[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	16.4.3 → 16.4.5

---

Release Notes

vercel/next.js (next)

v16.4.5

Compare Source

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#​100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#​100619)
• [lts-active] Revert "Optimize strict module factory chunks (#​98421)" (#​100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#​100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#​100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#​100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#​100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	canshi	a7b4c33	Commit Preview URL Branch Preview URL	Nov 08 2026, 01:42 AM

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://renovate-nextjs-monorepo-canshi.cateiru-fe4.workers.dev (commit e35bdd5)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://590e05db-canshi.cateiru-fe4.workers.dev	e35bdd5	2026-11-09T15:04:53.400Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://5f4222c7-canshi.cateiru-fe4.workers.dev	8b057b0	2026-11-08T13:28:10.195Z	Visit the dashboard ↗

[github-actions]

管理画面の VRT (reg-suit) 結果

ステータス	件数
差分あり	0
新規	0
削除	0
変化なし	19

reg-suit レポートを見る

[github-actions]

VRT (reg-suit) 結果

ステータス	件数
差分あり	0
新規	0
削除	0
変化なし	160

reg-suit レポートを見る

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://renovate-nextjs-monorepo-canshi-admin.cateiru-fe4.workers.dev (commit e35bdd5)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://39dc3dee-canshi-admin.cateiru-fe4.workers.dev	e35bdd5	2026-11-09T15:02:37.710Z	Visit the dashboard ↗