UI5 / webcomponents-react / 24330986502 / 1 – playwright

82%

main: 84%

push

github

chore(deps): update dependency next to v16.2.3 [security] (#8477)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [next](https://nextjs.org)
([source](https://redirect.github.com/vercel/next.js)) | [`16.2.2` →
`16.2.3`](https://renovatebot.com/diffs/npm/next/16.2.2/16.2.3) |
![age](https://developer.mend.io/api/mc/badges/age/npm/next/16.2.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/next/16.2.2/16.2.3?slim=true)
|

### GitHub Vulnerability Alerts

####
[GHSA-q4gf-8mx6-v5v3](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-q4gf-8mx6-v5v3)

A vulnerability affects certain React Server Components packages for
versions 19.x and frameworks that use the affected packages, including
Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is
tracked upstream as
[CVE-2026-23869](https://redirect.github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg).
You can read more about this advisory our [this
changelog](https://vercel.com/changelog/summary-of-cve-2026-23869).

A specially crafted HTTP request can be sent to any App Router Server
Function endpoint that, when deserialized, may trigger excessive CPU
usage. This can result in denial of service in unpatched environments.

---

### Release Notes

<details>
<summary>vercel/next.js (next)</summary>

###
[`v16.2.3`](https://redirect.github.com/vercel/next.js/compare/v16.2.2...v16.2.3)

[Compare
Source](https://redirect.github.com/vercel/next.js/compare/v16.2.2...v16.2.3)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this... (continued)

208 of 256 branches covered (81.25%)

Branch coverage included in aggregate %.

273 of 297 relevant lines covered (91.92%)

57.49 hits per line