js 16.3 rewrote loadCustomCacheHandlers: the declaration that binds cacheHandlers now also binds cacheMaxMemorySize, and the native method body consumes both. The composable cache patch replaced only that declaration, so on the minified runtime chunks (dist/compiled/next-server/*.runtime.prod.js) the surviving native code referenced bindings that were no longer declared. Every request to the Worker then failed with ReferenceError: <minified identifier> is not defined inside loadCustomCacheHandlers (site-wide 500s on Next.js 16.3.x), while builds stayed green because the unminified next-server.js short-circuits on if (!cacheHandlers) return before the orphaned binding is read.

  The patch now replaces the whole method body while preserving its signature and wires the composable cache registry to the static require() as before, so no native reference to a dropped binding can survive. The rule still matches pre-16.3 chunks, so older Next.js versions are unaffected.

• #1399 2b3e3a1 Thanks @​JT1974! - fix: throw MODULE_NOT_FOUND from the stub of a missing optional dependency

  With React 18, every Pages Router page rendered by the Worker failed with TypeError: Cannot read properties of undefined (reading 'contexts'), caused by Error: Missing optional dependency "react-dom/server.edge". React 18 has no react-dom/server.edge, and Next.js falls back to react-dom/server.browser only when the error carries the MODULE_NOT_FOUND code. The stub now sets that code, so the fallback works again.

• #1406 8ea9eb9 Thanks @​mgarbacz! - fix: only rename esbuild's __require helper, not __require properties

  Restoring esbuild's __require helper to a bare require was a text replacement over the whole bundle, so it also rewrote unrelated __require members. @rollup/plugin-commonjs emits exports.__require lazy-init wrappers, whose declarations the replacement never matched — leaving the two halves disagreeing and throwing TypeError: __webpack_require__(...).require is not a function when such a package was imported during SSR. Packages built that way (for example smartystreets-javascript-sdk) 500'd every route. The rename now skips property accesses.

• #1404 ca4415b Thanks @​vicb! - chore: require Next.js 15.5.26 or 16.3.6

  Raise the supported Next.js version floor to 15.5.26 and 16.3.6. Next.js 16.2.0 through 16.3.5 are affected by the critical next/og remote code execution vulnerability CVE-2026-94545.

• #1404 ca4415b Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.6

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.6

Commits

• 4636385 Version Packages (#1388)
• 8ea9eb9 fix: only rename esbuild's __require helper, not __require properties (#1...
• ca4415b Bump Next and AWS (#1404)
• dc3c0ab fix composable cache patch for Next.js 16.3 minified runtime (#1403)
• 2b3e3a1 fix: throw MODULE_NOT_FOUND from the stub of a missing optional dependency ...
• ee0a415 chore: bump @opennextjs/aws to 4.1.5 (#1387)
• See full diff in compare view

Updates wrangler from 4.139.0 to 4.146.0

Release notes

Sourced from wrangler's releases.

wrangler@4.146.0

Minor Changes

• #15777 464a582 Thanks @​Naapperas! - Support the new Workflows createBatch() API in local development

  Local Workflows bindings now accept object-form batches that create instances from a count or a list of instance options. The result includes handles for created instances and indexed per-instance errors, matching the runtime API while preserving the deprecated array form.

• #15639 aee2842 Thanks @​hugo-vicente11! - Add --allowed-mail to the experimental wrangler tunnel quick-start command

  The option forwards exact email addresses, comma-separated lists, and wildcard domains to cloudflared. It can be specified more than once to combine multiple recipient rules.

  Email-protected tunnels require cloudflared 2026.9.2 or later. Wrangler checks the selected binary before starting the tunnel and reports an upgrade error when it is incompatible.

Patch Changes

• #15992 b8e7cc3 Thanks @​zebp! - Mark wrangler artifacts commands as open beta

  Artifacts has entered open beta, so the wrangler artifacts commands no longer display a "private beta" label in help output and warnings.

• #15984 9d7b08e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260930.2	^5.20261001.1
  workerd	1.20260930.2	1.20261001.1

• #15959 efd67e6 Thanks @​breken-ai! - Keep colons in wrangler tail --header filter values

  wrangler tail --header splits its argument into a header name and an optional value at the colon. It split at every colon and kept only the first two parts, so a value containing a colon was cut short: --header "Origin:https://app.example.com" filtered on https. The value now includes everything after the first colon, so URLs, ports and IPv6 addresses are sent to the tail filter intact.

• Updated dependencies [b00ef4f, 9d7b08e, 464a582]:

  • miniflare@5.20261001.0-alpha

wrangler@4.145.0

Minor Changes

• #15685 b9f1cdc Thanks @​Ankcorn! - Add native support for the Analytics SQL binding

  Declare the zero-configuration binding in wrangler.json with "analytics": { "binding": "ANALYTICS" }. Wrangler uploads the analytics binding type and proxies it to the remote service during local development, so wrangler dev can call the binding without unsafe.bindings.

• #15943 8468487 Thanks @​sejoker! - Graduate SQL, Catalog, and Pipelines under wrangler basin out of beta to stable

  Basin SQL is now available under wrangler basin sql, Basin Catalog operations are available under wrangler basin catalog, and Pipelines operations are available under wrangler basin pipelines. These commands are now stable, while the previous wrangler r2 sql, wrangler r2 bucket catalog, and wrangler pipelines command paths remain available as hidden compatibility aliases.

  The Basin SQL authentication environment variable is now WRANGLER_BASIN_SQL_AUTH_TOKEN. Update any existing WRANGLER_R2_SQL_AUTH_TOKEN configuration to use the new name. The fallback to CLOUDFLARE_API_TOKEN remains available.

• #15948 a0712e5 Thanks @​akoval-cf! - Add beta K2 producer bindings for existing streams

... (truncated)

Commits

• b4954c1 Version Packages (#15983)
• b8e7cc3 [wrangler] Mark Artifacts commands as open beta (#15992)
• aee2842 [wrangler] Support email-protected Quick Tunnels (#15639)
• efd67e6 [wrangler] Keep colons in wrangler tail --header filter values (#15959)
• 89061a4 Version Packages (#15957)
• 4a5ab6c Preserve existing secret bindings during Worker deployments (#15964)
• b9f1cdc [wrangler] Add Analytics SQL binding support (#15685)
• a0712e5 [wrangler] Add K2 commands and bindings (#15948)
• 8468487 Basin rename (#15943)
• 4ee367c Version Packages (#15949)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions