[dependabot]

Bumps the production-minor-patch group with 5 updates in the / directory:

Package	From	To
next	16.4.3	16.4.5
@next/mdx	16.3.8	16.4.5
@next/third-parties	16.3.8	16.4.5
@xyflow/react	12.12.0	12.12.1
zustand	5.0.15	5.0.16

Updates next from 16.4.3 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
• [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

Commits

• 4e5335a v16.4.5
• 809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
• 2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
• 6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
• 18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
• e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
• d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
• 80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
• b175f52 v16.4.4
• ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
• Additional commits viewable in compare view

Updates @next/mdx from 16.3.8 to 16.4.5

Release notes

Sourced from @​next/mdx's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
• [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
• [lts-active] test: Pin react-virtualized (#100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
• [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

... (truncated)

Commits

• 4e5335a v16.4.5
• b175f52 v16.4.4
• 29bbeab v16.4.3
• 2864b17 v16.4.2
• 7217011 v16.4.1
• e273d5b v16.4.0
• c3e76ad v16.4.0-canary.63
• ccf8c15 v16.4.0-canary.62
• 27ee721 v16.4.0-canary.61
• cdf6866 v16.4.0-canary.60
• Additional commits viewable in compare view

Updates @next/third-parties from 16.3.8 to 16.4.5

Release notes

Sourced from @​next/third-parties's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
• [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
• [lts-active] test: Pin react-virtualized (#100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
• [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

... (truncated)

Commits

• 4e5335a v16.4.5
• b175f52 v16.4.4
• 29bbeab v16.4.3
• 2864b17 v16.4.2
• 7217011 v16.4.1
• e273d5b v16.4.0
• c3e76ad v16.4.0-canary.63
• ccf8c15 v16.4.0-canary.62
• 27ee721 v16.4.0-canary.61
• cdf6866 v16.4.0-canary.60
• Additional commits viewable in compare view

Updates @xyflow/react from 12.12.0 to 12.12.1

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.12.1

Patch Changes

• #6068 7813eeb - Cancel a pending click connection when clicking the pane and call onClickConnectEnd / onclickconnectend

• #6097 d150c38 - Don't mutate the internal selection state

• #5650 f7cddb9 - Infer the type of pathOptions in EdgeProps from the edge type instead of using any.

• #6090 b235ea0 - Respect nodeOrigin in isNodeIntersecting and getIntersectingNodes when you pass a node object instead of { id }

• #6054 c7d0fcb - Disconnect the ResizeObservers when a flow unmounts

• Updated dependencies [d150c38, 8483a2f, c7d0fcb, 9dcbd29, cba335d]:

  • @​xyflow/system@​0.0.84

Changelog

Sourced from @​xyflow/react's changelog.

12.12.1

Patch Changes

• #6068 7813eeb - Cancel a pending click connection when clicking the pane and call onClickConnectEnd / onclickconnectend

• #6097 d150c38 - Don't mutate the internal selection state

• #5650 f7cddb9 - Infer the type of pathOptions in EdgeProps from the edge type instead of using any.

• #6090 b235ea0 - Respect nodeOrigin in isNodeIntersecting and getIntersectingNodes when you pass a node object instead of { id }

• #6054 c7d0fcb - Disconnect the ResizeObservers when a flow unmounts

• Updated dependencies [d150c38, 8483a2f, c7d0fcb, 9dcbd29, cba335d]:

  • @​xyflow/system@​0.0.84

Commits

• 7599c7f chore(packages): bump
• d4bc936 Merge pull request #5650 from keepmhwn/fix/path-options-type
• c4fdcb1 Merge pull request #6097 from xyflow/fix/internal-selection
• 5c90af4 fix(react): cleanup internal selection handling #6096
• 93b7a91 chore(pane): cleanup
• 7abb6f0 Add Svelte pane cancellation and merge latest main
• b235ea0 fix: respect flow nodeOrigin in root node intersections
• 22388df chore(useResizeHandler): cleanup
• 7813eeb fix(react): cancel click connections on pane click
• c7d0fcb fix: disconnect ResizeObservers when a flow unmounts
• See full diff in compare view

Updates zustand from 5.0.15 to 5.0.16

Release notes

Sourced from zustand's releases.

v5.0.16

This version has some improvements thanks to contributors: @​MarshallOfSound @​koreahghg @​chungyo @​Godsdar

What's Changed

• perf(react): don't memoize getServerSnapshot in useStore by @​dai-shi in pmndrs/zustand#3563
• fix(devtools): apply serialize.reviver when parsing devtools messages by @​dai-shi in pmndrs/zustand#3568
• fix(devtools): preserve shared connections during store cleanup by @​dai-shi in pmndrs/zustand#3580
• fix(persist): preserve external devtools action arguments by @​dai-shi in pmndrs/zustand#3592

Full Changelog: pmndrs/zustand@v5.0.15...v5.0.16

Commits

• 382d29c v5.0.16
• b488323 chore(deps): update dev dependencies (#3593)
• da2706c fix(persist): preserve external devtools action arguments (#3592)
• a1fea2e fix(devtools): preserve shared connections during store cleanup (#3580)
• d867e6f fix(devtools): apply serialize.reviver when parsing devtools messages (#3568)
• dac22e1 perf(react): don't memoize getServerSnapshot in useStore (#3563)
• d7a5583 Clarify maintainer-guided contribution workflow (#3587)
• b57db4f docs(create): document that state cannot be read during initialization (#3569)
• f094eeb ci: build the docs with pmndrs/docs@v4 (#3570)
• ea612a5 docs: fix broken migrating-to-v5 link in README (#3567)
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.