chore(deps-dev): bump eslint-config-next from 15.5.15 to 16.2.6

[dependabot]

Bumps eslint-config-next from 15.5.15 to 16.2.6.

Release notes

Sourced from eslint-config-next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

• fix: preserve HTTP access fallbacks during prerender recovery (#92231)
• Fix fallback route params case in app-page handler (#91737)
• Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
• Patch setHeader for direct route handlers (#93101)
• Include deployment id in cacheHandlers keys (#93453)
• Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

... (truncated)

Commits

• ee6e79b v16.2.6
• 766148f v16.2.5
• 2275bd8 v16.2.4
• d5f649b v16.2.3
• 52faae3 v16.2.2
• ed7d2ce v16.2.1
• c5c94df v16.2.0
• 3683192 v16.2.0-canary.104
• 6689814 v16.2.0-canary.103
• ad66dbc v16.2.0-canary.102
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-config-next since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
thoughtbox-web-two	Ready	Preview, Comment	May 16, 2026 5:09am

[greptile-apps]

Greptile Summary

This Dependabot PR bumps eslint-config-next from 15.5.15 to 16.2.4 — a major version jump — while leaving the next runtime on ^15.2.0. The two packages are released in lockstep by the Next.js team and are intended to share the same major version; running the v16 ESLint plugin against a v15 project can yield incorrect lint results.

• P1: eslint-config-next@16.2.4 should not be used with next@15.x; the bundled @next/eslint-plugin-next@16.2.4 rules may enforce Next.js 16 conventions and produce false positives or miss valid warnings on a Next.js 15 codebase. Either pin eslint-config-next back to ^15.2.0 or simultaneously bump next to ^16.x.

Confidence Score: 3/5

Not safe to merge as-is due to a major version mismatch between eslint-config-next and next

A single P1 finding (cross-major package mismatch) that directly affects linting correctness; no P0 issues present

apps/web/package.json — eslint-config-next major version needs to align with the next major version

Important Files Changed

Filename	Overview
apps/web/package.json	Bumps eslint-config-next to ^16.2.4 while next stays on ^15.2.0, creating a cross-major peer mismatch
pnpm-lock.yaml	Lockfile updated consistently; confirms next@15.5.15 vs eslint-config-next@16.2.4 and adds @babel/core@7.29.0 as a transitive dep for next

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["next lint / CI"] --> B["eslint-config-next@16.2.4\n(@next/eslint-plugin-next@16.2.4)"]
    A --> C["next@15.5.15 runtime"]
    B -- "enforces Next.js 16 rules" --> D{{"Version mismatch ⚠️"}}
    C -- "Next.js 15 project" --> D
    D --> E["Potential false positives\nor missed warnings"]

Loading

Prompt To Fix All With AI

This is a comment left during a code review.
Path: apps/web/package.json
Line: 36

Comment:
**Major version mismatch between `eslint-config-next` and `next`**

`eslint-config-next` is being bumped to `16.2.4` while `next` remains at `^15.2.0` (resolved to `15.5.15` in the lockfile). Historically these packages are versioned and released together; the ESLint plugin rules bundled in `@next/eslint-plugin-next@16.2.4` may enforce or assume Next.js 16 project conventions (e.g. new App Router APIs, metadata, middleware shapes), which can produce false positives or suppress valid warnings on a Next.js 15 project. The recommended practice is to keep `eslint-config-next` on the same major as `next`.

```suggestion
"eslint-config-next": "^15.2.0",
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "chore(deps-dev): bump eslint-config-next..." | Re-trigger Greptile}

[greptile-apps]

Major version mismatch between eslint-config-next and next

eslint-config-next is being bumped to 16.2.4 while next remains at ^15.2.0 (resolved to 15.5.15 in the lockfile). Historically these packages are versioned and released together; the ESLint plugin rules bundled in @next/eslint-plugin-next@16.2.4 may enforce or assume Next.js 16 project conventions (e.g. new App Router APIs, metadata, middleware shapes), which can produce false positives or suppress valid warnings on a Next.js 15 project. The recommended practice is to keep eslint-config-next on the same major as next.

Suggested change

	"eslint-config-next": "^16.2.4",
	"eslint-config-next": "^15.2.0",

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/web/package.json
Line: 36

Comment:
**Major version mismatch between `eslint-config-next` and `next`**

`eslint-config-next` is being bumped to `16.2.4` while `next` remains at `^15.2.0` (resolved to `15.5.15` in the lockfile). Historically these packages are versioned and released together; the ESLint plugin rules bundled in `@next/eslint-plugin-next@16.2.4` may enforce or assume Next.js 16 project conventions (e.g. new App Router APIs, metadata, middleware shapes), which can produce false positives or suppress valid warnings on a Next.js 15 project. The recommended practice is to keep `eslint-config-next` on the same major as `next`.

```suggestion
"eslint-config-next": "^15.2.0",
```

How can I resolve this? If you propose a fix, please make it concise.