Skip to content

deps: align eslint-config-next with next 16.4.2 - #18143

Merged
diegosouzapw merged 1 commit into
release/v3.8.53from
fix/sec-deps-next-16-4-2-20261025
Oct 26, 2026
Merged

diegosouzapw merged 1 commit into
release/v3.8.53from
fix/sec-deps-next-16-4-2-20261025

Conversation

@diegosouzapw

Copy link
Copy Markdown
Collaborator

Summary

The security bump to next 16.4.2 (#18067) left eslint-config-next and its @next/eslint-plugin-next on 16.3.8. This pins both to 16.4.2, the same release as next, so the lint rules match the framework version.

eslint-config-next 16.4.2 is also part of the 26-package development group #17197; this PR moves only the Next.js pair so it does not wait on that group.

How

package.json pin changed (exact, no range, like next), then npm install --package-lock-only --ignore-scripts. The lockfile diff touches only node_modules/eslint-config-next and node_modules/@next/eslint-plugin-next.

Validation

Check Result
npm run check:lockfile OK
Lockfile diff only eslint-config-next and @next/eslint-plugin-next 16.3.8 → 16.4.2

The local node_modules is shared with the main checkout and was not reinstalled, so ESLint runs against 16.4.2 in CI (npm ci), not locally.

The security bump to next 16.4.2 (#18067) left eslint-config-next and its
@next/eslint-plugin-next on 16.3.8. Pin them to the same release.
@github-actions

Copy link
Copy Markdown
Contributor

CI Coverage Report

  • Coverage job: skipped
  • PR test policy: success

Coverage artifact was not available for this run.

@diegosouzapw
diegosouzapw merged commit d0a1c1c into release/v3.8.53 Oct 26, 2026
47 of 62 checks passed
@diegosouzapw
diegosouzapw deleted the fix/sec-deps-next-16-4-2-20261025 branch October 26, 2026 04:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant