Open
Conversation
Bumps [next](https://github.com/vercel/next.js) from 14.2.3 to 16.1.7. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.2.3...v16.1.7) --- updated-dependencies: - dependency-name: next dependency-version: 16.1.7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
❌ Deploy Preview for alloradocs failed. Why did it fail? →
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="package.json">
<violation number="1" location="package.json:4">
P0: Bumping `next` to 16.x will break the build because `nextra@2.13.4` uses a custom webpack plugin (`withNextra`) that is incompatible with Next.js 16's default Turbopack bundler. The Next.js 16 upgrade guide explicitly warns that custom webpack configurations will cause build failures. Nextra v2 was designed for Next.js 12–14; you need to upgrade `nextra` and `nextra-theme-docs` to v4+ (which supports Next.js 15+/16) before bumping Next.js, and adapt the project's configuration and content files accordingly.</violation>
</file>
Architecture diagram
sequenceDiagram
participant Client as Browser / Client
participant Proxy as HTTP Proxy (Rewrites)
participant App as Next.js Server Runtime
participant Img as Next Image Optimizer
participant Cache as LRU Disk/Response Cache
participant Action as Server Action / Route Handler
Note over Client, Action: Next.js 16.1.7 Runtime Request Flow
Client->>Proxy: Request (with Headers/Cookies)
Proxy->>Proxy: CHANGED: Validated via patched http-proxy
Note right of Proxy: Prevents Request Smuggling (CVE-2026-29057)
alt Image Request
Client->>Img: GET /_next/image?url=...
Img->>Cache: NEW: Check LRU Disk Cache
Note right of Cache: Respects images.maximumDiskCacheSize
alt Cache Hit
Cache-->>Img: Optimized Image
else Cache Miss
Img->>Img: Optimize Image
Img->>Cache: NEW: Store in LRU Disk Cache
end
Img-->>Client: 200 OK (Optimized Image)
end
alt Server Action Submission
Client->>Action: POST (Action ID)
Action->>Action: NEW: Validate Origin Context
Note right of Action: Blocks submissions from privacy-sensitive origins
opt Node Modules Integration
Action->>Action: NEW: Apply server actions transform
Note right of Action: Now supports node_modules in route handlers
end
Action-->>Client: Action Response
end
alt Data Fetching / Rendering
App->>App: CHANGED: Stream/Fetch Execution
Note right of App: Prevents streaming fetch hangs in dev mode
App->>Cache: NEW: Check Minimal Mode Response Cache
Note right of Cache: Uses Invocation ID scoping & LRU sentinel
App->>App: NEW: Enforce maxPostponedStateSize
Note right of App: Limits state size for PPR/postponed renders
App-->>Client: Rendered HTML / Stream
end
opt Dev Mode WebSockets
Client->>App: WebSocket Upgrade (Dev Server)
App->>App: NEW: Origin Validation
Note right of App: Blocks cross-site dev-only connections
end
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| "dependencies": { | ||
| "katex": "^0.16.11", | ||
| "next": "^14.2.3", | ||
| "next": "^16.1.7", |
There was a problem hiding this comment.
P0: Bumping next to 16.x will break the build because nextra@2.13.4 uses a custom webpack plugin (withNextra) that is incompatible with Next.js 16's default Turbopack bundler. The Next.js 16 upgrade guide explicitly warns that custom webpack configurations will cause build failures. Nextra v2 was designed for Next.js 12–14; you need to upgrade nextra and nextra-theme-docs to v4+ (which supports Next.js 15+/16) before bumping Next.js, and adapt the project's configuration and content files accordingly.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 4:
<comment>Bumping `next` to 16.x will break the build because `nextra@2.13.4` uses a custom webpack plugin (`withNextra`) that is incompatible with Next.js 16's default Turbopack bundler. The Next.js 16 upgrade guide explicitly warns that custom webpack configurations will cause build failures. Nextra v2 was designed for Next.js 12–14; you need to upgrade `nextra` and `nextra-theme-docs` to v4+ (which supports Next.js 15+/16) before bumping Next.js, and adapt the project's configuration and content files accordingly.</comment>
<file context>
@@ -1,7 +1,7 @@
"dependencies": {
"katex": "^0.16.11",
- "next": "^14.2.3",
+ "next": "^16.1.7",
"nextra": "^2.13.4",
"nextra-theme-docs": "^2.13.4",
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps next from 14.2.3 to 16.1.7.
Release notes
Sourced from next's releases.
... (truncated)
Commits
bdf3e35v16.1.7dc98c04[backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...9023c0a[backport] Disallow Server Action submissions from privacy-sensitive contexts...36a97b9Allow blocking cross-site dev-only websocket connections from privacy-sensiti...93c3993[backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...c68d62dBackport documentation fixes for 16.1.x (#90655)5214ac1[backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)c95e357Backport/docs fixes 16.1.x (#90125)cba6144[backport] Apply server actions transform tonode_modulesin route handlers...3db9063[backport] [Cache Components] Prevent streaming fetch calls from hanging in d...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Upgrade
nextfrom 14.2.3 to 16.1.7 to pick up security fixes, SWC updates, and improved caching/image handling. No app code changes included in this PR.Dependencies
nextto16.1.7.styled-jsx@5.1.6,@swc/helpers@0.5.15,baseline-browser-mapping.sharp@^0.34.4and platform binaries for Next Image.http-proxy).Migration
.next/, reinstall, rebuild.images.maximumDiskCacheSize(new LRU disk cache).Written for commit fd3c307. Summary will update on new commits.