Bump the npm_and_yarn group across 2 directories with 1 update

[dependabot]

Bumps the npm_and_yarn group with 1 update in the /clients/admin-ui directory: next.
Bumps the npm_and_yarn group with 1 update in the /clients/privacy-center directory: next.

Updates next from 14.2.35 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)
• Apply server actions transform to node_modules in route handlers (#89380)
• ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)
• feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)
• Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)
• Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)
• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​unstubbable, @​styfle, @​eps1lon, and @​ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Upgrade to swc 54 (#88207)
• implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)
• tweak LRU sentinel key (#89123)

Credits

Huge thanks to @​mischnic, @​wyattjoh, and @​ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.0.11

Please see this changelog for more information about this security patch.

v15.6.0-canary.61

Please refer the following changelogs for more information about this security release:

• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
• https://vercel.com/changelog/summary-of-cve-2026-23864

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

... (truncated)

Commits

• bdf3e35 v16.1.7
• dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
• 9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
• 36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
• 93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
• c68d62d Backport documentation fixes for 16.1.x (#90655)
• 5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
• c95e357 Backport/docs fixes 16.1.x (#90125)
• cba6144 [backport] Apply server actions transform to node_modules in route handlers...
• 3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
• Additional commits viewable in compare view

Updates next from 15.5.10 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)
• Apply server actions transform to node_modules in route handlers (#89380)
• ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)
• feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)
• Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)
• Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)
• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​unstubbable, @​styfle, @​eps1lon, and @​ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Upgrade to swc 54 (#88207)
• implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)
• tweak LRU sentinel key (#89123)

Credits

Huge thanks to @​mischnic, @​wyattjoh, and @​ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.0.11

Please see this changelog for more information about this security patch.

v15.6.0-canary.61

Please refer the following changelogs for more information about this security release:

• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
• https://vercel.com/changelog/summary-of-cve-2026-23864

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

... (truncated)

Commits

• bdf3e35 v16.1.7
• dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
• 9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
• 36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
• 93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
• c68d62d Backport documentation fixes for 16.1.x (#90655)
• 5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
• c95e357 Backport/docs fixes 16.1.x (#90125)
• cba6144 [backport] Apply server actions transform to node_modules in route handlers...
• 3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fides-plus-nightly	Error		Mar 17, 2026 7:29pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
fides-privacy-center	Ignored		Mar 17, 2026 7:29pm

[greptile-apps]

Greptile Summary

This PR bumps the next package to 16.1.7 across both client packages (admin-ui and privacy-center), pulling in several important security fixes (CVE-2026-27977, CVE-2026-27978, CVE-2026-27979, CVE-2026-27980, CVE-2026-29057). The privacy-center upgrade is straightforward since it was already on Next.js 15 with React 19. However, the admin-ui upgrade is a two-major-version jump (14 → 16) that has unresolved dependency conflicts — it still requires React 18, which is not supported by Next.js 16, and its eslint-config-next dev dependency is still pinned to ^14.2.5.

Key issues:

• admin-ui React version incompatibility: react and react-dom remain at ^18.3.1 (React 18), but Next.js 15+ requires React 19. The package will fail at install or build time due to unresolved peer dependencies. framer-motion at ^11.2.12 also does not support React 19 and needs to be bumped to ^12.x.
• admin-ui eslint-config-next mismatch: The ESLint config is still at ^14.2.5 while next is now ^16.1.7. This version must be kept in sync with the next runtime version.
• Missing code migration for admin-ui: The Next.js 14 → 15 migration involves several breaking code changes (e.g., params/searchParams are now async Promises, fetch caching semantics changed, next/headers APIs changed). These application-level changes are not included in this PR and would need to accompany the dependency bump.

Confidence Score: 2/5

• Not safe to merge — the admin-ui upgrade will likely break at install or build time due to React 18 / Next.js 16 peer dependency conflicts and a missing eslint-config-next version bump.
• The privacy-center half of the PR is clean (React 19 already in place, single major version bump), but admin-ui jumps two major versions (14 → 16) without upgrading React from 18 to 19, without updating framer-motion to a React-19-compatible version, and without updating eslint-config-next. These omissions are likely to cause installation failures and broken builds.
• clients/admin-ui/package.json requires React 19, updated type definitions, a matching eslint-config-next, and a compatible framer-motion version before merging.

Important Files Changed

Filename	Overview
clients/admin-ui/package.json	Bumps next from ^14.2.35 to ^16.1.7 — a two-major-version jump. React is still pinned to ^18.3.1 (React 18), which is incompatible with Next.js 15+. The eslint-config-next dev dependency remains at ^14.2.5, creating a significant version mismatch with the new Next.js 16 runtime.
clients/privacy-center/package.json	Bumps next from 15.5.10 to 16.1.7 — a single major version bump. React is already at 19.0.2 and types align with React 19, so no React compatibility issue. eslint-config-next at ^15.1.7 is behind the new version but this is a minor concern.

Comments Outside Diff (1)

1. clients/admin-ui/package.json, line 108 (link)

   eslint-config-next major version mismatch

   eslint-config-next is pinned at ^14.2.5 while next is now ^16.1.7. The ESLint config package is tied to the Next.js version and exposes rules specific to the Next.js runtime being used. Running a mismatched version will produce warnings during install and may cause linting failures or silently miss rules that apply to Next.js 15/16 APIs (e.g., async params/searchParams, updated caching semantics).

   This should be updated to match the next version:

_{Last reviewed commit: 8b55744}

[greptile-apps]

React 18 incompatible with Next.js 15+/16

next is jumping from ^14.2.35 to ^16.1.7 (two major versions), but react and react-dom remain pinned to ^18.3.1 and @types/react / @types/react-dom are still at their React 18 versions (^18.3.2 / ^18.3.0). Next.js 15 adopted React 19 as the required peer dependency, and Next.js 16 continues this requirement. Running Next.js 16 with React 18 will produce peer dependency errors and is untested/unsupported by Vercel — the app is likely to fail at install or build time.

The privacy-center package correctly uses react: "19.0.2" alongside next: "16.1.7". The same upgrade path is needed for admin-ui:

• react → ^19.0.0
• react-dom → ^19.0.0
• @types/react → ^19.0.0
• @types/react-dom → ^19.0.0

Note also that framer-motion is at ^11.2.12 in admin-ui while privacy-center already uses ^12.23.24; Framer Motion v11 does not support React 19 either, so that dependency will also need a bump as part of this upgrade.