chore(deps): bump next from 14.2.26 to 16.1.5 by dependabot[bot] · Pull Request #1981 · FuelLabs/fuels-wallet

dependabot · 2026-01-30T21:55:59Z

Bumps next from 14.2.26 to 16.1.5.

Release notes

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.1.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Only filter next config if experimental flag is enabled (#88733)

Credits

Huge thanks to @mischnic for helping!

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Fix linked list bug in LRU deleteFromLru (#88652)

Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @acdlite and @ijjk for helping!

v16.1.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Turbopack: Update to swc_core v50.2.3 (#87841) (#88296)

Fixes a crash when processing mdx files with multibyte characters. (#87713)

Turbopack: mimalloc upgrade and enabling it on musl (#88503) (#87815) (#88426)

Fixes a significant performance issue on musl-based Linux distributions (e.g. Alpine in Docker) related to musl's allocator.

Other platforms have always used mimalloc, but we previously did not use mimalloc on musl because of compilation issues that have since been resolved.

Credits

Huge thanks to @mischnic for helping!

v16.1.1

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

... (truncated)

Commits

acba4a6 v16.1.5
e1d1fc6 Add maximum size limit for postponed body parsing (#88175)
500ec83 fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
1caaca3 feat(next/image)!: add images.maximumResponseBody config (#88183)
522ed84 Sync DoS mitigations for React Flight
8cad197 [backport][cna] Ensure created app is not considered the workspace root in pn...
2718661 Backport/docs fixes (#89031)
5333625 Backport/docs fixes 16.1.5 (#88916)
60de6c2 v16.1.4
5f75d22 backport: Only filter next config if experimental flag is enabled (#88733) (#...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

cursor · 2026-01-30T21:56:05Z

PR Summary

Medium Risk
Framework major-version upgrade in the docs app may introduce build/runtime regressions or require config changes, even though the diff is a single dependency bump.

Overview
Updates the packages/docs Next.js dependency from 14.2.26 to 15.5.10 (no other dependency or code changes in this PR).

^{Written by Cursor Bugbot for commit fcd1189. This will update automatically on new commits. Configure here.}

cursor · 2026-02-03T17:30:06Z

    "hast-util-heading-rank": "^3.0.0",
    "hast-util-to-string": "^3.0.0",
-    "next": "14.2.26",
+    "next": "16.1.5",


MDX remote package incompatible with Next.js 16

High Severity

Upgrading next to 16.1.5 while keeping next-mdx-remote at 4.4.1 will likely cause runtime errors. There are documented compatibility issues between next-mdx-remote 4.x and Next.js 15+ that cause "Element rendered from older version of React" errors. The project actively uses MDXRemote in DocPage.tsx to render all documentation content, so this would break the entire docs site. The next-mdx-remote package needs to be upgraded to version 5.x for Next.js 16 compatibility.

Additional Locations (1)

packages/docs/package.json#L35-L36

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-19T01:24:53Z

CVE-2025-59471

    "hast-util-heading-rank": "^3.0.0",
    "hast-util-to-string": "^3.0.0",
-    "next": "14.2.26",
+    "next": "15.5.10",


Version mismatch: PR targets 16.1.5 but installs 15.5.10

Medium Severity

The PR title and description state this bumps next to 16.1.5 (a security release addressing CVE-2025-59471, CVE-2025-59472, and CVE-2026-23864), but the actual diff installs 15.5.10. While 15.5.10 fixes CVE-2025-59471, it does not include the fix for CVE-2025-59472 (PPR DoS, fixed only in 15.6.0-canary.61 and 16.1.5). This likely happened because Next.js 16 requires React 19, but the project uses React 18.3.1. Reviewers approving this PR may falsely believe all listed CVEs are addressed.

Bumps [next](https://github.com/vercel/next.js) from 14.2.26 to 16.1.5. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.2.26...v16.1.5) --- updated-dependencies: - dependency-name: next dependency-version: 16.1.5 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 30, 2026

dependabot Bot requested review from LuizAsFight and helciofranco as code owners January 30, 2026 21:56

dependabot Bot added the dependencies Pull requests that update a dependency file label Jan 30, 2026

dependabot Bot requested a review from nelitow as a code owner January 30, 2026 21:56

dependabot Bot added the javascript Pull requests that update javascript code label Jan 30, 2026

dependabot Bot mentioned this pull request Jan 30, 2026

chore(deps): bump next from 14.2.26 to 14.2.35 #1969

Closed

vercel Bot had a problem deploying to Preview January 30, 2026 21:56 Failure

cursor Bot reviewed Jan 30, 2026

View reviewed changes

Comment thread packages/docs/package.json Outdated

dependabot Bot force-pushed the dependabot/npm_and_yarn/next-16.1.5 branch from ad940ed to 16db5ee Compare February 3, 2026 17:25

cursor Bot reviewed Feb 3, 2026

View reviewed changes

vercel Bot had a problem deploying to Preview February 3, 2026 17:32 Failure

dependabot Bot force-pushed the dependabot/npm_and_yarn/next-16.1.5 branch from 16db5ee to 68cebd9 Compare February 3, 2026 17:32

vercel Bot had a problem deploying to Preview February 3, 2026 17:34 Failure

dependabot Bot force-pushed the dependabot/npm_and_yarn/next-16.1.5 branch from 68cebd9 to 0ed3d5f Compare February 19, 2026 01:20

vercel Bot had a problem deploying to Preview February 19, 2026 01:22 Failure

cursor Bot reviewed Feb 19, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/next-16.1.5 branch from 0ed3d5f to fcd1189 Compare February 23, 2026 18:17

vercel Bot had a problem deploying to Preview February 23, 2026 18:20 Failure

Navigation Menu

Uh oh!

chore(deps): bump next from 14.2.26 to 16.1.5 - #1981

chore(deps): bump next from 14.2.26 to 16.1.5#1981
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/next-16.1.5

dependabot Bot commented on behalf of github Jan 30, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jan 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

cursor Bot Feb 3, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.1.5

v16.1.4

Core Changes

Credits

v16.1.3

Core Changes

Credits

v16.1.2

Core Changes

Credits

v16.1.1

Uh oh!

cursor Bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

cursor Bot Feb 3, 2026

Choose a reason for hiding this comment

MDX remote package incompatible with Next.js 16

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Feb 19, 2026

Choose a reason for hiding this comment

Version mismatch: PR targets 16.1.5 but installs 15.5.10

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jan 30, 2026 •

edited

Loading

cursor Bot commented Jan 30, 2026 •

edited

Loading