Skip to content

chore(deps): update dependency next to v16.0.7 [security] #9941

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
renovate wants to merge 1 commit into from
Closed

chore(deps): update dependency next to v16.0.7 [security] #9941

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion examples/react/auto-refetching/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"dependencies": {
"@tanstack/react-query": "^5.90.11",
"@tanstack/react-query-devtools": "^5.91.1",
"next": "^15.3.1",
"next": "^16.0.0",
"react": "^18.2.0",
"react-dom": "^18.2.0"
},
Expand Down
2 changes: 1 addition & 1 deletion examples/react/infinite-query-with-max-pages/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"dependencies": {
"@tanstack/react-query": "^5.90.11",
"@tanstack/react-query-devtools": "^5.91.1",
"next": "^15.3.1",
"next": "^16.0.0",
"react": "^18.2.0",
"react-dom": "^18.2.0"
},
Expand Down
2 changes: 1 addition & 1 deletion examples/react/load-more-infinite-scroll/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"dependencies": {
"@tanstack/react-query": "^5.90.11",
"@tanstack/react-query-devtools": "^5.91.1",
"next": "^15.3.1",
"next": "^16.0.0",
"react": "^18.2.0",
"react-dom": "^18.2.0",
"react-intersection-observer": "^9.16.0"
Expand Down
2 changes: 1 addition & 1 deletion examples/react/nextjs-app-prefetching/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"dependencies": {
"@tanstack/react-query": "^5.90.11",
"@tanstack/react-query-devtools": "^5.91.1",
"next": "^15.3.1",
"next": "^16.0.0",
"react": "^19.0.0",
"react-dom": "^19.0.0"
},
Expand Down
2 changes: 1 addition & 1 deletion examples/react/nextjs/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"dependencies": {
"@tanstack/react-query": "^5.90.11",
"@tanstack/react-query-devtools": "^5.91.1",
"next": "^15.3.1",
"next": "^16.0.0",
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

Next.js 16.0.0 React version requirements compatibility

💡 Result:

Short answer: Next.js 16 supports React 18 and React 19 (Next.js docs recommend installing the latest React). Use matching react + react-dom versions (e.g. 18.x or 19.x). Note: some third‑party packages may still have peerDependency ranges that block React 19 and will need updates or overrides. [1][2][3][4]

Sources:

  • Next.js upgrade guide (v16) — recommends installing react@latest / react-dom@latest. [1]
  • Next.js 16 release post / blog. [2]
  • Next.js support policy (v16 release date / LTS). [3]
  • Third‑party issues showing peerDependency mismatches with React 19 (example). [4]

Critical: Major version discrepancy between PR objectives and actual code.

The PR objectives state a security update to Next.js 15.4.7 with CVE fixes in the v15.4.x series, but this file bumps to ^16.0.0 — a major version jump. This is a significant scope change that needs clarification.

React 18.2.0 (line 14) is compatible with Next.js 16.0.0, so no compatibility issue there.

🤖 Prompt for AI Agents 
In examples/react/nextjs/package.json around line 13, the dependency was bumped
to "next": "^16.0.0" which contradicts the PR objective of updating to Next.js
15.4.7; change the version back to the intended 15.4.7 (or ^15.4.x per policy),
update the lockfile (run npm install / pnpm install) so
package-lock.json/yarn.lock reflects the rollback, run the test suite and
security audit (npm audit or similar) to confirm CVE fixes remain, and commit
the updated package.json and lockfile with a note clarifying the PR targets
15.4.7 (not a major-version upgrade).

"react": "^18.2.0",
"react-dom": "^18.2.0"
},
Expand Down
2 changes: 1 addition & 1 deletion examples/react/optimistic-updates-cache/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"dependencies": {
"@tanstack/react-query": "^5.90.11",
"@tanstack/react-query-devtools": "^5.91.1",
"next": "^15.3.1",
"next": "^16.0.0",
"react": "^18.2.0",
"react-dom": "^18.2.0"
},
Expand Down
2 changes: 1 addition & 1 deletion examples/react/optimistic-updates-ui/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"dependencies": {
"@tanstack/react-query": "^5.90.11",
"@tanstack/react-query-devtools": "^5.91.1",
"next": "^15.3.1",
"next": "^16.0.0",
"react": "^18.2.0",
"react-dom": "^18.2.0"
},
Expand Down
2 changes: 1 addition & 1 deletion examples/react/pagination/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"dependencies": {
"@tanstack/react-query": "^5.90.11",
"@tanstack/react-query-devtools": "^5.91.1",
"next": "^15.3.1",
"next": "^16.0.0",
"react": "^18.2.0",
"react-dom": "^18.2.0"
Comment on lines +13 to 15
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

Next.js 16.0.0 React version requirements compatibility

💡 Result:

Short answer: Next.js 16 expects you to use the latest React (install react@latest / react-dom@latest). It adds stable support for the React Compiler and explicit support for React 19 features while remaining compatible with recent React releases — the official upgrade docs instruct installing react@latest. (nextjs.org)

If you want a precise version to install now: run npm info react version or npm install react@latest to pick the React release the Next.js 16 docs target. (nextjs.org)

Citations:

🌐 Web query:

React 19 latest version release date 2024 2025

💡 Result:

React 19 (stable) — December 5, 2024. [1]

Notable follow-up release: React 19.1.0 — March 28, 2025. [2]

Sources: React blog post announcing v19 (Dec 5, 2024) [1]; official GitHub releases (19.1.0, Mar 28, 2025) [2].

Update React version for Next.js 16 compatibility.

Next.js 16 requires React 19 (released December 2024). The example pins React to ^18.2.0, which is incompatible. Update to react@^19.0.0 and react-dom@^19.0.0 to align with Next.js 16's official upgrade guidance.

🤖 Prompt for AI Agents 
In examples/react/pagination/package.json around lines 13 to 15, the project
pins "react" and "react-dom" to ^18.2.0 which is incompatible with Next.js 16;
update the package.json entries for "react" and "react-dom" to ^19.0.0 (or
^19.x) to match Next.js 16 requirements, then run npm/yarn install and verify
the example builds and runs (fix any peer dependency/resolution issues if they
appear).

},
Expand Down
2 changes: 1 addition & 1 deletion examples/react/prefetching/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"dependencies": {
"@tanstack/react-query": "^5.90.11",
"@tanstack/react-query-devtools": "^5.91.1",
"next": "^15.3.1",
"next": "^16.0.0",
"react": "^18.2.0",
"react-dom": "^18.2.0"
},
Expand Down
2 changes: 1 addition & 1 deletion integrations/react-next-14/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"dependencies": {
"@tanstack/react-query": "workspace:*",
"@tanstack/react-query-devtools": "workspace:*",
"next": "^14.2.28",
"next": "^16.0.0",
"react": "^18.2.0",
"react-dom": "^18.2.0"
Comment on lines +10 to 12
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

# Check for PR context, renovate config, and app router code
git log --oneline -20 --all

Repository: TanStack/query

Length of output: 1449

🏁 Script executed:

# Look for Renovate configuration
fd -t f 'renovate\.json|\.renovaterc' -o 'renovate.json5'

Repository: TanStack/query

Length of output: 205

🏁 Script executed:

# Check the app directory structure
fd -t f '\.(tsx?|jsx?)$' integrations/react-next-14/app --max-depth 2

Repository: TanStack/query

Length of output: 236

🏁 Script executed:

# Read the referenced app/client-component.tsx file
cat -n integrations/react-next-14/app/client-component.tsx 2>/dev/null || echo "File not found"

Repository: TanStack/query

Length of output: 688

🏁 Script executed:

# Check package.json for full dependency context
cat -n integrations/react-next-14/package.json

Repository: TanStack/query

Length of output: 569

🌐 Web query:

Next.js 16 React version requirements compatibility matrix

💡 Result:

Here’s a concise compatibility matrix for Next.js 16 and React versions:

  • Next.js 16 — React 19.x: Supported / required (Next.js 16 ships with first‑class React 19/React Compiler support). [1][2]
  • Next.js 16 — React 18.x: Incompatible / not supported (Next.js 16 expects React 19 features; upgrade React when migrating). [1][2]
  • Next.js 16 — React 17.x and earlier: Incompatible / not supported. [1][2]
  • Notes: App Router uses React canary builds internally during dev; install react@19 and react-dom@19 for production apps. Next.js 16 also requires a modern Node.js (see docs). [3][2]

Sources: Next.js 16 announcement & blog / upgrade docs; Next.js installation docs / support policy. [1][2][3]

References
[1] Next.js 16 (blog/announcement).
[2] Next.js — Upgrading to version 16 (migration/upgrade guide).
[3] Next.js installation / getting started (notes about React canary / install react@latest).

🏁 Script executed:

# Check git history for this specific file to see the version change
git log --oneline -- integrations/react-next-14/package.json | head -10

Repository: TanStack/query

Length of output: 124

🏁 Script executed:

# Get more details on the security commit
git show 28340c31 --stat

Repository: TanStack/query

Length of output: 50371

React 18 is incompatible with Next.js 16; upgrade React and React DOM to ^19.0.0.

Next.js 16 requires React 19, but this package declares react@^18.2.0 and react-dom@^18.2.0, which will cause runtime failures in App Router code (confirmed in app/client-component.tsx).

Apply this fix:

  "dependencies": {
    "@tanstack/react-query": "workspace:*",
    "@tanstack/react-query-devtools": "workspace:*",
    "next": "^16.0.0",
-   "react": "^18.2.0",
-   "react-dom": "^18.2.0"
+   "react": "^19.0.0",
+   "react-dom": "^19.0.0"

Also update TypeScript types in devDependencies to match React 19:

  "devDependencies": {
-   "@types/react": "^18.2.79",
-   "@types/react-dom": "^18.2.25"
+   "@types/react": "^19.0.0",
+   "@types/react-dom": "^19.0.0"

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents 
integrations/react-next-14/package.json lines 10-12: the project lists react and
react-dom as ^18.2.0 which is incompatible with Next.js 16; update the
dependencies to "react" and "react-dom" to ^19.0.0, and also bump the
devDependencies for TypeScript React types (e.g. @types/react and
@types/react-dom) to versions that match React 19 (e.g. ^19.0.0) to avoid type
mismatches; after editing package.json run your package manager to
reinstall/update the lockfile and verify the app/client-component.tsx and any
JSX typings compile cleanly.

},
Expand Down
2 changes: 1 addition & 1 deletion integrations/react-next-15/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"@js-temporal/polyfill": "^0.4.4",
"@tanstack/react-query": "workspace:*",
"@tanstack/react-query-devtools": "workspace:*",
"next": "^15.3.1",
"next": "^16.0.0",
"react": "^19.0.0",
"react-dom": "^19.0.0",
"tupleson": "0.23.1"
Expand Down
Loading
Loading