chore(deps-dev): Bump the react-next group in /packages/rust-auth with 3 updates - #114
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps the react-next group in /packages/rust-auth with 3 updates: [next](https://github.com/vercel/next.js), [react](https://github.com/react/react/tree/HEAD/packages/react) and [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom). Updates `next` from 16.2.10 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.10...v16.2.12) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) --- updated-dependencies: - dependency-name: next dependency-version: 16.2.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: react-next - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: react-next - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: react-next ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
msalvatti
added a commit
that referenced
this pull request
Aug 2, 2026
…e peer range Takes the react half of the grouped bump #114 opened, and leaves out the part that would cost consumers something. Dependabot raises the peer range alongside the dev dependency, which would have moved `peerDependencies.react` from `^19.0.0` to `^19.2.8` — every consumer on an earlier 19.x forced to upgrade for no reason. A peer range states what the library SUPPORTS, not what it was last tested against, and nothing here stops working on react 19.0. `next` is the opposite case and keeps its raised floor: there the range is what decides whether a consumer can end up on a version carrying the middleware bypass. Verified under react 19.2.8 and next 16.2.12: install, bundle, `tsc`, lint, the Vitest suite, and the `react-vite` example's production build.
Member
|
Incorporated into #113, minus one part. The
Checked before closing that nothing is lost: none of the react advisories apply (the open alerts on this repo are |
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/packages/rust-auth/react-next-46e45a7888
branch
August 2, 2026 14:01
msalvatti
added a commit
that referenced
this pull request
Aug 2, 2026
…sories (#113) peerDependencies.next was ^16.2.10 — the exact version carrying eight open advisories fixed in 16.2.11, three of them high. One is why this is not routine dependency hygiene: Next.js Middleware / Proxy bypass in App Router applications. Crafted requests against an app built with Turbopack and a single config.i18n.locales entry bypass middleware-based authentication, and the advisory's own workaround is to stop relying on middleware alone. The ./nextjs surface of this package IS that middleware. ^16.2.11 is still a range, so every later 16.x satisfies it and nothing is pinned. Also here: - react and react-dom move to 19.2.8 as dev dependencies, taking the useful half of the grouped bump #114 opened. Its peer-range narrowing is deliberately left out: a peer range states what the library SUPPORTS, and nothing stops working on react 19.0. - engines.node goes from >=18.0.0 to >=20.9.0. It was promising a floor at which the package's own declared peers cannot install. Node 18 has been EOL since April 2025; CI has been on 24 throughout. - The nextjs and smoke-npm examples resolve a single Next. 16.2.11 gave NextURL an [Internal] property keyed by a unique symbol, which TypeScript treats as distinct per declaration file — so two INSTALLS of the identical version stopped being assignable, and the examples have one Next of their own beside the package's. A consumer never hits this: next is a peer dependency, so a registry install leaves one copy. - examples/react-vite/package-lock.json regenerated; it still embedded the pre-bump peer range because npm ci reads the lockfile rather than rewriting it. Verified from a clean state (rm -rf .next, which is what exposed the duplicate-Next failure a cached build had hidden): install, wasm, bundle, tsc, lint, TypeDoc, the Vitest suite, and the react-vite and nextjs production builds. The same floor was raised in nest-auth (#55, merged), which ships the equivalent proxy.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the react-next group in /packages/rust-auth with 3 updates: next, react and react-dom.
Updates
nextfrom 16.2.10 to 16.2.12Release notes
Sourced from next's releases.
Commits
2234717v16.2.12957f5ed[Backport] Fixes to support TypeScript 7 (#95831)b56eb16Backport/docs fixes 16.2 - July round (#96031)9beca08v16.2.113c48c7a[16.x] Fix Turbopack middleware matcher with i18n single localeac1eff3[16.x] Improve performance of checking valid MPA form submissions9a4651e[16.x] EnforceserverActions.bodySizeLimitfor Server Actions in Edge runtimeb512063[16.x] Set correct origin for internal redirects in custom serverd303326[16.x] Ensure exotic rewrite param values are properly encoded73b9487[16.x] fix(fetch-cache): key fetch(Request, init) by the effective requestUpdates
reactfrom 19.2.7 to 19.2.8Release notes
Sourced from react's releases.
Commits
1dd4ecb[FlightReply] Performance improvements when decoding (#37087)b0d2fdb[19.2.x] Update required references to GitHub repo (#36753)Updates
react-domfrom 19.2.7 to 19.2.8Release notes
Sourced from react-dom's releases.
Commits
1dd4ecb[FlightReply] Performance improvements when decoding (#37087)b0d2fdb[19.2.x] Update required references to GitHub repo (#36753)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions