Skip to content

build(deps): bump postcss and next - #227

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-046917101c
Open

build(deps): bump postcss and next#227
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-046917101c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026

Copy link
Copy Markdown
Contributor

Bumps postcss and next. These dependencies needed to be updated together.
Updates postcss from 8.5.18 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).
Changelog

Sourced from postcss's changelog.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).
Commits

Updates next from 16.2.12 to 16.3.0

Release notes

Sourced from next's releases.

v16.3.0

Core Changes

  • Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
  • Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
  • Normalize encoded dynamic placeholders in app routes: #91603
  • Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
  • Update tokio from 1.43.0 to 1.47.3: #90945
  • [turbopack] Simplify snapshotting logic: #91178
  • Turbopack: enable server HMR for app route handlers: #91466
  • turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
  • [turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
  • Skip loadBindings() Lightning CSS check during next start: #91538
  • turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
  • Turbopack: Add importModule() support to webpack loaders: #89630
  • turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
  • turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
  • feat(node-streams): add config flag, define-env, and env precedence test: #90427
  • Rename /_next/webpack-hmr to /_next/hmr: #91415
  • Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
  • Handle encoded params further: #91627
  • [turbopack] Respect {eval:true} in worker_threads constructors: #91666
  • Fix missing route in otel spans without base-server: #91665
  • [turbopack] Optimize compaction cpu usage: #91468
  • Fix layout segment optimization: move app-page imports to server-utility transition: #91701
  • Fix server actions in standalone mode with cacheComponents: #91711
  • turbo-persistence: remove Unmergeable mmap advice: #91713
  • turbopack: move "compact database" tracing span to backend layer: #91693
  • Turbopack: lazy require metadata and handle TLA: #91705
  • Fix adapter outputs for dynamic metadata routes: #91680
  • Turbopack: fix webpack loader runner layer: #91727
  • [turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
  • Add module count field to module graph tracing spans: #91697
  • turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
  • Turbopack: pull in updated vercel/nft tests: #91651
  • [turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
  • [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
  • [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
  • Avoid deprecated TS node10 moduleResolution defaults: #91847
  • [turbopack] Rebuild the docker build scripts: #91799
  • Fix TS6 baseUrl deprecation for extended tsconfig: #91855
  • Add next internal post-build CLI command for Turbopack database compaction: #91336
  • Turbopack: Define Effect as a trait instead of a closure: #89080
  • Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
  • turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
  • Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
  • Use charCodeAt for normalizePathTrailingSlash: #91380
  • Turbopack: Only patch lockfile when bindings fails to load: #91379
  • [create-next-app] Skip interactive prompts when CLI flags are provided: #91840
  • [devtools] Make instant navs panel draggable: #91914
  • [Segment Bundling] Bundle static prefetches based on size: #91439

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump postcss and next
f6fee57 
Bumps [postcss](https://github.com/postcss/postcss) and [next](https://github.com/vercel/next.js). These dependencies needed to be updated together.

Updates `postcss` from 8.5.18 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.18...8.5.25)

Updates `next` from 16.2.12 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.12...v16.3.0)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: direct:development
- dependency-name: next
  dependency-version: 16.3.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 4, 2026
@socket-security

socket-security Bot commented Aug 4, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednext@​16.2.12 ⏵ 16.3.061 -210090 +19970
Updatedpostcss@​8.5.18 ⏵ 8.5.25100 +1100 +28195100

View full report

@socket-security

socket-security Bot commented Aug 4, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Medium
Dynamic code execution: npm @img/sharp-wasm32

Eval Type: Function

Location: Package overview

From: package-lock.json → npm/next@16.3.0 → npm/@img/sharp-wasm32@0.35.3

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-wasm32@0.35.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@kinsta

kinsta Bot commented Aug 4, 2026

Copy link
Copy Markdown

Preview deployments for wdk-docs prod ⚡️

Status Branch preview Commit preview
🔁 Deploying... N/A N/A

Commit: f6fee575ebb90257b802f30bf7b9bbbd585bd6b2

Deployment ID: acf0fadd-75a8-463c-8236-ed53e4f3dd0d

Static site name: wdk-docs-prod-pbpbt

@kinsta

kinsta Bot commented Aug 4, 2026

Copy link
Copy Markdown

Preview deployments for wdk-docs prod ⚡️

Status Branch preview Commit preview
❌ Failed to deploy N/A N/A

Commit: f6fee575ebb90257b802f30bf7b9bbbd585bd6b2

Deployment ID: acf0fadd-75a8-463c-8236-ed53e4f3dd0d

Static site name: wdk-docs-prod-pbpbt

@kinsta

kinsta Bot commented Aug 4, 2026

Copy link
Copy Markdown

Preview deployments for wdk-docs staging ⚡️

Status Branch preview Commit preview
🔁 Deploying... N/A N/A

Commit: f6fee575ebb90257b802f30bf7b9bbbd585bd6b2

Deployment ID: c9481309-058e-4320-aea8-2280be3a1809

Static site name: wdk-docs-ve3eh

@kinsta

kinsta Bot commented Aug 4, 2026

Copy link
Copy Markdown

Preview deployments for wdk-docs staging ⚡️

Status Branch preview Commit preview
❌ Failed to deploy N/A N/A

Commit: f6fee575ebb90257b802f30bf7b9bbbd585bd6b2

Deployment ID: c9481309-058e-4320-aea8-2280be3a1809

Static site name: wdk-docs-ve3eh

@ihsraham ihsraham mentioned this pull request Aug 13, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants