fix(deps): update nextjs monorepo (16.3.0 → 16.3.1)

[its-miso]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
eslint-config-next (source)	16.3.0 → 16.3.1
next (source)	16.3.0 → 16.3.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

vercel/next.js (eslint-config-next)

v16.3.1

Compare Source

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in #​96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in #​96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in #​96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in #​96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in #​96900
• [backport] Bump @​swc/helpers by @​mischnic in #​96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in #​97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in #​97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in #​97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in #​97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in #​97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in #​97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in #​97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in #​97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in #​97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in #​97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in #​97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in #​97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in #​97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#​94905) by @​gaojude in #​97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation: Approve. This Renovate PR bumps the Next.js monorepo (next, eslint-config-next, @next/env, @next/eslint-plugin-next, the @next/swc-* platform binaries, and @swc/helpers) from 16.3.0 to 16.3.1, entirely within package-lock.json. No source, manifest, or Dockerfile changes. CI is green on the head commit, and the upstream 16.3.1 release is a patch-level set of backported fixes with no API or engine changes.

Change-by-change findings

• package-lock.json — next 16.3.0 → 16.3.1 together with its matched dependencies: @next/env 16.3.1, @next/eslint-plugin-next 16.3.1, eslint-config-next 16.3.1, all eight @next/swc-* optional platform binaries at 16.3.1, and @swc/helpers 0.5.15 → 0.5.23 (bumped upstream in this same release). Every package moves in lockstep from a single published release, so there is no version skew between next and its native binaries on any target platform (linux musl/gnu, darwin, win32).
• The PR title names only eslint-config-next, but the diff also updates the runtime next package and its dependencies; this is consistent with Renovate's nextjs-monorepo grouping and the lockfile is internally coherent.
• Release evidence (Next.js v16.3.1, published 2026-08-13): all 22 commits are backported fixes on the 16.3 branch — Turbopack runtime/HMR and module-registration fixes, a next/image response-preservation fix, a styled-jsx Pages Router SSR fix, cache-tag/revalidation and unstable_cache naming fixes, a dev-validation worker fix, and a revert of an i18n localization change for dynamic Pages API routes. No public API changes, no peerDependency changes, and no breaking changes are listed; the installed lockfile metadata retains engines.node >= 20.9.0 unchanged.
• The i18n revert applies to dynamic Pages Router API routes, while Dispatch uses the App Router (per AGENTS.md tech stack), so this revert is not expected to affect this application.
• Host-platform coupling check: the Dockerfile pins the runtime to node:24-bookworm-slim and package.json declares engines.node >= 24; the installed next@16.3.1 declares node >= 20.9.0, so Node 24 is within the supported range. The lockfile engines field for the exact installed version is the binding constraint and it is satisfied.
• Override coherence: next@16.3.1 still carries postcss 8.5.23 and optional sharp ^0.35.3, so the documented postcss/sharp override rationale in package.json remains accurate after this bump.

Standards Compliance

The change conforms to AGENTS.md: lockfile-only dependency update with no environment-variable, Prisma-schema, or Docker-base-image changes; the Docker npm ci stages consume the updated lockfile as-is; lint and typecheck gates still block CI and both passed.

Tool Harness Findings

CI on head commit 2f8ca61 reached a terminal success state for all checks: Build, Docker Build, Lint, Tests, Typecheck, and npm audit — all success. This directly satisfies the must-check "run full test suite after upgrade."

Unknowns or Needs Verification

• The "check for breaking API changes" must-check is satisfied from the component's own release evidence: a patch release with backported fixes only, no API or engine changes. A separate Node.js compatibility-matrix fetch could not be completed within the tool budget, but the installed lockfile's node >= 20.9.0 engine declaration is the authoritative floor and Node 24 satisfies it.
• No other unknowns: no image digest changes in the diff, no linked issues to compare against, and no evidence-provider findings were present in the corpus.

Sources

• Next.js v16.3.1 release notes: https://github.com/vercel/next.js/releases/tag/v16.3.1
• GitHub compare metadata for v16.3.0...v16.3.1 (22 commits, all backports)
• Repository files read: Dockerfile (node:24-bookworm-slim), package.json (engines >=24, override rationale), and the updated package-lock.json entries.