chore(deps-dev): bump @next/eslint-plugin-next from 15.3.2 to 16.2.10

[dependabot]

Bumps @next/eslint-plugin-next from 15.3.2 to 16.2.10.

Release notes

Sourced from @​next/eslint-plugin-next's releases.

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
• [backport] Fix "type: module" in project dir when using standalone or adapters (#94050)
• [backport] Propagate adapter preferred regions (#94200)
• [16.2.x] Don't drop FormData entries (#94240)
• [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @​eps1lon, @​icyJoseph, @​unstubbable, @​mischnic, @​bgw, @​timneutkens, and @​lukesandberg for helping!

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

... (truncated)

Commits

• 9dadfd6 v16.2.10
• 534d9c1 [16.2.x] Release pipeline updates (#95160)
• 6e1a94d [16.2.x][ci]: fix release script to not strip newlines (#94640)
• f37fad9 v16.2.9
• 6f16804 v16.2.8
• 411c455 v16.2.7
• ee6e79b v16.2.6
• 766148f v16.2.5
• 2275bd8 v16.2.4
• d5f649b v16.2.3
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​next/eslint-plugin-next since your current version.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
javascript-ms-teams-connect-example	Ready	Preview, Comment	Jul 28, 2026 1:20pm
javascript-nextjs-example	Ready	Preview, Comment	Jul 28, 2026 1:20pm
javascript-slack-connect-example	Ready	Preview, Comment	Jul 28, 2026 1:20pm
javascript-slack-kit-example	Ready	Preview, Comment	Jul 28, 2026 1:20pm

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2878697

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit f385a3e. Configure here.}

[cursor]

Next plugin breaks style-guide peer

Medium Severity

The devDependency bump to @next/eslint-plugin-next ^16.2.10 falls outside @vercel/style-guide’s peer range (>=12.3.0 <15.0.0-0). Both examples lint via @knocklabs/eslint-config/next.js, which extends that style guide, so the resolved Next ESLint plugin may be unsupported and yarn lint can fail or apply the wrong rules.

Additional Locations (1)

• examples/nextjs-example/package.json#L40-L41

^{Reviewed by Cursor Bugbot for commit f385a3e. Configure here.}

[kylemcd]

Closing — this bump can't work on the current lint stack, and there's no version combination that fixes it.

@next/eslint-plugin-next@16 emits flat-config-shaped objects (name: 'next/recommended' in dist/index.js). ESLint 8's eslintrc validator rejects unknown top-level properties, so nextjs-example:lint fails at config load:

Error: ESLint configuration in .eslintrc.js » @knocklabs/eslint-config/next.js » @vercel/style-guide/eslint/next.js
	- Unexpected top-level property "name".

Separately, @vercel/style-guide@6.0.0 — the latest release — pins @next/eslint-plugin-next: ">=12.3.0 <15.0.0-0", and packages/eslint-config/next.js extends it directly. So there's no newer style-guide to bump into either.

This unblocks once the repo is off @vercel/style-guide/ESLint 8, which is what the oxc migration in #1047 / #1048 does. Worth an ignore rule for @next/eslint-plugin-next >= 16 in dependabot.yml in the meantime so this doesn't get reopened every week.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.