[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps [next](https://github.com/vercel/next.js) from 16.1.1 to 16.1.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v16.1.6</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>Upgrade to swc 54 (<a
href="https://redirect.github.com/vercel/next.js/issues/88207">#88207</a>)</li>
<li>implement LRU cache with invocation ID scoping for minimal mode
response cache (<a
href="https://redirect.github.com/vercel/next.js/issues/88509">#88509</a>)</li>
<li>tweak LRU sentinel key (<a
href="https://redirect.github.com/vercel/next.js/issues/89123">#89123</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/mischnic"><code>@mischnic</code></a>, <a
href="https://github.com/wyattjoh"><code>@wyattjoh</code></a>, and <a
href="https://github.com/ztanner"><code>@ztanner</code></a> for
helping!</p>
<h2>v16.1.5</h2>
<p>Please refer the following changelogs for more information about this
security release:</p>
<p><a
href="https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472">https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472</a>
<a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">https://vercel.com/changelog/summary-of-cve-2026-23864</a></p>
<h2>v16.1.4</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>Only filter next config if experimental flag is enabled (<a
href="https://redirect.github.com/vercel/next.js/issues/88733">#88733</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/mischnic"><code>@mischnic</code></a> for
helping!</p>
<h2>v16.1.3</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>Fix linked list bug in LRU deleteFromLru (<a
href="https://redirect.github.com/vercel/next.js/issues/88652">#88652</a>)</li>
<li>Fix relative same host redirects in node middleware (<a
href="https://redirect.github.com/vercel/next.js/issues/88253">#88253</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/acdlite"><code>@acdlite</code></a> and <a
href="https://github.com/ijjk"><code>@ijjk</code></a> for helping!</p>
<h2>v16.1.2</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="adf8c612ad"><code>adf8c61</code></a>
v16.1.6</li>
<li><a
href="098c0c0f2b"><code>098c0c0</code></a>
[backport][ci] Make gh auth status optional when triggering a release
(<a
href="https://redirect.github.com/vercel/next.js/issues/89100">#89100</a>)</li>
<li><a
href="a43df3279b"><code>a43df32</code></a>
Backport/docs fixes jan 25 16.1.x (<a
href="https://redirect.github.com/vercel/next.js/issues/89124">#89124</a>)</li>
<li><a
href="d6d573493e"><code>d6d5734</code></a>
tweak LRU sentinel cache key (<a
href="https://redirect.github.com/vercel/next.js/issues/89123">#89123</a>)</li>
<li><a
href="4324698881"><code>4324698</code></a>
backport: implement LRU cache with invocation ID scoping for minimal
mode res...</li>
<li><a
href="23c4649853"><code>23c4649</code></a>
[backport] Upgrade to swc 54 (<a
href="https://redirect.github.com/vercel/next.js/issues/88207">#88207</a>)
(<a
href="https://redirect.github.com/vercel/next.js/issues/89103">#89103</a>)</li>
<li><a
href="acba4a6b9f"><code>acba4a6</code></a>
v16.1.5</li>
<li><a
href="e1d1fc6525"><code>e1d1fc6</code></a>
Add maximum size limit for postponed body parsing (<a
href="https://redirect.github.com/vercel/next.js/issues/88175">#88175</a>)</li>
<li><a
href="500ec83743"><code>500ec83</code></a>
fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (<a
href="https://redirect.github.com/vercel/next.js/issues/88588">#88588</a>)</li>
<li><a
href="1caaca3cdb"><code>1caaca3</code></a>
feat(next/image)!: add <code>images.maximumResponseBody</code> config
(<a
href="https://redirect.github.com/vercel/next.js/issues/88183">#88183</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v16.1.1...v16.1.6">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps
[react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom)
from 19.2.3 to 19.2.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/react/releases">react-dom's
releases</a>.</em></p>
<blockquote>
<h2>19.2.4 (January 26th, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Add more DoS mitigations to Server Actions, and harden Server
Components (<a
href="https://redirect.github.com/facebook/react/pull/35632">#35632</a>
by <a href="https://github.com/gnoff"><code>@gnoff</code></a>, <a
href="https://github.com/lubieowoce"><code>@lubieowoce</code></a>, <a
href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a
href="https://github.com/unstubbable"><code>@unstubbable</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="90ab3f89f4"><code>90ab3f8</code></a>
Version 19.2.4</li>
<li>See full diff in <a
href="https://github.com/facebook/react/commits/v19.2.4/packages/react-dom">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
dependabot[bot]