fix(security): bump Next.js 16.1.6 → 16.2.10 (CVE patches through May 2026 release)#38
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
lacymorrow
force-pushed
the
lac-2876/bump-next-16-2-10
branch
from
July 20, 2026 13:51
5ea6511 to
3339a39
Compare
|
Failed to generate code suggestions for PR |
…y 2026 release) 16.1.6 is affected by the March 2026 advisory batch (CVE-2026-29057 HTTP request smuggling in rewrites, CVE-2026-27978 Server Actions CSRF bypass via null origin, CVE-2026-27977 allowedDevOrigins bypass, CVE-2026-27979 and CVE-2026-27980 DoS), CVE-2026-23869 (April, patched 16.2.3), and the twelve-CVE May 2026 security release (patched 16.2.6). 16.2.10 is current stable. Companion @next/* and eslint-config-next packages bumped to match. Works around vercel/next.js#91735 (webpack regression since 16.2.0: page.mdx metadata exports lose their RSC bundle layer and fail the build) by restoring bundleLayer on the MDX swc-loader rule in the server compiler. LAC-2876 Co-Authored-By: Paperclip <noreply@paperclip.ing>
lacymorrow
force-pushed
the
lac-2876/bump-next-16-2-10
branch
from
July 20, 2026 13:52
3339a39 to
b79cf68
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Paperclip issue: LAC-2876 (parent LAC-2792)
The dead
lacymorrow/bones-wwwrepo bumped Next.js to 16.2.1 in March 2026 for a CVE fix, but that patch never reached this repo — the one that actually deploys bones.sh. This repo was still on 16.1.6.CVEs affecting 16.1.6, fixed by this bump
Target is 16.2.10, current stable. Companion packages (
@next/bundle-analyzer,@next/eslint-plugin-next,@next/mdx,eslint-config-next) bumped to match.Workaround included
Webpack builds ≥16.2.0 have a regression (vercel/next.js#91735, still open) where
page.mdxmetadata exports lose their RSC bundle layer and the build fails with "attempting to export metadata from a component marked with use client".with-mdx.tsnow restoresbundleLayeron the MDX swc-loader rule in the server compiler; remove when upstream fixes it.Testing
bun run test— 4/4 passbun run build— clean production build (webpack), all 27 routes generatednext start:/,/privacy-policy,/terms-of-service,/eula,/featuresall 200 with correct server-rendered<title>metadata from the MDX pages