chore(deps): bump the web-deps group across 1 directory with 18 updates by dependabot[bot] · Pull Request #41 · breaching/krill-watch

dependabot · 2026-08-01T02:09:29Z

Bumps the web-deps group with 16 updates in the /web directory:

Package	From	To
@sentry/nextjs	`8.51.0`	`10.68.0`
maplibre-gl	`5.24.0`	`6.0.0`
next	`15.5.15`	`16.2.12`
react	`19.2.5`	`19.2.8`
@types/react	`19.2.14`	`19.2.17`
react-dom	`19.2.5`	`19.2.8`
@axe-core/playwright	`4.10.0`	`4.12.1`
@next/bundle-analyzer	`15.5.15`	`16.2.12`
@playwright/test	`1.59.1`	`1.62.0`
@tailwindcss/postcss	`4.2.4`	`4.3.3`
@testing-library/jest-dom	`6.9.1`	`7.0.0`
@types/node	`22.19.17`	`26.1.2`
@vitejs/plugin-react	`4.7.0`	`6.0.4`
happy-dom	`15.11.7`	`20.11.1`
typescript	`5.9.3`	`7.0.2`
vitest	`2.1.9`	`4.1.10`

Updates @sentry/nextjs from 8.51.0 to 10.68.0

Release notes

Sourced from @sentry/nextjs's releases.

10.68.0

feat(cloudflare): Add @sentry/cloudflare/vite orchestrion plugin (#21967)

feat(nestjs): Support WebSocket errors in SentryGlobalFilter (#22224)

feat(node,server-utils): Set cache.key on dataloader spans and capture redis delete operations as cache.remove (#22389)

feat(server-utils): Allow integrations to be part of marker (#22094)

feat(server-utils): Migrate FirebaseInstrumentation to orchestrion (#22141)

feat(server-utils): Warn when bundler config has instrumented module in external (#22379)

feat(v10): Add http.route attribute to http.server spans with parameterized routes (#22564)

feat(v10): Add url.full and url.path to http.server spans (#22533)

feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)

feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)

feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)

feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)

feat(v10/cloudflare): Read wrangler config and resolve the Sentry options module (#22538)

feat(v10/core): Add instrumentStateGraph API (#22491)

feat(v10/core): Add url.full attribute to core fetch instrumentation (#22436)

feat(v10/core): Support filtering stackFrameVariables by variable name (#22526)

feat(v10/react-router): Make instrumentation API the default (#22525)

fix(cloudflare,deno,node): Align types of vercelai (#22343)

fix(core): Instrument Anthropic client in place instead of via a deep proxy (#22305)

fix(replay): Set text/javascript MIME type on compression worker Blob (#22377)

fix(sveltekit): Adapt frame rewriting for kit 3 (#22407)

fix(v10): Pin @apm-js-collab/code-transformer-bundler-plugins to 0.7.1 (#22497)

fix(v10/cloudflare): Import prismaIntegration from server-utils (#22535)

fix(v10/core): Avoid functionToStringIntegration causing infinite recursions (#22527)

fix(v10/core): Avoid propagating baggage: "undefined" when DSC is missing (#22440)

chore: Add external contributor to CHANGELOG.md (#22342)

chore: Add external contributor to CHANGELOG.md (#22405)

chore(deps): Bump axios from 1.16.0 to 1.18.0 in /dev-packages/e2e-tests/test-applications/nestjs-basic (#22395)

chore(deps): Bump morgan from 1.10.0 to 1.11.0 (#22187)

chore(size-limit): weekly auto-bump (#22182)

ci(v10): Add v10 to build and license-compliance branch filters (#22499)

feat(deps): Bump axios from 1.16.0 to 1.18.0 (#22396)

ref(server-utils): Remove unneeded orchestrion config (#22384)

ref(server-utils): Small fastify cleanup (#22385)

test: Remove unnecessary test waits (#22383)

test(sveltekit-3): Fix import defineEnvVars from @sveltejs/kit/env (#22390)

test(v10/cloudflare): Add Vite-build support to the integration-test runner (#22539)

Work in this release was contributed by @psh4607 and @trinitiwowka. Thank you for your contributions!

Bundle size 📦

| Path | Size |

... (truncated)

Changelog

Sourced from @sentry/nextjs's changelog.

10.68.0

feat(cloudflare): Add @sentry/cloudflare/vite orchestrion plugin (#21967)

feat(nestjs): Support WebSocket errors in SentryGlobalFilter (#22224)

feat(node,server-utils): Set cache.key on dataloader spans and capture redis delete operations as cache.remove (#22389)

feat(server-utils): Allow integrations to be part of marker (#22094)

feat(server-utils): Migrate FirebaseInstrumentation to orchestrion (#22141)

feat(server-utils): Warn when bundler config has instrumented module in external (#22379)

feat(v10): Add http.route attribute to http.server spans with parameterized routes (#22564)

feat(v10): Add url.full and url.path to http.server spans (#22533)

feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)

feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)

feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)

feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)

feat(v10/cloudflare): Read wrangler config and resolve the Sentry options module (#22538)

feat(v10/core): Add instrumentStateGraph API (#22491)

feat(v10/core): Add url.full attribute to core fetch instrumentation (#22436)

feat(v10/core): Support filtering stackFrameVariables by variable name (#22526)

feat(v10/react-router): Make instrumentation API the default (#22525)

fix(cloudflare,deno,node): Align types of vercelai (#22343)

fix(core): Instrument Anthropic client in place instead of via a deep proxy (#22305)

fix(replay): Set text/javascript MIME type on compression worker Blob (#22377)

fix(sveltekit): Adapt frame rewriting for kit 3 (#22407)

fix(v10): Pin @apm-js-collab/code-transformer-bundler-plugins to 0.7.1 (#22497)

fix(v10/cloudflare): Import prismaIntegration from server-utils (#22535)

fix(v10/core): Avoid functionToStringIntegration causing infinite recursions (#22527)

fix(v10/core): Avoid propagating baggage: "undefined" when DSC is missing (#22440)

chore: Add external contributor to CHANGELOG.md (#22342)

chore: Add external contributor to CHANGELOG.md (#22405)

chore(deps): Bump axios from 1.16.0 to 1.18.0 in /dev-packages/e2e-tests/test-applications/nestjs-basic (#22395)

chore(deps): Bump morgan from 1.10.0 to 1.11.0 (#22187)

chore(size-limit): weekly auto-bump (#22182)

ci(v10): Add v10 to build and license-compliance branch filters (#22499)

feat(deps): Bump axios from 1.16.0 to 1.18.0 (#22396)

ref(server-utils): Remove unneeded orchestrion config (#22384)

ref(server-utils): Small fastify cleanup (#22385)

test: Remove unnecessary test waits (#22383)

test(sveltekit-3): Fix import defineEnvVars from @sveltejs/kit/env (#22390)

test(v10/cloudflare): Add Vite-build support to the integration-test runner (#22539)

Work in this release was contributed by @psh4607 and @trinitiwowka. Thank you for your contributions!

10.67.0

... (truncated)

Commits

b4396c3 release: 10.68.0
be21e8c meta(changelog): Update changelog for 10.68.0 (#22566)
fb0987f feat(v10): Add http.route attribute to http.server spans with parameteriz...
f7bd901 feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)
ed3a8c8 feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)
20227f9 feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)
3e5625e feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)
d924551 test(v10/cloudflare): Add Vite-build support to the integration-test runner (...
11fed03 feat(v10/cloudflare): Read wrangler config and resolve the Sentry options mod...
a540764 feat(v10): Add url.full and url.path to http.server spans (#22533)
Additional commits viewable in compare view

Updates maplibre-gl from 5.24.0 to 6.0.0

Release notes

Sourced from maplibre-gl's releases.

v6.0.0

The following incorporates all the pre-releases for version 6 changes. Check-out our migration guide from v5 to v6 for more information.

✨ Features and improvements

⚠️ Switch to an ESM-only distribution (maplibre-gl.mjs). The UMD bundles (maplibre-gl.js, maplibre-gl-csp.js) are no longer published. The CSP-specific bundle is also dropped: the ESM build loads its worker as a real URL, so worker-src blob: is no longer required. Consumers using <script src=".../maplibre-gl.js"> must switch to <script type="module">, and consumers using import maplibregl from 'maplibre-gl' must switch to import * as maplibregl from 'maplibre-gl' or named imports. See the docs ESM section or our migration guide for migration steps. (#6254) (by @birkskyum)

⚠️ Interpolate the light position in spherical coordinates instead of cartesian ones, so that a transition keeps its radial distance. (#7919) (by @HarelM)

⚠️ styleimagemissing is now a notify-only event instead of the previous callback that allowed to provide an image. This aligns the event with standard event semantics (notify, not resolve). Use Map.setMissingStyleImageResolver to on-demand supply images instead via an function that can now also be async. (#7892) (by @birkskyum)

⚠️ Map now composes a Camera instead of extending it (Map extends Evented directly and forwards the camera API). The internal map.transform was removed — use map's public API instead or open a PR if you need something that's not exposed. Removed the internal transform.getMatrixForModel helper (#7800) (by @HarelM)

⚠️ All map events are now real classes that are instantiated when they are fired. Renamed the Maps' BoxZoom handler from MapLibreZoomEvent to MapBoxZoomEvent, added the rollstart/roll/rollend and style.load (as MapStyleLoadEvent) events to MapEventType, and added event classes and type-map for Marker, Popup, GeolocateControl and FullscreenControl. Removed MapDataEvent: the data/dataloading/dataabort events are now MapSourceDataEvent | MapStyleDataEvent, so source data events carry the full source info (sourceId, tile, sourceDataType, …). Added MapMovementEvent as the type for all camera-transition events (move/zoom/rotate/pitch/roll/drag and their start/end variants). Evented is now generic over an event-type map (Evented<EventType>) and is abstract, so subclasses get strongly-typed on/once/off automatically without re-declaring overloads — this also types the events on Camera/Style (via MapEventType) and on the sources (via the new SourceEventType) (#7789) (by @HarelM)

⚠️ Update maplibre-gl-style-spec to version 25, which now throws an error with warning severity instead of silently failing on encoutering legacy expressions (#7792) (by @HarelM)

⚠️ Removed the remaining mapbox references in the code and in the tests. This changes the #pragma mapbox to #pragma maplibre in case you have shader code that relied on it. (#7761) (by @HarelM)

⚠️ zoomLevelsToOverscale default value was changed to 4 to support better handling of high level zoom with dense labels. This might have a side effect of changing a bit the results of queryRenderedFeatures and some rendering of polygon center label. To revert this change, set the value to undefined (#7537) (by @HarelM)

⚠️ Remove the second parameter from GeoJSONSource.setData (waitForCompletion) and remove the return value of this to allow future changes to the API (#7538) (by @HarelM)

⚠️ The TypeScript target has been updated to ES2022. This results in smaller bundles and improved runtime performance by relying on modern JavaScript features and reducing transpilation. Consumers targeting browsers or using some tooling released before 2022 may need to transpile MapLibre or update. This change also aligns all internal build configurations to a single target instead of ES2016 + ES2019, avoiding inconsistencies in emitted code. (#7404) (by @CommanderStorm)

⚠️ WebGL (v1) support has been removed; WebGL2 is now required. In practical terms, this will not change how you interact with the map. This enables performance improvements (e.g. line opacity), Terrain3D enhancements, and several bug fixes. WebGL2 support has been widely available for years, and usage of the legacy path had plateaued, so maintaining it no longer justified the added complexity. To ease this breaking change, we have also refactored how we handle the case that no webgl is avaliable (e.g. due to browser restrictions). You can now listen to the webgl error via .on("error"). See caniuse.com/webgl2 for ecosystem support and our RFC for details. (#7453) (by @CommanderStorm)

⚠️ Support geojson nested objects, this is a breaking change as it encodes __$json__ before properties that used to be an object. It also parses them back, but this is still a breaking change if you assumed this bug existed. (#6992) (by HarelM)

⚠️ Improve types for {get,set}LayoutProperty, {get,set}PaintProperty to be the actual type instead of string/any (#7481) (by @CommanderStorm)

⚠️ Refactored the Hash-based location control (the option that syncs map state to the URL like #map=5/1/2) to use URLSearchParams internally. This improves extensibility for custom use cases, but may break existing code that relies on the previous implementation. It also changes how certain edge cases are parsed—for example, strings like [#10](https://github.com/maplibre/maplibre-gl-js/issues/10)%2F3.00%2F-1.00 are now accepted, and hashes like #foo are normalized to #foo=. (#7073) (by @CommanderStorm)

Validate the terrain passed to map.setTerrain, which was previously applied unchecked (#7941) (by @HarelM)

Improve runtime error warnings to point at the offending style location (e.g. layers[3].paint.line-color, layers[3].filter) instead of just logging the bare error message (#7869) (by @CommanderStorm)

Improve terrain render-to-texture preparation performance by skipping sources that are not rendered to terrain textures (#7863) (by @DoFabien)

Add Map.setMissingStyleImageResolver for resolving missing style images with sync or async callbacks (#7850) (by @birkskyum)

Add RasterTileSource#setPremultiplyAlpha(false) to preserve raw RGBA tile values when alpha is used for data instead of opacity (#7235) (by @plantain).

Drop the archived @mapbox/whoots-js dependency by inlining its single getTileBBox helper (#7838) (by @qorexdevs)

Debounce setImages broadcast to once per animation frame, fixing O(n²) serialization overhead when adding many images (#7614) (by @bradymadden97)

Improve terrain rendering performance by avoiding unnecessary terrain data lookups during Mercator render-to-texture passes (#7833) (by @DoFabien)

Reduce allocation pressure while constructing DEM data and sampling terrain elevations (#7814) (by @DoFabien)

Reuse terrain DEM texture when preparing terrain (#7813) (by @DoFabien)

Add fill-layer-opacity and line-layer-opacity paint properties, which apply opacity to the entire layer output uniformly (#7570) (by @CommanderStorm)

Build main and worker in same build context to extract shared chunk (#7745) (by @dangkyokhoang)

Revert the line-opacity-driven offscreen rendering introduced in #7490 (#7764) (by @CommanderStorm). The overlap-artefact fix is now driven by line-layer-opacity instead.

Improve ProjectionData matrix backing types for renderer and custom layer projection matrices (#6316) (by @cat0825)

Optimization: vertex shader opacity culling for lines and fills #7711 (by @xavierjs)

Use a shared FBO for the terrain cache render to texture #7637 (by @xavierjs)

Use flat to opt out of interpolation for constant shader varyings (#7661) (by @birkskyum)

Replace texImage2D with texStorage2D for immutable textures (#7643) (by @birkskyum)

Enable mipmaps for non-power-of-two raster tiles, reducing aliasing at high pitch (#7641) (by @birkskyum)

Use GLSL ES 3.00 layout qualifiers for vertex attribute locations, replacing runtime bindAttribLocation calls (#7644) (by @birkskyum)

Adopt isolatedDeclarations and switch dts emitter from tsgo to oxc (#7566) (by @birkskyum)

Improve 3D terrain performance (#7549) (by @lucaswoj)

... (truncated)

Changelog

Sourced from maplibre-gl's changelog.

6.0.0

The following incorporates all the pre-releases for version 6 changes. Check-out our migration guide from v5 to v6 for more information.

✨ Features and improvements

⚠️ Switch to an ESM-only distribution (maplibre-gl.mjs). The UMD bundles (maplibre-gl.js, maplibre-gl-csp.js) are no longer published. The CSP-specific bundle is also dropped: the ESM build loads its worker as a real URL, so worker-src blob: is no longer required. Consumers using <script src=".../maplibre-gl.js"> must switch to <script type="module">, and consumers using import maplibregl from 'maplibre-gl' must switch to import * as maplibregl from 'maplibre-gl' or named imports. See the docs ESM section or our migration guide for migration steps. (#6254) (by @birkskyum)

⚠️ Interpolate the light position in spherical coordinates instead of cartesian ones, so that a transition keeps its radial distance. (#7919) (by @HarelM)

⚠️ styleimagemissing is now a notify-only event instead of the previous callback that allowed to provide an image. This aligns the event with standard event semantics (notify, not resolve). Use Map.setMissingStyleImageResolver to on-demand supply images instead via an function that can now also be async. (#7892) (by @birkskyum)

⚠️ Map now composes a Camera instead of extending it (Map extends Evented directly and forwards the camera API). The internal map.transform was removed — use map's public API instead or open a PR if you need something that's not exposed. Removed the internal transform.getMatrixForModel helper (#7800) (by @HarelM)

⚠️ All map events are now real classes that are instantiated when they are fired. Renamed the Maps' BoxZoom handler from MapLibreZoomEvent to MapBoxZoomEvent, added the rollstart/roll/rollend and style.load (as MapStyleLoadEvent) events to MapEventType, and added event classes and type-map for Marker, Popup, GeolocateControl and FullscreenControl. Removed MapDataEvent: the data/dataloading/dataabort events are now MapSourceDataEvent | MapStyleDataEvent, so source data events carry the full source info (sourceId, tile, sourceDataType, …). Added MapMovementEvent as the type for all camera-transition events (move/zoom/rotate/pitch/roll/drag and their start/end variants). Evented is now generic over an event-type map (Evented<EventType>) and is abstract, so subclasses get strongly-typed on/once/off automatically without re-declaring overloads — this also types the events on Camera/Style (via MapEventType) and on the sources (via the new SourceEventType) (#7789) (by @HarelM)

⚠️ Update maplibre-gl-style-spec to version 25, which now throws an error with warning severity instead of silently failing on encoutering legacy expressions (#7792) (by @HarelM)

⚠️ Removed the remaining mapbox references in the code and in the tests. This changes the #pragma mapbox to #pragma maplibre in case you have shader code that relied on it. (#7761) (by @HarelM)

⚠️ zoomLevelsToOverscale default value was changed to 4 to support better handling of high level zoom with dense labels. This might have a side effect of changing a bit the results of queryRenderedFeatures and some rendering of polygon center label. To revert this change, set the value to undefined (#7537) (by @HarelM)

⚠️ Remove the second parameter from GeoJSONSource.setData (waitForCompletion) and remove the return value of this to allow future changes to the API (#7538) (by @HarelM)

⚠️ The TypeScript target has been updated to ES2022. This results in smaller bundles and improved runtime performance by relying on modern JavaScript features and reducing transpilation. Consumers targeting browsers or using some tooling released before 2022 may need to transpile MapLibre or update. This change also aligns all internal build configurations to a single target instead of ES2016 + ES2019, avoiding inconsistencies in emitted code. (#7404) (by @CommanderStorm)

⚠️ WebGL (v1) support has been removed; WebGL2 is now required. In practical terms, this will not change how you interact with the map. This enables performance improvements (e.g. line opacity), Terrain3D enhancements, and several bug fixes. WebGL2 support has been widely available for years, and usage of the legacy path had plateaued, so maintaining it no longer justified the added complexity. To ease this breaking change, we have also refactored how we handle the case that no webgl is avaliable (e.g. due to browser restrictions). You can now listen to the webgl error via .on("error"). See caniuse.com/webgl2 for ecosystem support and our RFC for details. (#7453) (by @CommanderStorm)

⚠️ Support geojson nested objects, this is a breaking change as it encodes __$json__ before properties that used to be an object. It also parses them back, but this is still a breaking change if you assumed this bug existed. (#6992) (by HarelM)

⚠️ Improve types for {get,set}LayoutProperty, {get,set}PaintProperty to be the actual type instead of string/any (#7481) (by @CommanderStorm)

⚠️ Refactored the Hash-based location control (the option that syncs map state to the URL like #map=5/1/2) to use URLSearchParams internally. This improves extensibility for custom use cases, but may break existing code that relies on the previous implementation. It also changes how certain edge cases are parsed—for example, strings like [#10](https://github.com/maplibre/maplibre-gl-js/issues/10)%2F3.00%2F-1.00 are now accepted, and hashes like #foo are normalized to #foo=. (#7073) (by @CommanderStorm)

Validate the terrain passed to map.setTerrain, which was previously applied unchecked (#7941) (by @HarelM)

Improve runtime error warnings to point at the offending style location (e.g. layers[3].paint.line-color, layers[3].filter) instead of just logging the bare error message (#7869) (by @CommanderStorm)

Improve terrain render-to-texture preparation performance by skipping sources that are not rendered to terrain textures (#7863) (by @DoFabien)

Add Map.setMissingStyleImageResolver for resolving missing style images with sync or async callbacks (#7850) (by @birkskyum)

Add RasterTileSource#setPremultiplyAlpha(false) to preserve raw RGBA tile values when alpha is used for data instead of opacity (#7235) (by @plantain).

Drop the archived @mapbox/whoots-js dependency by inlining its single getTileBBox helper (#7838) (by @qorexdevs)

Debounce setImages broadcast to once per animation frame, fixing O(n²) serialization overhead when adding many images (#7614) (by @bradymadden97)

Improve terrain rendering performance by avoiding unnecessary terrain data lookups during Mercator render-to-texture passes (#7833) (by @DoFabien)

Reduce allocation pressure while constructing DEM data and sampling terrain elevations (#7814) (by @DoFabien)

Reuse terrain DEM texture when preparing terrain (#7813) (by @DoFabien)

Add fill-layer-opacity and line-layer-opacity paint properties, which apply opacity to the entire layer output uniformly (#7570) (by @CommanderStorm)

Build main and worker in same build context to extract shared chunk (#7745) (by @dangkyokhoang)

Revert the line-opacity-driven offscreen rendering introduced in #7490 (#7764) (by @CommanderStorm). The overlap-artefact fix is now driven by line-layer-opacity instead.

Improve ProjectionData matrix backing types for renderer and custom layer projection matrices (#6316) (by @cat0825)

Optimization: vertex shader opacity culling for lines and fills #7711 (by @xavierjs)

Use a shared FBO for the terrain cache render to texture #7637 (by @xavierjs)

Use flat to opt out of interpolation for constant shader varyings (#7661) (by @birkskyum)

Replace texImage2D with texStorage2D for immutable textures (#7643) (by @birkskyum)

Enable mipmaps for non-power-of-two raster tiles, reducing aliasing at high pitch (#7641) (by @birkskyum)

Use GLSL ES 3.00 layout qualifiers for vertex attribute locations, replacing runtime bindAttribLocation calls (#7644) (by @birkskyum)

Adopt isolatedDeclarations and switch dts emitter from tsgo to oxc (#7566) (by @birkskyum)

Improve 3D terrain performance (#7549) (by @lucaswoj)

... (truncated)

Commits

14dfbcf Bump js version to 6.0.0 (#7983)
422815f chore(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#7982)
e8e8999 chore(deps-dev): bump autoprefixer from 10.5.2 to 10.5.4 (#7969)
d28b4f9 chore(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 (#7978)
ed0909f chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.1 (#7972)
8959eee docs: Vite worker snippet needs ?worker&url, not ?url (#7981)
7997dbd chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#7979)
c2bb9e6 chore(deps-dev): bump vite from 8.1.4 to 8.1.5 (#7975)
91c9dc4 chore(deps): bump zensical/zensical from 0.0.50 to 0.0.51 (#7977)
fa56dd5 chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.1 (#7976)
Additional commits viewable in compare view

Updates next from 15.5.15 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Backport/docs fixes 16.2 - July round by @icyJoseph in vercel/next.js#96031

[Backport] Fixes to support TypeScript 7 by @lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Backport documentation fixes for v16.2 (#93804)

[backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)

[backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)

[backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)

[backport] Encode non-ASCII characters in cache tags at construction (#93918)

[backport] Fix server action forwarding loop with middleware rewrites (#93919)

[backport] Turbopack: switch from base40 to base38 hash encoding (#93932)

[ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

... (truncated)

Commits

2234717 v16.2.12
957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
b56eb16 Backport/docs fixes 16.2 - July round (#96031)
9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates react from 19.2.5 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

Type hardening and performance improvements (#36425 by @eps1lon and @unstubbable)

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

Type hardening and performance improvements (@eps1lon, @unstubbable #36425)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
6117d7c Version 19.2.7 (#36591)
eaf3e95 Version 19.2.6
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates @types/react from 19.2.14 to 19.2.17

Commits

See full diff in compare view

Updates react-dom from 19.2.5 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

Type hardening and performance improvements (#36425 by @eps1lon and @unstubbable)

Changelog

Sourced from react-dom's changelog.

19.2.7 (June 1, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

Type hardening and performance improvements (@eps1lon, @unstubbable #36425)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
6117d7c Version 19.2.7 (#36591)
eaf3e95 Version 19.2.6
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for reac...

Description has been truncated

Bumps the web-deps group with 16 updates in the /web directory: | Package | From | To | | --- | --- | --- | | [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `8.51.0` | `10.68.0` | | [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) | `5.24.0` | `6.0.0` | | [next](https://github.com/vercel/next.js) | `15.5.15` | `16.2.12` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.5` | `19.2.8` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.14` | `19.2.17` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.8` | | [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.10.0` | `4.12.1` | | [@next/bundle-analyzer](https://github.com/vercel/next.js/tree/HEAD/packages/next-bundle-analyzer) | `15.5.15` | `16.2.12` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.59.1` | `1.62.0` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.4` | `4.3.3` | | [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `6.9.1` | `7.0.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.17` | `26.1.2` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `4.7.0` | `6.0.4` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `15.11.7` | `20.11.1` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `2.1.9` | `4.1.10` | Updates `@sentry/nextjs` from 8.51.0 to 10.68.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.68.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@8.51.0...10.68.0) Updates `maplibre-gl` from 5.24.0 to 6.0.0 - [Release notes](https://github.com/maplibre/maplibre-gl-js/releases) - [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md) - [Commits](maplibre/maplibre-gl-js@v5.24.0...v6.0.0) Updates `next` from 15.5.15 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.15...v16.2.12) Updates `react` from 19.2.5 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `@types/react` from 19.2.14 to 19.2.17 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.5 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `@axe-core/playwright` from 4.10.0 to 4.12.1 - [Release notes](https://github.com/dequelabs/axe-core-npm/releases) - [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md) - [Commits](https://github.com/dequelabs/axe-core-npm/commits) Updates `@next/bundle-analyzer` from 15.5.15 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.2.12/packages/next-bundle-analyzer) Updates `@playwright/test` from 1.59.1 to 1.62.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.59.1...v1.62.0) Updates `@tailwindcss/postcss` from 4.2.4 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-postcss) Updates `@testing-library/jest-dom` from 6.9.1 to 7.0.0 - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](testing-library/jest-dom@v6.9.1...v7.0.0) Updates `@types/node` from 22.19.17 to 26.1.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 19.2.14 to 19.2.17 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@vitejs/plugin-react` from 4.7.0 to 6.0.4 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.4/packages/plugin-react) Updates `happy-dom` from 15.11.7 to 20.11.1 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v15.11.7...v20.11.1) Updates `playwright` from 1.59.1 to 1.62.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.59.1...v1.62.0) Updates `tailwindcss` from 4.2.4 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) Updates `vitest` from 2.1.9 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) --- updated-dependencies: - dependency-name: "@sentry/nextjs" dependency-version: 10.68.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: web-deps - dependency-name: maplibre-gl dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: web-deps - dependency-name: next dependency-version: 16.2.12 dependency-type: direct:production update-type: version-update:semver-major dependency-group: web-deps - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web-deps - dependency-name: "@types/react" dependency-version: 19.2.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-deps - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web-deps - dependency-name: "@axe-core/playwright" dependency-version: 4.12.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-deps - dependency-name: "@next/bundle-analyzer" dependency-version: 16.2.12 dependency-type: direct:development update-type: version-update:semver-major dependency-group: web-deps - dependency-name: "@playwright/test" dependency-version: 1.62.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-deps - dependency-name: "@tailwindcss/postcss" dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-deps - dependency-name: "@testing-library/jest-dom" dependency-version: 7.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: web-deps - dependency-name: "@types/node" dependency-version: 26.1.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: web-deps - dependency-name: "@types/react" dependency-version: 19.2.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: web-deps - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.4 dependency-type: direct:development update-type: version-update:semver-major dependency-group: web-deps - dependency-name: happy-dom dependency-version: 20.11.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: web-deps - dependency-name: playwright dependency-version: 1.62.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-deps - dependency-name: tailwindcss dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web-deps - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: web-deps - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-major dependency-group: web-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 1, 2026

Navigation Menu

chore(deps): bump the web-deps group across 1 directory with 18 updates - #41

chore(deps): bump the web-deps group across 1 directory with 18 updates#41
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/main/web-deps-615d2d692f

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

10.68.0

Bundle size 📦

10.68.0

10.67.0

v6.0.0

✨ Features and improvements

6.0.0

✨ Features and improvements

v16.2.12

What's Changed

v16.2.11

v16.2.10

v16.2.9

v16.2.8

v16.2.7

Core Changes

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.7 (June 1, 2026)

React Server Components

19.2.6 (May 6, 2026)

React Server Components

19.2.8 (July 21st, 2026)

React Server Components

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.7 (June 1, 2026)

React Server Components

19.2.6 (May 6, 2026)

React Server Components

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants