chore(deps)(deps): bump the minor-and-patch group across 1 directory with 2 updates

[dependabot]

Bumps the minor-and-patch group with 2 updates in the / directory: @next/third-parties and @opennextjs/cloudflare.

Updates @next/third-parties from 16.3.1 to 16.3.3

Release notes

Sourced from @​next/third-parties's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

Commits

• a9a1cb7 v16.3.3
• d0ac882 v16.3.2
• See full diff in compare view

Updates @opennextjs/cloudflare from 1.20.2 to 1.20.4

Release notes

Sourced from @​opennextjs/cloudflare's releases.

@​opennextjs/cloudflare@​1.20.4

Patch Changes

• #1365 bf52109 Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.2

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.2

@​opennextjs/cloudflare@​1.20.3

Patch Changes

• #1361 8c31fbc Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.1

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.1

• #1359 65e4487 Thanks @​vicb! - chore: bump the Next.js peer dependency to 15.5.24 / 16.3.3

• #1359 65e4487 Thanks @​vicb! - fix: patch the Turbopack wasm helpers that Next.js 16.3 emits in the chunks

  Until Next.js 16.2 the Turbopack wasm loaders were named loadWebAssembly and loadWebAssemblyModule functions living in [turbopack]_runtime.js, which the adapter rewrote to resolve the chunk through a static import(). Next.js 16.3 emits them on demand in the chunks instead ([turbopack-wasm]/node/loadWasm.ts), so the existing patch silently stopped matching and WebAssembly.compileStreaming - which workerd does not implement - survived into the Worker.

  Every wasm backed import then threw TypeError: WebAssembly.compileStreaming is not a function at runtime, most visibly breaking Prisma with the workerd client runtime.

  The chunks emitted by Turbopack are now patched as well, for both the server and the Node.js middleware bundles.

• #1309 56dfacc Thanks @​ScienHAC! - feature: support Node.js middleware (proxy.ts)

  Next.js 16 replaces middleware.ts with proxy.ts which always runs on the Node.js runtime.

  The Node.js middleware is now bundled into a Workers compatible middleware/handler.mjs: the OpenNext config manifests are inlined at build time (as for the edge middleware) and the middleware compiled by Next.js is statically bundled instead of being loaded from the filesystem at runtime (workerd can not access the filesystem nor load modules at runtime).

  The support is experimental and requires the nodejs_compat compatibility flag.

• #1359 65e4487 Thanks @​vicb! - fix: do not load the instrumentation hook from the Node.js middleware bundle

  Next.js 16.3 registers the instrumentation hook from the middleware itself when the middleware does not run on the edge runtime, by dynamically requiring .next/server/instrumentation.js. workerd does not support dynamic requires so every request handled by the Node.js middleware (proxy.ts) failed with Dynamic require of ".next/server/instrumentation.js" is not supported.

  The guard Next.js uses (process.env.NEXT_RUNTIME !== "edge") is inlined by Next.js when it compiles the middleware, so it can not be eliminated when the middleware is re-bundled. The loader

... (truncated)

Changelog

Sourced from @​opennextjs/cloudflare's changelog.

1.20.4

Patch Changes

• #1365 bf52109 Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.2

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.2

1.20.3

Patch Changes

• #1361 8c31fbc Thanks @​vicb! - chore: bump @opennextjs/aws to 4.1.1

  See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.1

• #1359 65e4487 Thanks @​vicb! - chore: bump the Next.js peer dependency to 15.5.24 / 16.3.3

• #1359 65e4487 Thanks @​vicb! - fix: patch the Turbopack wasm helpers that Next.js 16.3 emits in the chunks

  Until Next.js 16.2 the Turbopack wasm loaders were named loadWebAssembly and loadWebAssemblyModule functions living in [turbopack]_runtime.js, which the adapter rewrote to resolve the chunk through a static import(). Next.js 16.3 emits them on demand in the chunks instead ([turbopack-wasm]/node/loadWasm.ts), so the existing patch silently stopped matching and WebAssembly.compileStreaming - which workerd does not implement - survived into the Worker.

  Every wasm backed import then threw TypeError: WebAssembly.compileStreaming is not a function at runtime, most visibly breaking Prisma with the workerd client runtime.

  The chunks emitted by Turbopack are now patched as well, for both the server and the Node.js middleware bundles.

• #1309 56dfacc Thanks @​ScienHAC! - feature: support Node.js middleware (proxy.ts)

  Next.js 16 replaces middleware.ts with proxy.ts which always runs on the Node.js runtime.

  The Node.js middleware is now bundled into a Workers compatible middleware/handler.mjs: the OpenNext config manifests are inlined at build time (as for the edge middleware) and the middleware compiled by Next.js is statically bundled instead of being loaded from the filesystem at runtime (workerd can not access the filesystem nor load modules at runtime).

  The support is experimental and requires the nodejs_compat compatibility flag.

• #1359 65e4487 Thanks @​vicb! - fix: do not load the instrumentation hook from the Node.js middleware bundle

  Next.js 16.3 registers the instrumentation hook from the middleware itself when the middleware does not run on the edge runtime, by dynamically requiring .next/server/instrumentation.js. workerd does not support dynamic requires so every request handled by the Node.js middleware (proxy.ts) failed with Dynamic require of ".next/server/instrumentation.js" is not supported.

... (truncated)

Commits

• 0622a45 Version Packages (#1367)
• 877c0b4 chore: bumps @cloudflare/workers-types (#1366)
• bf52109 bump @​opennextjs/aws to 4.1.2 (#1365)
• 9c3b797 Version Packages (#1358)
• 65e4487 chore: bump Next.js to 15.5.24 and 16.3.3 (#1359)
• 8c31fbc bump @opennextjs/aws to 4.1.1 (#1361)
• 56dfacc feat: support Node.js middleware (proxy.ts) (#1309)
• See full diff in compare view

[github-actions]

Preview deployment

Status	URL
Skipped	-

Commit: 8b8812e
Updated: 2026-08-31T06:21:17.417Z

Reason: Dependabot-triggered workflows do not have access to repository secrets in this workflow.

If you want a preview deployment, please ask a maintainer to run this from a branch within the main repository.