chore(deps): update dependency eslint-config-next to v16.2.6

[barnes-c]

This PR contains the following updates:

Package	Change	Age	Confidence
eslint-config-next (source)	16.2.1 → 16.2.6

---

Release Notes

vercel/next.js (eslint-config-next)

v16.2.6

Compare Source

[!NOTE]
This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

• fix: preserve HTTP access fallbacks during prerender recovery (#​92231)
• Fix fallback route params case in app-page handler (#​91737)
• Fix invalid HTML response for route-level RSC requests in deployment adapter (#​91541)
• Patch setHeader for direct route handlers (#​93101)
• Include deployment id in cacheHandlers keys (#​93453)
• Fix double-encoding of URL pathname parts in client param parsing (#​93491)

v16.2.5

Compare Source

[!NOTE]
This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

• fix: preserve HTTP access fallbacks during prerender recovery (#​92231)
• Fix fallback route params case in app-page handler (#​91737)
• Fix invalid HTML response for route-level RSC requests in deployment adapter (#​91541)
• Patch setHeader for direct route handlers (#​93101)
• Include deployment id in cacheHandlers keys (#​93453)
• Fix double-encoding of URL pathname parts in client param parsing (#​93491)

v16.2.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#​92713)
• Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#​92631)
• Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#​92580)
• Compiler: Support boolean and number primtives in next.config defines (#​92731)
• turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#​92725)
• Turbopack: shorter error for ChunkGroupInfo::get_index_of (#​92814)
• Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#​92828)
• Adding more system info to the 'initialize project' trace (#​92427)

Credits

Huge thanks to @​Badbird5907, @​lukesandberg, @​andrewimm, @​sokra, and @​mischnic for helping!

v16.2.3

Compare Source

[!NOTE]
This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

• Ensure app-page reports stale ISR revalidation errors via onRequestError (#​92282)
• Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#​91981 through #​92273)
• Deduplicate output assets and detect content conflicts on emit (#​92292)
• Fix styled-jsx race condition: styles lost due to concurrent rendering (#​92459)
• turbo-tasks-backend: stability fixes for task cancellation and error handling (#​92254)

Credits

Huge thanks to @​icyJoseph, @​sokra, @​wbinnssmith, @​eps1lon and @​ztanner for helping!

v16.2.2

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• backport: Move expanded adapters docs to API reference (#​92115) (#​92129)
• Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#​92130)
• [create-next-app] Skip interactive prompts when CLI flags are provided (#​91840)
• next.config.js: Accept an option for serverFastRefresh (#​91968)
• Turbopack: enable server HMR for app route handlers (#​91466)
• Turbopack: exclude metadata routes from server HMR (#​92034)
• Fix CI for glibc linux builds
• Backport: disable bmi2 in qfilter #​92177
• [backport] Fix CSS HMR on Safari (#​92174)

Credits

Huge thanks to @​nextjs-bot, @​icyJoseph, @​ijjk, @​gaojude, @​wbinnssmith, @​lukesandberg, and @​bgw for helping!

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.