Skip to content

chore(deps): bump next from 14.2.35 to 16.3.1 in /web - #40

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/next-16.3.1
Closed

chore(deps): bump next from 14.2.35 to 16.3.1 in /web#40
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/next-16.3.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 21, 2026

Copy link
Copy Markdown
Contributor

Bumps next from 14.2.35 to 16.3.1.

Release notes

Sourced from next's releases.

v16.3.1

What's Changed

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.1-canary.26

Misc Changes

  • docs: document deploymentId build ID override and Pages Router skew in 16.2: #97645
  • Upgrade React from eb8feb71-20260814 to eafeac09-20260819: #97636
  • Turbopack: rename to use turbopack: no side effects: #94427
  • refactor: move useDynamic{Route,Search}Params to reduce snapshot churn: #97360
  • [PPF] unstable_navigation(): #96908
  • [PPF] Scaffold unstable_navigation(): #97236
  • docs: Explicit cache output description: #97548
  • Improve Cache Components sync IO migration guidance: #97572
  • [test] Use a non-native stub for the server externals list test: #97614
  • Avoid GitHub API rate limits for create-next-app examples: #97612
  • [test] Cover the prerender worker-thread backend with an addon we control: #97543
  • [test] Convert the prerender-native-module suite to local fixture packages: #97542
  • [test] Replace the turbopack-reports sqlite3 dependency with a local addon fixture: #97541
  • [test] Drop the dead sqlite3 build approval from the sharp-basic suite: #97540
  • [ci] Authenticate Turborepo remote caching with OIDC instead of a static PAT: #97590
  • Remove HmrTarget: #97253
  • Keep HMR instructions typed until serialization: #96569
  • Serialize frozen collections by value only: #96686

Credits

... (truncated)

Commits
  • 3d32eb8 v16.3.1
  • 2b4b1ec [backport] Revert i18n localization change for dynamic Pages API routes (#949...
  • 228df5f [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fa...
  • 16eab3a [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops (#...
  • 75548c9 [backport] Fix Nav Inspector request loop on repeat captures (#97326)
  • f6bd714 [backport] [test] Compile the middleware redirect routes up front in dev (#97...
  • 43c1c60 [16.3] [ci] Use OIDC tokens to read private preview builds (#97258)
  • 9dbb357 [backport] Encode the cache item name built by unstable_cache (#97313)
  • 323a17c [backport] Discard only cache entries that predate a tag revalidation, and re...
  • 6d67f46 [backport] Keep the dev validation worker alive across HMR updates (#97315)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 21, 2026
Bumps [next](https://github.com/vercel/next.js) from 14.2.35 to 16.3.1.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v14.2.35...v16.3.1)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/web/next-16.3.1 branch from 3dbd05c to 1353c57 Compare August 21, 2026 22:35
edycutjong added a commit that referenced this pull request Aug 21, 2026
Next 16 makes Turbopack the default bundler and errors out when a
`webpack` config is present with no `turbopack` config, since it can no
longer tell whether the webpack customization is still needed. Our
webpack override stubs optional wagmi/rainbowkit native deps
(pino-pretty, lokijs, encoding, @base-org/account, @coinbase/cdp-sdk,
@react-native-async-storage/async-storage) that aren't installed and
are never reached in the browser bundle.

Port the same stubs to `turbopack.resolveAlias`, pointed at a new
empty CJS module (web/empty-module.js) since Turbopack has no
`externals`/`alias: false` equivalent — only alias-to-another-module.
Keep the webpack block for `next build --webpack` fallback; both stay
in sync via two named dep lists.

This unblocks PR #40 (next 14.2.35 -> 16.3.1), which fixes 25 of the
repo's 28 open Dependabot alerts (12 HIGH / 13 MEDIUM, all next CVEs).

Verified locally against next@16.3.1: npm run build/lint/typecheck/
format:check all pass, and reproduced PR #40's exact Turbopack error
with the pre-fix config to confirm this is the real fix. `npm run
start` serves all 4 routes (/,  /guard, /underwrite,
/integrations/verify) with zero console/page errors and a working
RainbowKit Connect Wallet button.
@dependabot @github

dependabot Bot commented on behalf of github Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Looks like next is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 21, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/web/next-16.3.1 branch August 21, 2026 23:01
@edycutjong

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR is closed. If the branch still exists, you can re-open the PR and then use @dependabot rebase or @dependabot recreate. If the branch was deleted, Dependabot will create a new PR on the next scheduled run, or you can trigger an update from the Dependency graph page.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant