[dependabot]

Bumps next from 16.2.6 to 16.3.3.

Release notes

Sourced from next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in vercel/next.js#96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in vercel/next.js#96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in vercel/next.js#96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in vercel/next.js#96900
• [backport] Bump @​swc/helpers by @​mischnic in vercel/next.js#96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in vercel/next.js#97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in vercel/next.js#97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in vercel/next.js#97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in vercel/next.js#97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in vercel/next.js#97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in vercel/next.js#97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in vercel/next.js#97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in vercel/next.js#97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in vercel/next.js#97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in vercel/next.js#97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in vercel/next.js#97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in vercel/next.js#97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in vercel/next.js#97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @​gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

... (truncated)

Commits

• a9a1cb7 v16.3.3
• 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
• 3a15b4a [16.3.x] [next/image]: disable avif image optimization
• 7378b51 Backport/docs fixes 16.3 (#97649)
• 528c1cd [16.3.x] Stop generating error codes (#97780)
• d0ac882 v16.3.2
• 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
• cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[theguild-bot]

Apollo Federation Subgraph Compatibility Results

Federation 1 Support	Federation 2 Support
_service 🟢 @key (single) 🟢 @key (multi) 🟢 @key (composite) 🟢 repeatable @key 🟢 @requires 🟢 @provides 🟢 federated tracing 🟢	@link 🟢 @shareable 🟢 @tag 🟢 @override 🟢 @inaccessible 🟢 @composeDirective 🟢 @interfaceObject 🟢

Learn more:

• Apollo Federation Subgraph Specification
• Compatibility Tests

[theguild-bot]

✅ Yoga Benchmark Results

     ✓ no_errors{mode:graphql}
     ✓ expected_result{mode:graphql}
     ✓ no_errors{mode:graphql-jit}
     ✓ expected_result{mode:graphql-jit}
     ✓ no_errors{mode:graphql-response-cache}
     ✓ expected_result{mode:graphql-response-cache}
     ✓ no_errors{mode:graphql-no-parse-validate-cache}
     ✓ expected_result{mode:graphql-no-parse-validate-cache}
     ✓ no_errors{mode:uws}
     ✓ expected_result{mode:uws}

     checks.......................................: 100.00% ✓ 668302      ✗ 0     
     data_received................................: 2.7 GB  18 MB/s
     data_sent....................................: 114 MB  756 kB/s
     http_req_blocked.............................: avg=1.32µs   min=375ns    med=1.05µs   max=300.45µs p(90)=1.82µs   p(95)=2.13µs  
     http_req_connecting..........................: avg=1ns      min=0s       med=0s       max=146.12µs p(90)=0s       p(95)=0s      
     http_req_duration............................: avg=370.24µs min=161.29µs med=335.41µs max=17.28ms  p(90)=524.55µs p(95)=579.11µs
       { expected_response:true }.................: avg=370.24µs min=161.29µs med=335.41µs max=17.28ms  p(90)=524.55µs p(95)=579.11µs
     ✓ { mode:graphql-jit }.......................: avg=297.26µs min=161.29µs med=282.03µs max=13.76ms  p(90)=368.24µs p(95)=401.28µs
     ✓ { mode:graphql-no-parse-validate-cache }...: avg=562.33µs min=404.45µs med=541.57µs max=13.93ms  p(90)=636.67µs p(95)=672.6µs 
     ✓ { mode:graphql-response-cache }............: avg=335.84µs min=189.2µs  med=320.87µs max=9.18ms   p(90)=402.54µs p(95)=429.91µs
     ✓ { mode:graphql }...........................: avg=362.34µs min=203.56µs med=344.13µs max=17.28ms  p(90)=438.1µs  p(95)=475.62µs
     ✓ { mode:uws }...............................: avg=368.19µs min=221.88µs med=348.76µs max=12.34ms  p(90)=443.65µs p(95)=476.47µs
     http_req_failed..............................: 0.00%   ✓ 0           ✗ 334151
     http_req_receiving...........................: avg=32.13µs  min=8.4µs    med=30.54µs  max=2.75ms   p(90)=50.01µs  p(95)=53.97µs 
     http_req_sending.............................: avg=8.63µs   min=2.42µs   med=6.26µs   max=2.39ms   p(90)=14.71µs  p(95)=19.35µs 
     http_req_tls_handshaking.....................: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting.............................: avg=329.47µs min=145.48µs med=293.13µs max=17.1ms   p(90)=486.03µs p(95)=529.77µs
     http_reqs....................................: 334151  2227.655125/s
     iteration_duration...........................: avg=444.09µs min=203.46µs med=412.4µs  max=17.88ms  p(90)=600.18µs p(95)=668.46µs
     iterations...................................: 334151  2227.655125/s
     vus..........................................: 1       min=1         max=1   
     vus_max......................................: 2       min=2         max=2   

[github-actions]

🚀 Snapshot Release (alpha)

The latest changes of this PR are available as alpha on npm (based on the declared changesets):

Package	Version	Info
@envelop/opentelemetry	9.2.2-alpha-20260925145539-bc71998b166605665a826da3060fd3298527ee52	npm ↗︎ unpkg ↗︎

[dependabot]

A newer version of next exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.