[dependabot]

Bumps the npm-minor-patch group with 6 updates:

Package	From	To
@next/mdx	16.4.3	16.4.5
@next/third-parties	16.4.3	16.4.5
next	16.4.3	16.4.5
@opennextjs/cloudflare	1.20.15	1.20.16
eslint-config-next	15.5.28	15.5.29
wrangler	4.156.0	4.158.0

Updates @next/mdx from 16.4.3 to 16.4.5

Release notes

Sourced from @​next/mdx's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
• [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

Commits

• 4e5335a v16.4.5
• b175f52 v16.4.4
• See full diff in compare view

Updates @next/third-parties from 16.4.3 to 16.4.5

Release notes

Sourced from @​next/third-parties's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
• [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

Commits

• 4e5335a v16.4.5
• b175f52 v16.4.4
• See full diff in compare view

Updates next from 16.4.3 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
• [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

Commits

• 4e5335a v16.4.5
• 809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
• 2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
• 6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
• 18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
• e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
• d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
• 80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
• b175f52 v16.4.4
• ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
• Additional commits viewable in compare view

Updates @opennextjs/cloudflare from 1.20.15 to 1.20.16

Release notes

Sourced from @​opennextjs/cloudflare's releases.

@​opennextjs/cloudflare@​1.20.16

Patch Changes

• #1477 6fa9898 Thanks @​vicb! - fix: serve public files like Next.js when run_worker_first is enabled

  Public files are now only served at their exact path when run_worker_first is enabled, like Next.js.

  The build now checks the assets configuration when run_worker_first is enabled. If the build fails with "When run_worker_first is enabled, the assets section of the wrangler configuration must be...", update the assets section of your wrangler configuration:

  {
  	"assets": {
  		"directory": ".open-next/assets",
  		"binding": "ASSETS",
  		"run_worker_first": true,
  		// Serve public files at their exact path only, like Next.js
  		"html_handling": "none",
  		// "404-page" is also allowed
  		"not_found_handling": "none",
  	},
  }

  With this configuration, public/about.html is served at /about.html but not at /about.

• #1476 750d1b7 Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.15

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.15

• #1477 dbeff84 Thanks @​vicb! - fix: false-positive AVIF/HEIC image type detection

  The AVIF and HEIC detection now validates the size of the ISOBMFF ftyp box.

• #1474 5c429e7 Thanks @​vicb! - chore: require Next.js 15.5.29 or 16.4.5

  Raise the supported Next.js version floor to 15.5.29 and 16.4.5 to include the fixes from the Next.js security release on Nov 3.

• #1477 0c7e3e6 Thanks @​vicb! - fix: encode cache keys in the static assets incremental cache and the regional cache

  Cache keys are now encoded when they are turned into URLs, so that a key can not resolve to the entry of a different key.

Changelog

Sourced from @​opennextjs/cloudflare's changelog.

1.20.16

Patch Changes

• #1477 6fa9898 Thanks @​vicb! - fix: serve public files like Next.js when run_worker_first is enabled

  Public files are now only served at their exact path when run_worker_first is enabled, like Next.js.

  The build now checks the assets configuration when run_worker_first is enabled. If the build fails with "When run_worker_first is enabled, the assets section of the wrangler configuration must be...", update the assets section of your wrangler configuration:

  {
  	"assets": {
  		"directory": ".open-next/assets",
  		"binding": "ASSETS",
  		"run_worker_first": true,
  		// Serve public files at their exact path only, like Next.js
  		"html_handling": "none",
  		// "404-page" is also allowed
  		"not_found_handling": "none",
  	},
  }

  With this configuration, public/about.html is served at /about.html but not at /about.

• #1476 750d1b7 Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.15

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.15

• #1477 dbeff84 Thanks @​vicb! - fix: false-positive AVIF/HEIC image type detection

  The AVIF and HEIC detection now validates the size of the ISOBMFF ftyp box.

• #1474 5c429e7 Thanks @​vicb! - chore: require Next.js 15.5.29 or 16.4.5

  Raise the supported Next.js version floor to 15.5.29 and 16.4.5 to include the fixes from the Next.js security release on Nov 3.

• #1477 0c7e3e6 Thanks @​vicb! - fix: encode cache keys in the static assets incremental cache and the regional cache

  Cache keys are now encoded when they are turned into URLs, so that a key can not resolve to the entry of a different key.

Commits

• 5734269 Version Packages (#1475)
• dbeff84 fix: false-positive AVIF/HEIC image type detection
• 6fa9898 fix: serve public files like Next.js when run_worker_first is enabled
• 0c7e3e6 fix: encode cache keys in the static assets incremental cache and the regiona...
• 750d1b7 chore: bump @opennextjs/aws to 4.1.15 (#1476)
• 5c429e7 chore: require Next.js 15.5.29 or 16.4.5 (#1474)
• See full diff in compare view

Updates eslint-config-next from 15.5.28 to 15.5.29

Release notes

Sourced from eslint-config-next's releases.

v15.5.29

This release contains security fixes for the following advisories:

Moderate

• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

Commits

• 17014e9 v15.5.29
• See full diff in compare view

Updates wrangler from 4.156.0 to 4.158.0

Release notes

Sourced from wrangler's releases.

wrangler@4.158.0

Minor Changes

• #16186 f1d81a2 Thanks @​leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

  Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

  In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

• #16700 dc35efb Thanks @​cjol! - Bump bundled brace-expansion to pick up security fixes

  These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

• #16700 dc35efb Thanks @​cjol! - Bump bundled fast-xml-parser from 4.4.1 to 4.5.5 to pick up security fixes

  Miniflare bundles fast-xml-parser into its local R2 S3 API, and Wrangler bundles it through the AWS SDK used by wrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.

• #16700 dc35efb Thanks @​cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

  These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

• #16700 dc35efb Thanks @​cjol! - Bump bundled shell-quote from 1.10.0 to 1.11.0 to pick up a security fix

  shell-quote is bundled into Wrangler, which uses it to parse and quote shell commands such as custom build and Pages dev commands. Version 1.10.0 is affected by a published advisory, and 1.11.0 includes the fix. Command parsing does not change.

• #16700 dc35efb Thanks @​cjol! - Bump bundled yaml from 2.8.1 to 2.9.0 to pick up a security fix

  yaml is bundled into Wrangler, which uses it to show container application details. Version 2.8.1 is affected by a published advisory, and versions from 2.8.3 onwards include the fix. Output does not change.

• #16688 fa3edb3 Thanks @​FlorentCollin! - Use the account_id from the configuration file in wrangler d1 migrations list --remote

  Before this change, the command ignored the account_id in the configuration file. When your login had access to more than one account, the command failed in non-interactive mode. In interactive mode, it asked you to select an account. The command now uses the configured account_id, as wrangler d1 migrations apply does.

• #16695 b2061f4 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16695 b2061f4 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261103.1	^5.20261104.1
  workerd	1.20261103.1	1.20261104.1

• #16306 36e64f2 Thanks @​efalcao! - Report Cloudflare Access login redirects on remote bindings instead of looping until "Too many redirects"

... (truncated)

Commits

• c579d50 Version Packages (#16681)
• f1d81a2 [miniflare] Enable local Artifacts in development tools [3/3] (#16186)
• dc35efb Bump dependencies to clear 101 Dependabot alerts (#16700)
• 4d88a45 [miniflare] Stabilize Artifacts integration tests on Windows (#16693)
• 0083f80 [wrangler] Harden the local KV pagination regression test (#16697)
• fa3edb3 [wrangler] Use config account_id in d1 migrations list --remote (#16688)
• 9a0732c Version Packages (#16654)
• 44d1ee4 fix(wrangler): stop wrangler delete orphaning Container applications (#16011)
• 8ac43df Require explicit route metadata flags when downloading Worker configuration (...
• 680666e Version Packages (#16646)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.