chore: bump the npm_and_yarn group across 2 directories with 1 update by dependabot[bot] · Pull Request #575 · kdlbs/kandev

dependabot · 2026-04-11T04:30:42Z

Bumps the npm_and_yarn group with 1 update in the /apps directory: next.
Bumps the npm_and_yarn group with 1 update in the /apps/web directory: next.

Updates next from 16.1.7 to 16.2.3

Release notes

Sourced from next's releases.

v16.2.3

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)

Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)

Deduplicate output assets and detect content conflicts on emit (#92292)

Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)

turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @icyJoseph, @sokra, @wbinnssmith, @eps1lon and @ztanner for helping!

v16.2.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

backport: Move expanded adapters docs to API reference (#92115) (#92129)

Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#92130)

[create-next-app] Skip interactive prompts when CLI flags are provided (#91840)

next.config.js: Accept an option for serverFastRefresh (#91968)

Turbopack: enable server HMR for app route handlers (#91466)

Turbopack: exclude metadata routes from server HMR (#92034)

Fix CI for glibc linux builds

Backport: disable bmi2 in qfilter #92177

[backport] Fix CSS HMR on Safari (#92174)

Credits

Huge thanks to @nextjs-bot, @icyJoseph, @ijjk, @gaojude, @wbinnssmith, @lukesandberg, and @bgw for helping!

v16.2.1

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

docs: post release amends (#91715)

docs: fix broken Activity Patterns demo link in preserving UI state guide (#91698)

Fix adapter outputs for dynamic metadata routes (#91680)

Turbopack: fix webpack loader runner layer (#91727)

Fix server actions in standalone mode with cacheComponents (#91711)

turbo-persistence: remove Unmergeable mmap advice (#91713)

Fix layout segment optimization: move app-page imports to server-utility transition (#91701)

Turbopack: lazy require metadata and handle TLA (#91705)

[turbopack] Respect {eval:true} in worker_threads constructors (#91666)

... (truncated)

Commits

d5f649b v16.2.3
2873928 [16.x] Avoid consuming cyclic models multiple times (#75)
d7c7765 [backport]: Ensure app-page reports stale ISR revalidation errors via onReque...
c573e8c fix(server-hmr): metadata routes overwrite page runtime HMR handler (#92273)
57b8f65 next-core: deduplicate output assets and detect content conflicts on emit (#9...
f158df1 Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
356d605 turbo-tasks-backend: stability fixes for task cancellation and error handling...
3b77a6e Fix DashMap read-write self-deadlock in task_cache causing hangs (#92210)
b2f208a Backport: new view-transitions guide, update and fixes (#92264)
52faae3 v16.2.2
Additional commits viewable in compare view

Updates next from 16.1.7 to 16.2.3

Release notes

Sourced from next's releases.

v16.2.3

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)

Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)

Deduplicate output assets and detect content conflicts on emit (#92292)

Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)

turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @icyJoseph, @sokra, @wbinnssmith, @eps1lon and @ztanner for helping!

v16.2.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

backport: Move expanded adapters docs to API reference (#92115) (#92129)

Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#92130)

[create-next-app] Skip interactive prompts when CLI flags are provided (#91840)

next.config.js: Accept an option for serverFastRefresh (#91968)

Turbopack: enable server HMR for app route handlers (#91466)

Turbopack: exclude metadata routes from server HMR (#92034)

Fix CI for glibc linux builds

Backport: disable bmi2 in qfilter #92177

[backport] Fix CSS HMR on Safari (#92174)

Credits

Huge thanks to @nextjs-bot, @icyJoseph, @ijjk, @gaojude, @wbinnssmith, @lukesandberg, and @bgw for helping!

v16.2.1

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

docs: post release amends (#91715)

docs: fix broken Activity Patterns demo link in preserving UI state guide (#91698)

Fix adapter outputs for dynamic metadata routes (#91680)

Turbopack: fix webpack loader runner layer (#91727)

Fix server actions in standalone mode with cacheComponents (#91711)

turbo-persistence: remove Unmergeable mmap advice (#91713)

Fix layout segment optimization: move app-page imports to server-utility transition (#91701)

Turbopack: lazy require metadata and handle TLA (#91705)

[turbopack] Respect {eval:true} in worker_threads constructors (#91666)

... (truncated)

Commits

d5f649b v16.2.3
2873928 [16.x] Avoid consuming cyclic models multiple times (#75)
d7c7765 [backport]: Ensure app-page reports stale ISR revalidation errors via onReque...
c573e8c fix(server-hmr): metadata routes overwrite page runtime HMR handler (#92273)
57b8f65 next-core: deduplicate output assets and detect content conflicts on emit (#9...
f158df1 Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
356d605 turbo-tasks-backend: stability fixes for task cancellation and error handling...
3b77a6e Fix DashMap read-write self-deadlock in task_cache causing hangs (#92210)
b2f208a Backport: new view-transitions guide, update and fixes (#92264)
52faae3 v16.2.2
Additional commits viewable in compare view

Updates next from 16.1.7 to 16.2.3

Release notes

Sourced from next's releases.

v16.2.3

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)

Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)

Deduplicate output assets and detect content conflicts on emit (#92292)

Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)

turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @icyJoseph, @sokra, @wbinnssmith, @eps1lon and @ztanner for helping!

v16.2.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

backport: Move expanded adapters docs to API reference (#92115) (#92129)

Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#92130)

[create-next-app] Skip interactive prompts when CLI flags are provided (#91840)

next.config.js: Accept an option for serverFastRefresh (#91968)

Turbopack: enable server HMR for app route handlers (#91466)

Turbopack: exclude metadata routes from server HMR (#92034)

Fix CI for glibc linux builds

Backport: disable bmi2 in qfilter #92177

[backport] Fix CSS HMR on Safari (#92174)

Credits

Huge thanks to @nextjs-bot, @icyJoseph, @ijjk, @gaojude, @wbinnssmith, @lukesandberg, and @bgw for helping!

v16.2.1

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

docs: post release amends (#91715)

docs: fix broken Activity Patterns demo link in preserving UI state guide (#91698)

Fix adapter outputs for dynamic metadata routes (#91680)

Turbopack: fix webpack loader runner layer (#91727)

Fix server actions in standalone mode with cacheComponents (#91711)

turbo-persistence: remove Unmergeable mmap advice (#91713)

Fix layout segment optimization: move app-page imports to server-utility transition (#91701)

Turbopack: lazy require metadata and handle TLA (#91705)

[turbopack] Respect {eval:true} in worker_threads constructors (#91666)

... (truncated)

Commits

d5f649b v16.2.3
2873928 [16.x] Avoid consuming cyclic models multiple times (#75)
d7c7765 [backport]: Ensure app-page reports stale ISR revalidation errors via onReque...
c573e8c fix(server-hmr): metadata routes overwrite page runtime HMR handler (#92273)
57b8f65 next-core: deduplicate output assets and detect content conflicts on emit (#9...
f158df1 Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
356d605 turbo-tasks-backend: stability fixes for task cancellation and error handling...
3b77a6e Fix DashMap read-write self-deadlock in task_cache causing hangs (#92210)
b2f208a Backport: new view-transitions guide, update and fixes (#92264)
52faae3 v16.2.2
Additional commits viewable in compare view

Updates next from 16.1.7 to 16.2.3

Release notes

Sourced from next's releases.

v16.2.3

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)

Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)

Deduplicate output assets and detect content conflicts on emit (#92292)

Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)

turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @icyJoseph, @sokra, @wbinnssmith, @eps1lon and @ztanner for helping!

v16.2.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

backport: Move expanded adapters docs to API reference (#92115) (#92129)

Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#92130)

[create-next-app] Skip interactive prompts when CLI flags are provided (#91840)

next.config.js: Accept an option for serverFastRefresh (#91968)

Turbopack: enable server HMR for app route handlers (#91466)

Turbopack: exclude metadata routes from server HMR (#92034)

Fix CI for glibc linux builds

Backport: disable bmi2 in qfilter #92177

[backport] Fix CSS HMR on Safari (#92174)

Credits

Huge thanks to @nextjs-bot, @icyJoseph, @ijjk, @gaojude, @wbinnssmith, @lukesandberg, and @bgw for helping!

v16.2.1

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

docs: post release amends (#91715)

docs: fix broken Activity Patterns demo link in preserving UI state guide (#91698)

Fix adapter outputs for dynamic metadata routes (#91680)

Turbopack: fix webpack loader runner layer (#91727)

Fix server actions in standalone mode with cacheComponents (#91711)

turbo-persistence: remove Unmergeable mmap advice (#91713)

Fix layout segment optimization: move app-page imports to server-utility transition (#91701)

Turbopack: lazy require metadata and handle TLA (#91705)

[turbopack] Respect {eval:true} in worker_threads constructors (#91666)

... (truncated)

Commits

d5f649b v16.2.3
2873928 [16.x] Avoid consuming cyclic models multiple times (#75)
d7c7765 [backport]: Ensure app-page reports stale ISR revalidation errors via onReque...
c573e8c fix(server-hmr): metadata routes overwrite page runtime HMR handler (#92273)
57b8f65 next-core: deduplicate output assets and detect content conflicts on emit (#9...
f158df1 Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
356d605 turbo-tasks-backend: stability fixes for task cancellation and error handling...
3b77a6e Fix DashMap read-write self-deadlock in task_cache causing hangs (#92210)
b2f208a Backport: new view-transitions guide, update and fixes (#92264)
52faae3 v16.2.2
Additional commits viewable in compare view

Preview Environment


URL	https://kandev-pr-575-bwo7.sprites.app
Commit	`a3e1f3b`
Agent	Mock agent

Updates automatically on each push. Destroyed when the PR is closed.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

claude · 2026-04-11T04:30:55Z

Claude encountered an error —— View job

I'll analyze this and get back to you.

greptile-apps · 2026-04-11T04:31:50Z

Greptile Summary

This PR bumps next from 16.1.7 to 16.2.3 in apps/web/package.json and updates the pnpm-lock.yaml lockfile accordingly. The update includes a security fix for CVE-2026-23869 along with several bug fixes (styled-jsx race condition, HMR stability, ISR revalidation error reporting).

Confidence Score: 5/5

Safe to merge — automated security patch with no manual code changes.

This is a dependabot-generated security patch bump with no custom code changes. The lockfile is consistent with the version specifier, and the sub-dependency updates are minor version increments. No P0 or P1 findings.

No files require special attention.

Important Files Changed

Filename	Overview
apps/web/package.json	Bumps `next` dependency from `16.1.7` to `16.2.3`; no other changes.
apps/pnpm-lock.yaml	Lockfile updated to reflect Next.js 16.2.3, including sub-dependency updates (`@emnapi/runtime`, `@lezer/common`, `caniuse-lite`, `baseline-browser-mapping`) and removal of `@babel/core` as an optional dep of `styled-jsx`.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[dependabot PR] --> B[next 16.1.7 to 16.2.3]
    B --> C[Security fix: CVE-2026-23869]
    B --> D[Bug fixes]
    D --> D1[styled-jsx race condition]
    D --> D2[HMR stability]
    D --> D3[ISR revalidation errors]
    B --> E[Lockfile sub-dep updates]
    E --> E1[emnapi-runtime 1.9.0 to 1.9.2]
    E --> E2[lezer-common 1.5.1 to 1.5.2]
    E --> E3[caniuse-lite updated]
    E --> E4[styled-jsx drops babel-core optional dep]

_{Reviews (4): Last reviewed commit: "chore: bump the npm_and_yarn group acros..." | Re-trigger Greptile}

claude · 2026-04-11T16:45:44Z

Claude encountered an error —— View job

I'll analyze this and get back to you.

claude · 2026-04-17T16:43:44Z

Claude finished @carlosflorencio's task in 58s —— View job

PR Review

Read review skill instructions
Analyze changed files
Post review findings

Findings

Summary

This is a pure dependency bump — only apps/web/package.json and apps/pnpm-lock.yaml are modified. No application code, tests, or configuration files are touched.

What changed in the lock file:

next 16.1.7 → 16.2.3 (primary change)
@babel/core dropped as peer dep for next and styled-jsx (Next.js 16.2.x no longer requires it — expected)
@emnapi/runtime 1.9.0 → 1.9.2 (transitive)
@babel/code-frame 7.28.6 → 7.29.0 (transitive, via @testing-library/dom)
baseline-browser-mapping 2.10.8 → 2.10.18, caniuse-lite 1.0.30001780 → 1.0.30001787 (browser compat data refreshes)
libc: [glibc] constraints removed from @img/sharp-libvips-linux-* packages (broadens portability)
eslint-import-resolver-typescript snapshot keys expanded with full peer resolution strings

All lock file changes are consistent with the version bump. No unexpected transitive changes.

No blockers. No suggestions.

Severity	Count
Blocker	0
Suggestion	0

Verdict: Ready to merge — security patch (CVE-2026-23869) with no application code changes.

Bumps the npm_and_yarn group with 1 update in the /apps directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /apps/web directory: [next](https://github.com/vercel/next.js). Updates `next` from 16.1.7 to 16.2.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v16.1.7...v16.2.3) Updates `next` from 16.1.7 to 16.2.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v16.1.7...v16.2.3) --- updated-dependencies: - dependency-name: next dependency-version: 16.2.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.3 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

claude · 2026-05-04T13:05:57Z

Claude finished @carlosflorencio's task in 37s —— View job

PR Review

Read review skill instructions
Analyze changed files
Post review findings

Findings

This is a pure dependency bump — only apps/web/package.json (1 line) and apps/pnpm-lock.yaml (generated) are modified. No application code, tests, or configuration files are touched.

Primary change: next 16.1.7 → 16.2.3, addressing security vulnerability CVE-2026-23869.

Lockfile changes are all expected side effects:

@babel/core dropped as optional peer of next and styled-jsx — Next.js 16.2.x no longer requires it
@emnapi/runtime 1.9.0 → 1.9.2, @lezer/common 1.5.1 → 1.5.2, @babel/code-frame 7.28.6 → 7.29.0 — routine transitive bumps
baseline-browser-mapping 2.10.8 → 2.10.18, caniuse-lite 1.0.30001780 → 1.0.30001787 — browser compat data refreshes
libc: [glibc] / libc: [musl] fields removed from @img/sharp-*, @rollup/rollup-*, @tailwindcss/oxide-*, @unrs/resolver-binding-*, lightningcss-* platform packages — pnpm lockfile format change, no functional impact
eslint-import-resolver-typescript snapshot key expanded with full peer resolution strings — pnpm internal resolution normalization

No unexpected transitive changes. Nothing outside the scope of this bump.

Summary

Severity	Count
Blocker	0
Suggestion	0

Verdict: Ready to merge — security patch (CVE-2026-23869) with no application code changes.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 11, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/apps/npm_and_yarn-20f9baa048 branch from 3cbb93c to 0e520b0 Compare April 11, 2026 16:45

carlosflorencio force-pushed the dependabot/npm_and_yarn/apps/npm_and_yarn-20f9baa048 branch from 0e520b0 to 341f1f7 Compare April 17, 2026 16:43

carlosflorencio force-pushed the dependabot/npm_and_yarn/apps/npm_and_yarn-20f9baa048 branch from 341f1f7 to a3e1f3b Compare May 4, 2026 13:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump the npm_and_yarn group across 2 directories with 1 update#575

chore: bump the npm_and_yarn group across 2 directories with 1 update#575
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/npm_and_yarn-20f9baa048

dependabot Bot commented on behalf of github Apr 11, 2026 •

edited

Loading

Uh oh!

claude Bot commented Apr 11, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Apr 11, 2026 •

edited

Loading

Greptile Summary

Uh oh!

claude Bot commented Apr 11, 2026 •

edited

Loading

Uh oh!

claude Bot commented Apr 17, 2026 •

edited

Loading

Uh oh!

claude Bot commented May 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.2.3

Core Changes

Credits

v16.2.2

Core Changes

Credits

v16.2.1

Core Changes

v16.2.3

Core Changes

Credits

v16.2.2

Core Changes

Credits

v16.2.1

Core Changes

v16.2.3

Core Changes

Credits

v16.2.2

Core Changes

Credits

v16.2.1

Core Changes

v16.2.3

Core Changes

Credits

v16.2.2

Core Changes

Credits

v16.2.1

Core Changes

Preview Environment

Uh oh!

claude Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

claude Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

Findings

Summary

Uh oh!

claude Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

Findings

Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 11, 2026 •

edited

Loading

claude Bot commented Apr 11, 2026 •

edited

Loading

greptile-apps Bot commented Apr 11, 2026 •

edited

Loading

claude Bot commented Apr 11, 2026 •

edited

Loading

claude Bot commented Apr 17, 2026 •

edited

Loading

claude Bot commented May 4, 2026 •

edited

Loading