🚨 [security] Update all of nextjs 16.0.7 → 16.0.10 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint-config-next (16.0.7 → 16.0.10)

Sorry, we couldn't find anything useful about this release.

✳️ next (16.0.7 → 16.0.10) · Repo

Security Advisories 🚨

🚨 Next Vulnerable to Denial of Service with Server Components

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.

A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.

🚨 Next Server Actions Source Code Exposure

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.

A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.

Release Notes

16.0.8

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Update react version in cna templates (#86950)

Credits

Huge thanks to @huozhi for helping!

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 8 commits:

• v16.0.10
• Backport facebook/react#35351 for 16.0.9 (#87085)
• v16.0.9
• Update React Versions (#40)
• Update React Version (#22)
• Backport Next.js changes to v16.0.9 (#20)
• v16.0.8
• Update react version in cna templates (#86950)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[coderabbitai]

Walkthrough

The pull request updates Next.js-related dependency versions in two package.json files. In playgrounds/nextjs/package.json, next and eslint-config-next are updated from ^16.0.7 to ^16.0.10. In playgrounds/v3/package.json, the next dependency and the eslint-config-next devDependency are also updated from ^16.0.7 to ^16.0.10. No other changes to code or exported declarations are included.

Pre-merge checks

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: updating Next.js dependencies from 16.0.7 to 16.0.10 with security fixes emphasized.
Description check	✅ Passed	The description is directly related to the changeset, detailing the security vulnerabilities being fixed and the specific dependency updates in both package.json files.

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between dd757fd and c20c80f.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• playgrounds/nextjs/package.json (2 hunks)
• playgrounds/v3/package.json (2 hunks)

🚧 Files skipped from review as they are similar to previous changes (2)

• playgrounds/nextjs/package.json
• playgrounds/v3/package.json

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)

• GitHub Check: Linux
• GitHub Check: Windows
• GitHub Check: Linux / postcss
• GitHub Check: Linux / vite
• GitHub Check: Linux / cli
• GitHub Check: Linux / webpack
• GitHub Check: Linux / upgrade
• GitHub Check: macOS

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[thecrypticace]

@depfu rebase