Skip to content

chore(deps): bump next from 15.3.5 to 16.1.7 in /blog#17

Open
dependabot[bot] wants to merge 16 commits intomainfrom
dependabot/npm_and_yarn/blog/next-16.1.7
Open

chore(deps): bump next from 15.3.5 to 16.1.7 in /blog#17
dependabot[bot] wants to merge 16 commits intomainfrom
dependabot/npm_and_yarn/blog/next-16.1.7

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 17, 2026

Bumps next from 15.3.5 to 16.1.7.

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)
  • Apply server actions transform to node_modules in route handlers (#89380)
  • ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)
  • feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)
  • Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)
  • Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)
  • fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​unstubbable, @​styfle, @​eps1lon, and @​ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Upgrade to swc 54 (#88207)
  • implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)
  • tweak LRU sentinel key (#89123)

Credits

Huge thanks to @​mischnic, @​wyattjoh, and @​ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.0.11

Please see this changelog for more information about this security patch.

v15.6.0-canary.61

Please refer the following changelogs for more information about this security release:

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

... (truncated)

Commits
  • bdf3e35 v16.1.7
  • dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
  • 9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
  • 36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
  • 93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
  • c68d62d Backport documentation fixes for 16.1.x (#90655)
  • 5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
  • c95e357 Backport/docs fixes 16.1.x (#90125)
  • cba6144 [backport] Apply server actions transform to node_modules in route handlers...
  • 3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

amethystani and others added 16 commits March 17, 2026 00:56
…tivity logging, webhooks, notifications, API keys, and enhanced user settings.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…s voice session

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…service role key fallback to prevent bundle exposure
…/DE auto-language

- New Netlify function /api/elevenlabs-kb-sync: syncs all document chunks to ElevenLabs agent KB (full replace strategy)
- New utility buildElevenLabsSystemPrompt: builds voice-optimized system prompt from KnowledgeBaseConfig (persona, categories, priority rules, custom instructions, guidelines + EN/DE auto-detect)
- ragService: fires syncKbToElevenLabs after processDocument() and deleteDocument() succeed (non-fatal, fire-and-forget)
- UserPhoneInterface: injects KB system prompt and greeting as ElevenLabs session overrides on call start

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Deploy api-webhooks and api-activity-log Supabase edge functions
- Apply DB migration for activity_log, webhooks, webhook_deliveries, notification_preferences tables
- Add activityLogger service: fire-and-forget POST to api-activity-log
- Wire activity logging to: auth sign-in, API key create/revoke, settings save, document upload/delete, team invite/remove
- Fix embed iframe: override X-Frame-Options and CSP frame-ancestors for /user/* routes in netlify.toml and _headers
- Handle embed=true query param in UserCall.tsx: hide header/sidebar, start directly in chat mode

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rewrite PlaybooksView with preset date range buttons (week/month/year)
  and custom date picker; shows analyzed call count after generation
- Add "Use in Rescue" button to promote AI templates into rescue_playbooks
  so they appear in CustomerGraph's Create Action modal
- Fix playbooks edge function: use call_history table (not call_sessions),
  upgrade to llama-3.3-70b-versatile, fix POST response key to playbooks
- Remove hardcoded DEFAULT_PLAYBOOKS and auto-seeding from api-rescue-playbooks

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Upgrade @elevenlabs/react 0.14.1 → 0.14.3
- Upgrade @elevenlabs/client 0.15.0 → 0.15.2

Root cause: ElevenLabs server now sends 'multimodal_message' WebSocket
events during session init. The old client (0.15.0) didn't handle this
event type — the server would close the connection, then the SDK cleanup
called socket.close() on an already-CLOSED socket, producing the repeated
"WebSocket is already in CLOSING or CLOSED state" errors.

0.15.2 adds multimodal_message handling, restoring the connection flow.

Also fixed: overrides.agent.first_message (snake_case) → firstMessage
(camelCase) — SDK reads i.firstMessage so the greeting was silently
dropped on every call start.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Root cause of 'agent connects but never responds' (timeout → disconnect):
The overrides.agent.prompt.prompt was replacing the agent's ENTIRE system
prompt, including ElevenLabs' hidden injections for tool-call routing and
knowledge-base search. Without those injections the agent silently fails
to produce any response, times out, and closes the WebSocket — which is
why onInputWorkletMessage kept firing sendMessage on an already-closed
socket ('WebSocket is already in CLOSING or CLOSED state' × N).

Fix: remove the prompt override entirely. The ElevenLabs agent's system
prompt should be managed in the ElevenLabs dashboard, not injected at
session start. Only the firstMessage (greeting) override is kept since
that is safe to supply per-session.

Also removes unused buildElevenLabsSystemPrompt import.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… WebRTC

Remove the custom signed-URL Netlify webhook and pass agentId directly to
useConversation.startSession(). This triggers the SDK's modern LiveKit
WebRTC path instead of the legacy WebSocket path to api.elevenlabs.io.

The WebSocket path (signedUrl) was causing repeated
  'WebSocket is already in CLOSING or CLOSED state'
errors from onInputWorkletMessage — the audio worklet kept firing after
the server closed the socket without the client realising it.

With agentId, ElevenLabs SDK fetches its own LiveKit JWT from
/v1/convai/conversation/token and connects via WebRTC — no custom
server function or signed-URL proxy needed.

Requirement: VITE_ELEVENLABS_AGENT_ID must be set in Netlify env vars
(VITE_ prefix so Vite bundles it into the frontend build). The agent
must have public access enabled in the ElevenLabs dashboard.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Bumps [next](https://github.com/vercel/next.js) from 15.3.5 to 16.1.7.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.3.5...v16.1.7)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.1.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 17, 2026
@netlify
Copy link

netlify bot commented Mar 17, 2026

Deploy Preview for gonnaai ready!

Name Link
🔨 Latest commit f049d52
🔍 Latest deploy log https://app.netlify.com/projects/gonnaai/deploys/69b99f702bb5f500087b7872
😎 Deploy Preview https://deploy-preview-17--gonnaai.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse
1 paths audited
Performance: 28
Accessibility: 97
Best Practices: 100
SEO: 100
PWA: 80
View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify project configuration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

configuration dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code size/L

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant