[dependabot]

Bumps the eslint-prettier group with 1 update in the / directory: eslint-config-next.

Updates eslint-config-next from 16.4.3 to 16.4.5

Release notes

Sourced from eslint-config-next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
• [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

Commits

• 4e5335a v16.4.5
• b175f52 v16.4.4
• See full diff in compare view