[dependabot]

Bumps the security-fixes group with 2 updates in the / directory: next and sharp.

Updates next from 16.3.8 to 16.4.1

Release notes

Sourced from next's releases.

v16.4.1

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682
• fix(scripts): correct typo in rm.mjs error message: #87015
• docs: improve clarity and punctuation in README: #86096
• Fix debug build paths Pages Router support entries: #93529
• bundle-analyzer: record historical snapshots on each analyze run: #93520
• fix: detect proxy.ts correctly with compound pageExtensions: #93246
• feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

• docs: correction to dynamicParams migration: #96624
• docs: proxy event argument: #96435
• docs: remove experimental note from runtime prefetching: #96615
• Preserve per-segment prefetching after dynamic navigation: #96583
• Rename static generation stream option to waitForAllReady: #96564
• Remove obsolete static generation plumbing: #96563
• [turbopack] Drop dead writes to exports: #96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #96549
• [turbopack] Strip leading BOM before parsing CSS: #96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
• docs: use relative doc links in instant-navigation error pages: #96672
• Turbopack: terminate failed plugin worker threads: #96592
• Fix HTML-limited bot matching in prerender bypass rules: #96584
• [ci] Fix create_release_branch for new repo permissions: #96641
• test: skip action module instance deploy test: #96629
• docs: quote the dynamicParams build error in a blockquote: #96633
• [react-sync] Open pull requests as the bot that authors the commits: #96682
• [Bench] Fixes for pure Fizz bench: #96771
• Derive foreground cache revalidation from the consumer: #96731
• Fix race when navigating Back before hydration: #96252
• docs: present each Skill as steps in the AI agents guide: #96751
• Reuse completed cache entries for the rest of a request: #96727
• Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
• Remove WorkStore execution mode: #96674

... (truncated)

Commits

• 7217011 v16.4.1
• 1798e42 [cd] Allow branch to get published
• 9571ec8 [lts-active][next/image] Bump sharp (#234)
• a4cea6a [lts-active][react] Improve Server Component transport protocol (#193)
• 8df0d97 [lts-active][test] Backport various deploy test fixes (#100114)
• ac9afcc [lts-active] Fix google tag manager e2e test, assume GTM 200s instead of 404i...
• e273d5b v16.4.0
• fdf41d6 [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...
• c3e76ad v16.4.0-canary.63
• 47c6cc8 Document next analyze export in the package bundling guide (#99735)
• Additional commits viewable in compare view

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mogplex-docs	Ready	Preview	Nov 15, 2026 5:13am UTC