simstudioai · waleedlatif1 · Aug 17, 2026 · Aug 17, 2026 · Aug 17, 2026
@@ -27,7 +27,7 @@
     "fumadocs-mdx": "14.3.2",
     "fumadocs-openapi": "10.8.1",
     "fumadocs-ui": "16.8.5",
-    "next": "16.2.12",
+    "next": "16.3.1",
     "next-themes": "^0.4.6",
     "react": "19.2.4",
     "react-dom": "19.2.4",

diff --git a/apps/sim/next.config.ts b/apps/sim/next.config.ts
@@ -218,16 +218,15 @@ const nextConfig: NextConfig = {
      * it lives. Restoring across commits is separately undocumented-as-supported
      * (vercel/next.js#87283 reports stale HTML from a cache built elsewhere).
      *
-     * Keep the explicit pin even while we sit on 16.2.12: 16.3.0 flips this
-     * default to true for stable (vercel/next.js#94616), so dropping it would
-     * silently re-enable the slower cache the next time we take that bump.
+     * The explicit pin is load-bearing: 16.3.0 flipped this default to true for
+     * stable (vercel/next.js#94616), so dropping it re-enables the slower cache.
      */
     turbopackFileSystemCacheForBuild: false,
     /**
      * TypeScript 7 ships no JavaScript compiler API until 7.1, so Next's default
      * checker cannot load it — this shells out to the project-local `tsc` instead.
      * Pinned because the failure mode is not slower type checking but none at all:
-     * without it 16.2.12 skips the stage silently in 138ms.
+     * 16.2.12 skipped the stage silently in 138ms.
      */
     useTypeScriptCli: true,
     preloadEntriesOnStart: false,

@@ -195,7 +195,7 @@
     "mssql": "12.7.0",
     "mysql2": "3.14.3",
     "neo4j-driver": "6.0.1",
-    "next": "16.2.12",
+    "next": "16.3.1",
     "next-mdx-remote": "^6.0.0",
     "next-runtime-env": "3.3.0",
     "next-themes": "^0.4.6",

@@ -5,16 +5,34 @@ exact = true
 minimumReleaseAge = 604800
 # @typescript/native-preview stays excluded permanently: it only publishes nightly
 # dev builds, so every version is structurally younger than any age gate.
-# mermaid 11.16.1 (published 2026-08-04) clears five open Dependabot advisories that
-# 11.15.0 carries: architecture-diagram and config-API prototype pollution, radar and
-# XY-chart DoS, and CSS injection into siblings of the diagram. It is inside the 7-day
-# window and cannot be installed without an exception; it ages out on 2026-08-11 — drop
-# the entry then, and re-date this note on any further bump rather than deleting the entry
-# early, because removing it while the pinned version is still inside the window blocks the
-# bump outright. js-yaml 4.3.1 (published 2026-07-31) carries the CVE-2026-59870 !!omap
-# quadratic-CPU fix, which was never backported to the 4.3.0 line; it ages out on 2026-08-07,
-# so that entry can go on the next touch of this file.
-minimumReleaseAgeExcludes = ["@typescript/native-preview", "mermaid", "js-yaml"]
+# next 16.3.1 (published 2026-08-13) carries the Turbopack fix for vercel/next.js#96595,
+# the dead-code elimination bug that deleted the POST /api/credentials create path in
+# production and forced the 16.3.0 revert (#6242). Sitting on 16.2.12 to wait out the
+# window means knowingly staying on a release whose successor we already reverted once,
+# so the bump takes an exception instead. It ages out on 2026-08-20 — drop these entries
+# then, and re-date this note on any further bump rather than deleting them early, because
+# removing an entry while its pinned version is still inside the window blocks the bump
+# outright. The mermaid and js-yaml entries aged out on 2026-08-11 and 2026-08-07 and are
+# dropped here per that rule.
+# All eight @next/swc platform packages are listed even though package.json pins only four:
+# next declares all eight as its own optionalDependencies, so every one of them is resolved
+# into bun.lock regardless of which host runs the install. A gated optional dependency does
+# not fail the install — bun drops it silently — so omitting the musl and win32 entries here
+# would quietly strip them from the lockfile, and the Alpine devcontainer and any Windows
+# machine would then have no SWC binary to resolve.
+minimumReleaseAgeExcludes = [
+  "@typescript/native-preview",
+  "next",
+  "@next/env",
+  "@next/swc-darwin-arm64",
+  "@next/swc-darwin-x64",
+  "@next/swc-linux-arm64-gnu",
+  "@next/swc-linux-arm64-musl",
+  "@next/swc-linux-x64-gnu",
+  "@next/swc-linux-x64-musl",
+  "@next/swc-win32-arm64-msvc",
+  "@next/swc-win32-x64-msvc",
+]
 
 [run]
 env = { NEXT_PUBLIC_APP_URL = "http://localhost:3000" }
@@ -97,8 +97,8 @@
   "overrides": {
     "react": "19.2.4",
     "react-dom": "19.2.4",
-    "next": "16.2.12",
-    "@next/env": "16.2.12",
+    "next": "16.3.1",
+    "@next/env": "16.3.1",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.5",
     "minimatch": "^10.2.5",
@@ -107,10 +107,10 @@
     "e2b": "^2.36.1"
   },
   "optionalDependencies": {
-    "@next/swc-darwin-arm64": "16.2.12",
-    "@next/swc-darwin-x64": "16.2.12",
-    "@next/swc-linux-arm64-gnu": "16.2.12",
-    "@next/swc-linux-x64-gnu": "16.2.12"
+    "@next/swc-darwin-arm64": "16.3.1",
+    "@next/swc-darwin-x64": "16.3.1",
+    "@next/swc-linux-arm64-gnu": "16.3.1",
+    "@next/swc-linux-x64-gnu": "16.3.1"
   },
   "devDependencies": {
     "@babel/parser": "7.29.2",

@@ -82,7 +82,7 @@
     "class-variance-authority": "^0.7.1",
     "framer-motion": "^12.5.0",
     "input-otp": "^1.4.2",
-    "next": "16.2.12",
+    "next": "16.3.1",
     "prismjs": "^1.30.0",
     "react": "19.2.4",
     "react-dom": "19.2.4",