From 69381bd836c47c16bbae7cafd572eb81c50d1b57 Mon Sep 17 00:00:00 2001 From: Brendan Kellam Date: Thu, 27 Aug 2026 10:20:18 -0700 Subject: [PATCH 1/2] chore(web): update Next.js to 16.3.3 --- packages/web/package.json | 2 +- yarn.lock | 84 +++++++++++++++++++-------------------- 2 files changed, 43 insertions(+), 43 deletions(-) diff --git a/packages/web/package.json b/packages/web/package.json index 71812c410..f90ba7555 100644 --- a/packages/web/package.json +++ b/packages/web/package.json @@ -162,7 +162,7 @@ "micromatch": "^4.0.8", "minidenticons": "^4.2.1", "motion": "^12.42.0", - "next": "^16.3.1", + "next": "^16.3.3", "next-auth": "^5.0.0-beta.32", "next-navigation-guard": "^0.2.0", "next-themes": "^0.3.0", diff --git a/yarn.lock b/yarn.lock index 1764f3b01..a063c833f 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3764,10 +3764,10 @@ __metadata: languageName: node linkType: hard -"@next/env@npm:16.3.1": - version: 16.3.1 - resolution: "@next/env@npm:16.3.1" - checksum: 10c0/c2c61e12c31a8d3be6738fc18b4d7c1e6a151336fb386b4eff8961ee0c72cabb33867febe903a2aacf26aed75be9aa77d4947b15c45162fc0279c0f612884f5a +"@next/env@npm:16.3.3": + version: 16.3.3 + resolution: "@next/env@npm:16.3.3" + checksum: 10c0/6f300379d8ddc476d09897e97c26d593b60973bf425b093b96fdb4459f9547e8d05f3aca82a59bf0c1711b96b6a615b3483a396aec1c36a91526b9617260ba92 languageName: node linkType: hard @@ -3780,58 +3780,58 @@ __metadata: languageName: node linkType: hard -"@next/swc-darwin-arm64@npm:16.3.1": - version: 16.3.1 - resolution: "@next/swc-darwin-arm64@npm:16.3.1" +"@next/swc-darwin-arm64@npm:16.3.3": + version: 16.3.3 + resolution: "@next/swc-darwin-arm64@npm:16.3.3" conditions: os=darwin & cpu=arm64 languageName: node linkType: hard -"@next/swc-darwin-x64@npm:16.3.1": - version: 16.3.1 - resolution: "@next/swc-darwin-x64@npm:16.3.1" +"@next/swc-darwin-x64@npm:16.3.3": + version: 16.3.3 + resolution: "@next/swc-darwin-x64@npm:16.3.3" conditions: os=darwin & cpu=x64 languageName: node linkType: hard -"@next/swc-linux-arm64-gnu@npm:16.3.1": - version: 16.3.1 - resolution: "@next/swc-linux-arm64-gnu@npm:16.3.1" +"@next/swc-linux-arm64-gnu@npm:16.3.3": + version: 16.3.3 + resolution: "@next/swc-linux-arm64-gnu@npm:16.3.3" conditions: os=linux & cpu=arm64 & libc=glibc languageName: node linkType: hard -"@next/swc-linux-arm64-musl@npm:16.3.1": - version: 16.3.1 - resolution: "@next/swc-linux-arm64-musl@npm:16.3.1" +"@next/swc-linux-arm64-musl@npm:16.3.3": + version: 16.3.3 + resolution: "@next/swc-linux-arm64-musl@npm:16.3.3" conditions: os=linux & cpu=arm64 & libc=musl languageName: node linkType: hard -"@next/swc-linux-x64-gnu@npm:16.3.1": - version: 16.3.1 - resolution: "@next/swc-linux-x64-gnu@npm:16.3.1" +"@next/swc-linux-x64-gnu@npm:16.3.3": + version: 16.3.3 + resolution: "@next/swc-linux-x64-gnu@npm:16.3.3" conditions: os=linux & cpu=x64 & libc=glibc languageName: node linkType: hard -"@next/swc-linux-x64-musl@npm:16.3.1": - version: 16.3.1 - resolution: "@next/swc-linux-x64-musl@npm:16.3.1" +"@next/swc-linux-x64-musl@npm:16.3.3": + version: 16.3.3 + resolution: "@next/swc-linux-x64-musl@npm:16.3.3" conditions: os=linux & cpu=x64 & libc=musl languageName: node linkType: hard -"@next/swc-win32-arm64-msvc@npm:16.3.1": - version: 16.3.1 - resolution: "@next/swc-win32-arm64-msvc@npm:16.3.1" +"@next/swc-win32-arm64-msvc@npm:16.3.3": + version: 16.3.3 + resolution: "@next/swc-win32-arm64-msvc@npm:16.3.3" conditions: os=win32 & cpu=arm64 languageName: node linkType: hard -"@next/swc-win32-x64-msvc@npm:16.3.1": - version: 16.3.1 - resolution: "@next/swc-win32-x64-msvc@npm:16.3.1" +"@next/swc-win32-x64-msvc@npm:16.3.3": + version: 16.3.3 + resolution: "@next/swc-win32-x64-msvc@npm:16.3.3" conditions: os=win32 & cpu=x64 languageName: node linkType: hard @@ -9141,7 +9141,7 @@ __metadata: micromatch: "npm:^4.0.8" minidenticons: "npm:^4.2.1" motion: "npm:^12.42.0" - next: "npm:^16.3.1" + next: "npm:^16.3.3" next-auth: "npm:^5.0.0-beta.32" next-navigation-guard: "npm:^0.2.0" next-themes: "npm:^0.3.0" @@ -18371,19 +18371,19 @@ __metadata: languageName: node linkType: hard -"next@npm:^16.2.11, next@npm:^16.3.1": - version: 16.3.1 - resolution: "next@npm:16.3.1" +"next@npm:^16.2.11, next@npm:^16.3.3": + version: 16.3.3 + resolution: "next@npm:16.3.3" dependencies: - "@next/env": "npm:16.3.1" - "@next/swc-darwin-arm64": "npm:16.3.1" - "@next/swc-darwin-x64": "npm:16.3.1" - "@next/swc-linux-arm64-gnu": "npm:16.3.1" - "@next/swc-linux-arm64-musl": "npm:16.3.1" - "@next/swc-linux-x64-gnu": "npm:16.3.1" - "@next/swc-linux-x64-musl": "npm:16.3.1" - "@next/swc-win32-arm64-msvc": "npm:16.3.1" - "@next/swc-win32-x64-msvc": "npm:16.3.1" + "@next/env": "npm:16.3.3" + "@next/swc-darwin-arm64": "npm:16.3.3" + "@next/swc-darwin-x64": "npm:16.3.3" + "@next/swc-linux-arm64-gnu": "npm:16.3.3" + "@next/swc-linux-arm64-musl": "npm:16.3.3" + "@next/swc-linux-x64-gnu": "npm:16.3.3" + "@next/swc-linux-x64-musl": "npm:16.3.3" + "@next/swc-win32-arm64-msvc": "npm:16.3.3" + "@next/swc-win32-x64-msvc": "npm:16.3.3" "@swc/helpers": "npm:0.5.23" baseline-browser-mapping: "npm:^2.9.19" caniuse-lite: "npm:^1.0.30001579" @@ -18427,7 +18427,7 @@ __metadata: optional: true bin: next: dist/bin/next - checksum: 10c0/a071c6fdb9d02fc97b520d2c94aacfce693cf1847287129e0eaec42e8715433d925d165b8c800aff102f40820c8cf4a2e0306905d4d9912b5864a16e4f223bf0 + checksum: 10c0/2c8c27085771fa522468a69ecaae9a7bc603fb1e6e6badfd9fb22b85a8085d3285e9af3d6a457012780ff2c778b983705fa71a2da5d1ba2282aa6134c4d0e2ec languageName: node linkType: hard From 5d06c22b002a4c96faa235a9845169446c8e28d0 Mon Sep 17 00:00:00 2001 From: Brendan Kellam Date: Thu, 27 Aug 2026 10:21:16 -0700 Subject: [PATCH 2/2] docs: add changelog entry for Next.js update --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 79ec1e2a3..0c659279e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Upgraded `posthog-node` to `^5.51.2` and `@sentry/*` to `^10.71.0` to stop request contexts and child spans from being retained indefinitely. [#1617](https://github.com/sourcebot-dev/sourcebot/pull/1617) - [EE] Fixed MCP protocol traffic marking users as active by recording activity only for tool calls. [#1613](https://github.com/sourcebot-dev/sourcebot/pull/1613) +- Upgraded Next.js to 16.3.3 to include the latest upstream security fixes. [#1619](https://github.com/sourcebot-dev/sourcebot/pull/1619) ## [5.1.9] - 2026-08-22