Skip to content

chore(deps): bump next from 14.2.35 to 16.1.6 - #89

Closed
dependabot[bot] wants to merge 419 commits into
mainfrom
dependabot/npm_and_yarn/next-16.1.6
Closed

chore(deps): bump next from 14.2.35 to 16.1.6#89
dependabot[bot] wants to merge 419 commits into
mainfrom
dependabot/npm_and_yarn/next-16.1.6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jan 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps next from 14.2.35 to 16.1.6.

Release notes

Sourced from next's releases.

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Upgrade to swc 54 (#88207)
  • implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)
  • tweak LRU sentinel key (#89123)

Credits

Huge thanks to @​mischnic, @​wyattjoh, and @​ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.1.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Only filter next config if experimental flag is enabled (#88733)

Credits

Huge thanks to @​mischnic for helping!

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

v16.1.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

devin-ai-integration Bot and others added 30 commits February 15, 2025 12:29
@devin-ai-integration @catomean
fix: improve client/server boundary handling in MDX setup
10fb462 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: resolve circular dependency in MDX setup
019d14e 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: use dynamic imports for layout components
6a2fecb 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: split mobile menu into separate client component
1758a3e 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: use absolute import path for MobileMenu
f72cc91 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: resolve React fragment TypeScript errors
22a8d95 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: remove duplicate mobile menu code
9c51ed5 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: simplify component imports to resolve infinite loop
1b53c59 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: split menu button into separate client component
b2734a1 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: resolve TypeScript errors in MobileMenu component
5f44127 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: make MobileMenu a server component
357ac5a 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: improve type handling in menu components
b1a7c8a 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: handle menu visibility in client component
6590437 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: improve state management in menu components
5c873c8 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: resolve circular dependencies in component imports
b3c386b 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: improve dynamic import loading state
6aa0258 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: improve component loading states
17e4d7c 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: improve loading states and SSR configuration
afc4754 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: add navigation file and update MDX provider setup
3ed38d3 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: configure Next.js for MDX support
4068df9 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: add MDX plugin options to Next.js config
ca0939b 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: update MDX configuration with provider import source
ccb2083 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: enable experimental MDX support in Next.js config
93d8187 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: remove duplicate use client directive in MDX provider
1f76145 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: update MDX provider exports and component configuration
5c10997 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: update MDX provider exports and component boundaries
ff22222 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: update MDX provider exports to use default export
2ad5654 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: add proper MDX component types
785db6e 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: update MDX provider and layout component boundaries
8c62548 
Co-Authored-By: G <butaeff@gmail.com>
@devin-ai-integration @catomean
fix: update MDX provider to use named exports
4c7ded1 
Co-Authored-By: G <butaeff@gmail.com>
catomean and others added 6 commits January 28, 2026 10:13
@catomean @claude
chore: remove unused hooks and utilities
f195154 
- Delete lib/hooks/useFormSubmit.ts (never imported)
- Delete lib/utils/error.ts (never imported)
- Remove unused exports from lib/hooks/index.ts:
  - NAV_COLOR_CLASSES (only used internally)
  - NavColorClasses type (never imported)
  - useFormSubmit exports

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
refactor: consolidate formatFileSize duplicates to shared formatBytes
22db278 
- Update app/documents/page.tsx to use formatBytes from lib/format
- Update app/my-data/page.tsx to use formatBytes from lib/format
- Update components/shared/demo/DemoFileUpload.tsx to use formatBytes
- Update workspaceUtils.ts to re-export formatBytes as formatFileSize

DRY: 4 duplicate formatFileSize implementations → 1 SSOT (lib/format.ts)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
chore: remove orphaned bot navigation components
23cff2b 
- Remove swiss-german-teacher/components/shared/ (unused DemoModeOverlay, DemoPopup, Navigation)
- Remove swiss-german-teacher/components/navigation/ (unused Navigation)
- Remove medical-expert/components/navigation/ (unused Navigation)
- Remove product-manager/components/navigation/ (unused Navigation)
- Remove research-assistant/components/navigation/ (unused Navigation)
- Fix test to use valid ErrorCode type

All bots now use BotPageTemplate's shared navigation.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
chore: remove orphaned governance components
b2aa340 
- Remove unused InfoBox.tsx (140 lines)
- Remove unused ProfileTabs.tsx (40 lines)
- Update governance/index.ts to only export ProfileHeader (which is used)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
chore: remove unused dependencies
cd4ecee 
Remove packages that were installed but never imported:
- @heroicons/react (using custom Icons instead)
- framer-motion (no animations used)
- nodemailer (email handled differently)
- @mdx-js/loader, @mdx-js/react, @next/mdx (using next-mdx-remote)
- @eslint/eslintrc, @eslint/js (using old .eslintrc.json format)
- @testing-library/react (tests use Jest only)

Reduces bundle size and maintenance surface.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
chore: remove empty/orphaned files
4160f98 
- Remove empty stub files (mdx-provider.tsx, events.ts, route.d.ts)
- Remove orphaned components/auth/ folder (EmailVerificationBanner never imported)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/next-16.1.6 branch from 1466b1e to d472ae1 Compare January 28, 2026 15:00
catomean and others added 15 commits January 28, 2026 16:05
@catomean @claude
chore: remove orphaned styles and empty folders
d11a63c 
- Remove swiss-german-teacher/styles/ (CSS file not imported anywhere)
- Remove empty lib/models/ directory

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
chore: remove orphaned files never imported anywhere
cf37cac 
Removed dead code:
- components/ErrorBoundary.tsx (108 lines, Next.js error.tsx exists)
- components/CollaborationForm.tsx (190 lines, never imported)
- types/solutions.ts (24 lines, never imported)
- data/botsmann-knowledge.ts (215 lines, never imported)
- data/demo/swiss-german-knowledge.json (never imported)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
chore: remove orphaned lib/rag and search schema
a0d9d44 
Removed dead code:
- lib/rag/ folder (149 lines, never imported - demo/chat has inline impl)
- lib/schemas/search.ts (10 lines, never used)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
chore: remove orphaned swiss-german-teacher support files
de5ac2c 
Removed dead code that was never imported:
- hooks/useDemoMode.ts (101 lines)
- data/conversation.ts (28 lines)
- types/index.ts (44 lines)
- utils/constants.ts (34 lines)
- utils/navigation.ts (22 lines)
- utils/validation.ts (8 lines)

Total: 237 lines removed

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
chore: cleanup orphaned bot files, restore needed utils
88a4815 
Removed orphaned files:
- app/bots/medical-expert/types/index.ts (92 lines, never imported)
- app/bots/product-manager/metadata.ts (18 lines, never used)

Restored utils needed by swiss-german-teacher components:
- utils/constants.ts (used by EmailGenerator, TextGenerator, SwissContentSection)
- utils/navigation.ts (used by EmailGenerator)

Note: Previous commit incorrectly removed these as orphaned.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
fix(auth): lazy-load Supabase client to prevent crash without env vars
879b136 
Previously, createClientComponentClient() was called at module load time,
causing the app to crash when Supabase environment variables weren't
configured. This prevented pages from rendering even when they didn't
need authentication.

Changes:
- Made Supabase client lazy-loaded via getSupabaseClient() function
- Check isSupabaseConfigured() before creating the client
- Return early from useEffect if Supabase is not configured
- Added optional chaining for all Supabase method calls

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
refactor(bots): config-driven bot pages architecture
6cebcd3 
Replace individual static bot pages with a single dynamic [slug]/page.tsx
that renders from centralized configuration. This makes adding new bots
a matter of editing config files only - no new page files needed.

Architecture changes:
- Add lib/config/bot-pages.ts as SSOT for all bot page content
- Add components/shared/sections/ with generic section components
- Add app/bots/[slug]/page.tsx as single dynamic page
- Remove 100+ files from individual bot directories

New section components:
- DisclaimerSection, FeaturesSection, HowItWorksSection
- BenefitsSection, TestimonialsSection, VisionSection
- TechnologySection, CTASection, DemoSectionWrapper

To add a new bot now:
1. Add entry to lib/config/bot-pages.ts (sections + content)
2. Add hero config to data/botHeroConfigs.ts
3. Add demo config to lib/demo/botDemoConfigs.ts
4. Add basic info to data/bots.ts
Done - no new page.tsx files needed!

Files deleted: ~100+ (bot-specific pages/components)
Files added: 11 (config + generic sections)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
fix(bots): add missing hero config for artistic-advisor
c60271b 
The artistic-advisor page was missing its hero section because the
hero configuration was not defined in botHeroConfigs.ts. This adds
the complete hero config including title, badge, chat preview, and
key benefits.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
refactor(bots): make bots.ts SSOT for footer, menu, and bots page
4dba3eb 
Reduces files needed to add a new bot from 7-8 to 3-4 by eliminating
hardcoded bot lists in multiple locations:

- Add `display` field to Bot interface for bots list page metadata
- Footer.tsx: Generate AI Assistants links from bots array
- app/bots/page.tsx: Remove 100-line botDetails Record, derive from bot.display
- menuItems.ts: Generate Professionals menu children from bots array

Adding a new bot now automatically updates the footer, navigation menu,
and bots list page without any additional code changes.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
feat(chat): add model indicator, selector, privacy tiers & auth CTA
c462247 
Add model visibility and switching UI for AI professionals:
- ModelIndicator: shows current model with icon in chat header
- ModelSelector: dropdown to switch models (auth-gated for guests)
- PrivacyTierInfo: expandable Cloud vs Self-Hosted comparison
- ChatAuthCTA: dismissible guest conversion banner

Config files (SSOT):
- privacy-tiers.ts: tier definitions, model display config
- auth-cta.ts: CTA content for guest/authenticated users

Also increases quick-chat maxTokens from 256 to 1024 to prevent
response cutoff.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
feat: add document categories and professional chat API
9e3ef01 
Port features from legacy codebase:
- Add DocumentCategory type with 7 categories (legal, health, research, etc.)
- Add PROFESSIONAL_DOCUMENT_ACCESS mapping for category-based access
- Add CategoryBadge and CategorySelector components
- Add professional-chat API with document context integration
- Add ErrorBoundary component for error handling
- Add professionals layout with metadata
- Add useRateLimitCountdown hook

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
fix(security): add prompt injection protection to all chat APIs
ed0190b 
Add comprehensive prompt sanitization to prevent LLM prompt injection:
- Create lib/prompt-sanitizer.ts with detection and filtering
- Detect injection patterns (instruction overrides, role manipulation, jailbreaks)
- Escape delimiter sequences that could break prompt structure
- Wrap user-provided context in XML-like tags with data-not-instructions note
- Apply sanitization to all 4 chat API routes:
  - /api/quick-chat
  - /api/professional-chat
  - /api/demo/chat
  - /api/demo/document-chat

Security measures:
- Length limits on all user inputs
- Injection pattern detection with filtering
- Control character removal
- Clear separation between instructions and user data

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
perf(api): add HTTP caching headers to reduce database load
41bd8bf 
Add Cache-Control header support to API response utilities:
- NONE: no-store for mutations and sensitive data
- PRIVATE_SHORT: 1 minute for user-specific data
- PRIVATE_MEDIUM: 5 minutes for less frequent user data
- PUBLIC_SHORT: 5 minutes for public data
- PUBLIC_MEDIUM: 1 hour for semi-static data
- IMMUTABLE: 1 day for truly static data

Apply caching to key routes:
- GET /api/settings: private, 1 min cache
- GET /api/health: public, 5 min cache
- GET /api/documents: private, 1 min cache
- GET /api/stats: private, 1 min cache
- GET /api/conversations: private, 1 min cache
- All mutations (POST/PUT/DELETE): no-store
- All errors: no-store (automatic)

Expected impact: 2-3x reduction in database queries for
repeated requests within cache window.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@catomean @claude
fix(deps): patch fast-xml-parser vulnerability and improve Link usage
5beee22 
Security fixes:
- Add npm override for fast-xml-parser@^5.3.4 to fix RangeError DoS
- Update @aws-sdk/client-ses to 3.980.0
- Reduces vulnerabilities from 25 to 8 (fixed 17 high severity)

Code improvements (prep for future Next.js 15):
- Replace <a> tags with <Link> components for internal navigation
- Create ConsultationFormLoader client wrapper for dynamic imports
- Use direct Analytics import instead of dynamic with ssr:false
- Add eslint-disable for global-error.tsx (intentional <a> usage)

Remaining vulnerabilities (require breaking changes):
- 7 moderate: eslint circular reference stack overflow
- 1 high: Next.js DoS (specific conditions, low practical risk)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@dependabot
chore(deps): bump next from 14.2.35 to 16.1.6
4da6d3e 
Bumps [next](https://github.com/vercel/next.js) from 14.2.35 to 16.1.6.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v14.2.35...v16.1.6)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.1.6
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/next-16.1.6 branch from d472ae1 to 4da6d3e Compare February 2, 2026 11:55
@catomean

catomean commented Feb 26, 2026

Copy link
Copy Markdown
Collaborator

Closing stale automated PR — cleaning up repo.

@catomean catomean closed this Feb 26, 2026
@dependabot @github

dependabot Bot commented on behalf of github Feb 26, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/next-16.1.6 branch February 26, 2026 07:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@catomean