[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	16.4.0 → 16.4.2

---

Release Notes

vercel/next.js (next)

v16.4.2

Compare Source

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#​99644, #​99732, #​99649) by @​lukesandberg in #​100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#​98823, #​99910, #​100091) by @​sokra in #​100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in #​100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in #​100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in #​100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in #​100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in #​100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in #​100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.