[dependabot]

Bumps the npm_and_yarn group with 1 update in the /apps/web directory: next.

Updates next from 16.2.6 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

• Server-Side Request Forgery in Image Optimization

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
• Pending use cache fill can leak Draft Mode content into regular responses and persisted pages
• Cache leak across root param values in nested 'use cache' functions

Low:

• Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
• next/image: Reject empty images when reading/writing to the disk cache (#98186)
• Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
• Add CSP nonce to script tags of loading and template files (#98403)
• Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

... (truncated)

Commits

• b0fad0d v16.3.8
• 719e4c6 [lts-active] Scope response cache keys to their source route (#218)
• e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
• 40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
• 2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
• bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
• 8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
• e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
• 4c20699 v16.3.7
• 2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c3882819-5508-41b0-9589-df641c521130

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml