Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 19, 2026

Bumps the npm group with 16 updates:

Package From To
@next/mdx 16.1.2 16.1.3
next 16.1.2 16.1.3
@next/eslint-plugin-next 16.1.2 16.1.3
eslint-config-next 16.1.2 16.1.3
pnpm 10.28.0 10.28.1
@next/env 16.1.2 16.1.3
@next/swc-darwin-arm64 16.1.2 16.1.3
@next/swc-darwin-x64 16.1.2 16.1.3
@next/swc-linux-arm64-gnu 16.1.2 16.1.3
@next/swc-linux-arm64-musl 16.1.2 16.1.3
@next/swc-linux-x64-gnu 16.1.2 16.1.3
@next/swc-linux-x64-musl 16.1.2 16.1.3
@next/swc-win32-arm64-msvc 16.1.2 16.1.3
@next/swc-win32-x64-msvc 16.1.2 16.1.3
baseline-browser-mapping 2.9.14 2.9.15
caniuse-lite 1.0.30001764 1.0.30001765

Updates @next/mdx from 16.1.2 to 16.1.3

Release notes

Sourced from @​next/mdx's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates next from 16.1.2 to 16.1.3

Release notes

Sourced from next's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates @next/eslint-plugin-next from 16.1.2 to 16.1.3

Release notes

Sourced from @​next/eslint-plugin-next's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates eslint-config-next from 16.1.2 to 16.1.3

Release notes

Sourced from eslint-config-next's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates pnpm from 10.28.0 to 10.28.1

Release notes

Sourced from pnpm's releases.

pnpm 10.28.1

Patch Changes

  • Fixed installation of config dependencies from private registries.

    Added support for object type in configDependencies when the tarball URL returned from package metadata differs from the computed URL #10431.

  • Fix path traversal vulnerability in binary fetcher ZIP extraction

    • Validate ZIP entry paths before extraction to prevent writing files outside target directory
    • Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix
    • Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error
  • Support plain http:// and https:// URLs ending with .git as git repository dependencies.

    Previously, URLs like https://gitea.example.org/user/repo.git#commit were not recognized as git repositories because they lacked the git+ prefix (e.g., git+https://). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads.

    Changes:

    • The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver
    • The git resolver now recognizes plain http:// and https:// URLs ending in .git as git repositories
    • Removed the isRepository check from the tarball resolver since it's no longer needed with the new resolver order

    Fixes #10468

  • pnpm run -r and pnpm run --filter now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use --if-present to suppress this error #6844.

  • Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for ./ but not .\. Since backslashes are directory separators on Windows, malicious packages could use paths like foo\..\..\.npmrc to write files outside the package directory.

  • When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project #5759.

  • Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with @ bypassed validation, and after scope normalization, path traversal sequences like ../../ remained intact.

  • Revert Try to avoid making network calls with preferOffline #10334.

  • Fix --save-peer to write valid semver ranges to peerDependencies for protocol-based installs (e.g. jsr:) by deriving from resolved versions when available and falling back to * if none is available #10417.

  • Do not exclude the root workspace project, when it is explicitly selected via a filter #10465.

Platinum Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.28.1

Patch Changes

  • Fixed installation of config dependencies from private registries.

    Added support for object type in configDependencies when the tarball URL returned from package metadata differs from the computed URL #10431.

  • Fix path traversal vulnerability in binary fetcher ZIP extraction

    • Validate ZIP entry paths before extraction to prevent writing files outside target directory
    • Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix
    • Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error
  • Support plain http:// and https:// URLs ending with .git as git repository dependencies.

    Previously, URLs like https://gitea.example.org/user/repo.git#commit were not recognized as git repositories because they lacked the git+ prefix (e.g., git+https://). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads.

    Changes:

    • The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver
    • The git resolver now recognizes plain http:// and https:// URLs ending in .git as git repositories
    • Removed the isRepository check from the tarball resolver since it's no longer needed with the new resolver order

    Fixes #10468

  • pnpm run -r and pnpm run --filter now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use --if-present to suppress this error #6844.

  • Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for ./ but not .\. Since backslashes are directory separators on Windows, malicious packages could use paths like foo\..\..\.npmrc to write files outside the package directory.

  • When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project #5759.

  • Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with @ bypassed validation, and after scope normalization, path traversal sequences like ../../ remained intact.

  • Revert Try to avoid making network calls with preferOffline #10334.

  • Fix --save-peer to write valid semver ranges to peerDependencies for protocol-based installs (e.g. jsr:) by deriving from resolved versions when available and falling back to * if none is available #10417.

  • Do not exclude the root workspace project, when it is explicitly selected via a filter #10465.

Commits

Updates @next/env from 16.1.2 to 16.1.3

Release notes

Sourced from @​next/env's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates @next/swc-darwin-arm64 from 16.1.2 to 16.1.3

Release notes

Sourced from @​next/swc-darwin-arm64's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates @next/swc-darwin-x64 from 16.1.2 to 16.1.3

Release notes

Sourced from @​next/swc-darwin-x64's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates @next/swc-linux-arm64-gnu from 16.1.2 to 16.1.3

Release notes

Sourced from @​next/swc-linux-arm64-gnu's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates @next/swc-linux-arm64-musl from 16.1.2 to 16.1.3

Release notes

Sourced from @​next/swc-linux-arm64-musl's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates @next/swc-linux-x64-gnu from 16.1.2 to 16.1.3

Release notes

Sourced from @​next/swc-linux-x64-gnu's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates @next/swc-linux-x64-musl from 16.1.2 to 16.1.3

Release notes

Sourced from @​next/swc-linux-x64-musl's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates @next/swc-win32-arm64-msvc from 16.1.2 to 16.1.3

Release notes

Sourced from @​next/swc-win32-arm64-msvc's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates @next/swc-win32-x64-msvc from 16.1.2 to 16.1.3

Release notes

Sourced from @​next/swc-win32-x64-msvc's releases.

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

Commits

Updates baseline-browser-mapping from 2.9.14 to 2.9.15

Release notes

Sourced from baseline-browser-mapping's releases.

v2.9.3 - remove process.loadEnvFile()

What's Changed

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.2...v2.9.3

Commits

Updates caniuse-lite from 1.0.30001764 to 1.0.30001765

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm group with 16 updates:

| Package | From | To |
| --- | --- | --- |
| [@next/mdx](https://github.com/vercel/next.js/tree/HEAD/packages/next-mdx) | `16.1.2` | `16.1.3` |
| [next](https://github.com/vercel/next.js) | `16.1.2` | `16.1.3` |
| [@next/eslint-plugin-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-plugin-next) | `16.1.2` | `16.1.3` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.1.2` | `16.1.3` |
| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) | `10.28.0` | `10.28.1` |
| [@next/env](https://github.com/vercel/next.js/tree/HEAD/packages/next-env) | `16.1.2` | `16.1.3` |
| [@next/swc-darwin-arm64](https://github.com/vercel/next.js/tree/HEAD/crates/napi/npm/darwin-arm64) | `16.1.2` | `16.1.3` |
| [@next/swc-darwin-x64](https://github.com/vercel/next.js/tree/HEAD/crates/napi/npm/darwin-x64) | `16.1.2` | `16.1.3` |
| [@next/swc-linux-arm64-gnu](https://github.com/vercel/next.js/tree/HEAD/crates/napi/npm/linux-arm64-gnu) | `16.1.2` | `16.1.3` |
| [@next/swc-linux-arm64-musl](https://github.com/vercel/next.js/tree/HEAD/crates/napi/npm/linux-arm64-musl) | `16.1.2` | `16.1.3` |
| [@next/swc-linux-x64-gnu](https://github.com/vercel/next.js/tree/HEAD/crates/napi/npm/linux-x64-gnu) | `16.1.2` | `16.1.3` |
| [@next/swc-linux-x64-musl](https://github.com/vercel/next.js/tree/HEAD/crates/napi/npm/linux-x64-musl) | `16.1.2` | `16.1.3` |
| [@next/swc-win32-arm64-msvc](https://github.com/vercel/next.js/tree/HEAD/crates/napi/npm/win32-arm64-msvc) | `16.1.2` | `16.1.3` |
| [@next/swc-win32-x64-msvc](https://github.com/vercel/next.js/tree/HEAD/crates/napi/npm/win32-x64-msvc) | `16.1.2` | `16.1.3` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.9.14` | `2.9.15` |
| [caniuse-lite](https://github.com/browserslist/caniuse-lite) | `1.0.30001764` | `1.0.30001765` |


Updates `@next/mdx` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/packages/next-mdx)

Updates `next` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.1.2...v16.1.3)

Updates `@next/eslint-plugin-next` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/packages/eslint-plugin-next)

Updates `eslint-config-next` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/packages/eslint-config-next)

Updates `pnpm` from 10.28.0 to 10.28.1
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/v10.28.1/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v10.28.1/pnpm)

Updates `@next/env` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/packages/next-env)

Updates `@next/swc-darwin-arm64` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/crates/napi/npm/darwin-arm64)

Updates `@next/swc-darwin-x64` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/crates/napi/npm/darwin-x64)

Updates `@next/swc-linux-arm64-gnu` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/crates/napi/npm/linux-arm64-gnu)

Updates `@next/swc-linux-arm64-musl` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/crates/napi/npm/linux-arm64-musl)

Updates `@next/swc-linux-x64-gnu` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/crates/napi/npm/linux-x64-gnu)

Updates `@next/swc-linux-x64-musl` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/crates/napi/npm/linux-x64-musl)

Updates `@next/swc-win32-arm64-msvc` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/crates/napi/npm/win32-arm64-msvc)

Updates `@next/swc-win32-x64-msvc` from 16.1.2 to 16.1.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.1.3/crates/napi/npm/win32-x64-msvc)

Updates `baseline-browser-mapping` from 2.9.14 to 2.9.15
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.9.14...v2.9.15)

Updates `caniuse-lite` from 1.0.30001764 to 1.0.30001765
- [Commits](browserslist/caniuse-lite@1.0.30001764...1.0.30001765)

---
updated-dependencies:
- dependency-name: "@next/mdx"
  dependency-version: 16.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: next
  dependency-version: 16.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@next/eslint-plugin-next"
  dependency-version: 16.1.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: eslint-config-next
  dependency-version: 16.1.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: pnpm
  dependency-version: 10.28.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@next/env"
  dependency-version: 16.1.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@next/swc-darwin-arm64"
  dependency-version: 16.1.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@next/swc-darwin-x64"
  dependency-version: 16.1.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@next/swc-linux-arm64-gnu"
  dependency-version: 16.1.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@next/swc-linux-arm64-musl"
  dependency-version: 16.1.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@next/swc-linux-x64-gnu"
  dependency-version: 16.1.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@next/swc-linux-x64-musl"
  dependency-version: 16.1.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@next/swc-win32-arm64-msvc"
  dependency-version: 16.1.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@next/swc-win32-x64-msvc"
  dependency-version: 16.1.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: baseline-browser-mapping
  dependency-version: 2.9.15
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: caniuse-lite
  dependency-version: 1.0.30001765
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jan 19, 2026
@vercel
Copy link

vercel bot commented Jan 19, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
github-oauth-example Error Error Jan 19, 2026 4:28pm

@github-actions github-actions bot enabled auto-merge (squash) January 19, 2026 16:28
@github-actions github-actions bot merged commit f60e802 into main Jan 19, 2026
5 of 6 checks passed
@github-actions github-actions bot deleted the dependabot/npm_and_yarn/npm-7c9698a986 branch January 19, 2026 16:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant