[dependabot]

Bumps eslint-config-next from 16.3.6 to 16.3.8.

Release notes

Sourced from eslint-config-next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

• Server-Side Request Forgery in Image Optimization

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
• Pending use cache fill can leak Draft Mode content into regular responses and persisted pages
• Cache leak across root param values in nested 'use cache' functions

Low:

• Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

Commits

• b0fad0d v16.3.8
• 4c20699 v16.3.7
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[justalab-agents]

This PR bumps eslint-config-next from 16.3.6 to 16.3.8 in devDependencies, along with the corresponding lockfile updates for its transitive dependencies (typescript-eslint 8.71.0→8.71.1, browserslist, axe-core, caniuse-lite, and several other minor packages). Notably, the next package in dependencies is not updated and remains at 16.3.6, creating a version mismatch with eslint-config-next — these two packages are designed to be kept in lockstep by the Next.js team.

Reviewer callouts (1)

Non-blocking observations. Nothing here needs to change before merge.

• .github:1 — "The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see actions/runner-images#14748"

[justalab-agents]

[WARNING] agentic/design

eslint-config-next (16.3.8) is now two patch versions ahead of next (16.3.6 in dependencies). These two packages are released in lockstep by the Next.js team and are designed to match exactly — eslint-config-next re-exports @next/eslint-plugin-next at the same version, which contains lint rules that may reference APIs and patterns specific to the corresponding Next.js release. Running a mismatched pair can cause false positives (new rules flagging valid 16.3.6 patterns) or false negatives (lint rules not checking for issues that exist in 16.3.6). The standard practice is to keep both at the same version.

Suggested fix:

Either bump `next` to `16.3.8` in `dependencies` to match, or revert `eslint-config-next` back to `16.3.6` until `next` itself is ready to be upgraded:

```json
"dependencies": {
  ...
  "next": "16.3.8",
  ...
},
"devDependencies": {
  ...
  "eslint-config-next": "16.3.8",
  ...
}

<!-- justalab-agents:hash:4fe899dc1c4d -->