Bump next and next-auth in /src

[dependabot]

Bumps next and next-auth. These dependencies needed to be updated together.
Updates next from 14.0.4 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in vercel/next.js#96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in vercel/next.js#96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in vercel/next.js#96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in vercel/next.js#96900
• [backport] Bump @​swc/helpers by @​mischnic in vercel/next.js#96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in vercel/next.js#97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in vercel/next.js#97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in vercel/next.js#97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in vercel/next.js#97311

... (truncated)

Commits

• 299180d v16.3.4
• 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
• 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
• d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
• 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
• a9a1cb7 v16.3.3
• 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
• 3a15b4a [16.3.x] [next/image]: disable avif image optimization
• 7378b51 Backport/docs fixes 16.3 (#97649)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next-auth from 4.24.5 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

• getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.
• OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.
• Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.
• An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.
• Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.

next-auth@4.24.14

Bugfixes

• providers: add issuer to GitHub provider for RFC 9207 compliance (#13412)

GitHub now returns an iss parameter in OAuth callbacks. openid-client validates it unconditionally, which was breaking authentication for apps that didn't configure an issuer. This sets the default GitHub provider issuer to https://github.com/login/oauth.

Commits

• d857eec chore(release): next-auth@4.24.15 [skip ci]
• 5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
• db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
• 32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
• fa85858 chore: update uuid to v14, remove deprecated types (#13422)
• 2a39465 Merge commit from fork
• 19d2feb Merge commit from fork
• e9a892a chore(release): bump version [skip ci]
• 0497da4 fix(providers): add issuer to github (#13412)
• 1a70ee8 chore(release): bump version [skip ci]
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.