Bump next from 16.0.0 to 16.0.1

[dependabot]

Bumps next from 16.0.0 to 16.0.1.

Release notes

Sourced from next's releases.

v16.0.1

Core Changes

• fix(static-paths): add depth tracking to parallel route param resolution: #85319
• Fix types of @​next/mdx: #82238
• Ensure getServerInsertedHTML skips rendering correctly: #85394
• Fix duplicate .next/types include on Windows: #85400
• Exclude next-js condition from middleware, proxy, and instrumentation: #85321
• remove unstable_forceStale prefetch option & restore prefetch={true} functionality: #85411
• Upgrade React from 2bcbf254-20251020 to 6160773f-20251023: #85277
• fix(next/image): swap dependencies: #85419
• Handle Origin: null headers: #85402
• Generalize Segment Cache fallback implementation: #84652
• fix: ensure req.query is writable: #81573
• fix: Proxy not picked up on Windows: #85443
• [test] Ensure we can toggle the DevTools menu while status indicators are active: #85456
• Fix crash when suspending in Components using useActionQueue: #85459

Misc Changes

• docs: create-next-app react-compiler and new prompts: #85213
• docs: cache components - introduction: #85196
• docs: use cache feedback: #85169
• docs: stabilize apis in docs: #85219
• docs: revalidateTag immediate expiration in Route Handlers: #85223
• Docs/use cache feedback 2: #85222
• docs: added use cache: remote docs: #85145
• docs: proxy runtime defaults to nodejs: #85204
• chore: cache components feedback: #85241
• docs: add a note that cache components is opt-in near the top: #85245
• Docs/v16 feedback: #85259
• Update command to install babel-plugin-react-compiler as a devDependency: #85235
• docs: typegen next-env.d.ts feedback: #85273
• docs: link to MCP guide from upgrade: #85308
• docs: regexp removed from middleware config: #85343
• docs: simplify MCP guide to focus on next-devtools-mcp: #85353
• docs: fix proxy matcher overflow: #85337
• docs: point out diff in serialization types for arguments and return values: #85338
• [test] Update snapshots: #85407
• docs: Fix typo in SEO section of loading.mdx: #85301
• Fix typo in Fast Refresh documentation: #85352
• Fix grammatical errors in updating data documentation: #85067
• [test] Skip devlow benchmarks on PRs: #85408
• [test] Unflake typed-env suite: #85410
• Update rust toolchain to 2025-10-27: #85409
• [test] Speed up prefetching suite: #85417
• docs: remove inaccuracies from use cache: private: #85425
• [test] Exclude Next.js internal stack frames from cache-component-error CLI output assertions: #85421
• [test] Exclude likely Next.js internal Components from component stacks in Redbox assertions: #85420
• Turbopack: correctly trace files with npm: #85323

... (truncated)

Commits

• e08402b v16.0.1
• 51d9631 Upgrade React from 6160773f-20251023 to b4455a6e-20251027 (#85464)
• 163fc17 v16.0.1-canary.6
• a986e17 Fix crash when suspending in Components using useActionQueue (#85459)
• 4067214 Turbopack: correctly trace files with npm (#85323)
• 976a222 [test] Ensure we can toggle the DevTools menu while status indicators are act...
• b95dbe6 fix: Proxy not picked up on Windows (#85443)
• b0837e0 [test] Exclude likely Next.js internal Components from component stacks in Re...
• 456d8e7 fix: ensure req.query is writable (#81573)
• 0b6fe15 [test] Exclude Next.js internal stack frames from cache-component-error CLI o...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.0.0 ⏵ 16.0.1	+1		+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm @next/env under MIT Location: Package overview From: package-lock.json → npm/next@16.0.1 → npm/@next/env@16.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@next/env@16.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @next/swc-darwin-arm64 under MIT Location: Package overview From: package-lock.json → npm/next@16.0.1 → npm/@next/swc-darwin-arm64@16.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@next/swc-darwin-arm64@16.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @next/swc-darwin-x64 under MIT Location: Package overview From: package-lock.json → npm/next@16.0.1 → npm/@next/swc-darwin-x64@16.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@next/swc-darwin-x64@16.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @next/swc-linux-arm64-gnu under MIT Location: Package overview From: package-lock.json → npm/next@16.0.1 → npm/@next/swc-linux-arm64-gnu@16.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@next/swc-linux-arm64-gnu@16.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @next/swc-linux-arm64-musl under MIT Location: Package overview From: package-lock.json → npm/next@16.0.1 → npm/@next/swc-linux-arm64-musl@16.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@next/swc-linux-arm64-musl@16.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @next/swc-linux-x64-gnu under MIT Location: Package overview From: package-lock.json → npm/next@16.0.1 → npm/@next/swc-linux-x64-gnu@16.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@next/swc-linux-x64-gnu@16.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @next/swc-linux-x64-musl under MIT Location: Package overview From: package-lock.json → npm/next@16.0.1 → npm/@next/swc-linux-x64-musl@16.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@next/swc-linux-x64-musl@16.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @next/swc-win32-arm64-msvc under MIT Location: Package overview From: package-lock.json → npm/next@16.0.1 → npm/@next/swc-win32-arm64-msvc@16.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@next/swc-win32-arm64-msvc@16.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @next/swc-win32-x64-msvc under MIT Location: Package overview From: package-lock.json → npm/next@16.0.1 → npm/@next/swc-win32-x64-msvc@16.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@next/swc-win32-x64-msvc@16.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm next under CC-BY-SA-4.0 License: CC-BY-SA-4.0 (package/dist/compiled/glob/LICENSE) License: MPL-2.0 (package/dist/compiled/@vercel/og/package.json) License: MPL-2.0 (package/dist/compiled/@vercel/og/LICENSE) License: MPL-2.0 (package/dist/compiled/@vercel/og/satori/LICENSE) From: package-lock.json → npm/next@16.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report