[github-actions]

This PR contains the following updates:

Package	Change	Age	Confidence
eslint-config-next (source)	16.4.0 → 16.4.3
next (source)	16.4.0 → 16.4.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

vercel/next.js (eslint-config-next)

v16.4.3

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• v16.4.2
• [lts-active] Fix extensionless Google font URLs in both bundlers (#​100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#​100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#​95732)" (#​100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#​100123)
• [lts-active] test: Pin react-virtualized (#​100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#​100572)
• [lts-active] Keep OpenTelemetry request traces together (#​100349, #​100294, #​100324, #​100350, #​100552, #​100583) (#​100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#​100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

v16.4.2

Compare Source

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#​99644, #​99732, #​99649) by @​lukesandberg in #​100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#​98823, #​99910, #​100091) by @​sokra in #​100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in #​100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in #​100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in #​100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in #​100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in #​100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in #​100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.