Bump the npm_and_yarn group across 2 directories with 1 update by dependabot[bot] · Pull Request #7592 · ethyca/fides

dependabot · 2026-03-07T01:02:58Z

Bumps the npm_and_yarn group with 1 update in the /clients/admin-ui directory: next.
Bumps the npm_and_yarn group with 1 update in the /clients/privacy-center directory: next.

Updates next from 14.2.35 to 16.1.6

Release notes

Sourced from next's releases.

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Upgrade to swc 54 (#88207)

implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)

tweak LRU sentinel key (#89123)

Credits

Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.1.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Only filter next config if experimental flag is enabled (#88733)

Credits

Huge thanks to @mischnic for helping!

v16.1.1-canary.36

Core Changes

Rename rewroteURL to rewrittenPathname in request metadata: #88751

Simplify getImplicitTags to accept pathname instead of url object: #88753

Add NEXT_DEPLOYMENT_ID global: #86738

Turbopack: remove deployment id suffix from client reference manifest chunks: #88741

Inject <html data-dpl-id> and don't inline it into JS anymore: #88761

[metadata] match the Metadata and ResolvedMetadata type: #88739

Example Changes

Update with-mysql example to Next.js 15, Tailwind 4, Prisma 7: #88475

Misc Changes

[ci] Ensure Turbo Remote Cache can be written to: #88794

perf(turbopack): optimize resolve plugin handling: #88639

Fix buildManifest.js deployment tests: #88806

... (truncated)

Commits

adf8c61 v16.1.6
098c0c0 [backport][ci] Make gh auth status optional when triggering a release (#89100)
a43df32 Backport/docs fixes jan 25 16.1.x (#89124)
d6d5734 tweak LRU sentinel cache key (#89123)
4324698 backport: implement LRU cache with invocation ID scoping for minimal mode res...
23c4649 [backport] Upgrade to swc 54 (#88207) (#89103)
acba4a6 v16.1.5
e1d1fc6 Add maximum size limit for postponed body parsing (#88175)
500ec83 fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
1caaca3 feat(next/image)!: add images.maximumResponseBody config (#88183)
Additional commits viewable in compare view

Updates next from 15.2.8 to 15.5.10

Release notes

Sourced from next's releases.

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Upgrade to swc 54 (#88207)

implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)

tweak LRU sentinel key (#89123)

Credits

Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.1.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Only filter next config if experimental flag is enabled (#88733)

Credits

Huge thanks to @mischnic for helping!

v16.1.1-canary.36

Core Changes

Rename rewroteURL to rewrittenPathname in request metadata: #88751

Simplify getImplicitTags to accept pathname instead of url object: #88753

Add NEXT_DEPLOYMENT_ID global: #86738

Turbopack: remove deployment id suffix from client reference manifest chunks: #88741

Inject <html data-dpl-id> and don't inline it into JS anymore: #88761

[metadata] match the Metadata and ResolvedMetadata type: #88739

Example Changes

Update with-mysql example to Next.js 15, Tailwind 4, Prisma 7: #88475

Misc Changes

[ci] Ensure Turbo Remote Cache can be written to: #88794

perf(turbopack): optimize resolve plugin handling: #88639

Fix buildManifest.js deployment tests: #88806

... (truncated)

Commits

adf8c61 v16.1.6
098c0c0 [backport][ci] Make gh auth status optional when triggering a release (#89100)
a43df32 Backport/docs fixes jan 25 16.1.x (#89124)
d6d5734 tweak LRU sentinel cache key (#89123)
4324698 backport: implement LRU cache with invocation ID scoping for minimal mode res...
23c4649 [backport] Upgrade to swc 54 (#88207) (#89103)
acba4a6 v16.1.5
e1d1fc6 Add maximum size limit for postponed body parsing (#88175)
500ec83 fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
1caaca3 feat(next/image)!: add images.maximumResponseBody config (#88183)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

vercel · 2026-03-07T01:03:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
fides-plus-nightly	Ignored	Preview	Mar 10, 2026 7:43pm
fides-privacy-center	Ignored		Mar 10, 2026 7:43pm

greptile-apps · 2026-03-07T01:06:52Z

Greptile Summary

This Dependabot PR bumps next in two client directories:

admin-ui: 14.2.35 → 16.1.6 (two-major-version jump)
privacy-center: 15.2.8 → 15.5.10 (minor bump within major version 15)

No application code changes accompany these updates (only package.json modifications).

admin-ui update: While this is a significant version jump, the primary risks identified in prior analysis (async request API breaking changes) do not apply to this codebase because admin-ui uses the Next.js Pages Router, which does not rely on the async request APIs introduced in Next.js 15. The codebase has minimal fetch() usage (1 commented-out call) and relies on RTK Query for data fetching, so fetch caching behavior changes have minimal impact.

privacy-center update: This is a safe minor version bump within the same major version. The project already uses React 19 and has eslint-config-next reasonably aligned at ^15.1.7.

eslint-config-next version: admin-ui has eslint-config-next at ^14.2.5 while next is at ^16.1.6, creating a major version mismatch. While best practice is to keep these packages in sync, no concrete linting failures are demonstrated by this PR.

Confidence Score: 3/5

Admin-ui's two-major-version jump from Next.js 14 to 16 carries inherent risk, but specific breaking change concerns (async APIs) do not apply to this Pages Router-based codebase. Testing would help validate compatibility.
While this PR jumps Next.js major versions in admin-ui without application-level code changes, the previously identified concerns about async request API breaking changes do not apply to the Pages Router architecture used by admin-ui. Privacy-center's minor version bump is low-risk. Without concrete evidence of test failures or incompatibilities, and given that Dependabot PRs typically don't include application code changes, the risk is moderate rather than critical. However, the admin-ui jump still warrants testing before merging.
clients/admin-ui/package.json should undergo testing given the two-major-version jump, though specific breaking changes for Pages Router apps have not been identified.

_{Last reviewed commit: d714912}

Bumps the npm_and_yarn group with 1 update in the /clients/admin-ui directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /clients/privacy-center directory: [next](https://github.com/vercel/next.js). Updates `next` from 14.2.35 to 16.1.6 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.2.35...v16.1.6) Updates `next` from 15.2.8 to 15.5.10 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.2.35...v16.1.6) --- updated-dependencies: - dependency-name: next dependency-version: 16.1.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.10 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

NextJS upgrades currently break admin-ui export configuration, so suppress these alerts until the issue is resolved. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jason Gill <103820+gilluminate@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Jason Gill <jason.gill@ethyca.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 7, 2026

dependabot bot requested a review from a team as a code owner March 7, 2026 01:02

dependabot bot requested review from gilluminate and removed request for a team March 7, 2026 01:02

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 7, 2026

vercel bot had a problem deploying to Preview – fides-plus-nightly March 7, 2026 01:03 Failure

vercel bot deployed to Preview – fides-plus-nightly March 9, 2026 18:39 View deployment

dependabot bot and others added 5 commits March 10, 2026 13:40

Ignore NextJS upgrades in dependabot config

aa60ef8

NextJS upgrades currently break admin-ui export configuration, so suppress these alerts until the issue is resolved. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

revert package.json

6a4ecb3

Update package-lock.json

1d94732

fix race condition

11fac1f

gilluminate force-pushed the dependabot/npm_and_yarn/clients/admin-ui/npm_and_yarn-6b900b85e9 branch from 937a582 to 11fac1f Compare March 10, 2026 19:40

Add changelog for PR #7592

824e319

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

gilluminate approved these changes Mar 10, 2026

View reviewed changes

gilluminate added this pull request to the merge queue Mar 10, 2026

Merged via the queue into main with commit 881a30f Mar 10, 2026
42 checks passed

gilluminate deleted the dependabot/npm_and_yarn/clients/admin-ui/npm_and_yarn-6b900b85e9 branch March 10, 2026 21:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 2 directories with 1 update#7592

Bump the npm_and_yarn group across 2 directories with 1 update#7592
gilluminate merged 6 commits intomainfrom
dependabot/npm_and_yarn/clients/admin-ui/npm_and_yarn-6b900b85e9

dependabot bot commented on behalf of github Mar 7, 2026

Uh oh!

vercel bot commented Mar 7, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Mar 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Mar 7, 2026

v16.1.6

Core Changes

Credits

v16.1.5

v16.1.4

Core Changes

Credits

v16.1.1-canary.36

Core Changes

Example Changes

Misc Changes

v16.1.6

Core Changes

Credits

v16.1.5

v16.1.4

Core Changes

Credits

v16.1.1-canary.36

Core Changes

Example Changes

Misc Changes

Uh oh!

vercel bot commented Mar 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps bot commented Mar 7, 2026

Greptile Summary

Confidence Score: 3/5

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel bot commented Mar 7, 2026 •

edited

Loading