chore: upgrade next to ^16.2.6 to address CVE-2026-45109

[brendan-kellam]

Fixes SOU-1102

Summary

Upgrades Next.js from ^16.2.3 to ^16.2.6 to address CVE-2026-45109, which is an incomplete fix follow-up to CVE-2026-44575.

CVE Details

CVE-2026-45109: Next.js Turbopack middleware bypass via segment-prefetch routes (incomplete fix for CVE-2026-44575)

The fix for CVE-2026-44575 (Next.js App Router middleware bypass via segment-prefetch routes) did not apply to middleware.ts when using Turbopack. Applications using Turbopack with middleware remain vulnerable to the same App Router segment-prefetch authorization bypass even after upgrading to 16.2.5.

References

• GHSA-26hh-7cqf-hhc6
• GHSA-267c-6grr-h53f
• Release v16.2.6

Linear Issue: SOU-1102

  

Summary by CodeRabbit

• Chores
  • Updated Next.js dependency to version 16.2.6

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 31fbfa48-2bbe-4df4-9e8c-5aed6df38552

📥 Commits

Reviewing files that changed from the base of the PR and between b65db72 and 6a23803.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• CHANGELOG.md
• packages/web/package.json

---

Walkthrough

This PR upgrades the Next.js dependency in packages/web/package.json from ^16.2.3 to ^16.2.6 to address CVE-2026-45109, and documents the security patch in the CHANGELOG.md under the Unreleased section.

Changes

Next.js Security Update

Layer / File(s)	Summary
Next.js version bump and changelog packages/web/package.json, CHANGELOG.md	The next dependency is updated to ^16.2.6, and an unreleased changelog entry documents the CVE-2026-45109 fix.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• sourcebot-dev/sourcebot#1113: Both PRs modify packages/web/package.json to bump the next dependency version within the 16.x line.
• sourcebot-dev/sourcebot#1126: Both PRs bump dependency versions in packages/web/package.json and update CHANGELOG.md under ## [Unreleased].
• sourcebot-dev/sourcebot#970: Both PRs upgrade Next.js in packages/web/package.json and record the change in CHANGELOG.md.

Suggested reviewers

• msukkari

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/cve/next-b42c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2077
Resolved (non-standard)	11
Unresolved	0
Strong copyleft	0
Weak copyleft	39

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-darwin-arm64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.0.5	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.2.4	LGPL-3.0-or-later
@img/sharp-wasm32	0.33.5	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-wasm32	0.34.5	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.34.5	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.33.5	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.34.5	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.33.5	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.34.5	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.0	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (11)

Package	Version	Original	Resolved	Source
@react-grab/cli	0.1.23	UNKNOWN	MIT	GitHub repo aidenybai/react-grab LICENSE file
@react-grab/cli	0.1.29	UNKNOWN	MIT	GitHub repo aidenybai/react-grab LICENSE file
@react-grab/mcp	0.1.29	UNKNOWN	MIT	GitHub repo aidenybai/react-grab LICENSE file
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	GitHub repo livebook-dev/codemirror-lang-elixir LICENSE file
element-source	0.0.3	UNKNOWN	MIT	GitHub repo aidenybai/element-source repository license
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	GitHub repo livebook-dev/lezer-elixir LICENSE file
map-stream	0.1.0	UNKNOWN	MIT	upstream GitHub package.json (dominictarr/map-stream)
memorystream	0.3.1	UNKNOWN	MIT	npm registry licenses array entry (type: MIT)
pause-stream	0.0.11	MIT,Apache2	MIT	extracted from license array (dual-licensed MIT / Apache-2.0)
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	GitHub repo PostHog/posthog-js LICENSE file
valid-url	1.0.9	UNKNOWN	MIT	GitHub repo ogt/valid-url LICENSE file