Skip to content

build(deps): bump next from 14.2.0 to 16.2.12 - #138

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/next-16.2.12
Closed

build(deps): bump next from 14.2.0 to 16.2.12#138
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/next-16.2.12

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps next from 14.2.0 to 16.2.12.

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Moderate:

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Backport documentation fixes for v16.2 (#93804)
  • [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
  • [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
  • [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
  • [backport] Encode non-ASCII characters in cache tags at construction (#93918)
  • [backport] Fix server action forwarding loop with middleware rewrites (#93919)
  • [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
  • [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

... (truncated)

Commits
  • 2234717 v16.2.12
  • 957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
  • b56eb16 Backport/docs fixes 16.2 - July round (#96031)
  • 9beca08 v16.2.11
  • 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
  • ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
  • 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
  • b512063 [16.x] Set correct origin for internal redirects in custom server
  • d303326 [16.x] Ensure exotic rewrite param values are properly encoded
  • 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump next from 14.2.0 to 16.2.12
527d3d2 
Bumps [next](https://github.com/vercel/next.js) from 14.2.0 to 16.2.12.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v14.2.0...v16.2.12)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.2.12
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@dependabot
dependabot Bot requested a review from ribato22 as a code owner July 27, 2026 08:36
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@ribato22

ribato22 commented Jul 27, 2026

Copy link
Copy Markdown
Owner

Held (not merged): Next.js 14 → 16 is a two-major framework migration, not a drop-in bump — Next 15+ requires React 19 (this repo pins react ^18.3.0, and the React 19 PRs #118/#119 are held for exactly this reason), plus Next 15 changed caching semantics and made request APIs async. A green CI build alone isn't sufficient warrant for jumping two majors of the framework that serves the production admin dashboard. This should be done as a deliberate, tested Next 15 → 16 migration together with React 19. Adding an ignore rule for the major so it stops re-opening.

@ribato22 ribato22 closed this Jul 27, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/next-16.2.12 branch July 27, 2026 08:46
@ribato22 ribato22 mentioned this pull request Jul 27, 2026
Merged
ribato22 added a commit that referenced this pull request Jul 27, 2026
@ribato22
chore(deps): align vitest across the workspace + ignore migration-gat…
1fffc95 
…ed majors (#140)

Closes out the second Dependabot triage wave.

## 1. Align `vitest` across the workspace
`packages/sdk` pinned `vitest ^1.2.2` while `apps/api` and `apps/worker`
were on `^2.0.0`. **That split is itself a PR generator** — it's why
Dependabot kept proposing a separate sdk-only bump (#134, `1.6.1 →
4.1.10`) that could never merge cleanly and would have left the
workspace split three ways.

Aligning sdk to `^2.0.0` means one vitest major governs everything (and
matches the `^2` pin on `@vitest/coverage-v8`). Drops **249 lines** of
duplicate vitest-1 tree from the lockfile; sdk tests stay green (17/17).

## 2. Three more `ignore` rules for migration-gated majors
| dep | why it can't be a drop-in bump |
|-----|-------------------------------|
| `next` | Next 15+ **requires React 19**, which is already ignored for
the same reason — the admin crosses both majors together or not at all
(#138 closed) |
| `vitest` | must move in lockstep with `@vitest/coverage-v8` **and**
every workspace package → one deliberate PR, never per-package (#134
closed) |
| `n8n-workflow` | 2.x is a new n8n node-API major; the published
`n8n-nodes-multiwa` must be reconciled against it and re-published (#137
closed) |

## Verification
- All 5 workspace packages build ✓ · `api`/`worker`/`admin` typecheck ✓
- **api 324/324** · **worker 34/34** · **sdk 17/17** ✓
- Lockfile still **air-gap safe** (0 `ssh://` refs)
- `dependabot.yml` parses; 13 migration-gated majors now ignored

## This wave's triage
**Merged (4):** #135 `@fastify/multipart` 10 · #136 `@types/nodemailer`
8 (aligned all 3 packages) · **#139 `@fastify/static` 10.1.2 — SECURITY
FIX** · this PR
**Closed with reasons (3):** #134 vitest (workspace split) · #137
n8n-workflow 2.x · #138 next 14→16

> ⚠️ **#139 was a real vulnerability:** `@fastify/static@8.3.0` was
affected by
[GHSA-8pvw-jcv7-9cmj](GHSA-8pvw-jcv7-9cmj)
— *Authorization Bypass via Non-Canonical URL Paths* (MODERATE, affects
`<= 10.1.1`). First patched version is exactly `10.1.2`, so the major
bump was the only remedy. Now on `10.1.2`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ribato22 ribato22 Awaiting requested review from ribato22 ribato22 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ribato22