[dependabot]

Bumps the javascript-minor-and-patch group with 5 updates in the / directory:

Package	From	To
next	16.3.6	16.4.3
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
@types/node	26.6.3	26.6.5
eslint-config-next	16.3.6	16.4.3

Updates next from 16.3.6 to 16.4.3

Release notes

Sourced from next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• v16.4.2
• [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
• [lts-active] test: Pin react-virtualized (#100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
• [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

v16.4.2

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @​lukesandberg in vercel/next.js#100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @​sokra in vercel/next.js#100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in vercel/next.js#100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in vercel/next.js#100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in vercel/next.js#100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in vercel/next.js#100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in vercel/next.js#100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682

... (truncated)

Commits

• 29bbeab v16.4.3
• 5117201 [lts-active] Avoid loading standalone React in server bootstrap (#100610)
• 37d603b [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #1...
• cf9d27d [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (...
• 3f6a632 [lts-active] test: Pin react-virtualized (#100545)
• f715bba [lts-active][cd] Gate release bot credentials behind GitHub environments (#10...
• c864c78 [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• f3ff943 [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• f697cf5 [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• 2864b17 v16.4.2
• Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates @types/node from 26.6.3 to 26.6.5

Commits

• See full diff in compare view

Updates eslint-config-next from 16.3.6 to 16.4.3

Release notes

Sourced from eslint-config-next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• v16.4.2
• [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
• [lts-active] test: Pin react-virtualized (#100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
• [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

v16.4.2

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @​lukesandberg in vercel/next.js#100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @​sokra in vercel/next.js#100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in vercel/next.js#100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in vercel/next.js#100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in vercel/next.js#100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in vercel/next.js#100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in vercel/next.js#100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682

... (truncated)

Commits

• 29bbeab v16.4.3
• 2864b17 v16.4.2
• 7217011 v16.4.1
• e273d5b v16.4.0
• c3e76ad v16.4.0-canary.63
• ccf8c15 v16.4.0-canary.62
• 27ee721 v16.4.0-canary.61
• 907721a eslint-config-next: support ESLint 10 (#99628)
• cdf6866 v16.4.0-canary.60
• ba80ee4 v16.4.0-canary.59
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: rheos/rheostream
• Branch: main
• File: .coderabbit.yaml
• Commit: c54a2e7
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: aff2918c-6fc4-47bb-845c-c860fb92f8ec

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[rheos]

Approving on evidence. Not merging in this pass: a bureau run is in flight on main.

• The coupled pairs move together, so nothing gets split. next and eslint-config-next both go 16.3.6 to 16.4.3, and react and react-dom both go 19.3.0 to 19.3.1. @types/node is a patch bump. The only extra transitive move is @typescript-eslint/parser 8.71.0 to 8.72.1, pulled in by eslint-config-next.
• What Web checks proved (run 40463527447): a frozen pnpm install, reproducible codegen, pnpm -r lint, pnpm -r typecheck, a next build of apps/web, and Vitest in both path and subdomain mode. Container image builds is green as well, and that is the image the flagship deploys.
• The base is current. c54a2e7 already includes #487 (the happy-dom and vitest config change). The only later merge is #491, which touches forms.tsx and one test file and no manifests.
• Not proven: the running flagship container's behaviour on Next 16.4. Once this merges, check the deploy-flagship run and the booted container's next version.