Skip to content

chore(deps): bump Next.js to 16.3.6 on main - #7319

Closed
mmabrouk wants to merge 1 commit into
mainfrom
fix/security-next-16.3.6
Closed

chore(deps): bump Next.js to 16.3.6 on main#7319
mmabrouk wants to merge 1 commit into
mainfrom
fix/security-next-16.3.6

Conversation

@mmabrouk

@mmabrouk mmabrouk commented Oct 4, 2026

Copy link
Copy Markdown
Member

Summary

Bump next from 16.3.3 to 16.3.6 in web/mobile/package.json and refresh web/pnpm-lock.yaml.

This applies the exact Dependabot patch from #7298 to main. That PR was merged only into release/v0.121.8.

Security alerts fixed

Hetzner verification

Tested from an isolated worktree based on main (9c9f97b7ca) on the Hetzner server.

  • pnpm install --frozen-lockfile: pass
  • pnpm lint-fix: pass (28 tasks; no file changes beyond the dependency patch)
  • pnpm --filter @agenta/mobile types:check: pass
  • pnpm build-mobile: pass with Next.js 16.3.6
  • docker build -f mobile/docker/Dockerfile.gh ...: pass; image b320243ddb6996373b61a6a58712825717ca9cd120f45f70fc1d35953ee07611
  • pnpm --filter @agenta/mobile test: 365 pass, 1 fail

The one failed test is verified as pre-existing on an unchanged clean main worktree. In both worktrees, tests/unit/projectPermission.test.ts expects checkPermissions to receive one argument, but the implementation also passes {queryParams: {project_id: "project-1"}}. The exact test and assertion diff are identical. This dependency patch does not change that code.

@dependabot Depandabot Bot
chore(deps): bump next from 16.3.3 to 16.3.6 in /web
69463cd 
Bumps [next](https://github.com/vercel/next.js) from 16.3.3 to 16.3.6.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.3...v16.3.6)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.3.6
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@coderabbitai

coderabbitai Bot commented Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used
📚 Code guidelines (2) 
web/mobile/AGENTS.md — auto-discovered
web/AGENTS.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository YAML (base), Organization UI (inherited)
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 4826fc81-9ff0-47f8-8259-61f5e9d28c61
📥 Commits

Reviewing files that changed from the base of the PR and between 9c9f97b and 69463cd.

⛔ Files ignored due to path filters (1)
  • web/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (1)
  • web/mobile/package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Summary

Summary by CodeRabbit

  • Chores
    • Updated the app’s underlying web platform. This maintenance release does not include any changes to app features or behavior visible to users. No new functionality or user-facing fixes are included in this update.

Walkthrough

The mobile package updates its declared Next.js dependency from version 16.3.3 to 16.3.6.

Changes

Mobile dependency update

Layer / File(s) Summary
Update Next.js version
web/mobile/package.json		 The declared Next.js version changes from 16.3.3 to 16.3.6.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 69463

No issue requiring a change before merge was identified for the mobile dependency update.

Architecture Summary

Architecture risk: 🔵 Low · up to 69463

The change affects 1 system.

Changed systems: web

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

  • observed — web (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

  • observed — Modified behavior in web/mobile/package.json: The next dependency version changed from 16.3.3 to 16.3.6.
🚥 Pre-merge checks | ✅ 4 | ❓ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Out of Scope Changes check ❓ Inconclusive The reviewed change to web/mobile/package.json updates next from 16.3.3 to 16.3.6, which matches the current PR scope. The PR description also identifies a lockfile refresh, but `web/pnpm-lock… Reviewable evidence of the web/pnpm-lock.yaml changes is needed to determine whether the full change set contains out-of-scope changes.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: upgrading Next.js to version 16.3.6.
Description check ✅ Passed The description explains the dependency update, the security alerts it addresses, and the reported verification results.
Linked Issues check ✅ Passed The only directly linked issue shown is #1544, which is closed and supplies historical context only. No active directly linked issue coding requirements apply.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Full details: Out of Scope Changes check

Explanation

The reviewed change to web/mobile/package.json updates next from 16.3.3 to 16.3.6, which matches the current PR scope. The PR description also identifies a lockfile refresh, but web/pnpm-lock.yaml is excluded from review and is not represented in the change summary. Its contents cannot be assessed for unrelated changes.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 4, 2026

Copy link
Copy Markdown
Contributor

Website preview

Preview URL: https://pr-7319-agenta-website-preview.mahmoud-637.workers.dev

Built from 69463cdda2adfedcd9fe95a445048d39f8e582f7. This comment updates in place on every push.

@github-actions

github-actions Bot commented Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Railway Preview Environment

Item Value
Status stopped
Commit 69463cdda2adfedcd9fe95a445048d39f8e582f7
Manual expiry (UTC) Not granted
CI deadline (UTC) Not granted
Workflow https://github.com/Agenta-AI/agenta/actions/runs/37185022704

Dependent tests finished. Post /preview for manual review. Environment absence verified; retained storage requires separate provider accounting.

Post /preview as a new comment to request a one-hour preview. Repeating it while active does not extend the hour.
Preview data is disposable. Expiry is enforced by the next successful cleanup sweep, not an exact timer.
Environment deletion stops its compute. Provider-retained storage and permanent services may still be billed.

@mmabrouk mmabrouk closed this Oct 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mmabrouk