chore(deps-dev): bump eslint-config-next from 15.5.18 to 16.2.9

[dependabot]

Bumps eslint-config-next from 15.5.18 to 16.2.9.

Release notes

Sourced from eslint-config-next's releases.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
• [backport] Fix "type: module" in project dir when using standalone or adapters (#94050)
• [backport] Propagate adapter preferred regions (#94200)
• [16.2.x] Don't drop FormData entries (#94240)
• [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @​eps1lon, @​icyJoseph, @​unstubbable, @​mischnic, @​bgw, @​timneutkens, and @​lukesandberg for helping!

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

... (truncated)

Commits

• f37fad9 v16.2.9
• 6f16804 v16.2.8
• 411c455 v16.2.7
• ee6e79b v16.2.6
• 766148f v16.2.5
• 2275bd8 v16.2.4
• d5f649b v16.2.3
• 52faae3 v16.2.2
• ed7d2ce v16.2.1
• c5c94df v16.2.0
• Additional commits viewable in compare view

[cloudflare-workers-and-pages]

Deploying agent-render with    Cloudflare Pages

Latest commit:	6f01531
Status:	✅  Deploy successful!
Preview URL:	https://6eeb7d88.agent-render.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-esli-8sm6.agent-render.pages.dev

View logs

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint-config-next@​15.5.18 ⏵ 16.2.9	+1		+3

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/eslint-config-next@16.2.9 → npm/@typescript-eslint/eslint-plugin@8.61.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.61.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[greptile-apps]

Greptile Summary

This is an automated Dependabot bump of the eslint-config-next devDependency from 15.5.18 to 16.2.9, which also pulls in updated transitive Babel dependencies via package-lock.json.

• package.json: eslint-config-next version updated from 15.5.18 to 16.2.9.
• package-lock.json: Corresponding lockfile updates for eslint-config-next and several transitive @babel/* packages that the new major version now requires.

Confidence Score: 5/5

Safe to merge — this is a devDependency-only change with no impact on the production bundle or runtime behaviour.

The only changed artifacts are package.json and package-lock.json. eslint-config-next is a devDependency used exclusively at lint time and is never included in the production build. The transitive Babel packages introduced are likewise dev-only. No application code, runtime paths, or static-export behaviour are affected.

No files require special attention beyond what has already been discussed in prior review threads.

Important Files Changed

Filename	Overview
package.json	Bumps eslint-config-next devDependency from 15.5.18 to 16.2.9; production next dependency remains at 15.5.18 (version mismatch already flagged in a prior review thread)
package-lock.json	Lockfile updated to reflect eslint-config-next 16.2.9 and its new transitive @babel/* dependencies (e.g. @babel/core, @babel/compat-data added as dev deps)

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    P[agent-render project] -->|devDependency| E[eslint-config-next 16.2.9]
    P -->|dependency| N[next 15.5.18]
    E -->|transitively adds| B["@babel/core 7.29.7\n@babel/compat-data 7.29.7\n@babel/code-frame 7.29.7"]
    E -->|peer dep expects| NP[next ^16.x]
    N -->|installed version| N15[next 15.x]
    NP -. version mismatch .-> N15

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    P[agent-render project] -->|devDependency| E[eslint-config-next 16.2.9]
    P -->|dependency| N[next 15.5.18]
    E -->|transitively adds| B["@babel/core 7.29.7\n@babel/compat-data 7.29.7\n@babel/code-frame 7.29.7"]
    E -->|peer dep expects| NP[next ^16.x]
    N -->|installed version| N15[next 15.x]
    NP -. version mismatch .-> N15

Loading

_{Reviews (2): Last reviewed commit: "chore(deps-dev): bump eslint-config-next..." | Re-trigger Greptile}

[greptile-apps]

eslint-config-next version mismatch with next

eslint-config-next is being bumped to 16.2.9 while the production next dependency stays at 15.1.11. The eslint-config-next package carries a peer dependency on the matching major version of next, so npm will warn about an unsatisfied peer. Beyond warnings, the ESLint config ships rules that assume Next.js 16 internal APIs and conventions; running it against a Next.js 15 project can produce false positives (flagging valid 15.x patterns) or false negatives (missing issues specific to 15.x behaviour). The two versions should stay in sync — consider pinning eslint-config-next to 15.1.11 until next itself is upgraded to 16.

[kilo-code-bot]

Code Review Summary

Status: No New Issues Found (1 pre-existing concern already tracked) | Recommendation: Address the version mismatch before merge

Overview

This Dependabot PR bumps eslint-config-next from 15.5.18 to 16.2.9 (a major version jump) in devDependencies, with the cascading package-lock.json changes. The diff is limited to package.json (1 line) and the generated lockfile.

Note: this branch was force-pushed since the prior review (the previous review commit b898c4e no longer exists in history), so this pass is a full re-review against the current state. The one substantive concern is already flagged by an existing review comment and is not duplicated here.

Compatibility checks (all satisfied)

• eslint-config-next@16.2.9 peer: eslint >=9.0.0 — project uses eslint ^9.22.0 ✅
• bundled typescript-eslint@8.61.1 peer: typescript <6.1.0 — project uses typescript ^5.8.2 ✅
• eslint-plugin-react-hooks@7.1.1 (major bump 5→7) needs node >=18 — project requires node >=20.10.0 ✅
• new transitive deps (@babel/core, hermes-parser, zod, browserslist, globals, node-releases, etc.) are dev-scoped — no production bundle impact ✅

Pre-existing Concern (already commented by another reviewer)

File	Line	Issue
package.json	85	eslint-config-next@16.2.9 is paired with next@15.5.18 (line 65). The config and its bundled @next/eslint-plugin-next@16.2.9 ship rules targeting Next.js 16 APIs/conventions, which can produce false positives/negatives against a Next.js 15 codebase. Pin eslint-config-next to 15.5.18 to match next, or upgrade next to 16 in the same pass. (The existing comment cites next@15.1.11; the current production next is 15.5.18, but the major-version mismatch concern is unchanged.)

Files Reviewed (2 files)

• package.json — 1 changed line; no new issues (version mismatch already tracked)
• package-lock.json — generated lockfile; skipped per review guidelines

Previous Review Summary (commit b898c4e)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit b898c4e)

Status: No New Issues Found (1 pre-existing concern already tracked) | Recommendation: Address the version mismatch before merge

Overview

This Dependabot PR bumps eslint-config-next from 15.1.11 to 16.2.9 (a major version jump) in devDependencies, with the cascading lockfile changes. The diff is limited to package.json (1 line) and package-lock.json (generated).

I reviewed the changed files and the project's ESLint setup (eslint.config.mjs uses compat.extends("next/core-web-vitals")). No new inline issues were found — the one substantive concern is already flagged by an existing review comment and is not duplicated here.

Compatibility checks (all satisfied)

• eslint peer tightened to >=9.0.0 — project uses eslint ^9.22.0 ✅
• typescript-eslint peer is now <6.1.0 — project uses typescript ^5.8.2 ✅
• eslint-plugin-react-hooks bumped to 7.1.1 (needs node >=18) — project requires node >=20.10.0 ✅
• All new transitive deps (@babel/core, hermes-parser, zod, browserslist, etc.) are dev-scoped — no production bundle impact ✅

Pre-existing Concern (already commented by another reviewer)

File	Line	Issue
package.json	90	eslint-config-next@16.2.9 is paired with next@15.1.11 (line 68). The ESLint config and its bundled @next/eslint-plugin-next@16.2.9 ship rules targeting Next.js 16 APIs/conventions, which can produce false positives/negatives when run against a Next.js 15 codebase. Consider pinning eslint-config-next to 15.1.11 until next is upgraded to 16, or upgrade next in the same pass.

Files Reviewed (2 files)

• package.json — 1 changed line; no new issues (version mismatch already tracked)
• package-lock.json — generated lockfile; skipped per review guidelines

---

_{Reviewed by GLM-5.2 · Input: 145.1K · Output: 12.9K · Cached: 250.7K}

[baanish]

Closing as premature: eslint-config-next@16 is built for Next.js 16 and its flat-config shape breaks under this repo's Next 15.5.18 setup (CI fails with "Converting circular structure to JSON" in the eslintrc config-validator). eslint-config-next is version-locked to next (both pinned at 15.5.18), so it should only move to 16 as part of a deliberate Next 16 upgrade. Dependabot will re-propose this once Next itself is bumped.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.