[dependabot]

Bumps next from 16.3.8 to 16.4.1.

Release notes

Sourced from next's releases.

v16.4.1

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682
• fix(scripts): correct typo in rm.mjs error message: #87015
• docs: improve clarity and punctuation in README: #86096
• Fix debug build paths Pages Router support entries: #93529
• bundle-analyzer: record historical snapshots on each analyze run: #93520
• fix: detect proxy.ts correctly with compound pageExtensions: #93246
• feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

• docs: correction to dynamicParams migration: #96624
• docs: proxy event argument: #96435
• docs: remove experimental note from runtime prefetching: #96615
• Preserve per-segment prefetching after dynamic navigation: #96583
• Rename static generation stream option to waitForAllReady: #96564
• Remove obsolete static generation plumbing: #96563
• [turbopack] Drop dead writes to exports: #96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #96549
• [turbopack] Strip leading BOM before parsing CSS: #96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
• docs: use relative doc links in instant-navigation error pages: #96672
• Turbopack: terminate failed plugin worker threads: #96592
• Fix HTML-limited bot matching in prerender bypass rules: #96584
• [ci] Fix create_release_branch for new repo permissions: #96641
• test: skip action module instance deploy test: #96629
• docs: quote the dynamicParams build error in a blockquote: #96633
• [react-sync] Open pull requests as the bot that authors the commits: #96682
• [Bench] Fixes for pure Fizz bench: #96771
• Derive foreground cache revalidation from the consumer: #96731
• Fix race when navigating Back before hydration: #96252
• docs: present each Skill as steps in the AI agents guide: #96751
• Reuse completed cache entries for the rest of a request: #96727
• Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
• Remove WorkStore execution mode: #96674

... (truncated)

Commits

• 7217011 v16.4.1
• 1798e42 [cd] Allow branch to get published
• 9571ec8 [lts-active][next/image] Bump sharp (#234)
• a4cea6a [lts-active][react] Improve Server Component transport protocol (#193)
• 8df0d97 [lts-active][test] Backport various deploy test fixes (#100114)
• ac9afcc [lts-active] Fix google tag manager e2e test, assume GTM 200s instead of 404i...
• e273d5b v16.4.0
• fdf41d6 [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...
• c3e76ad v16.4.0-canary.63
• 47c6cc8 Document next analyze export in the package bundling guide (#99735)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9827b6e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hyperdx-oss	Ready	Preview	Oct 26, 2026 11:49pm UTC
hyperdx-storybook	Ready	Preview	Oct 26, 2026 11:49pm UTC

[github-actions]

🟢 Tier 1 — Trivial

Docs, images, lock files, a dependency bump, or an automated release. No functional code changes detected.

Why this tier:

• Bot author: dependabot[bot]

Review process: Auto-merge once CI passes. No human review required.
SLA: Resolves automatically.

Stats

• Production files changed: 1
• Production lines changed: 2
• Branch: dependabot/npm_and_yarn/next-16.4.1
• Author: dependabot[bot]

To override this classification, remove the review/tier-1 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

[github-actions]

PR Review

✅ No issues found.

[github-actions]

Duplicate code analysis

No new duplicate code introduced by this PR.

---

jscpd compared this branch against origin/main
across app, api and common-utils. Only new clones are listed; the codebase
currently holds 114 in total (1.41%).
Run yarn dupes locally to reproduce, or yarn dupes:all for the full picture.

[github-actions]

Deep Review

✅ No critical issues found.

This is a Dependabot bump of next from 16.3.8 to 16.4.1 (a security patch release) in packages/app/package.json plus the corresponding yarn.lock update, including a transitive sharp constraint move from ^0.35.4 to ^0.35.5 (resolution unchanged at 0.35.5). Zero executable code lines changed. Seven reviewers ran; none surfaced a finding at any severity.

Verification highlights from the fan-out:

• packages/app/next.config.mjs uses only stable config keys (distDir, reactCompiler, transpilePackages, basePath, env, serverExternalPackages, typescript, webpack, headers, output, assetPrefix, images, logging); none of the 16.4 renamed/removed surfaces (stream→waitForAllReady, WorkStore execution mode, removed static-generation plumbing) are used, and no app code touches those APIs.
• next is declared in exactly one place — no competing pins in root resolutions, other workspace packages, Dockerfiles, or CI — so no version-skew trap is introduced. The eslint-config-next packages sit at caret ^16.3.4, which already permits 16.4.x, so the bump is internally coherent.
• The missing changeset flagged by changeset-bot is not a standards violation here: repo precedent (the prior hono Dependabot bump 0b753cc6 merged with only yarn.lock and no changeset) and AGENTS.md scope treat dependency bumps as the documented changeset-skip case.
• All 3 prior PR comments are automated bot notices (greptile excluded-author, changeset-bot, Vercel deploy status); none carry actionable human review feedback.

---

Reviewers (7): correctness, testing, maintainability, project-standards, agent-native, learnings-researcher, previous-comments.

Testing gaps: None — a lockfile-only minor bump warrants no new unit tests; upgrade validation rests on existing CI (Playwright e2e full-stack suite plus the build steps in main.yml/release.yml), which would surface a Next.js build or runtime regression.

[github-actions]

E2E Test Results

✅ All tests passed • 458 passed • 1 skipped • 1431s

Status	Count
✅ Passed	458
❌ Failed	0
⚠️ Flaky	1
⏭️ Skipped	1

Tests ran across 4 shards in parallel.

View full report →

[wrn14897]

Minor/patch dependency bump, CI green.

[github-actions]

Deep Review

✅ No critical issues found.

This is a Dependabot bump of next from 16.3.8 to 16.4.1 (a security patch release) in packages/app/package.json plus the corresponding yarn.lock update, including a transitive sharp constraint move from ^0.35.4 to ^0.35.5 (resolution unchanged at 0.35.5). Zero executable code lines changed. Eight reviewers ran; none surfaced a finding at any severity.

Verification highlights from the fan-out:

• packages/app/next.config.mjs uses only stable config keys (distDir, reactCompiler, transpilePackages, basePath, env, serverExternalPackages, typescript, webpack, headers, output, assetPrefix, images, logging); none of the 16.4 renamed/removed surfaces (stream→waitForAllReady, removed WorkStore execution mode, removed static-generation plumbing) are referenced, so the bump introduces no config-level break.
• The security patch is reachable: next resolves to 16.4.1 and sharp to 0.35.5, root resolutions overrides neither, and next is pinned in exactly one place (packages/app/package.json) — no competing pin holds either package at a vulnerable version.
• Version skew is clean: eslint-config-next and @next/eslint-plugin-next at ^16.3.4 already admit 16.4.x via caret, so the bump is internally coherent.
• The changeset-bot "No Changeset found" notice is not a standards violation here: AGENTS.md requires a changeset only for user-facing or behavior-affecting changes, and recent Dependabot bumps (storybook chore(deps-dev): bump storybook from 10.2.13 to 10.6.2 #3458, ip-address chore(deps): bump ip-address from 10.7.1 to 10.7.4 #3457, undici chore(deps): bump undici from 7.30.0 to 7.30.1 #3462) all merged without one.
• All 8 prior PR comments are automated bot notices or an approval with no requested change (@wrn14897 APPROVED, greptile excluded-author, changeset-bot, Vercel deploy status, pr-triage tier-1, jscpd, prior deep-review, e2e results); none carry unaddressed human review feedback.

---

Reviewers (8): correctness, security, testing, maintainability, project-standards, previous-comments, agent-native, learnings-researcher.

Testing gaps: None warranting new tests — a lockfile-only framework patch bump with zero code changes relies on existing CI (the next build steps plus the Playwright e2e suite, reported green at 457 passed) to surface any upgrade regression.