fix(deps): bump next to 15.5.13/16.1.7 to fix CVE-2026-1525, CVE-202-33036 and related

[chargome]

Fixes Dependabot alerts #1165-#1215 (HTTP smuggling, image disk cache DoS, WebSocket DoS, CSRF null origin bypass in Next.js).

• nextjs-16-bun/cacheComponents/cf-workers/trailing-slash/tunnel: 16.1.5 → 16.1.7
• nextjs-sourcemaps: 16.1.6 → 16.1.7
• nextjs-15, nextjs-15-intl: 15.5.10 → 15.5.13
• nextjs-15-t3: ^15.5.9 → ^15.5.13

[github-actions]

Semver Impact of This PR

🟢 Patch (bug fixes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

New Features ✨

• (remix) Server Timing Headers Trace Propagation by onurtemizkan in #18653

Bug Fixes 🐛

Deps

• Bump next to 15.5.13/16.1.7 to fix CVE-2026-1525, CVE-202-33036 and related by chargome in #19870

• Bump devalue 5.6.3 to 5.6.4 to fix CVE-2026-30226 by chargome in #19849
• Bump file-type to 21.3.2 and @nestjs/common to 11.1.17 by chargome in #19847
• Bump unhead 2.1.4 to 2.1.12 to fix CVE-2026-31860 and CVE-2026-31873 by chargome in #19848
• Bump flatted 3.3.1 to 3.4.2 to fix CVE-2026-32141 by chargome in #19842
• Bump tar 7.5.10 to 7.5.11 to fix CVE-2026-31802 by chargome in #19846
• Bump hono 4.12.5 to 4.12.7 in cloudflare-hono E2E test app by chargome in #19850
• Bump undici 6.23.0 to 6.24.1 to fix multiple CVEs by chargome in #19841

Other

• (deno) Clear pre-existing OTel global before registering TracerProvider by sergical in #19723
• (node-core) Recycle propagationContext for each request by Lms24 in #19835

Internal Changes 🔧

• (deps) Bump next from 16.1.5 to 16.1.7 in /dev-packages/e2e-tests/test-applications/nextjs-16 by dependabot in #19851
• (nextjs) Skip broken ISR tests by chargome in #19871
• (react) Add gql tests for react router by chargome in #19844
• (release) Switch from action-prepare-release to Craft by BYK in #18763

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

size-limit report 📦

Path	Size	% Change	Change
@sentry/browser	25.64 kB	-	-
@sentry/browser - with treeshaking flags	24.14 kB	-	-
@sentry/browser (incl. Tracing)	42.62 kB	-	-
@sentry/browser (incl. Tracing, Profiling)	47.28 kB	-	-
@sentry/browser (incl. Tracing, Replay)	81.42 kB	-	-
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	71 kB	-	-
@sentry/browser (incl. Tracing, Replay with Canvas)	86.12 kB	-	-
@sentry/browser (incl. Tracing, Replay, Feedback)	98.37 kB	-	-
@sentry/browser (incl. Feedback)	42.45 kB	-	-
@sentry/browser (incl. sendFeedback)	30.31 kB	-	-
@sentry/browser (incl. FeedbackAsync)	35.36 kB	-	-
@sentry/browser (incl. Metrics)	26.92 kB	-	-
@sentry/browser (incl. Logs)	27.07 kB	-	-
@sentry/browser (incl. Metrics & Logs)	27.74 kB	-	-
@sentry/react	27.39 kB	-	-
@sentry/react (incl. Tracing)	44.95 kB	-	-
@sentry/vue	30.08 kB	-	-
@sentry/vue (incl. Tracing)	44.48 kB	-	-
@sentry/svelte	25.66 kB	-	-
CDN Bundle	28.28 kB	-	-
CDN Bundle (incl. Tracing)	43.51 kB	-	-
CDN Bundle (incl. Logs, Metrics)	29.14 kB	-	-
CDN Bundle (incl. Tracing, Logs, Metrics)	44.36 kB	-	-
CDN Bundle (incl. Replay, Logs, Metrics)	68.21 kB	-	-
CDN Bundle (incl. Tracing, Replay)	80.33 kB	-	-
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	81.23 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback)	85.87 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	86.77 kB	-	-
CDN Bundle - uncompressed	82.62 kB	-	-
CDN Bundle (incl. Tracing) - uncompressed	128.56 kB	-	-
CDN Bundle (incl. Logs, Metrics) - uncompressed	85.49 kB	-	-
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	131.43 kB	-	-
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	209.12 kB	-	-
CDN Bundle (incl. Tracing, Replay) - uncompressed	245.41 kB	-	-
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	248.26 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	258.32 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	261.17 kB	-	-
@sentry/nextjs (client)	47.37 kB	-	-
@sentry/sveltekit (client)	43.07 kB	-	-
@sentry/node-core	56.38 kB	+0.02%	+8 B 🔺
@sentry/node	173.19 kB	+0.01%	+12 B 🔺
@sentry/node - without tracing	96.37 kB	+0.01%	+5 B 🔺
@sentry/aws-serverless	113.37 kB	+0.01%	+10 B 🔺

View base workflow run