PR #6861 Review: next 16.1.5 → 16.1.7

Verdict: Approve. Clean dependency bump with no issues.

Changes (7 files)

• bun.lock — updated all next + @next/swc-* entries from 16.1.5 to 16.1.7
• package.json — updated root next dev dep
• 5 template package.json files — updated their next deps

Release notes

v16.1.6 (Jan 27): swc upgrade to 54, LRU cache fixes for minimal mode

v16.1.7 (Mar 16): 7 back-ported fixes including multiple security CVEs:

• Prevent streaming fetch hangs in dev
• Apply server actions transform to node_modules
• maxPostponedStateSize always respected
• next/image LRU disk cache + maximumDiskCacheSize
• Cross-site websocket connections blocked from privacy-sensitive origins
• Server Action submissions blocked from privacy-sensitive contexts
• http-proxy request smuggling patch (CVE-2026-29057)

Observations

• Both releases are stable back-port releases with no breaking changes
• bun.lock updates are consistent: all next and @next/swc-* entries match 16.1.7
• All 6 package.json files updated in lockstep
• No stale references to the old version found in the repo

  ^{｜ View workflow run ｜ Triggered by Pullfrog ｜ pullfrog.com ｜ 𝕏}

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
bugs	Ready	Preview, Comment	Mar 18, 2026 9:03am
remotion	Ready	Preview, Comment	Mar 18, 2026 9:03am