[Snyk] Security upgrade next from 15.5.21 to 16.3.0

[Dargon789]

Snyk has created this PR to fix 3 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• extras/web/package.json

⚠️ Warning

Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Directory Traversal SNYK-JS-POSTCSS-18512282	****
	Directory Traversal SNYK-JS-POSTCSS-18313036	506
	Directory Traversal SNYK-JS-POSTCSS-18313038	506

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal

[Dargon789]

The upgrade from Next.js 15.5.21 to 16.3.0 is a major version jump with significant architectural and breaking changes that require careful migration.

Key Breaking Changes:

• Explicit Caching Model: This is the most critical change. Next.js 15 implicitly cached fetch() requests in Server Components. Next.js 16 changes to an explicit model where nothing is cached by default. You must now use the 'use cache' directive to opt-in to caching. Failure to audit and update your data fetching logic can lead to a massive increase in API requests and performance issues.

• Turbopack as Default Bundler: Webpack is no longer the default bundler; Turbopack is now used for both development and production builds. While this offers significant performance gains, it is a major architectural shift. If you have a custom Webpack configuration or rely on specific Webpack plugins, you will need to either migrate your configuration or explicitly opt back into using Webpack.

• Middleware Replaced by Proxy: The middleware.ts file has been replaced by proxy.ts. This is not just a rename but a change in the underlying runtime and network boundary control. You must migrate your existing middleware logic to the new proxy.ts file. A codemod is available to assist with this transition: npx @next/codemod@canary middleware-to-proxy.

• React 19 Required: Next.js 16 is built on and requires React 19. You must update your react and react-dom dependencies to ^19.0.0 as part of the upgrade.

• AMP Support Removed: Support for AMP (Accelerated Mobile Pages), which was deprecated in v15, is now fully removed.

Recommendation:
This is a HIGH risk upgrade. Before merging, you must:

1. Thoroughly audit all data-fetching patterns and add the 'use cache' directive where needed to prevent production issues.
2. Run the middleware-to-proxy codemod and verify your proxy logic.
3. Assess your Webpack configuration. If you have custom settings, decide whether to migrate to Turbopack or revert to a Webpack build.
4. Upgrade React dependencies to version 19.

Source: Next.js 16 Release Notes, Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sequence-js-docs	Canceled		Aug 5, 2026 3:12am
sequence-js-web	Canceled		Aug 5, 2026 3:12am
sequence.js	Canceled		Aug 5, 2026 3:12am
wagmi-project	Canceled		Aug 5, 2026 3:12am

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.