Skip to content

deps: bump next from 15.4.0 to 16.3.4 - #4

Closed
dependabot[bot] wants to merge 9 commits into
mainfrom
dependabot/npm_and_yarn/next-16.3.4
Closed

deps: bump next from 15.4.0 to 16.3.4#4
dependabot[bot] wants to merge 9 commits into
mainfrom
dependabot/npm_and_yarn/next-16.3.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown

Bumps next from 15.4.0 to 16.3.4.

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

... (truncated)

Commits
  • 299180d v16.3.4
  • 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
  • 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
  • d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
  • 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
  • a9a1cb7 v16.3.3
  • 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
  • 3a15b4a [16.3.x] [next/image]: disable avif image optimization
  • 7378b51 Backport/docs fixes 16.3 (#97649)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

nerdresolve and others added 9 commits September 7, 2026 15:18
@nerdresolve @claude
Estrutura inicial da plataforma
a27f86e 
Monorepo em tres camadas, com a direcao das dependencias verificada por
portao automatico (frontend -> backend -> core):

- packages/core   regra de dominio pura, sem framework e sem SQL
- apps/backend    casos de uso, repositorios e integracoes
- apps/frontend   Next.js 15 e React 19: telas e rotas HTTP
- infra           compose, migracoes do Postgres, proxy e ferramentas

Design system proprio em tokens: paleta violeta, tipografia e espacamento
num lugar so', com tema claro e escuro que passam em contraste WCAG AA.

Nenhum .env e' versionado. O .gitignore recusa qualquer um que nao seja
.example, e a documentacao manda gerar segredo proprio por instalacao.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@nerdresolve @claude
Nucleo funcional da plataforma
7b7186b 
Aluno assiste, faz prova e recebe certificado. A conclusao exige 90% de
cobertura do video COM tempo de sessao compativel: arrastar a barra nao
conta. O avanco para trecho nao assistido e' bloqueado por curso.

Prova com banco de questoes, correcao por rubrica e reteste PEDIDO ao
instrutor, que libera ou recusa com comentario obrigatorio. Certificado
em PDF com assinatura do instrutor e codigo conferivel, que reavalia
matricula, conclusao e nota em vez de confiar no codigo sozinho.

Tambem entram: biblioteca de conteudos, plano de formacao por cargo,
trilha por funcao e local, avaliacao de eficacia do treinamento, corte
automatico de video, LDAP como fonte de identidade, exclusao de conta
(LGPD), cifra de segredos em repouso, H5P e rigor de leitura.

Multi-tenant desde o schema: toda consulta filtra por tenant_id, e ha
teste automatizado cobrindo o isolamento entre clientes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@nerdresolve @claude
Automacao de CI e deploy, e o ponto unico de personalizacao
2f96c94 
- CI com typecheck, lint, testes, build, imagem Docker e compose validado
- Deploy por tag: publica no GHCR e atualiza o servidor por SSH, migrando
  antes de trocar o container e esperando o healthcheck. Sem os secrets
  de SSH a Action publica a imagem e pula o deploy, sem falhar
- CodeQL, npm audit e Gitleaks em cada PR e semanalmente
- Dependabot agrupado, templates de issue e de PR

brand.config.ts reune nome, cor e caminhos das imagens num arquivo so':
trocar a marca do produto e' editar dois valores e substituir quatro
imagens.

O nome que aparece na aba, no certificado e nas telas publicas sai do
tenant que atende a requisicao, com o nome do produto como reserva.
Nenhum nome fica fixo em codigo.

README, CONTRIBUTING, SECURITY e DEPLOY escritos para quem chega de fora.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@nerdresolve @claude
Reduz o peso do repositorio e completa o .env.example
34e935f 
- o prototipo gerado deixa de ser versionado: os .template.html sao a
  fonte, e a CI roda npm run preview antes dos portoes
- documenta HTTP_PORT, HTTPS_PORT, STORAGE_PUBLIC_ENDPOINT e TZ, que o
  compose ja lia sem estarem declaradas em lugar nenhum
- remove assets que nenhum codigo referenciava

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@nerdresolve @claude
Tipografia sob licenca aberta e ajustes de contraste
cc772bf 
Manrope, sob SIL Open Font License: pode ser redistribuida, inclusive
num fork comercial. Por ser variavel, um arquivo de 24 kB cobre os pesos
200-800 onde uma familia estatica levaria oito arquivos e 215 kB.

Auditoria visual das telas nos dois temas ajustou:
- o gradiente de marca e a arte da landing no tema escuro
- tres cores da sidebar no tema claro, com os contrastes que os
  comentarios documentam
- o hover do botao primario no escuro, que dava 3.96:1 com texto branco

Corrige tambem width/height de imagem que nao batiam com os arquivos e
causavam layout shift, e o alvo de toque do .link (WCAG 2.5.8).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@nerdresolve @claude
Corrige achados da auditoria de acessibilidade
230bc3c 
`.sr-only` usava margem negativa e `position: absolute` sem ancestral
posicionado, entao um rotulo dentro de `<th>` se ancorava na pagina e
reaparecia como 8px de rolagem horizontal a 1024px. Agora recorta por
`clip-path` e quem o envolve vira o bloco de contencao.

Tres campos do prototipo nao tinham nome acessivel: o `<label
class="sr-only">` ao lado deles nao tinha `for` nem envolvia o campo, o
que faz dele texto solto. Como os formularios sao clonados por modulo,
`id` colidiria; ficou `aria-label`.

As quatro capas de curso eram degrades do mesmo violeta variando so' o
angulo, e numa grade liam como um retangulo so'. Cada uma passa a puxar
para um acento da marca, que a personalizacao por cliente ja deriva.

Alinha as acoes de linha da tabela com o botao que o app React usa.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@nerdresolve @claude
Alinha o prototipo com o app e aperta o orcamento de peso
9b23780 
O prototipo usava `.studio` e `.studio__head` como container de pagina,
e nenhuma folha define as duas. O app React usa `.page` e `.page-head`
nos mesmos lugares. Oito paginas renderizavam sem o container que o
codigo pedia.

O defeito estava escondido porque o portao que compara classes usadas
com classes definidas varria o `<style>` inteiro, comentarios inclusive
— e um comentario que menciona `.studio` contava como definicao. Tirar
os comentarios do CSS gerado revelou o buraco e, de quebra, cortou 39 kB
de cada uma das 21 paginas. Com elas mais leves, o orcamento por pagina
cai para 200 kB.

Na tabela em tela estreita, um e-mail longo nao quebrava e encostava na
borda do cartao. A barra de QA do prototipo media 426px numa tela de
390px e tapava o conteudo que se estava conferindo.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@nerdresolve @claude
Tira o nome do produto do rotulo da moeda
f595a33 
A moeda da gamificacao e' do cliente que instala, nao do produto: um
nome fixo apareceria na tela de quem usa outra marca.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@dependabot
deps: bump next from 15.4.0 to 16.3.4
3a519e0 
Bumps [next](https://github.com/vercel/next.js) from 15.4.0 to 16.3.4.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v15.4.0...v16.3.4)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.3.4
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026
@nerdresolve nerdresolve closed this Sep 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/next-16.3.4 branch September 7, 2026 22:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nerdresolve