deps(website): bump eslint-config-next from 16.3.8 to 16.4.2 in /website in the nextjs group across 1 directory by dependabot[bot] · Pull Request #895 · iris-eval/mcp-server

dependabot · 2026-10-22T16:54:40Z

Bumps the nextjs group with 1 update in the /website directory: eslint-config-next.

Updates eslint-config-next from 16.3.8 to 16.4.2

Release notes

Sourced from eslint-config-next's releases.

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

Show compiler plugin warning in more situations: #75682

fix(scripts): correct typo in rm.mjs error message: #87015

docs: improve clarity and punctuation in README: #86096

Fix debug build paths Pages Router support entries: #93529

bundle-analyzer: record historical snapshots on each analyze run: #93520

fix: detect proxy.ts correctly with compound pageExtensions: #93246

feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

docs: correction to dynamicParams migration: #96624

docs: proxy event argument: #96435

docs: remove experimental note from runtime prefetching: #96615

Preserve per-segment prefetching after dynamic navigation: #96583

Rename static generation stream option to waitForAllReady: #96564

Remove obsolete static generation plumbing: #96563

[turbopack] Drop dead writes to exports: #96381

[turbopack] Ignore writes to exports after a module.exports = {} writes: #96380

[turbopack] Add test for sideEffects with optimizePackageImports: #96549

[turbopack] Strip leading BOM before parsing CSS: #96678

Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550

... (truncated)

Commits

2864b17 v16.4.2
7217011 v16.4.1
e273d5b v16.4.0
c3e76ad v16.4.0-canary.63
ccf8c15 v16.4.0-canary.62
27ee721 v16.4.0-canary.61
907721a eslint-config-next: support ESLint 10 (#99628)
cdf6866 v16.4.0-canary.60
ba80ee4 v16.4.0-canary.59
1bcedb4 v16.4.0-canary.58
Additional commits viewable in compare view

github-actions · 2026-10-22T17:05:27Z

Iris gate — 1 of 2 tripped `--fail-on detector_veto`

iris-eval ingest: 3 stored, 1 tripped --fail-on detector_veto (2 of 3 evaluated in dataset "release-gate")

Trace	Verdict	Basis	Rules, classes or missing inputs	Evidence
`1437dab0c43f67cb949016bb9fe61407`	failed	`detector_veto` + `risk_over_loss`	no_pii, pii_leak, credential_leak	no_pii: AWS Access Key (output 45–65)

Verdict basis	Traces
`detector_veto`	2
`clean`	1

Unjudged questions: task_completed (3), tool_use_correct (3) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/traces.ndjson · 3 evaluated · dataset release-gate: 2 in the gate · exit 1 · what the bases mean}

github-actions · 2026-10-22T17:05:30Z

Iris gate — 1 stored, nothing tripped `--fail-on any`

iris-eval ingest: 1 stored, 0 tripped --fail-on any

Verdict basis	Traces
`clean`	1

Unjudged questions: task_completed (1), tool_use_correct (1) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/clean.ndjson · 1 evaluated · exit 0 · what the bases mean}

package.json takes the ranges #874 and #895 set; eslint-config-next stays an exact 16.4.2, the version next is on. - @babel/generator 7.29.7 -> 7.29.8 - @babel/helpers 7.29.7 -> 7.29.10 - @babel/parser 7.29.7 -> 7.29.9 - @babel/traverse 7.29.7 -> 7.29.10 - @babel/types 7.29.7 -> 7.29.8 - @next/eslint-plugin-next 16.3.8 -> 16.4.2 - @radix-ui/primitive 1.1.7 -> 1.2.0 - @radix-ui/react-collection 1.1.15 -> 1.2.0 - @radix-ui/react-collection > @radix-ui/react-compose-refs 1.1.5 (nested copy removed; the hoisted copy now satisfies it) - @radix-ui/react-compose-refs 1.1.5 (new nested copy) - @radix-ui/react-context 1.2.2 -> 1.3.0 - @radix-ui/react-direction 1.1.4 -> 1.2.0 - @radix-ui/react-presence 1.1.10 -> 1.1.11 - @radix-ui/react-primitive 2.1.10 -> 2.2.0 - @radix-ui/react-roving-focus 1.1.19 -> 1.2.1 - @radix-ui/react-roving-focus > @radix-ui/react-compose-refs 1.1.5 (nested copy removed; the hoisted copy now satisfies it) - @radix-ui/react-slot 1.3.3 -> 1.5.0 - @radix-ui/react-slot > @radix-ui/react-compose-refs 1.1.5 (nested copy removed; the hoisted copy now satisfies it) - @radix-ui/react-tabs 1.1.21 -> 1.2.1 - @radix-ui/react-toggle 1.1.18 -> 1.2.1 - @radix-ui/react-use-callback-ref 1.1.4 -> 1.1.5 - @radix-ui/react-use-controllable-state 1.2.6 -> 1.3.0 - @radix-ui/react-visually-hidden 1.2.11 -> 1.2.13 - @types/node 26.6.3 -> 26.6.5 - baseline-browser-mapping 2.11.20 -> 2.11.30 - browserslist 4.28.8 -> 4.29.4 - caniuse-lite 1.0.30001810 -> 1.0.30001817 - electron-to-chromium 1.5.420 -> 1.5.462 - eslint-config-next 16.3.8 -> 16.4.2 - eslint-plugin-react-hooks 7.0.1 -> 7.1.1 - node-releases 2.0.54 -> 2.0.59 - update-browserslist-db 1.3.2 -> 1.3.4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bumps the nextjs group with 1 update in the /website directory: [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next). Updates `eslint-config-next` from 16.3.8 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.2/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nextjs ... Signed-off-by: dependabot[bot] <support@github.com>

… updates (#901) * build: pnpm 11 and later build Iris from a clone again; two dependency updates unblocked - pnpm 11 stopped reading settings from package.json, so `pnpm install` refused the install scripts of better-sqlite3 and esbuild (ERR_PNPM_IGNORED_BUILDS) and exited 1 on pnpm 11 and 12, and `pnpm install && pnpm run build`, the command Glama runs, never built. The allow-list moves back to pnpm-workspace.yaml, as `allowBuilds` (pnpm 11 and later) and `onlyBuiltDependencies` (pnpm 10). Checked in node:22 from a clean tree on pnpm 10.34.9, 11.28.8 and 12.15.0: install and build exit 0, better-sqlite3 loads, and check-tools-listed lists all 12 tools. The fresh-clone-build job now runs on pnpm 10 and on the newest pnpm, and requires the native module to have been built. - jsdom 30.1.3 reports the computed `background` shorthand in full, so two dashboard badge tests compare `backgroundColor` instead (unblocks #893). - openai 3 is ignored in examples/otel-recipes: llama-index-llms-openai 0.8.2 and 0.8.3 both declare openai<3 (#851). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * deps: the root lockfile, Dependabot #869 #880 #881 #882 in one Lockfile-only updates within the existing package.json ranges. vitest and @vitest/coverage-v8 move together (they pin each other exactly), as do the typescript-eslint parser and plugin. Each package is at the newest patch on the line its PR proposed that is at least five days old (the repo's Dependabot cooldown); @modelcontextprotocol/sdk 1.32.2 (published 2026-10-23) is left for the next run. vite stays 8.3.5: #880's own lockfile had written it back to 8.3.4. - @eslint-community/eslint-utils 4.9.1 -> 4.10.1 - @modelcontextprotocol/sdk 1.32.0 -> 1.32.1 - @playwright/test 1.63.0 -> 1.64.1 - @types/node 26.6.3 -> 26.6.5 - @typescript-eslint/eslint-plugin 8.71.0 -> 8.71.2 - @typescript-eslint/parser 8.71.0 -> 8.71.2 - @typescript-eslint/project-service 8.71.0 -> 8.71.2 - @typescript-eslint/scope-manager 8.71.0 -> 8.71.2 - @typescript-eslint/tsconfig-utils 8.71.0 -> 8.71.2 - @typescript-eslint/type-utils 8.71.0 -> 8.71.2 - @typescript-eslint/types 8.71.0 -> 8.71.2 - @typescript-eslint/typescript-estree 8.71.0 -> 8.71.2 - @typescript-eslint/utils 8.71.0 -> 8.71.2 - @typescript-eslint/visitor-keys 8.71.0 -> 8.71.2 - @vitest/coverage-v8 5.0.3 -> 5.0.5 - @vitest/istanbul-lib-coverage 1.0.1 -> 1.0.2 - @vitest/istanbul-lib-report 1.0.1 -> 1.0.2 - @vitest/mocker 5.0.3 -> 5.0.5 - @vitest/spy 5.0.3 -> 5.0.5 - acorn 8.16.0 -> 8.19.0 - ast-v8-to-istanbul 1.0.6 -> 1.0.7 - content-disposition 1.0.1 -> 2.0.1 - eslint 10.11.0 -> 10.13.0 - eslint > ajv 6.14.0 -> 6.15.0 - express 5.2.1 -> 5.3.0 - express-rate-limit 8.7.0 -> 8.7.1 - express > content-type 2.1.0 (new nested copy) - magic-string 1.4.2 -> 1.4.3 - minimatch 10.2.5 -> 10.2.6 - nanoid 3.3.19 -> 3.3.20 - obug 2.2.1 -> 3.0.0 - pino 10.3.1 -> 10.4.0 - pino > real-require 1.0.0 (new nested copy) - playwright 1.63.0 -> 1.64.1 - playwright-core 1.63.0 -> 1.64.1 - postcss 8.5.28 -> 8.5.31 - prettier 3.9.9 -> 3.9.10 - safe-regex2 5.1.1 -> 5.1.2 - tinybench 6.2.0 -> 6.2.2 - tinyrainbow 3.1.1 -> 3.2.0 - vitest 5.0.3 -> 5.0.5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * deps(dashboard): Dependabot #891 #893 in one package.json takes the ranges #891 and #893 set, plus @typescript-eslint/parser ^8.71.2 to match the plugin it pairs with. The storybook addons lock at 10.6.3, the version storybook itself is already on. - @asamuzakjp/css-color 7.1.2 -> 7.1.7 - @asamuzakjp/dom-selector 9.2.2 -> 10.0.4 - @csstools/css-calc 3.4.1 -> 3.4.3 - @csstools/css-color-parser 4.2.4 -> 4.2.6 - @csstools/css-parser-algorithms 4.0.1 -> 4.0.2 - @csstools/css-syntax-patches-for-csstree 1.1.14 -> 1.1.15 - @storybook/addon-docs 10.6.1 -> 10.6.3 - @storybook/builder-vite 10.6.1 -> 10.6.3 - @storybook/react 10.6.1 -> 10.6.3 - @storybook/react-dom-shim 10.6.1 -> 10.6.3 - @storybook/react-vite 10.6.1 -> 10.6.3 - @testing-library/user-event 14.6.7 -> 14.6.8 - @typescript-eslint/eslint-plugin 8.71.0 -> 8.71.2 - @typescript-eslint/parser 8.71.0 -> 8.71.2 - @typescript-eslint/project-service 8.71.0 -> 8.71.2 - @typescript-eslint/scope-manager 8.71.0 -> 8.71.2 - @typescript-eslint/tsconfig-utils 8.71.0 -> 8.71.2 - @typescript-eslint/type-utils 8.71.0 -> 8.71.2 - @typescript-eslint/types 8.71.0 -> 8.71.2 - @typescript-eslint/typescript-estree 8.71.0 -> 8.71.2 - @typescript-eslint/utils 8.71.0 -> 8.71.2 - @typescript-eslint/visitor-keys 8.71.0 -> 8.71.2 - @vitejs/plugin-react 6.1.1 -> 6.1.2 - @vitest/mocker 5.0.3 -> 5.0.5 - @vitest/spy 5.0.3 -> 5.0.5 - data-urls 7.0.0 -> 8.0.0 - eslint 10.11.0 -> 10.13.0 - jsdom 30.1.1 -> 30.1.3 - jsdom > whatwg-url 17.1.2 (nested copy removed; the hoisted copy now satisfies it) - lucide-react 1.52.0 -> 1.58.0 - magic-string 1.4.2 -> 1.4.3 - obug 2.2.1 -> 3.0.0 - react 19.3.0 -> 19.3.1 - react-dom 19.3.0 -> 19.3.1 - resolve 1.22.12 -> 1.22.13 - tinybench 6.2.0 -> 6.2.2 - tr46 6.0.0 -> 7.0.0 - vitest 5.0.3 -> 5.0.5 - whatwg-url 16.0.1 -> 17.3.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * deps(website): Dependabot #872 #874 #895 in one package.json takes the ranges #874 and #895 set; eslint-config-next stays an exact 16.4.2, the version next is on. - @babel/generator 7.29.7 -> 7.29.8 - @babel/helpers 7.29.7 -> 7.29.10 - @babel/parser 7.29.7 -> 7.29.9 - @babel/traverse 7.29.7 -> 7.29.10 - @babel/types 7.29.7 -> 7.29.8 - @next/eslint-plugin-next 16.3.8 -> 16.4.2 - @radix-ui/primitive 1.1.7 -> 1.2.0 - @radix-ui/react-collection 1.1.15 -> 1.2.0 - @radix-ui/react-collection > @radix-ui/react-compose-refs 1.1.5 (nested copy removed; the hoisted copy now satisfies it) - @radix-ui/react-compose-refs 1.1.5 (new nested copy) - @radix-ui/react-context 1.2.2 -> 1.3.0 - @radix-ui/react-direction 1.1.4 -> 1.2.0 - @radix-ui/react-presence 1.1.10 -> 1.1.11 - @radix-ui/react-primitive 2.1.10 -> 2.2.0 - @radix-ui/react-roving-focus 1.1.19 -> 1.2.1 - @radix-ui/react-roving-focus > @radix-ui/react-compose-refs 1.1.5 (nested copy removed; the hoisted copy now satisfies it) - @radix-ui/react-slot 1.3.3 -> 1.5.0 - @radix-ui/react-slot > @radix-ui/react-compose-refs 1.1.5 (nested copy removed; the hoisted copy now satisfies it) - @radix-ui/react-tabs 1.1.21 -> 1.2.1 - @radix-ui/react-toggle 1.1.18 -> 1.2.1 - @radix-ui/react-use-callback-ref 1.1.4 -> 1.1.5 - @radix-ui/react-use-controllable-state 1.2.6 -> 1.3.0 - @radix-ui/react-visually-hidden 1.2.11 -> 1.2.13 - @types/node 26.6.3 -> 26.6.5 - baseline-browser-mapping 2.11.20 -> 2.11.30 - browserslist 4.28.8 -> 4.29.4 - caniuse-lite 1.0.30001810 -> 1.0.30001817 - electron-to-chromium 1.5.420 -> 1.5.462 - eslint-config-next 16.3.8 -> 16.4.2 - eslint-plugin-react-hooks 7.0.1 -> 7.1.1 - node-releases 2.0.54 -> 2.0.59 - update-browserslist-db 1.3.2 -> 1.3.4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * deps(sdk): Dependabot #878 devDependencies take the ranges #878 set; the open peer ranges are unchanged. ai locks at 7.0.147, the newest patch at least five days old (7.0.148 to 7.0.153 are newer). - @ai-sdk/gateway 4.0.103 -> 4.0.120 - @ai-sdk/provider 4.0.21 -> 4.0.31 - @ai-sdk/provider-utils 5.0.53 -> 5.0.64 - @anthropic-ai/sdk 0.131.0 -> 0.132.1 - ai 7.0.127 -> 7.0.147 - openai 7.27.0 -> 7.30.1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * deps(langchain): Dependabot #879 devDependencies take the ranges #879 set; the peer range is unchanged. @langchain/core locks at 1.2.19, the newest patch at least five days old (1.2.20 is newer); langsmith 0.11 is what core 1.2.19 requires. - @langchain/core 1.2.14 -> 1.2.19 - @langchain/langgraph 1.4.18 -> 1.4.21 - @langchain/langgraph-checkpoint 1.1.5 -> 1.2.0 - @langchain/langgraph-sdk 1.12.0 -> 1.12.5 - @langchain/langgraph-sdk > p-queue 9.3.3 -> 9.3.5 - langsmith 0.10.5 -> 0.11.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci: Dependabot #873 #877 #883 in one The same pins those PRs proposed (commit sha and version comment), applied to every workflow as it is now, ci.yml included after #899. The four codeql-action steps in codeql.yml and scorecard.yml move together, as CodeQL requires. 73 lines in 12 workflows; no old pin is left. - actions/setup-node v7.0.0 (8207627) -> v7.1.0 (949feb2), 43 lines - actions/upload-artifact v7.0.1 (043fb46) -> v7.0.2 (cf430e0), 13 lines - actions/download-artifact v8.0.1 (3e5f45b) -> v8.0.2 (9000827), 12 lines - github/codeql-action init, autobuild, analyze, upload-sarif v4.38.2 (2892aa5) -> v4.39.0 (6f2ac81), 4 lines - ossf/scorecard-action v2.4.4 (2d11466) -> v2.5.0 (fa7117d), 1 line Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * deps(examples): Dependabot #902, zod 4.6.5 -> 4.6.7 in the OpenTelemetry JS recipe (GHSA-mrhx-c7xc-m3w5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

dependabot · 2026-10-25T21:01:10Z

Looks like eslint-config-next is no longer updatable, so this is no longer needed.

dependabot Bot requested a review from irparent as a code owner October 22, 2026 16:54

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 22, 2026

irparent mentioned this pull request Oct 25, 2026

Build from a clone with pnpm 11 and later, and this week's dependency updates #901

Merged

dependabot Bot force-pushed the dependabot/npm_and_yarn/website/nextjs-03556a4c12 branch from f25af3b to 0237376 Compare October 25, 2026 20:31

dependabot Bot closed this Oct 25, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/website/nextjs-03556a4c12 branch October 25, 2026 21:01

Navigation Menu

Repository navigation

deps(website): bump eslint-config-next from 16.3.8 to 16.4.2 in /website in the nextjs group across 1 directory - #895

deps(website): bump eslint-config-next from 16.3.8 to 16.4.2 in /website in the nextjs group across 1 directory#895
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/website/nextjs-03556a4c12

dependabot Bot commented on behalf of github Oct 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.4.2

What's Changed

v16.4.1

v16.4.0

Core Changes

Misc Changes

Uh oh!

github-actions Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Iris gate — 1 of 2 tripped --fail-on detector_veto

Uh oh!

github-actions Bot commented Oct 22, 2026

Iris gate — 1 stored, nothing tripped --fail-on any

Uh oh!

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 22, 2026 •

edited

Loading

github-actions Bot commented Oct 22, 2026 •

edited

Loading

Iris gate — 1 of 2 tripped `--fail-on detector_veto`

Iris gate — 1 stored, nothing tripped `--fail-on any`