[dependabot]

Bumps next from 16.3.0-canary.93 to 16.3.0-preview.10.

Release notes

Sourced from next's releases.

v16.3.0-preview.10

Misc Changes

• Unify allow-runtime with Partial Prefetching: #96106
• Attempt static prefetch before resorting to runtime: #96095
• Block prefetch task until sufficient response is received: #96017
• Use a safe clock for Request Insights bookkeeping: #96274
• Count key length in remaining byte-budgeted LRUs: #96231
• Serve cached misses from the filesystem route cache: #96230
• Count URL key length in the filesystem route cache LRU: #96229
• Turbopack: Only extend the watcher's batch window for unfiltered events: #96186
• Turbopack: Store watcher batch state with bitflags instead of 4 different sets: #96114
• docs: document query-only href resolution and fix with-vercel-blob : #96280
• Micro-optimization for string format: #95774
• Upgrade React from 28cd4bb0-20260723 to 756fdd47-20260727: #96270
• [test] Unflake more tests: #96081
• [test] Run the navigation e2e suite under cacheComponents: #95877
• [test] Run more test suites under cacheComponents flag, again: #96196
• [test] Unflake a prefetch-related race: #96222
• docs(ai-agents): restructure as steps and close 16.2/16.3 coverage gaps: #96247
• Replace vendored http-proxy with httpxy: #96060
• Update vendored @mswjs/interceptors to 0.41.9: #96059
• Track whether runtime data is accessed during prefetch: #95964
• Add Instant Insights request timing: #95958
• [turbopack] Tree-shake module.exports = {...} (CJS): #95996
• [turbopack] Fix de-opt in getChunkRelativeUrl(): #96183
• Add shell offset to static segment prefetches: #95963
• Turbopack: support import.meta.glob caseSensitive option: #96226
• fix(sandbox): release one-shot timeout ids after they run: #96161
• Fix dev overlay symbolication for project paths needing percent-encoding: #96221
• [internal] Add a skill for benching changes in a sandbox: #95943
• Run dev validation in process when using Webpack: #96219
• Read chunk source maps from disk in the dev validation worker: #96218
• Retry the source map lookup with a plain path: #96215
• Pass fallback params to the dev validation worker as maps: #96210
• [sourcemaps] Reuse source map payloads and consumers across stack frames: #96198
• fix: release compression stream when client disconnects mid-response: #96173
• Run Cache Components dev validation on a worker thread: #96153
• Add a benchmark for dev Cache Components validation on a worker thread: #96152
• [test] Unflake the enabled-features-trace test suite: #96175
• [refactor] Prepare dev validation for running on a worker thread: #96151
• Add the experimental.devValidationWorker config flag: #96150
• [refactor] Model dev validation render outputs as a discriminated union: #96149
• Forward dev invalid dynamic usage errors from the render, not validation: #96148
• Optimize implicit cache tag derivation: #96120
• Avoid quadratic HMR queue shifts: #96137
• [sourcemaps] Use file: sourcemaps for Turbopack to improve dev performance: #95946
• Give RouteCacheEntry a single hidden class across its lifecycle: #96164
• Keep optimistic-route param handling monomorphic: #96169
• Store RouteTree slots in a Map to keep slot access monomorphic: #96168

... (truncated)

Commits

• 35917f5 v16.3.0-preview.10
• 3de2d1a Unify allow-runtime with Partial Prefetching (#96106)
• dfa7f4f Attempt static prefetch before resorting to runtime (#96095)
• e70495c v16.3.0-canary.99
• aae4179 v16.3.0-canary.98
• bdbbb1e Block prefetch task until sufficient response is received (#96017)
• a619237 Use a safe clock for Request Insights bookkeeping (#96274)
• 8cd4a50 Count key length in remaining byte-budgeted LRUs (#96231)
• cdc390b Serve cached misses from the filesystem route cache (#96230)
• 9a31a17 Count URL key length in the filesystem route cache LRU (#96229)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openintern	Ready	Preview	Jul 30, 2026 7:56am

[dnexdev]

Superseded: #25 moved next to 16.4.2, which patches GHSA-vcvr-r3jv-pc5j, GHSA-2464-fhr4-w9xw, GHSA-cjq9-62q9-8jv4 and GHSA-p3m5-59mp-jv5r. This bump would leave those open.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.