chore(deps): bump eslint-config-next from 16.2.5 to 16.2.6 in /web

[dependabot]

Bumps eslint-config-next from 16.2.5 to 16.2.6.

Release notes

Sourced from eslint-config-next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

• fix: preserve HTTP access fallbacks during prerender recovery (#92231)
• Fix fallback route params case in app-page handler (#91737)
• Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
• Patch setHeader for direct route handlers (#93101)
• Include deployment id in cacheHandlers keys (#93453)
• Fix double-encoding of URL pathname parts in client param parsing (#93491)

Commits

• ee6e79b v16.2.6
• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
islamwiki	Ready	Preview, Comment	May 17, 2026 7:45pm
ummat-islamwiki	Ready	Preview, Comment	May 17, 2026 7:45pm

[github-actions]

🔒 Dependency Audit Failed — 10 HIGH/CRITICAL vulnerability(s)

Package	Severity	Advisory	Fix
next	HIGH	1117930	Upgrade to version 16.2.5 or later
@opentelemetry/auto-instrumentations-node	HIGH	1117941	Upgrade to version 0.75.0 or later
@opentelemetry/sdk-node	HIGH	1117942	Upgrade to version 0.217.0 or later
@opentelemetry/exporter-prometheus	HIGH	1117943	Upgrade to version 0.217.0 or later
next	HIGH	1118938	Upgrade to version 16.2.6 or later
next	HIGH	1118949	Upgrade to version 16.2.5 or later
next	HIGH	1118953	Upgrade to version 16.2.5 or later
next	HIGH	1118955	Upgrade to version 16.2.5 or later
next	HIGH	1118959	Upgrade to version 16.2.5 or later
next	HIGH	1118961	Upgrade to version 16.2.5 or later

To resolve: upgrade the affected packages or add an accepted-risk entry to web/.audit-allowlist.json.

Allowlist format

{
  "GHSA-xxxx-xxxx-xxxx": {
    "reason": "No fix available; mitigated by WAF rule #123",
    "expires": "2026-12-31"
  }
}

[github-actions]

🔒 Dependency Audit Failed — 4 HIGH/CRITICAL vulnerability(s)

Package	Severity	Advisory	Fix
@opentelemetry/auto-instrumentations-node	HIGH	1117941	Upgrade to version 0.75.0 or later
@opentelemetry/sdk-node	HIGH	1117942	Upgrade to version 0.217.0 or later
@opentelemetry/exporter-prometheus	HIGH	1117943	Upgrade to version 0.217.0 or later
next	HIGH	1118938	Upgrade to version 16.2.6 or later

To resolve: upgrade the affected packages or add an accepted-risk entry to web/.audit-allowlist.json.

Allowlist format

{
  "GHSA-xxxx-xxxx-xxxx": {
    "reason": "No fix available; mitigated by WAF rule #123",
    "expires": "2026-12-31"
  }
}

[dependabot]

Superseded by #18.