Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 26 updates - #14

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-11bd0cf432
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-11bd0cf432

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 26 updates in the / directory:

Package From To
@anthropic-ai/sdk 0.117.1 0.126.0
@sentry/nextjs 10.70.0 10.75.0
@supabase/ssr 0.12.4 0.12.7
@supabase/supabase-js 2.112.3 2.116.0
@upstash/redis 1.38.2 1.38.4
dompurify 3.4.13 3.4.15
groq-sdk 1.5.0 1.6.0
next 16.3.1 16.3.5
next-intl 4.13.6 4.14.5
sharp 0.35.3 0.35.4
swagger-ui-react 5.32.13 5.33.0
tailwind-merge 3.6.0 3.7.0
@next/env 16.3.1 16.3.5
@playwright/test 1.62.1 1.63.0
@testing-library/dom 10.4.1 10.4.2
@testing-library/react 16.3.2 16.3.3
@typescript-eslint/eslint-plugin 8.67.0 8.70.0
@typescript-eslint/parser 8.67.0 8.70.0
@vitest/coverage-v8 4.1.10 4.1.11
autoprefixer 10.5.4 10.6.1
eslint-config-next 16.3.1 16.3.5
postcss 8.5.26 8.5.28
vitest 4.1.10 4.1.11
web-tree-sitter 0.26.12 0.27.0
@img/sharp-linux-x64 0.35.3 0.35.4
@swc/core-linux-x64-gnu 1.15.47 1.16.2

Updates @anthropic-ai/sdk from 0.117.1 to 0.126.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.126.0

0.126.0 (2026-09-15)

Full Changelog: sdk-v0.125.0...sdk-v0.126.0

Features

  • api: add auto mode tool permissions for Managed Agents (7829b43)
  • api: add compaction parameter and signed compaction blocks (beta) (05fd878)
  • api: add enum types for workspace data-residency geo fields (89c5920)
  • api: add thinking_mismatch_allowed entries to input_transformations (beta) (1f32871)
  • api: add url_sources to the web fetch tool (ee23dd2)
  • api: add workspace_id parameter to user profiles methods (f5b9fb7)

Bug Fixes

  • api: mark usage iteration model as nullable (bec3bec)
  • api: use one input transformation type for message and delta event (e016d25)
  • client: ignore invalid Retry-After values and validate maxRetries (7829b43)
  • client: retry connection errors in the async client and stop blocking in the coroutine retry loop (7829b43)
  • client: stop waiting for a retry as soon as the request is aborted (941aaea)
  • client: use the default backoff when Retry-After is out of range (1090c44)
  • internal: stop a declaration file using a type that needs TypeScript 5.7 (e32a956)

Performance Improvements

  • add "sideEffects": false so bundlers can drop unused modules (f804366)
  • mark classes as pure so bundlers can drop unused ones (f804366)

Chores

  • docs: clarify that session_thread_id on tool use events is informational (a07ecf3)
  • docs: correct the compaction beta's parameter descriptions (eb9abd2)
  • internal: move the sub-packages off ts-node and modernise their tsconfig (1d7cd91)
  • internal: move tsconfig off settings deprecated in TypeScript 6 (e0d58f6)
  • internal: pin the pnpm version with an integrity hash (f804366)
  • internal: root package drops ts-node; repo root becomes ESM (3f371a1)
  • internal: stop using ts-node for the publish script and the ecosystem test runner (2e589c8)
  • tests: stop the mock server without failing a passing test run (a364c12)

Documentation

  • api: clarify usage.iterations entry typing under server-side fallback (c5f0ef3)
  • api: compaction instructions replace the server's summarization prompt (941aaea)
  • api: fix typo in temperature deprecation message (4a8b49b)
  • stop documenting unions with their first variant's description (fa06caf)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.126.0 (2026-09-15)

Full Changelog: sdk-v0.125.0...sdk-v0.126.0

Features

  • api: add auto mode tool permissions for Managed Agents (7829b43)
  • api: add compaction parameter and signed compaction blocks (beta) (05fd878)
  • api: add enum types for workspace data-residency geo fields (89c5920)
  • api: add thinking_mismatch_allowed entries to input_transformations (beta) (1f32871)
  • api: add url_sources to the web fetch tool (ee23dd2)
  • api: add workspace_id parameter to user profiles methods (f5b9fb7)

Bug Fixes

  • api: mark usage iteration model as nullable (bec3bec)
  • api: use one input transformation type for message and delta event (e016d25)
  • client: ignore invalid Retry-After values and validate maxRetries (7829b43)
  • client: retry connection errors in the async client and stop blocking in the coroutine retry loop (7829b43)
  • client: stop waiting for a retry as soon as the request is aborted (941aaea)
  • client: use the default backoff when Retry-After is out of range (1090c44)
  • internal: stop a declaration file using a type that needs TypeScript 5.7 (e32a956)

Performance Improvements

  • add "sideEffects": false so bundlers can drop unused modules (f804366)
  • mark classes as pure so bundlers can drop unused ones (f804366)

Chores

  • docs: clarify that session_thread_id on tool use events is informational (a07ecf3)
  • docs: correct the compaction beta's parameter descriptions (eb9abd2)
  • internal: move the sub-packages off ts-node and modernise their tsconfig (1d7cd91)
  • internal: move tsconfig off settings deprecated in TypeScript 6 (e0d58f6)
  • internal: pin the pnpm version with an integrity hash (f804366)
  • internal: root package drops ts-node; repo root becomes ESM (3f371a1)
  • internal: stop using ts-node for the publish script and the ecosystem test runner (2e589c8)
  • tests: stop the mock server without failing a passing test run (a364c12)

Documentation

  • api: clarify usage.iterations entry typing under server-side fallback (c5f0ef3)
  • api: compaction instructions replace the server's summarization prompt (941aaea)
  • api: fix typo in temperature deprecation message (4a8b49b)
  • stop documenting unions with their first variant's description (fa06caf)

... (truncated)

Commits
  • d103182 Merge pull request #1200 from anthropics/release-please--branches--main--chan...
  • 39273d1 chore: release main
  • eb9abd2 chore(docs): correct the compaction beta's parameter descriptions
  • 05fd878 feat(api): add compaction parameter and signed compaction blocks (beta)
  • e0d58f6 chore(internal): move tsconfig off settings deprecated in TypeScript 6
  • e016d25 fix(api): use one input transformation type for message and delta event
  • 1d7cd91 chore(internal): move the sub-packages off ts-node and modernise their tsconfig
  • ee23dd2 feat(api): add url_sources to the web fetch tool
  • a364c12 chore(tests): stop the mock server without failing a passing test run
  • 1f32871 feat(api): add thinking_mismatch_allowed entries to input_transformations (beta)
  • Additional commits viewable in compare view

Updates @sentry/nextjs from 10.70.0 to 10.75.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.75.0

Important Changes

  • feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24445)

    On Effect v4, Sentry.effectLayer now registers a Sentry ErrorReporter. Failures that pass through Effect.withErrorReporting, ErrorReporter.report or the built-in HTTP and RPC reporting boundaries are captured automatically, with ErrorReporter.ignore, ErrorReporter.severity and ErrorReporter.attributes annotations respected. Nothing changes on Effect v3.

Other Changes

  • feat(v10/core): Accept a CollectBehavior shorthand for dataCollection.httpHeaders (#24339)
  • fix(v10/browser): Release the XHR virtualError once the request completed (#24307)
  • fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
  • fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps when disable-upload is set (#24332)
  • fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
  • fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcemap upload (#24295)
  • fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
  • fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe (#24353)
  • fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
  • fix(v10/replay): Don't rewrite already-emitted nodes when syncing mirror attributes (#23588)

Bundle size 📦

Path Size
@​sentry/browser 27.18 KB
@​sentry/browser - with treeshaking flags 25.66 KB
@​sentry/browser (incl. Tracing) 45.6 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.34 KB
@​sentry/browser (incl. Tracing, Profiling) 50.24 KB
@​sentry/browser (incl. Tracing, Replay) 83.99 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.84 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.6 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.94 KB
@​sentry/browser (incl. Feedback) 43.94 KB
@​sentry/browser (incl. sendFeedback) 31.87 KB
@​sentry/browser (incl. FeedbackAsync) 36.88 KB
@​sentry/browser (incl. Metrics) 28.25 KB
@​sentry/browser (incl. Logs) 28.47 KB
@​sentry/browser (incl. Metrics & Logs) 29.15 KB
@​sentry/react 28.93 KB
@​sentry/react (incl. Tracing) 47.81 KB
@​sentry/vue 32.47 KB
@​sentry/vue (incl. Tracing) 47.55 KB
@​sentry/svelte 27.21 KB
CDN Bundle 29.53 KB
CDN Bundle (incl. Tracing) 47.52 KB
CDN Bundle (incl. Logs, Metrics) 31.07 KB
CDN Bundle (incl. Tracing, Logs, Metrics) 48.81 KB
CDN Bundle (incl. Replay, Logs, Metrics) 69.49 KB
CDN Bundle (incl. Tracing, Replay) 84.22 KB

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.75.0

Important Changes

  • feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24445)

    On Effect v4, Sentry.effectLayer now registers a Sentry ErrorReporter. Failures that pass through Effect.withErrorReporting, ErrorReporter.report or the built-in HTTP and RPC reporting boundaries are captured automatically, with ErrorReporter.ignore, ErrorReporter.severity and ErrorReporter.attributes annotations respected. Nothing changes on Effect v3.

Other Changes

  • feat(v10/core): Accept a CollectBehavior shorthand for dataCollection.httpHeaders (#24339)
  • fix(v10/browser): Release the XHR virtualError once the request completed (#24307)
  • fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
  • fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps when disable-upload is set (#24332)
  • fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
  • fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcemap upload (#24295)
  • fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
  • fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe (#24353)
  • fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
  • fix(v10/replay): Don't rewrite already-emitted nodes when syncing mirror attributes (#23588)

10.74.0

  • feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)
  • fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)
  • fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)
  • fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)
  • fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
  • fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)
  • fix(v10/core): Resolve MCP capture policy per operation (#23796)
  • fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)
  • fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)
  • fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)
  • fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)
  • fix(v10/profiling-node): Bump @​sentry/node-cpu-profiler to 2.4.4 (#24238)
  • fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)
  • fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#23994)
  • fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#23998)
  • test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#23910)

Work in this release was contributed by @​halillusion and @​zkasuran. Thank you for your contributions!

10.73.0

... (truncated)

Commits
  • 9ffb58c release: 10.75.0
  • 664c906 meta(changelog): Update changelog for 10.75.0 (#24446)
  • e3e7acc fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
  • 4bb51d1 feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24...
  • 738f17e fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
  • f63c56a fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe...
  • 0e24355 fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
  • ac3ea13 fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
  • 9235d43 fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcema...
  • e2deda0 feat(v10/core): Accept CollectBehavior shorthand for `dataCollection.httpHe...
  • Additional commits viewable in compare view

Updates @supabase/ssr from 0.12.4 to 0.12.7

Release notes

Sourced from @​supabase/ssr's releases.

v0.12.7

0.12.7 (2026-09-08)

Bug Fixes

  • apply non-browser defaults when cookies only sets encode (#294) (9d6e2a5)

v0.12.7-rc.162

What's Changed

Full Changelog: supabase/ssr@v0.12.6...v0.12.7-rc.162

v0.12.6

0.12.6 (2026-09-04)

Bug Fixes

  • avoid duplicate cache headers per server client (#283) (af750e2)

v0.12.6-rc.158

What's Changed

New Contributors

Full Changelog: supabase/ssr@v0.12.5...v0.12.6-rc.158

v0.12.5

0.12.5 (2026-08-24)

Bug Fixes

  • warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142

v0.12.5-rc.154

What's Changed

... (truncated)

Changelog

Sourced from @​supabase/ssr's changelog.

0.12.7 (2026-09-08)

Bug Fixes

  • apply non-browser defaults when cookies only sets encode (#294) (9d6e2a5)

0.12.6 (2026-09-04)

Bug Fixes

  • avoid duplicate cache headers per server client (#283) (af750e2)

0.12.5 (2026-08-24)

Bug Fixes

  • warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142
Commits
  • 9b28f49 chore(main): release 0.12.7 (#295)
  • 9d6e2a5 fix: apply non-browser defaults when cookies only sets encode (#294)
  • 4ed9f65 chore: add workflow for autoclosing stale issues (#292)
  • 71c33a7 chore(main): release 0.12.6 (#291)
  • c7c7e68 docs: fix typos in tsdoc and design doc (#288)
  • af750e2 fix: avoid duplicate cache headers per server client (#283)
  • 905c7c3 build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 (#290)
  • 9e2564d chore: update @​supabase/supabase-js to v2.114.0 (#289)
  • c5310fd chore(main): release 0.12.5 (#286)
  • c1700f2 fix: warn when auth.storage is ignored by createBrowserClient/createServerCli...
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.112.3 to 2.116.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)
  • storage: add bucket lifecycle configuration (#2659)
  • storage: topk 10k support (#2667)
  • storage: add versionId support to create URL methods (#2678)

🩹 Fixes

  • auth: silence commit-guard-discarded refresh in initial session (#2668)
  • storage: drop legacy prefix from lifecycles (#2674)
  • supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

  • fadymak
  • Ferhat Elmas
  • Katerina Skroumpelou @​mandarini
  • Tyler Hillery

v2.116.0-canary.3

2.116.0-canary.3 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)
  • storage: add versionId support to create URL methods (#2678)

❤️ Thank You

  • fadymak
  • Katerina Skroumpelou
  • Tyler Hillery

v2.116.0-canary.2

2.116.0-canary.2 (2026-09-07)

🚀 Features

  • storage: topk 10k support (#2667)

🩹 Fixes

  • storage: drop legacy prefix from lifecycles (#2674)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)

🩹 Fixes

  • supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

2.115.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

2.114.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.113.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.4 (2026-08-24)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

Commits

Updates @upstash/redis from 1.38.2 to 1.38.4

Release notes

Sourced from @​upstash/redis's releases.

@​upstash/redis@​1.38.4

Patch Changes

  • 7ac8182: Fix read-your-writes sending a stale upstash-sync-token

    A read issued straight after a write travelled with the token from before that write, so the server was under no obligation to serve the write and readYourWrites silently did not hold.

    HttpClient.request() snapshotted the outgoing headers with mergeHeaders(this.headers, ...) and only afterwards wrote the freshest token into this.headers, so the token learned from response N first shipped with request N+2. The assignment now happens before the merge.

    This regressed in 1.34.5. In 1.34.0–1.34.4 the request options held headers: this.headers by reference, so the late write was still picked up before fetch; 1.34.5 introduced per-request header merging, which turned that reference into a copy without moving the assignment.

@​upstash/redis@​1.38.3

Patch Changes

  • f020866: Send an Upstash-Telemetry-Retry header with the retry count on retried requests so retry rates are visible in server-side telemetry
  • 777dc30: Trim telemetry header values before deduplicating so whitespace around existing values does not defeat the dedup check

@​upstash/redis@​1.38.3-canary-20260807072941-777dc30585ae61e5826bb95f5a957e6dea277900

What's Changed

Full Changelog: https://github.com/upstash/redis-js/compare/@​upstash/redis@1.38.2...@​upstash/redis@1.38.3-canary-20260807072941-777dc30585ae61e5826bb95f5a957e6dea277900

Commits
  • 73fbe1a chore: version packages (#1448)
  • 7ac8182 DX-2995: fix read-your-writes sending a stale upstash-sync-token (#1447)
  • 1bec566 ci: poll npm for the ci version instead of a fixed sleep (#1444)
  • 74da1df chore: version packages (#1443)
  • f020866 DX-2960: send Upstash-Telemetry-Retry header with the attempt number (DX-2960...
  • 777dc30 fix: trim telemetry values before dedup and cover distinct-version case (#1442)
  • See full diff in compare view

Updates dompurify from 3.4.13 to 3.4.15

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible

DOMPurify 3.4.14

  • Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
  • Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
  • Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
  • Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
  • Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
  • Updated several development dependencies and CI workflow actions
Commits

Updates groq-sdk from 1.5.0 to 1.6.0

Release notes

Sourced from groq-sdk's releases.

v1.6.0

1.6.0 (2026-08-25)

Full Changelog: v1.5.0...v1.6.0

Features

  • chat: add Qwen3.8 reasoning guidance (c2b0264)

Chores

  • GitHub Terraform: Create/Update .github/workflows/code-freeze-bypass.yaml [skip ci] (99fc8ef)
  • GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci] (8d224a0)
  • GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci] (2c5b7aa)
  • internal: allow the mock server port to be set with STAINLESS_MOCK_PORT (90cec2d)

Styles

  • chat: format completion params union (91d9de9)
Changelog

Sourced from groq-sdk's changelog.

1.6.0 (2026-08-25)

Full Changelog: v1.5.0...v1.6.0

Features

  • chat: add Qwen3.8 reasoning guidance (c2b0264)

Chores

  • GitHub Terraform: Create/Update .github/workflows/code-freeze-bypass.yaml [skip ci] (99fc8ef)
  • GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci] (8d224a0)
  • GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci] (2c5b7aa)
  • internal: allow the mock server port to be set with STAINLESS_MOCK_PORT (90cec2d)

Styles

  • chat: format completion params union (91d9de9)
Commits
  • 6de8d02 release: 1.6.0 (#273)
  • 8d224a0 chore: GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci]
  • 2c5b7aa chore: GitHub Terraform: Create/Update .github/workflows/stale.yaml [skip ci]
  • 99fc8ef chore: GitHub Terraform: Create/Update .github/workflows/code-freeze-bypass.y...
  • See full diff in compare view

Updates next from 16.3.1 to 16.3.5

Release notes

Sourced from next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

Commits
  • ca2c75e v16.3.5
  • 14fb290 [backport] Fix use cache prerender signal retention (#98448)
  • 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
  • 4b56cee [16.3.x] Backport docs fixes (#98317)
  • 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
  • 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
  • 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
  • d9eac96 [16.3.x] next/image: skip 0-byte entries when initializing disk LRU cache (#9...
  • 84b35fe [test] Fix 16.3 deploy test assertions (#98133)
  • 14f9c1a [16.3.x][ci] Run flake detection and new deploy tests when merged and on back...
  • Additional commits viewable in compare view

Updates next-intl from 4.13.6 to 4.14.5

Release notes

Sourced from

…6 updates

Bumps the minor-and-patch group with 26 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.117.1` | `0.126.0` |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.70.0` | `10.75.0` |
| [@supabase/ssr](https://github.com/supabase/ssr) | `0.12.4` | `0.12.7` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.3` | `2.116.0` |
| [@upstash/redis](https://github.com/upstash/redis-js) | `1.38.2` | `1.38.4` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.13` | `3.4.15` |
| [groq-sdk](https://github.com/groq/groq-typescript) | `1.5.0` | `1.6.0` |
| [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.5` |
| [next-intl](https://github.com/amannn/next-intl) | `4.13.6` | `4.14.5` |
| [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.4` |
| [swagger-ui-react](https://github.com/swagger-api/swagger-ui) | `5.32.13` | `5.33.0` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` |
| [@next/env](https://github.com/vercel/next.js/tree/HEAD/packages/next-env) | `16.3.1` | `16.3.5` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |
| [@testing-library/dom](https://github.com/testing-library/dom-testing-library) | `10.4.1` | `10.4.2` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.67.0` | `8.70.0` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.67.0` | `8.70.0` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.4` | `10.6.1` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.1` | `16.3.5` |
| [postcss](https://github.com/postcss/postcss) | `8.5.26` | `8.5.28` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |
| [web-tree-sitter](https://github.com/tree-sitter/tree-sitter/tree/HEAD/lib/binding_web) | `0.26.12` | `0.27.0` |
| [@img/sharp-linux-x64](https://github.com/lovell/sharp/tree/HEAD/npm/linux-x64) | `0.35.3` | `0.35.4` |
| [@swc/core-linux-x64-gnu](https://github.com/swc-project/swc) | `1.15.47` | `1.16.2` |



Updates `@anthropic-ai/sdk` from 0.117.1 to 0.126.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.117.1...sdk-v0.126.0)

Updates `@sentry/nextjs` from 10.70.0 to 10.75.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.75.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.70.0...10.75.0)

Updates `@supabase/ssr` from 0.12.4 to 0.12.7
- [Release notes](https://github.com/supabase/ssr/releases)
- [Changelog](https://github.com/supabase/ssr/blob/main/CHANGELOG.md)
- [Commits](supabase/ssr@v0.12.4...v0.12.7)

Updates `@supabase/supabase-js` from 2.112.3 to 2.116.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.116.0/packages/core/supabase-js)

Updates `@upstash/redis` from 1.38.2 to 1.38.4
- [Release notes](https://github.com/upstash/redis-js/releases)
- [Commits](https://github.com/upstash/redis-js/compare/@upstash/redis@1.38.2...@upstash/redis@1.38.4)

Updates `dompurify` from 3.4.13 to 3.4.15
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.13...3.4.15)

Updates `groq-sdk` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/groq/groq-typescript/releases)
- [Changelog](https://github.com/groq/groq-typescript/blob/main/CHANGELOG.md)
- [Commits](groq/groq-typescript@v1.5.0...v1.6.0)

Updates `next` from 16.3.1 to 16.3.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.1...v16.3.5)

Updates `next-intl` from 4.13.6 to 4.14.5
- [Release notes](https://github.com/amannn/next-intl/releases)
- [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md)
- [Commits](amannn/next-intl@v4.13.6...v4.14.5)

Updates `sharp` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.4)

Updates `swagger-ui-react` from 5.32.13 to 5.33.0
- [Release notes](https://github.com/swagger-api/swagger-ui/releases)
- [Commits](swagger-api/swagger-ui@v5.32.13...v5.33.0)

Updates `tailwind-merge` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge)

Updates `@next/env` from 16.3.1 to 16.3.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.5/packages/next-env)

Updates `@playwright/test` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.63.0)

Updates `@testing-library/dom` from 10.4.1 to 10.4.2
- [Release notes](https://github.com/testing-library/dom-testing-library/releases)
- [Changelog](https://github.com/testing-library/dom-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/dom-testing-library@v10.4.1...v10.4.2)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

Updates `@typescript-eslint/eslint-plugin` from 8.67.0 to 8.70.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.67.0 to 8.70.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/parser)

Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)

Updates `autoprefixer` from 10.5.4 to 10.6.1
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.5.4...10.6.1)

Updates `eslint-config-next` from 16.3.1 to 16.3.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.5/packages/eslint-config-next)

Updates `postcss` from 8.5.26 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.26...8.5.28)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

Updates `web-tree-sitter` from 0.26.12 to 0.27.0
- [Release notes](https://github.com/tree-sitter/tree-sitter/releases)
- [Commits](https://github.com/tree-sitter/tree-sitter/commits/v0.27.0/lib/binding_web)

Updates `@img/sharp-linux-x64` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](https://github.com/lovell/sharp/commits/v0.35.4/npm/linux-x64)

Updates `@swc/core-linux-x64-gnu` from 1.15.47 to 1.16.2
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md)
- [Commits](swc-project/swc@v1.15.47...v1.16.2)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.126.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@sentry/nextjs"
  dependency-version: 10.75.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@supabase/ssr"
  dependency-version: 0.12.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.116.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@upstash/redis"
  dependency-version: 1.38.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: dompurify
  dependency-version: 3.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: groq-sdk
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: next-intl
  dependency-version: 4.14.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: swagger-ui-react
  dependency-version: 5.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tailwind-merge
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@next/env"
  dependency-version: 16.3.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@testing-library/dom"
  dependency-version: 10.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: autoprefixer
  dependency-version: 10.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.3.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: web-tree-sitter
  dependency-version: 0.27.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@img/sharp-linux-x64"
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@swc/core-linux-x64-gnu"
  dependency-version: 1.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from omen18 as a code owner September 21, 2026 15:28
@dependabot @github

dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: level:beginner. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@vercel

vercel Bot commented Sep 21, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
code-stride Ready Ready Preview Sep 21, 2026 3:32pm UTC

@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 28, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-11bd0cf432 branch September 28, 2026 15:28

This branch was successfully deployed

1 active deployment
Preview — 0a8cae11 Deployed Sep 21, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants