chore(deps): bump the dev-tooling group across 1 directory with 3 updates

[dependabot]

Bumps the dev-tooling group with 3 updates in the / directory: @types/react, @types/react-dom and eslint-config-next.

Updates @types/react from 19.2.13 to 19.3.0

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.3.0

Commits

• See full diff in compare view

Updates eslint-config-next from 16.3.5 to 16.3.8

Release notes

Sourced from eslint-config-next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

• Server-Side Request Forgery in Image Optimization

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
• Pending use cache fill can leak Draft Mode content into regular responses and persisted pages
• Cache leak across root param values in nested 'use cache' functions

Low:

• Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

Commits

• b0fad0d v16.3.8
• 4c20699 v16.3.7
• a758ffc v16.3.6
• See full diff in compare view

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5c3eab65-7680-4c89-a605-8d2c48956a13

📥 Commits

Reviewing files that changed from the base of the PR and between 8d8a93e and 4f83bbf.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a8a41cb0-52cb-4b4a-94e0-e02e0b10492a

📥 Commits

Reviewing files that changed from the base of the PR and between 7d9a7d0 and 8d8a93e.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The eslint-config-next development dependency range in package.json changes from ^16.3.5 to ^16.3.8.

Changes

ESLint Config Dependency Update

Layer / File(s)	Summary
Update the dependency range package.json	The declared development dependency range for eslint-config-next changes from ^16.3.5 to ^16.3.8.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 8d8a9

This updates only the development lint configuration range to the version already in the lockfile. It does not update the separate Next.js runtime, but no new runtime risk from this change is established.

Architecture Summary

Architecture risk: 🔵 Low · up to 8d8a9

The change affects 1 system.

Changed systems: package.json

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — package.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in package.json: The eslint-config-next dev dependency range changed from ^16.3.5 to ^16.3.8.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes a dev-tooling dependency update affecting three packages in one directory, which matches the pull request objective.
Description check	✅ Passed	The description explains all three dependency updates and includes relevant release details. It does not use the repository template or report verification results, but the main change is clear and su…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}