UI5 / webcomponents-react / 20159981546

85%

main: 85%

push

github

chore(deps): update dependency next to v16.0.9 [security] (#8021)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [next](https://nextjs.org)
([source](https://redirect.github.com/vercel/next.js)) | [`16.0.7` ->
`16.0.9`](https://renovatebot.com/diffs/npm/next/16.0.7/16.0.9) |
![age](https://developer.mend.io/api/mc/badges/age/npm/next/16.0.9?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/next/16.0.7/16.0.9?slim=true)
|

### GitHub Vulnerability Alerts

####
[GHSA-mwv6-3258-q52c](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c)

A vulnerability affects certain React packages for versions 19.0.0,
19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that
use the affected packages, including Next.js 15.x and 16.x using the App
Router. The issue is tracked upstream as
[CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).

A malicious HTTP request can be crafted and sent to any App Router
endpoint that, when deserialized, can cause the server process to hang
and consume CPU. This can result in denial of service in unpatched
environments.

####
[GHSA-w37m-7fhw-fmv9](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9)

A vulnerability affects certain React packages for versions 19.0.0,
19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that
use the affected packages, including Next.js 15.x and 16.x using the App
Router. The issue is tracked upstream as
[CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183).

A malicious HTTP request can be crafted and sent to any App Router
endpoint that can return the compiled source code of [Server
Functions](https://react.dev/reference/rsc/server-functions). This could
reveal business logic, but would not expose secrets ... (continued)

3264 of 4169 branches covered (78.29%)

Branch coverage included in aggregate %.

5741 of 6434 relevant lines covered (89.23%)

118867.03 hits per line