[dependabot]

Bumps the minor-and-patch group with 2 updates in the / directory: @next/third-parties and @opennextjs/cloudflare.

Updates @next/third-parties from 16.3.8 to 16.4.2

Release notes

Sourced from @​next/third-parties's releases.

v16.4.2

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @​lukesandberg in vercel/next.js#100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @​sokra in vercel/next.js#100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in vercel/next.js#100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in vercel/next.js#100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in vercel/next.js#100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in vercel/next.js#100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in vercel/next.js#100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682
• fix(scripts): correct typo in rm.mjs error message: #87015
• docs: improve clarity and punctuation in README: #86096
• Fix debug build paths Pages Router support entries: #93529
• bundle-analyzer: record historical snapshots on each analyze run: #93520
• fix: detect proxy.ts correctly with compound pageExtensions: #93246
• feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

• docs: correction to dynamicParams migration: #96624
• docs: proxy event argument: #96435
• docs: remove experimental note from runtime prefetching: #96615
• Preserve per-segment prefetching after dynamic navigation: #96583
• Rename static generation stream option to waitForAllReady: #96564
• Remove obsolete static generation plumbing: #96563
• [turbopack] Drop dead writes to exports: #96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #96549
• [turbopack] Strip leading BOM before parsing CSS: #96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550

... (truncated)

Commits

• 2864b17 v16.4.2
• 7217011 v16.4.1
• e273d5b v16.4.0
• c3e76ad v16.4.0-canary.63
• ccf8c15 v16.4.0-canary.62
• 27ee721 v16.4.0-canary.61
• cdf6866 v16.4.0-canary.60
• ba80ee4 v16.4.0-canary.59
• 1bcedb4 v16.4.0-canary.58
• 3683479 v16.4.0-canary.57
• Additional commits viewable in compare view

Updates @opennextjs/cloudflare from 1.20.7 to 1.20.12

Release notes

Sourced from @​opennextjs/cloudflare's releases.

@​opennextjs/cloudflare@​1.20.12

Patch Changes

• #1453 5d8c5bc Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.11

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.11

  • Add support for Next.js 16.4
  • Bump Next.js dependencies following the Next.js security update on Oct 14

• #1356 f993c8c Thanks @​chargome! - fix(patches): include preview-props.json in loadManifest build-time inlining

@​opennextjs/cloudflare@​1.20.11

Patch Changes

• #1451 a6893b8 Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.10

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.10

• #1437 6be5daf Thanks @​mathurshubham! - fix: do not bundle @vercel/og into the Node.js middleware when it is not used

@​opennextjs/cloudflare@​1.20.10

Patch Changes

• #1426 66b4a2d Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.9

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.9

• #1419 8327c21 Thanks @​Adnan-Husayn! - fix: set the image Content-Type from the format produced by the Images binding

  The Images binding can fall back to another format than the requested one, i.e. from AVIF to WebP for large images. /_next/image responses were labelled with the requested format, so the Content-Type could disagree with the image bytes.

• #1420 afea1a0 Thanks @​cpruijsen! - fix: skip route directories matching the loadManifest globs

  opennextjs-cloudflare build no longer fails with EISDIR or an unresolved import when an App Router route directory matches an internal manifest glob. Only manifest files are now inlined.

• #1423 a515128 Thanks @​Adnan-Husayn! - fix: do not log Failed to copy for packages whose exports is a string

@​opennextjs/cloudflare@​1.20.9

Patch Changes

• #1416 63cbece Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.8

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.8

• #1416 63cbece Thanks @​vicb! - fix: isolate module-loading cache signals between requests

  Prevent Next.js 15.4 and newer Cache Components from failing under concurrent traffic with Cannot perform I/O on behalf of a different request when module-loading timers cross Cloudflare Worker request contexts.

@​opennextjs/cloudflare@​1.20.8

... (truncated)

Changelog

Sourced from @​opennextjs/cloudflare's changelog.

1.20.12

Patch Changes

• #1453 5d8c5bc Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.11

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.11

  • Add support for Next.js 16.4
  • Bump Next.js dependencies following the Next.js security update on Oct 14

• #1356 f993c8c Thanks @​chargome! - fix(patches): include preview-props.json in loadManifest build-time inlining

1.20.11

Patch Changes

• #1451 a6893b8 Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.10

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.10

• #1437 6be5daf Thanks @​mathurshubham! - fix: do not bundle @vercel/og into the Node.js middleware when it is not used

1.20.10

Patch Changes

• #1426 66b4a2d Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.9

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.9

• #1419 8327c21 Thanks @​Adnan-Husayn! - fix: set the image Content-Type from the format produced by the Images binding

  The Images binding can fall back to another format than the requested one, i.e. from AVIF to WebP for large images. /_next/image responses were labelled with the requested format, so the Content-Type could disagree with the image bytes.

• #1420 afea1a0 Thanks @​cpruijsen! - fix: skip route directories matching the loadManifest globs

  opennextjs-cloudflare build no longer fails with EISDIR or an unresolved import when an App Router route directory matches an internal manifest glob. Only manifest files are now inlined.

• #1423 a515128 Thanks @​Adnan-Husayn! - fix: do not log Failed to copy for packages whose exports is a string

1.20.9

Patch Changes

• #1416 63cbece Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.8

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.8

• #1416 63cbece Thanks @​vicb! - fix: isolate module-loading cache signals between requests

... (truncated)

Commits

• 71c0c56 Version Packages (#1452)
• 5d8c5bc chore: bump @opennextjs/aws to 4.1.11 (#1453)
• f993c8c fix(patches): include preview-props.json in loadManifest glob for Next.js 16....
• 2c37a8a Version Packages (#1447)
• a6893b8 chore: bump @opennextjs/aws to 4.1.10 (#1451)
• 6be5daf fix: do not bundle @vercel/og into the Node.js middleware when it is not us...
• 37ede26 Version Packages (#1421)
• 66b4a2d chore: bump @opennextjs/aws to 4.1.9 (#1426)
• 82486c8 refactor: write next-env.mjs in a single call (#1422)
• a515128 fix: do not log Failed to copy for packages whose exports is a string (#1...
• Additional commits viewable in compare view

[github-actions]

Preview deployment

Status	URL
Skipped	-

Commit: c93c54c
Updated: 2026-10-19T06:15:58.034Z

Reason: Dependabot-triggered workflows do not have access to repository secrets in this workflow.

If you want a preview deployment, please ask a maintainer to run this from a branch within the main repository.