chore(deps): bump the npm_and_yarn group across 3 directories with 1 update#1821
Conversation
…update Bumps the npm_and_yarn group with 1 update in the /packages/sdk/react/contract-tests directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/sdk/vercel/examples/complete directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/sdk/vercel/examples/route-handler directory: [next](https://github.com/vercel/next.js). Updates `next` from 16.2.6 to 16.2.11 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.6...v16.2.11) Updates `next` from 15.5.18 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.6...v16.2.11) Updates `next` from 15.5.18 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.6...v16.2.11) --- updated-dependencies: - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
@launchdarkly/js-sdk-common size report |
|
@launchdarkly/js-client-sdk size report |
|
@launchdarkly/browser size report |
|
@launchdarkly/js-client-sdk-common size report |
|
NOTE: we need to wait until next week to merge this in as the |
1 participant
Bumps the npm_and_yarn group with 1 update in the /packages/sdk/react/contract-tests directory: next.
Bumps the npm_and_yarn group with 1 update in the /packages/sdk/vercel/examples/complete directory: next.
Bumps the npm_and_yarn group with 1 update in the /packages/sdk/vercel/examples/route-handler directory: next.
Updates
nextfrom 16.2.6 to 16.2.11Release notes
Sourced from next's releases.
Commits
9beca08v16.2.113c48c7a[16.x] Fix Turbopack middleware matcher with i18n single localeac1eff3[16.x] Improve performance of checking valid MPA form submissions9a4651e[16.x] EnforceserverActions.bodySizeLimitfor Server Actions in Edge runtimeb512063[16.x] Set correct origin for internal redirects in custom serverd303326[16.x] Ensure exotic rewrite param values are properly encoded73b9487[16.x] fix(fetch-cache): key fetch(Request, init) by the effective requestbf9d17f[16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodiesfe28768[16.x] fix(next/image): improve performance of detectContentType()d8afb8d[16.x] Performance improvements when decoding React Server function payloadsUpdates
nextfrom 15.5.18 to 15.5.21Release notes
Sourced from next's releases.
Commits
9beca08v16.2.113c48c7a[16.x] Fix Turbopack middleware matcher with i18n single localeac1eff3[16.x] Improve performance of checking valid MPA form submissions9a4651e[16.x] EnforceserverActions.bodySizeLimitfor Server Actions in Edge runtimeb512063[16.x] Set correct origin for internal redirects in custom serverd303326[16.x] Ensure exotic rewrite param values are properly encoded73b9487[16.x] fix(fetch-cache): key fetch(Request, init) by the effective requestbf9d17f[16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodiesfe28768[16.x] fix(next/image): improve performance of detectContentType()d8afb8d[16.x] Performance improvements when decoding React Server function payloadsUpdates
nextfrom 15.5.18 to 15.5.21Release notes
Sourced from next's releases.
Commits
9beca08v16.2.113c48c7a[16.x] Fix Turbopack middleware matcher with i18n single localeac1eff3[16.x] Improve performance of checking valid MPA form submissions9a4651e[16.x] EnforceserverActions.bodySizeLimitfor Server Actions in Edge runtimeb512063[16.x] Set correct origin for internal redirects in custom serverd303326[16.x] Ensure exotic rewrite param values are properly encoded73b9487[16.x] fix(fetch-cache): key fetch(Request, init) by the effective requestbf9d17f[16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodiesfe28768[16.x] fix(next/image): improve performance of detectContentType()d8afb8d[16.x] Performance improvements when decoding React Server function payloadsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Scope is limited to example and contract-test
package.jsonpins; no library or runtime code changes, though upgrading Next.js always warrants a quick smoke of those apps if CI does not cover them fully.Overview
Bumps the
nextdependency in three non-production packages: React SDK contract tests (16.2.6 → 16.2.11) and both Vercel example apps (15.5.18 → 15.5.21). No application or SDK source changes—onlypackage.jsonversion pins.These releases include security fixes (e.g. Server Actions DoS/SSRF, middleware bypass, rewrite SSRF, cache confusion, image optimization DoS). Reviewers should treat this as a routine Dependabot security bump for example/test harnesses, not a behavioral change to published SDKs.
Reviewed by Cursor Bugbot for commit 8a95935. Bugbot is set up for automated code reviews on this repo. Configure here.