Skip to content

[Snyk] Upgrade next from 15.2.4 to 16.1.4 - #8

Open
pinkycollie wants to merge 1 commit into
mainfrom
snyk-upgrade-99e97ea1a7f7bf44ade9cfa25baf2490
Open

[Snyk] Upgrade next from 15.2.4 to 16.1.4#8
pinkycollie wants to merge 1 commit into
mainfrom
snyk-upgrade-99e97ea1a7f7bf44ade9cfa25baf2490

Conversation

@pinkycollie

Copy link
Copy Markdown
Owner

snyk-top-banner

Snyk has created this PR to upgrade next from 15.2.4 to 16.1.4.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 533 versions ahead of your current version.

  • The recommended version was released 25 days ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Server-side Request Forgery (SSRF)
SNYK-JS-NEXT-12299318
44 Proof of Concept
high severity Deserialization of Untrusted Data
SNYK-JS-NEXT-14400636
44 Proof of Concept
medium severity Use of Cache Containing Sensitive Information
SNYK-JS-NEXT-12301496
44 No Known Exploit
low severity Missing Source Correlation of Multiple Independent Data
SNYK-JS-NEXT-12265451
44 No Known Exploit
critical severity Arbitrary Code Injection
SNYK-JS-NEXT-14173355
44 Mature
medium severity Exposure of Sensitive System Information to an Unauthorized Control Sphere
SNYK-JS-NEXT-14400644
44 No Known Exploit

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.

Release notes
Package name: next
  • 16.1.4 - 2026-01-19

    Note

    This release is backporting bug fixes. It does not include all pending features/changes on canary.

    Core Changes

    • Only filter next config if experimental flag is enabled (#88733)

    Credits

    Huge thanks to @ mischnic for helping!

  • 16.1.3 - 2026-01-16

    Note

    This release is backporting bug fixes. It does not include all pending features/changes on canary.

    Core Changes

    • Fix linked list bug in LRU deleteFromLru (#88652)
    • Fix relative same host redirects in node middleware (#88253)

    Credits

    Huge thanks to @ acdlite and @ ijjk for helping!

  • 16.1.2 - 2026-01-14

    Note

    This release is backporting bug fixes. It does not include all pending features/changes on canary.

    Core Changes

    • Turbopack: Update to swc_core v50.2.3 (#87841) (#88296)
      • Fixes a crash when processing mdx files with multibyte characters. (#87713)
    • Turbopack: mimalloc upgrade and enabling it on musl (#88503) (#87815) (#88426)
      • Fixes a significant performance issue on musl-based Linux distributions (e.g. Alpine in Docker) related to musl's allocator.
      • Other platforms have always used mimalloc, but we previously did not use mimalloc on musl because of compilation issues that have since been resolved.

    Credits

    Huge thanks to @ mischnic for helping!

  • 16.1.1 - 2025-12-22
  • 16.1.1-canary.36 - 2026-01-20
  • 16.1.1-canary.35 - 2026-01-20
  • 16.1.1-canary.34 - 2026-01-19

    Core Changes

    • Add negation pattern support to --debug-build-paths: #88654
    • Only filter next config if experimental flag is enabled: #88733
    • [Devtool Indicator] Fix cross alignment: #88664
    • Turbopack: don't use build id for pages router client-side manifests: #88641
    • Allow inspecting server with next start --inspect: #88744
    • Turbopack: Add --debug-build-paths support to filter routes: #88655
    • Upgrade React from bef88f7c-20260116 to 41b3e9a6-20260119: #88756
    • Use rewritten pathname for implicit cache tags: #88732

    Misc Changes

    • [ci] Enable Turborepo remote caching in e2e release deploy tests: #88746
    • [test] Deflake test/development/app-dir/browser-log-forwarding/fixtures/verbose-level/verbose-level.test.ts: #88754
    • Fix Build Commands section in AGENTS.md: #88757
    • [test] Deflake test/development/app-dir/hydration-error-count/hydration-error-count.test.ts: #88749
    • [ci] Exclude test/production from deploy tests: #88763
    • Apply buildArgs also for deploy tests (via package.json): #88731

    Credits

    Huge thanks to @ unstubbable, @ mischnic, @ williambout, and @ eps1lon for helping!

  • 16.1.1-canary.33 - 2026-01-19

    Misc Changes

    • Revert "[turbopack] Add bundling support for worker_threads": #88725

    Credits

    Huge thanks to @ sokra for helping!

  • 16.1.1-canary.32 - 2026-01-17

    Core Changes

    • fix: setImmediate[util.promisify.custom] access fails in edge runtime: #88685
    • Fix --debug-build-paths bracket escaping for glob patterns: #88660

    Misc Changes

    • [turbopack] Add bundling support for worker_threads: #87746
    • [cna] Ensure created app is not considered the workspace root in pnpm: #88647

    Credits

    Huge thanks to @ lukesandberg, @ eps1lon, @ lubieowoce, and @ unstubbable for helping!

  • 16.1.1-canary.31 - 2026-01-16

    Core Changes

    • Upgrade React from 4a3d993e-20260114 to bef88f7c-20260116: #88649
    • fix: make RedirectType constant properties literal types: #88653
    • Turbopack: add support for matching loaders on resource queries: #88644
    • fix: capture promisified setImmediate separately: #88346

    Misc Changes

    • Turbopack: use bugs.nextjs.org for Turbopack panic error reports: #88356
    • Turbopack: docs: condition.query will ship in 16.2.0, not 16.1.1: #88663

    Credits

    Huge thanks to @ naaa760, @ sokra, @ wbinnssmith, @ jgeschwendt, and @ bgw for helping!

  • 16.1.1-canary.30 - 2026-01-16

    Core Changes

    • Fix incorrect 'Ready in' time for next start: #88589
    • feat: server action logging: #88277
    • Log browser error and warnings in terminal: #88352

    Misc Changes

    • Turbopack: avoid removing cells for erroring tasks: #88305
    • [ci] Use native concurrency feature in build-and-test: #87287
    • doc: add details of mcp client integration: #88543
    • Turbopack: unflake unit test: #88620
    • Turbopack: snapshot the ModuleGraph to avoid (eventual) inconsistent graphs: #88340
    • Turbopack: Consistency for compute_async_module_info: #88409
    • Turbopack: follow tracing spans through aggregation update queue: #88410
    • Turbopack: avoid chunk_item_id task and use selective cell access instead: #88411
    • Turbopack: MappedReadRef should be Send and Sync: #88558
    • Turbopack: selective read for module_chunk_groups in ChunkGroupInfo: #88559
    • Turbopack: use selective reads for merged modules: #88560
    • Turbopack: add caching to chunking: #88561

    Credits

    Huge thanks to @ sokra, @ eps1lon, @ timneutkens, and @ huozhi for helping!

  • 16.1.1-canary.29 - 2026-01-15

    Core Changes

    • fetch(next/image): reduce maximumResponseBody from 300MB to 50MB: #88588
    • [CC] Fix dev validation error from server action bound args: #88600

    Misc Changes

    • feat: add TaskStorage derive macro and schema infrastructure: #88338
    • docs: fix Pages Router fonts documentation showing App Router examples: #88326
    • [ci] Don't retry/notify for failed deploy tests with custom tarball URLs: #88576
    • fix(turbopack): Collect declare global {} in VarDeclWithTsDeclareCollector: #88568
    • Update labeler.json: #88591
    • Fix optional parent_task_id compile failure w/tokio_tracing enabled: #88598
    • Turbopack: support disabling tsconfig lookup: #88529
    • Turbopack: run tasks with priority based on distance to leaf: #87662

    Credits

    Huge thanks to @ lukesandberg, @ timneutkens, @ unstubbable, @ kdy1, @ mischnic, @ mmastrac, @ sokra, @ styfle, and @ lubieowoce for helping!

  • 16.1.1-canary.28 - 2026-01-14

    Core Changes

    • Turbopack: more dead code: #88505
    • fix(build): prevent route handler manifests from inheriting unrelated client components: #88419
    • Upgrade React from 65eec428-20251218 to 3e1abcc8-20260113: #88530
    • Better typesafety for interopDefault: #88486
    • keep next-env.d.s unchanged between dev and build: #88428
    • Remove sibling caches from CacheNode tree: #87991
    • Upgrade React from 3e1abcc8-20260113 to 4a3d993e-20260114: #88547
    • Finish deleting Mutable from router implementation: #88046

    Misc Changes

    • Remove lerna bootstrap from the clean script in package.json: #88527
    • docs: add useSearchParams and useParams documentation for Pages Router: #88429
    • Turbopack: Clean up VcRead::Repr associated type: #88456
    • [cna] Avoid error with out-of-box Netlify config: #88546
    • [turbopack] Move some of the logic for issue filtering into the rust layer: #88511
    • Update Rspack production test manifest: #88469
    • Update Rspack development test manifest: #88470

    Credits

    Huge thanks to @ mischnic, @ timneutkens, @ unstubbable, @ huozhi, @ acdlite, @ bgw, @ karlhorky, @ lukesandberg, and @ vercel-release-bot for helping!

  • 16.1.1-canary.27 - 2026-01-14
  • 16.1.1-canary.26 - 2026-01-14
  • 16.1.1-canary.25 - 2026-01-13
  • 16.1.1-canary.24 - 2026-01-13
  • 16.1.1-canary.23 - 2026-01-12
  • 16.1.1-canary.22 - 2026-01-12
  • 16.1.1-canary.21 - 2026-01-11
  • 16.1.1-canary.20 - 2026-01-09
  • 16.1.1-canary.19 - 2026-01-08
  • 16.1.1-canary.18 - 2026-01-08
  • 16.1.1-canary.17 - 2026-01-07
  • 16.1.1-canary.16 - 2026-01-07
  • 16.1.1-canary.15 - 2026-01-06
  • 16.1.1-canary.14 - 2026-01-06
  • 16.1.1-canary.13 - 2026-01-05
  • 16.1.1-canary.12 - 2026-01-04
  • 16.1.1-canary.11 - 2026-01-03
  • 16.1.1-canary.10 - 2025-12-30
  • 16.1.1-canary.9 - 2025-12-29
  • 16.1.1-canary.8 - 2025-12-28
  • 16.1.1-canary.7 - 2025-12-28
  • 16.1.1-canary.6 - 2025-12-26
  • 16.1.1-canary.5 - 2025-12-23
  • 16.1.1-canary.4 - 2025-12-22
  • 16.1.1-canary.3 - 2025-12-22
  • 16.1.1-canary.2 - 2025-12-20
  • 16.1.1-canary.1 - 2025-12-19
  • 16.1.1-canary.0 - 2025-12-18
  • 16.1.0 - 2025-12-18
  • 16.1.0-canary.34 - 2025-12-18
  • 16.1.0-canary.33 - 2025-12-18
  • 16.1.0-canary.32 - 2025-12-17
  • 16.1.0-canary.31 - 2025-12-17
  • 16.1.0-canary.30 - 2025-12-16
  • 16.1.0-canary.29 - 2025-12-16
  • 16.1.0-canary.28 - 2025-12-16
  • 16.1.0-canary.27 - 2025-12-15
  • 16.1.0-canary.26 - 2025-12-15
  • 16.1.0-canary.25 - 2025-12-15
  • 16.1.0-canary.24 - 2025-12-15
  • 16.1.0-canary.22 - 2025-12-15
  • 16.1.0-canary.21 - 2025-12-14
  • 16.1.0-canary.20 - 2025-12-12
  • 16.1.0-canary.19 - 2025-12-11
  • 16.1.0-canary.18 - 2025-12-11
  • 16.1.0-canary.17 - 2025-12-11
  • 16.1.0-canary.16 - 2025-12-08
  • 16.1.0-canary.15 - 2025-12-05
  • 16.1.0-canary.14 - 2025-12-04
  • 16.1.0-canary.13 - 2025-12-03
  • 16.1.0-canary.12 - 2025-12-03
  • 16.1.0-canary.11 - 2025-12-02
  • 16.1.0-canary.10 - 2025-12-01
  • 16.1.0-canary.9 - 2025-11-30
  • 16.1.0-canary.4 - 2025-11-26
  • 16.1.0-canary.3 - 2025-11-26
  • 16.1.0-canary.2 - 2025-11-25
  • 16.1.0-canary.1 - 2025-11-24
  • 16.1.0-canary.0 - 2025-11-24
  • 16.0.11 - 2026-01-26
  • 16.0.10 - 2025-12-11
  • 16.0.9 - 2025-12-11
  • 16.0.8 - 2025-12-08
  • 16.0.7 - 2025-12-03
  • 16.0.6 - 2025-11-30
  • 16.0.5 - 2025-11-26
  • 16.0.4 - 2025-11-24
  • 16.0.3 - 2025-11-13
  • 16.0.2 - 2025-11-12
  • 16.0.2-canary.34 - 2025-11-24
  • 16.0.2-canary.33 - 2025-11-23
  • 16.0.2-canary.32 - 2025-11-22
  • 16.0.2-canary.31 - 2025-11-22
  • 16.0.2-canary.30 - 2025-11-21
  • 16.0.2-canary.29 - 2025-11-21
  • 16.0.2-canary.27 - 2025-11-20
  • 16.0.2-canary.26 - 2025-11-19
  • 16.0.2-canary.25 - 2025-11-19
  • 16.0.2-canary.24 - 2025-11-18
  • 16.0.2-canary.23 - 2025-11-17
  • 16.0.2-canary.22 - 2025-11-17
  • 16.0.2-canary.21 - 2025-11-15
  • 16.0.2-canary.20 - 2025-11-15
  • 16.0.2-canary.19 - 2025-11-13
  • 16.0.2-canary.18 - 2025-11-13
  • 16.0.2-canary.17 - 2025-11-12
  • 16.0.2-canary.16 - 2025-11-11
  • 16.0.2-canary.15 - 2025-11-11
  • 16.0.2-canary.14 - 2025-11-10
  • 16.0.2-canary.13 - 2025-11-09
  • 16.0.2-canary.12 - 2025-11-08
  • 16.0.2-canary.11 - 2025-11-08
  • 16.0.2-canary.10 - 2025-11-07
  • 16.0.2-canary.9 - 2025-11-05
  • 16.0.2-canary.8 - 2025-11-05
  • 16.0.2-canary.7 - 2025-11-04
  • 16.0.2-canary.6 - 2025-11-03
  • 16.0.2-canary.5 - 2025-11-02
  • 16.0.2-canary.4 - 2025-11-01
  • 16.0.2-canary.3 - 2025-10-31
  • 16.0.2-canary.2 - 2025-10-30
  • 16.0.2-canary.1 - 2025-10-29
  • 16.0.2-canary.0 - 2025-10-28
  • 16.0.1 - 2025-10-28
  • 16.0.1-canary.6 - 2025-10-28
  • 16.0.1-canary.5 - 2025-10-27
  • 16.0.1-canary.4 - 2025-10-27
  • 16.0.1-canary.3 - 2025-10-27
  • 16.0.1-canary.2 - 2025-10-24
  • 16.0.1-canary.1 - 2025-10-23
  • 16.0.1-canary.0 - 2025-10-22
  • 16.0.0 - 2025-10-22
  • 16.0.0-canary.19 - 2025-10-21
  • 16.0.0-canary.18 - 2025-10-21
  • 16.0.0-canary.17 - 2025-10-21
  • 16.0.0-canary.16 - 2025-10-20
  • 16.0.0-canary.15 - 2025-10-19
  • 16.0.0-canary.14 - 2025-10-19
  • 16.0.0-canary.13 - 2025-10-18
  • 16.0.0-canary.12 - 2025-10-18
  • 16.0.0-canary.11 - 2025-10-17
  • 16.0.0-canary.10 - 2025-10-17
  • 16.0.0-canary.9 - 2025-10-16
  • 16.0.0-canary.8 - 2025-10-16
  • 16.0.0-canary.7 - 2025-10-15
  • 16.0.0-canary.6 - 2025-10-15
  • 16.0.0-canary.5 - 2025-10-14
  • 16.0.0-canary.4 - 2025-10-13
  • 16.0.0-canary.3 - 2025-10-12
  • 16.0.0-canary.2 - 2025-10-11
  • 16.0.0-canary.1 - 2025-10-10
  • 16.0.0-canary.0 - 2025-10-10
  • 16.0.0-beta.0 - 2025-10-10
  • 15.6.0-canary.61 - 2026-01-26
  • 15.6.0-canary.60 - 2025-12-11
  • 15.6.0-canary.59 - 2025-12-11
  • 15.6.0-canary.58 - 2025-12-04
  • 15.6.0-canary.57 - 2025-10-10
  • 15.6.0-canary.56 - 2025-10-09
  • 15.6.0-canary.55 - 2025-10-09
  • 15.6.0-canary.54 - 2025-10-09
  • 15.6.0-canary.53 - 2025-10-08
  • 15.6.0-canary.52 - 2025-10-07
  • 15.6.0-canary.51 - 2025-10-07
  • 15.6.0-canary.50 - 2025-10-07
  • 15.6.0-canary.49 - 2025-10-07
  • 15.6.0-canary.48 - 2025-10-07
  • 15.6.0-canary.47 - 2025-10-06
  • 15.6.0-canary.46 - 2025-10-06
  • 15.6.0-canary.45 - 2025-10-05
  • 15.6.0-canary.44 - 2025-10-05
  • 15.6.0-canary.43 - 2025-10-04
  • 15.6.0-canary.42 - 2025-10-03
  • 15.6.0-canary.41 - 2025-10-03
  • 15.6.0-canary.40 - 2025-10-02
  • 15.6.0-canary.39 - 2025-10-01
  • 15.6.0-canary.38 - 2025-09-30
  • 15.6.0-canary.37 - 2025-09-30
  • 15.6.0-canary.36 - 2025-09-30
  • 15.6.0-canary.35 - 2025-09-29
  • 15.6.0-canary.34 - 2025-09-29
  • 15.6.0-canary.33 - 2025-09-28
  • 15.6.0-canary.32 - 2025-09-26
  • 15.6.0-canary.31 - 2025-09-25
  • 15.6.0-canary.30 - 2025-09-25
  • 15.6.0-canary.29 - 2025-09-25
  • 15.6.0-canary.28 - 2025-09-24
  • 15.6.0-canary.27 - 2025-09-24
  • 15.6.0-canary.26 - 2025-09-24
  • 15.6.0-canary.25 - 2025-09-23
  • 15.6.0-canary.24 - 2025-09-23
  • 15.6.0-canary.23 - 2025-09-23
  • 15.6.0-canary.22 - 2025-09-23
  • 15.6.0-canary.21 - 2025-09-22
  • 15.6.0-canary.20 - 2025-09-20
  • 15.6.0-canary.19 - 2025-09-19
  • 15.6.0-canary.18 - 2025-09-19
  • 15.6.0-canary.17 - 2025-09-19
  • 15.6.0-canary.16 - 2025-09-18
  • 15.6.0-canary.15 - 2025-09-18
  • 15.6.0-canary.14 - 2025-09-18
  • 15.6.0-canary.13 - 2025-09-18
  • 15.6.0-canary.12 - 2025-09-17
  • 15.6.0-canary.11 - 2025-09-17
  • 15.6.0-canary.10 - 2025-09-16
  • 15.6.0-canary.9 - 2025-09-16
  • 15.6.0-canary.8 - 2025-09-15
  • 15.6.0-canary.7 - 2025-09-15
  • 15.6.0-canary.6 - 2025-09-13
  • 15.6.0-canary.5 - 2025-09-12
  • 15.6.0-canary.4 - 2025-09-12
  • 15.6.0-canary.3 - 2025-09-12
  • 15.6.0-canary.2 - 2025-09-11
  • 15.6.0-canary.1 - 2025-09-11
  • 15.6.0-canary.0 - 2025-09-11
  • 15.5.12 - 2026-02-04
  • 15.5.11 - 2026-01-28
  • 15.5.10 - 2026-01-26
  • 15.5.9 - 2025-12-11
  • 15.5.8 - 2025-12-11
  • 15.5.7 - 2025-12-03
  • 15.5.6 - 2025-10-17
  • 15.5.5 - 2025-10-13
  • 15.5.4 - 2025-09-23
  • 15.5.3 - 2025-09-10
  • 15.5.2 - 2025-08-26
  • 15.5.1 - 2025-08-26
  • 15.5.1-canary.39 - 2025-09-10
  • 15.5.1-canary.38 - 2025-09-10
  • 15.5.1-canary.37 - 2025-09-09
  • 15.5.1-canary.36 - 2025-09-09
  • 15.5.1-canary.35 - 2025-09-08
  • 15.5.1-canary.34 - 2025-09-08
  • 15.5.1-canary.33 - 2025-09-08
  • 15.5.1-canary.32 - 2025-09-07
  • 15.5.1-canary.31 - 2025-09-06
  • 15.5.1-canary.30 - 2025-09-05
  • 15.5.1-canary.29 - 2025-09-05
  • 15.5.1-canary.28 - 2025-09-04
  • 15.5.1-canary.27 - 2025-09-04
  • 15.5.1-canary.26 - 2025-09-04
  • 15.5.1-canary.25 - 2025-09-03
  • 15.5.1-canary.24 - 2025-09-02
  • 15.5.1-canary.23 - 2025-09-01
  • 15.5.1-canary.22 - 2025-08-31
  • 15.5.1-canary.21 - 2025-08-30
  • 15.5.1-canary.20 - 2025-08-29
  • 15.5.1-canary.19 - 2025-08-29
  • 15.5.1-canary.18 - 2025-08-29
  • 15.5.1-canary.17 - 2025-08-28
  • 15.5.1-canary.16 - 2025-08-28
  • 15.5.1-canary.15 - 2025-08-28
  • 15.5.1-canary.14 - 2025-08-27
  • 15.5.1-canary.13 - 2025-08-27
  • 15.5.1-canary.12 - 2025-08-27
  • 15.5.1-canary.11 - 2025-08-26
  • 15.5.1-canary.10 - 2025-08-26
  • 15.5.1-canary.9 - 2025-08-26
  • 15.5.1-canary.8 - 2025-08-25
  • 15.5.1-canary.7 - 2025-08-24
  • 15.5.1-canary.6 - 2025-08-23
  • ...

Snyk has created this PR to upgrade next from 15.2.4 to 16.1.4.

See this package in npm:
next

See this project in Snyk:
https://app.snyk.io/org/pinkycollie/project/19394bc5-5ee2-4bfe-8a0b-7dfa3f7b57e0?utm_source=github&utm_medium=referral&page=upgrade-pr
@pinkycollie

Copy link
Copy Markdown
Owner Author

Merge Risk: High

This is a major version upgrade from Next.js 15 to 16, which introduces significant breaking changes, new defaults, and requires developer action to migrate.

Key Breaking Changes:

  • Node.js Version Requirement: The minimum required Node.js version has been increased to 20.9.0. Projects running on Node.js 18 or older will need to upgrade their environment. [4]
  • Turbopack is Now the Default Bundler: Turbopack is the default bundler for both development and production builds (next dev, next build). [3, 4, 9] If your project has a custom webpack.config.js, your build will fail. [9]
    • Action Required: You must either migrate your configuration to be compatible with Turbopack or explicitly opt-out by using the --webpack flag (e.g., next build --webpack). [9]
  • API and Behavior Changes:
    • Parallel Routes: All parallel routes now require an explicit default.js file to be defined for each slot. Builds will fail if this file is missing. [4, 5]
    • next/image Defaults Changed: Several defaults for image optimization have been modified, including minimumCacheTTL (increased to 4 hours) and imageSizes (16px size removed). [5, 9]
    • Middleware Renamed to Proxy: The middleware.ts file is now deprecated and should be renamed to proxy.ts. [3, 9]
  • Removed Features:
    • Support for AMP has been completely removed. [9]
    • The next lint command has been removed in favor of using the ESLint CLI directly. [9]

Recommendation: This upgrade requires careful planning. Use the official codemod to automate parts of the migration, such as renaming middleware files and updating your configuration.

npx @next/codemod@canary upgrade latest

Thoroughly review the official upgrade guide to address all breaking changes, especially the new Node.js requirement and the switch to Turbopack. [9]

Source: Official Next.js 16 Upgrade Guide [9]

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants