Skip to content

chore(deps)(deps): Bump next from 15.5.18 to 16.2.6#40

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/next-16.2.6
Closed

chore(deps)(deps): Bump next from 15.5.18 to 16.2.6#40
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/next-16.2.6

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 20, 2026

Bumps next from 15.5.18 to 16.2.6.

Release notes

Sourced from next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

Moderate:

Low:

Core Changes

  • fix: preserve HTTP access fallbacks during prerender recovery (#92231)
  • Fix fallback route params case in app-page handler (#91737)
  • Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
  • Patch setHeader for direct route handlers (#93101)
  • Include deployment id in cacheHandlers keys (#93453)
  • Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

... (truncated)

Commits
  • ee6e79b v16.2.6
  • afa053d Turbopack: Match proxy matchers with webpack implementation (#93594)
  • 97a154e Turbopack: Fix middleware matcher suffix (#93590)
  • 83899bc [backport] Disable build caches for production/staging/force-preview deploys ...
  • 7b222b9 [backport][test] Pin package manager to patch versions (#93595)
  • a8dc24f [backport] Turbopack: more strict vergen setup (#93587)
  • 766148f v16.2.5
  • 0dd9483 fix: add explicit checks for RSC header (#83) (#98)
  • d166096 fix proxy matching for segment prefetch URLs (#89) (#96)
  • 9d50c0b Strip next-resume header from incoming requests (#92)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [next](https://github.com/vercel/next.js) from 15.5.18 to 16.2.6.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.5.18...v16.2.6)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.2.6
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 20, 2026

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@travisbreaks
Copy link
Copy Markdown
Owner

Closing as part of the 2026-05-20 GitHub audit pass. Tracked alongside the other three major-version dep bumps at #45 so the open-PR list stays clean for visitors. Dependabot will re-open this on its next scheduled run (Mondays 09:00 CT); the migration work belongs on a dedicated branch with its own validation pass.

@travisbreaks travisbreaks deleted the dependabot/npm_and_yarn/next-16.2.6 branch May 20, 2026 19:04
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 20, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

travisbreaks added a commit that referenced this pull request May 20, 2026
* docs: replace broken install snippets in README + docs

Caught during a final pre-send audit. The CDN snippet pointed at
`https://eats.travisfixes.com/v1.js`, which returns 401 (the worker
only serves API routes). The npm snippet pointed at
`@travisbreaks/travisEATSbugs`, which is not on the public npm
registry (the README's own Status line correctly states "Public npm
publish lands at v1.0.0", so the snippet contradicted itself).

This PR replaces both with paths that actually work today, mirroring
the fix that just landed on the marketing site:

- **README.md** Install section: script tag pointing at the
  travismakes.org bundle that the live demo uses, plus a vendor-from-
  repo path. Includes the canonical wiring snippet
  (`LocalStorageAdapter` + `AnnotationPageMode` + `init({ onToggle })`).
- **docs/install.md** fully rewritten. Four options (script tag,
  vendor bundle, pnpm pack, self-hosted worker) with a picking-guide
  table at the bottom. Honest note about `eats.travisfixes.com` being
  a not-public-signup destination today; public hosted tier lands in
  the `teb-cloud` repo per the strategic plan.
- **docs/architecture.md** Widget Delivery section: same swap; the
  `eats.travisfixes.com/v1.js` route is correctly framed as a v1.0
  deliverable, not a present-tense claim.

`client-facing-tenancy.md` line 239 still mentions `eats.travisfixes.com/v1.js`
but that file is a design doc for the multi-tenant Phase 2 work and
correctly describes future state. No change needed there.

No code or schema change. Tests + lint untouched. Em-dash gate green.

Co-Authored-By: Tadao <tadao@travisfixes.com>

* chore(memory): record colleague-send polish sprint in thread-state

Captures today's late-day work (post-Phase-1 sprint EOD wrap):

- PR #37 / #38 / #39 / #46 merged on TEB repo
- v0.0.10-alpha.0 release tagged + GitHub Release published
- 10 shipped roadmap issues closed with version pointers
- Dependabot merge train (#27-#30) merged; #31-#32 auto-closed by
  dependabot when ungrouping landed; #40-#44 closed with tracking
  issue #45 opened for major dep migrations
- CODE-side PR #231 merged + deployed (TEB marketing refresh +
  travisfixes.com em-dash sweep)
- GitHub profile README slimmed (Featured Projects + Stats + Stack
  cut; bio + 4 destination badges kept)
- Colleague-send (Adam Masonbrink + Rikard Arkebaeck at timeglass.ai)
  shipped after a final pre-send audit caught broken install
  snippets in the README and docs that would have looked bad to a
  CEO-level reader.

Memory note for future-self: pre-send audits must sweep README +
docs alongside marketing surfaces. The same broken install URL was
in four places and fixing one is not fixing the rest.

Co-Authored-By: Tadao <tadao@travisfixes.com>

---------

Co-authored-by: Tadao <tadao@travisfixes.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant