chore(deps): bump the npm-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the npm-dependencies group with 8 updates in the / directory:

Package	From	To
next	16.3.1	16.3.3
sharp	0.35.3	0.35.4
@types/node	26.2.0	26.4.0
@types/react-dom	19.2.4	19.2.5
@keystar/ui	0.9.6	0.10.0
@keystatic/core	0.6.8	0.6.9
@opennextjs/cloudflare	1.20.2	1.20.4
wrangler	4.124.0	4.127.0

Updates next from 16.3.1 to 16.3.3

Release notes

Sourced from next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

Commits

• a9a1cb7 v16.3.3
• 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
• 3a15b4a [16.3.x] [next/image]: disable avif image optimization
• 7378b51 Backport/docs fixes 16.3 (#97649)
• 528c1cd [16.3.x] Stop generating error codes (#97780)
• d0ac882 v16.3.2
• 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
• cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• Additional commits viewable in compare view

Updates sharp from 0.35.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

v0.35.4-rc.0

• Upgrade to libvips v8.18.6 for upstream bug fixes.

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

Commits

• 7f1a0a2 Release v0.35.4
• f927818 Upgrade to sharp-libvips v1.3.3
• e802092 Prerelease v0.35.4-rc.0
• e13eb2f CI: Fix wasm32 build (#4589)
• a82a0b3 Upgrade to libvips v8.18.6
• 8044fe4 Bound resize dimensions to coordinate limit
• 147f859 Docs: changelog entries for #4578 #4584
• ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
• 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
• ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
• Additional commits viewable in compare view

Updates @types/node from 26.2.0 to 26.4.0

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.4 to 19.2.5

Commits

• See full diff in compare view

Updates @keystar/ui from 0.9.6 to 0.10.0

Changelog

Sourced from @​keystar/ui's changelog.

0.10.0

Minor Changes

• #1612 dbb0bb5 Thanks @​emmatown! - Add generic useNavigate, usePathname, and useSearch router hooks with support for replacement navigation.

Commits

• b65d4a5 Version Packages (#1613)
• dbb0bb5 Add @​keystar/ui/router with useNavigate, usePathname and useSearch (#1612)
• See full diff in compare view

Updates @keystatic/core from 0.6.8 to 0.6.9

Changelog

Sourced from @​keystatic/core's changelog.

0.6.9

Patch Changes

• Updated dependencies [dbb0bb5]:
  • @​keystar/ui@​0.10.0

Commits

• b65d4a5 Version Packages (#1613)
• dbb0bb5 Add @​keystar/ui/router with useNavigate, usePathname and useSearch (#1612)
• See full diff in compare view

Updates @opennextjs/cloudflare from 1.20.2 to 1.20.4

Release notes

Sourced from @​opennextjs/cloudflare's releases.

@​opennextjs/cloudflare@​1.20.4

Patch Changes

• #1365 bf52109 Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.2

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.2

@​opennextjs/cloudflare@​1.20.3

Patch Changes

• #1361 8c31fbc Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.1

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.1

• #1359 65e4487 Thanks @​vicb! - chore: bump the Next.js peer dependency to 15.5.24 / 16.3.3

• #1359 65e4487 Thanks @​vicb! - fix: patch the Turbopack wasm helpers that Next.js 16.3 emits in the chunks

  Until Next.js 16.2 the Turbopack wasm loaders were named loadWebAssembly and loadWebAssemblyModule functions living in [turbopack]_runtime.js, which the adapter rewrote to resolve the chunk through a static import(). Next.js 16.3 emits them on demand in the chunks instead ([turbopack-wasm]/node/loadWasm.ts), so the existing patch silently stopped matching and WebAssembly.compileStreaming - which workerd does not implement - survived into the Worker.

  Every wasm backed import then threw TypeError: WebAssembly.compileStreaming is not a function at runtime, most visibly breaking Prisma with the workerd client runtime.

  The chunks emitted by Turbopack are now patched as well, for both the server and the Node.js middleware bundles.

• #1309 56dfacc Thanks @​ScienHAC! - feature: support Node.js middleware (proxy.ts)

  Next.js 16 replaces middleware.ts with proxy.ts which always runs on the Node.js runtime.

  The Node.js middleware is now bundled into a Workers compatible middleware/handler.mjs: the OpenNext config manifests are inlined at build time (as for the edge middleware) and the middleware compiled by Next.js is statically bundled instead of being loaded from the filesystem at runtime (workerd can not access the filesystem nor load modules at runtime).

  The support is experimental and requires the nodejs_compat compatibility flag.

• #1359 65e4487 Thanks @​vicb! - fix: do not load the instrumentation hook from the Node.js middleware bundle

  Next.js 16.3 registers the instrumentation hook from the middleware itself when the middleware does not run on the edge runtime, by dynamically requiring .next/server/instrumentation.js. workerd does not support dynamic requires so every request handled by the Node.js middleware (proxy.ts) failed with Dynamic require of ".next/server/instrumentation.js" is not supported.

  The guard Next.js uses (process.env.NEXT_RUNTIME !== "edge") is inlined by Next.js when it compiles the middleware, so it can not be eliminated when the middleware is re-bundled. The loader

... (truncated)

Changelog

Sourced from @​opennextjs/cloudflare's changelog.

1.20.4

Patch Changes

• #1365 bf52109 Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.2

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.2

1.20.3

Patch Changes

• #1361 8c31fbc Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.1

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.1

• #1359 65e4487 Thanks @​vicb! - chore: bump the Next.js peer dependency to 15.5.24 / 16.3.3

• #1359 65e4487 Thanks @​vicb! - fix: patch the Turbopack wasm helpers that Next.js 16.3 emits in the chunks

  Until Next.js 16.2 the Turbopack wasm loaders were named loadWebAssembly and loadWebAssemblyModule functions living in [turbopack]_runtime.js, which the adapter rewrote to resolve the chunk through a static import(). Next.js 16.3 emits them on demand in the chunks instead ([turbopack-wasm]/node/loadWasm.ts), so the existing patch silently stopped matching and WebAssembly.compileStreaming - which workerd does not implement - survived into the Worker.

  Every wasm backed import then threw TypeError: WebAssembly.compileStreaming is not a function at runtime, most visibly breaking Prisma with the workerd client runtime.

  The chunks emitted by Turbopack are now patched as well, for both the server and the Node.js middleware bundles.

• #1309 56dfacc Thanks @​ScienHAC! - feature: support Node.js middleware (proxy.ts)

  Next.js 16 replaces middleware.ts with proxy.ts which always runs on the Node.js runtime.

  The Node.js middleware is now bundled into a Workers compatible middleware/handler.mjs: the OpenNext config manifests are inlined at build time (as for the edge middleware) and the middleware compiled by Next.js is statically bundled instead of being loaded from the filesystem at runtime (workerd can not access the filesystem nor load modules at runtime).

  The support is experimental and requires the nodejs_compat compatibility flag.

• #1359 65e4487 Thanks @​vicb! - fix: do not load the instrumentation hook from the Node.js middleware bundle

  Next.js 16.3 registers the instrumentation hook from the middleware itself when the middleware does not run on the edge runtime, by dynamically requiring .next/server/instrumentation.js. workerd does not support dynamic requires so every request handled by the Node.js middleware (proxy.ts) failed with Dynamic require of ".next/server/instrumentation.js" is not supported.

... (truncated)

Commits

• 0622a45 Version Packages (#1367)
• 877c0b4 chore: bumps @cloudflare/workers-types (#1366)
• bf52109 bump @​opennextjs/aws to 4.1.2 (#1365)
• 9c3b797 Version Packages (#1358)
• 65e4487 chore: bump Next.js to 15.5.24 and 16.3.3 (#1359)
• 8c31fbc bump @opennextjs/aws to 4.1.1 (#1361)
• 56dfacc feat: support Node.js middleware (proxy.ts) (#1309)
• See full diff in compare view

Updates wrangler from 4.124.0 to 4.127.0

Release notes

Sourced from wrangler's releases.

wrangler@4.127.0

Minor Changes

• #15356 fe265f8 Thanks @​rubuy-74! - Add support for configuring a per-workflow max concurrency limit via workflows[].concurrency.limit in your Wrangler config.

  The limit is the maximum number of Workflow instances that can run concurrently. It is validated as a positive integer and persisted on deploy; the ceiling is enforced server-side. Concurrency is ignored in local development.

  {
    "workflows": [
      {
        "binding": "MY_WORKFLOW",
        "name": "my-workflow",
        "class_name": "MyWorkflow",
        "concurrency": { "limit": 10 }
      }
    ]
  }

Patch Changes

• #15367 412c79e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260825.1	^5.20260826.1
  workerd	1.20260825.1	1.20260826.1

• #15375 92874f6 Thanks @​WillTaylorDev! - Upload wrangler preview modules as multipart form data

  wrangler preview used to base64 the bundle, its modules, and any sourcemaps into a single JSON request body. Base64 inflates content by a third, so a Worker with a large sourcemap could exceed the API request size limit and fail to deploy.

  The preview deployment request is now multipart/form-data. The deployment settings travel in a metadata part and each module follows as its own part carrying raw bytes, matching how wrangler deploy already uploads a Worker.

• Updated dependencies [412c79e]:

  • miniflare@5.20260826.0-alpha

wrangler@4.126.0

Minor Changes

• #15332 d1cc3af Thanks @​pombosilva! - Add default_retention to Workflow bindings for configuring how long instances are retained

  Workflow instances are retained for an account-wide default period after they finish. You can now set a per-Workflow default in your Wrangler configuration, applied to instances that do not specify their own retention:

  {
    "workflows": [

... (truncated)

Commits

• a831498 Version Packages (#15372)
• fe265f8 [wrangler] Add per-workflow concurrency limit config (#15356)
• 92874f6 WC-5857 [wrangler] Upload preview deployments as multipart form data (#15375)
• e9df120 Support multiple named Workers in the build output (#15371)
• 5377aae Version Packages (#15354)
• e56d2e6 Revert "Version Packages" (#15355)
• d765e10 Version Packages (#15291)
• 433fa98 [wrangler] Add pull request title to preview deployment annotations (#15307)
• ad89456 [wrangler] Add hyperdrive planetscale signature command (#15065)
• d589d30 [wrangler] Pause automatic skills installation offers (#15296)
• Additional commits viewable in compare view