Skip to content

build(deps): bump next from 16.1.6 to 16.1.7 in the npm_and_yarn group across 1 directory#1

Open
dependabot[bot] wants to merge 104 commits intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-229c191f58
Open

build(deps): bump next from 16.1.6 to 16.1.7 in the npm_and_yarn group across 1 directory#1
dependabot[bot] wants to merge 104 commits intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-229c191f58

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 19, 2026

Bumps the npm_and_yarn group with 1 update in the / directory: next.

Updates next from 16.1.6 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)
  • Apply server actions transform to node_modules in route handlers (#89380)
  • ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)
  • feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)
  • Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)
  • Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)
  • fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​unstubbable, @​styfle, @​eps1lon, and @​ztanner for helping!

Commits
  • bdf3e35 v16.1.7
  • dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
  • 9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
  • 36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
  • 93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
  • c68d62d Backport documentation fixes for 16.1.x (#90655)
  • 5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
  • c95e357 Backport/docs fixes 16.1.x (#90125)
  • cba6144 [backport] Apply server actions transform to node_modules in route handlers...
  • 3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

GeiserX and others added 30 commits March 15, 2026 21:09
The "Calcular ruta" button was only enabled when a suggestion was selected
from the autocomplete dropdown. Now it enables when both text fields have
content, and geocodes the typed text on submit if no autocomplete selection
was made. Also clears stale coordinates when the user edits text after
selecting.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ad art

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ng guide in README

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The GraphHopper planet dump (photon-dump-planet-1.0-latest) is
periodically truncated/broken. Additionally, Photon 1.0.1 has a bug
where -country-codes crashes with NPE on entries without country_code.

Switch to country-specific dump from
download1.graphhopper.com/public/europe/spain/ (~490MB, 5.6M docs,
~12 min import) which avoids both issues.
Main branch pushes produced zero Docker tags (semver rules only fire on
tag refs), causing the build to fail with "tag is needed when pushing".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… levels

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Individual points visible from zoom 8+, clusters only when very zoomed out.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… light theme

- PROPEL_CLUSTER_STATIONS=true (default) enables clustering at zoom ≤7
- Set to false to always show individual points
- Fix fuel type dropdown unreadable on light OS theme (explicit dark bg on options)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Uses Next.js instrumentation hook to run scrapers on a timer.
Set to e.g. 6 for every 6 hours. Runs once on startup + repeats.
Default 0 = disabled (manual CLI only).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Request browser geolocation on first visit, fly to user's location
  if allowed, silently ignore if denied
- Change PROPEL_SCRAPE_INTERVAL_HOURS default from 0 to 24
- Still runs once on startup regardless of interval

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Move geolocation into handleLoad so mapRef is ready
- If geolocation denied, fall back to fetching stations at default view
- flyTo triggers moveEnd which fetches stations at the new location
- Search panel starts expanded instead of collapsed

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fetch stations at default view immediately on map load. Geolocation
runs in parallel — if allowed, flyTo re-fetches at the new location.
Previously, stations were empty while waiting for the geolocation prompt.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ading

Stations now load at all zoom levels (API handles full Spain in ~100ms).
Reduced debounce from 300ms to 100ms so panning/zooming feels responsive.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Check geolocation permission state before deciding:
- granted: geolocate directly (no wasted default fetch)
- denied: fetch at default country view (no useless prompt)
- prompt: fetch default view + ask (double fetch only if accepted)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…cture notes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Single search field expands to show destination after origin selection.
Phase state machine (search → destination → route) with auto-route
calculation, no buttons needed. Bare-mode autocomplete inputs with
slide-in transitions.
Previously, pressing Enter with results visible but none highlighted
would bypass the dropdown and trigger a separate geocode call that
could silently fail.
Single card with both fields inside, connected by a vertical dashed
line in a left gutter (Google Maps style). Origin shows as hollow
circle, destination as filled square. Destination slides in within
the same card instead of appearing as a separate element.
useImperativeHandle with empty deps captured mapRef.current before
react-map-gl set it, leaving the parent with a null ref. Replaced
with a callback ref that syncs both internal and parent refs.
Toggle overflow-visible after slide animation so the dropdown isn't
clipped. Change destination icon from filled black square to a subtle
gray filled circle (origin=hollow circle, dest=filled circle).
Route corridor filtering was replacing the full station set with only
nearby stations. Now stations are always fetched by viewport bbox
regardless of route state — the route is just a visual overlay.
Callback ref broke react-map-gl — mapRef.current stayed null so no
stations loaded. Reverted to object ref with parent ref synced in
onLoad. Restored route corridor station fetching. Added console logs
for station fetch debugging.
Stations, route-stations, and route APIs now log request params and
result counts. This makes the app observable via docker logs.
…ation

When geolocation was already granted, handleLoad skipped the initial
fetchStations and relied on handleMoveEnd firing after flyTo. This
was unreliable. Now always fetches at the default view, then geolocates
on top (flyTo will re-fetch at new location).
… color expression

Cluster layers ("clusters", "cluster-count") were causing MapLibre errors
("missing required property source") that broke station rendering entirely.
Also fixed "Expected value to be of type number, but found null" by guarding
the price interpolation expression against null values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Route line now uses beforeLayerId prop to insert before "clusters" (when
clustering enabled) or "unclustered-point" (when disabled), ensuring
stations are always drawn on top of the route.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Page was statically rendered at Docker build time, baking in default
clusterStations=true. Adding force-dynamic ensures PROPEL_CLUSTER_STATIONS
and other env vars are read at request time.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… list

- Valhalla: add getRoutes() with alternates support (up to 3 routes for A->B)
- Route API: returns { routes: Route[] } with primary + alternatives
- Route-stations API: add routeFraction via ST_LineLocatePoint for sorting
- Route layer: multi-route rendering with data-driven styling
  - Primary: blue (#3b82f6), alternatives: violet/teal/amber
  - Click alternative route on map to make it primary
  - Alternatives rendered below primary for z-ordering
- Map view: fetch corridor stations for ALL routes in parallel, merge + dedup
  - Report primary corridor stations to parent for station list
- Search panel:
  - Swap origin/destination button (reverses waypoints too)
  - Waypoint inputs (up to 5 intermediate stops, with add/remove)
  - Alternative route cards (colored dots, click to switch primary)
  - Station list sorted by position along primary route (routeFraction)
  - Each station shows brand, name, price, km position
  - Click station to fly to it on the map

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GeiserX and others added 27 commits March 18, 2026 15:14
- Finland: fix polttoaine.net table row regex to match actual HTML structure
  (no leading number cell, map link in first <td>, CSS class-based matching)
- Serbia: fix cenagoriva.rs price parsing to match actual HTML structure
- Norway: rewrite SSR fallback to use fuelo.net instead of DrivstoffAppen

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add Array.isArray check on s.prices before iterating (fixes crash on
  stations without price data)
- base.ts: priceMax multiplier 25→250 for non-EUR/GBP/CHF currencies
  (fixes Serbia RSD prices being filtered out at ~200 RSD/l)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…crapers

Same issue as Norway — some stations in the API have null/missing prices
field. Guard prevents "s.prices is not iterable" crash.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Cluster circles now colored by average price of contained stations
  (same green→red scale as individual markers) using clusterProperties
  to aggregate sum/count for average calculation
- Clustering automatically disabled when route is active (corridor
  stations shown individually for selection)
- Increased clusterMaxZoom to 11 and clusterRadius to 50
- Show "No results found" in autocomplete when geocode returns empty

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…tion query at 20k

- Set minZoom=5 on Map so users can't zoom out beyond roughly one
  country visible (prevents 100k+ station fetches and 502 errors)
- Fix "Expected value to be of type number, but found null" by guarding
  cluster color expression against countPrice=0 division
- Add LIMIT 20000 to stations API as safety net

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Show pulsing blue dot marker at user's position when geolocation is
  granted, with watchPosition for live updates
- Geolocate button highlights blue when tracking is active
- Mobile navbar: fuel selector always visible, language/currency moved
  behind a settings gear icon that opens a dropdown
- Desktop unchanged: all selectors visible in navbar row

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The public photon.komoot.io only supports default/de/en/fr, not es.
Remove lang param to use default language, works on both public and private.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
MapLibre cannot dynamically change the `cluster` property on an existing
GeoJSON source. Add a React key to force full unmount/remount when
toggling between clustered (browse) and unclustered (route) views.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Users can now adjust how far from the route to search for stations,
with a slider in the search panel alongside the existing detour filter.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Corridor is now user-controlled via the slider, no need for env config.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use a ref for corridorKm in the fetch callback (no dep recreation)
and a 300ms debounced effect so the API call only fires after the
user stops dragging the slider.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Baltics (Estonia, Latvia, Lithuania) and Balkans (Bosnia, North Macedonia)
via Fuelo.net. Adds BAM/MKD/RSD currencies with fallback exchange rates
for currencies not in ECB daily feed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Stats button moved from navbar to floating top-right on the map
- Light theme for stats dropdown (matches map overlay style)
- Added all 31 country flags to stats
- Mobile: chevron toggle collapses destination/route/stations panels
  when a route is active, keeping just the origin search bar visible

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ThemeProvider with localStorage persistence and system preference detection.
Toggle in top-right switches between OpenFreeMap liberty (light) and dark styles.
All overlay components (search panel, stats, price filter, geolocate, popups)
support dark: variants via Tailwind class-based dark mode.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Price filter resets to max (all stations) when changing fuel type via
  synchronous callback instead of useEffect (no stale frame)
- Blue dot auto-shows on page load when geolocation permission already granted
- Stats dropdown: fixed country code visibility in dark mode, aligned
  country names with fixed-width flag+code columns
- Stats sponsor button and attribution link dark mode support

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Eliminates mobile layout collision between search panel and map overlay
buttons. All three controls (geolocate, dark/light toggle, stats) now
live in the navbar as icon buttons matching the existing dark theme.
Geolocation state lifted to home-client, blue dot marker stays in map.
Also updates AGENTS.md with 31-country data sources and Fuelo notes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When changing currency, the maxPrice value was stale (still in the
previous currency), making the slider position meaningless. Now resets
to null (show all) when currency changes.

Also removes unused geolocate-button.tsx (functionality moved to navbar).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Turkey (TR): Fuelo.net scraper, TRY currency, ~2K stations
- Moldova (MD): ANRE government API (api.ecarburanti.anre.md), MDL
  currency, ~750 stations. EPSG:3857→WGS84 coordinate conversion.
- Australia (AU): WA FuelWatch RSS feed, AUD currency, ~600 stations.
  Multiple fuel types via separate Product ID requests.
- Fix CodeQL workflow: add actions:read permission for telemetry
- Add TR/MD/AU/KR flags to stats dropdown

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add viewport-fit=cover + theme-color=#0c111b so status bar matches navbar
- Use h-dvh instead of h-screen for proper Safari address bar behavior
- Add safe-area-inset-top padding to navbar for notch/dynamic island
- Add safe-area-inset-bottom to price filter overlay
- Apple web app meta tags for standalone mode

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Include lat/lon in external ID since idno is the company fiscal ID,
not a unique station identifier. Multiple stations per company.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Argentina: 4,292 stations from Secretaría de Energía open data CSV
- Mexico: 13,526 stations from CRE XML endpoints (places + prices)
- Widen fuel_prices.price from DECIMAL(6,3) to DECIMAL(10,3) for
  high-value currencies like ARS (up to 2665/litre)
- Increase non-EUR price filter multiplier from 250x to 1000x

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Without these entries, the countries were filtered from enabled
countries list and displayed with codes instead of names.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fuelo scraper now parses actual currency from title text (e.g. "563,8 HUF/l"
  vs "1,42 €/l") instead of blindly assigning config.currency. Fixes thousands
  of EUR prices mislabeled as HUF/CZK/PLN/TRY/BAM/MKD across 7 countries.
- Cross-border stations now correctly show their native currency (PLN in CZ,
  RON/RSD in HU, etc.)
- Add Australia NSW FuelCheck API scraper (3,245 stations, OAuth2 auth)
- CLI supports multiple scrapers per country (AU = WA + NSW)
- Lower map minZoom from 5 to 2 for world view
- Show country markers with station counts + flags at zoom < 5
- Hide station dots and price filter at low zoom for clean overview

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…y, auto-collapse

- Prevent iOS Safari auto-zoom on input focus (text-base on mobile, text-sm on desktop)
- Hide theme toggle, stats, divider on mobile navbar; add theme to settings dropdown
- Make route collapse toggle prominent with distance/duration summary bar
- Auto-collapse search panel when selecting a station from the list

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bumps the npm_and_yarn group with 1 update in the / directory: [next](https://github.com/vercel/next.js).


Updates `next` from 16.1.6 to 16.1.7
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.1.6...v16.1.7)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.1.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant