chore(starters): update next to 16.3.8

[cursor]

Dependency

• Package: next
• Version: 16.3.7 -> 16.3.8 (patch)
• Declaration: runtime dependencies in projects/starters/nextjs/package.json (nextjs-starter)
• Commit: chore(starters) because starter packages are private and unpublished. No other Next package is a direct dependency.

Release review

• 16.3.8 is a security patch. The release notes list one high-severity image-optimization SSRF fix, five medium-severity cache and metadata fixes, and one low-severity development-server information-disclosure fix. The commits are bug-fix backports and do not add a migration or new install step.
• This starter uses the pages router and output: 'export'. The patch does not change engines (node >=20.9.0), peer ranges, or the MIT license. Published 2026-09-30T16:07:21Z, which satisfies minimumReleaseAge (1140 minutes).
• Catalog react and react-dom 19.2.8 remain inside the unchanged Next peer range. @lit-labs/nextjs@0.2.4 already peers next 13–15 while this starter is on Next 16. This patch does not change that existing mismatch, and Lit SSR stays disabled in the starter.

Generated files

• pnpm-lock.yaml moves next, @next/env, and the @next/swc-* optional packages to 16.3.8, and updates the @lit-labs/nextjs snapshot key that peers next.
• License notices were unchanged.

Validation

• CI=1 mise exec -- pnpm install --no-frozen-lockfile — passed
• mise exec -- pnpm run notice — failed (ERR_PNPM_NO_SCRIPT; notice is a Wireit task without a script entry)
• mise exec -- node ./projects/internals/ci/notice/index.js — passed, notices unchanged
• mise exec -- pnpm run ci in projects/starters/nextjs — passed (24 scripts, 31s). That starter has no DEVELOPMENT.md; ci is the Wireit build and lint task.
• mise exec -- node .agents/skills/agent-dependencies/scripts/verify-update.js --type=chore --scope=starters — passed
• CI=1 mise exec -- pnpm install --frozen-lockfile — passed
• mise exec -- pnpm run ci from the repository root, with Git LFS files checked out and FONTCONFIG_FILE rejecting /usr/share/fonts/truetype/macos/* — passed (138 scripts, 24 skipped, 117.6s)
• git diff --check — passed

  

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: NVIDIA/elements/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 0f33764a-c0d6-4ffb-bc33-690a1b6fd8ca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/vitest

The overall line coverage in commit 692c5df in the topic/dependencies/s... branch remains at 99%, unchanged from commit a342850 in the main branch.

---

_{Updated October 02, 2026 17:57 UTC}

[coryrylan]

🎉 This issue has been resolved in version 2.12.0 🎉

Changelog