Repository navigation
chore(deps): take the safe-updates group past the Next.js advisories - #267
Merged
Merged
Conversation
…pdates Bumps the safe-updates group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@next/mdx](https://github.com/vercel/next.js/tree/HEAD/packages/next-mdx) | `16.3.8` | `16.4.2` | | [next](https://github.com/vercel/next.js) | `16.3.8` | `16.4.2` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `0.10.1` | `0.14.7` | | [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` | | [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.13.0` | `4.14.0` | | [@next/eslint-plugin-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-plugin-next) | `16.3.8` | `16.4.2` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` | | [@storybook/addon-links](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/links) | `10.6.1` | `10.6.3` | | [@storybook/nextjs](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/nextjs) | `10.6.1` | `10.6.3` | | [@storybook/react](https://github.com/storybookjs/storybook/tree/HEAD/code/renderers/react) | `10.6.1` | `10.6.3` | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.7` | `14.6.8` | | [eslint-plugin-storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/lib/eslint-plugin) | `10.6.1` | `10.6.3` | | [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` | | [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core) | `10.6.1` | `10.6.3` | | [typescript](https://github.com/microsoft/TypeScript) | `5.8.3` | `5.9.3` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.0` | `8.72.0` | | [webpack](https://github.com/webpack/webpack) | `5.111.1` | `5.112.0` | Updates `@next/mdx` from 16.3.8 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.2/packages/next-mdx) Updates `next` from 16.3.8 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.8...v16.4.2) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `shiki` from 0.10.1 to 0.14.7 - [Release notes](https://github.com/shikijs/shiki/releases) - [Changelog](https://github.com/shikijs/shiki/blob/v0.14.7/CHANGELOG.md) - [Commits](https://github.com/shikijs/shiki/commits/v0.14.7/packages/shiki) Updates `zod` from 4.6.5 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.7) Updates `@axe-core/playwright` from 4.13.0 to 4.14.0 - [Release notes](https://github.com/dequelabs/axe-core-npm/releases) - [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md) - [Commits](dequelabs/axe-core-npm@v4.13.0...v4.14.0) Updates `@next/eslint-plugin-next` from 16.3.8 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.2/packages/eslint-plugin-next) Updates `@playwright/test` from 1.63.0 to 1.64.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.63.0...v1.64.1) Updates `@storybook/addon-links` from 10.6.1 to 10.6.3 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.6.3/code/addons/links) Updates `@storybook/nextjs` from 10.6.1 to 10.6.3 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.6.3/code/frameworks/nextjs) Updates `@storybook/react` from 10.6.1 to 10.6.3 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.6.3/code/renderers/react) Updates `@testing-library/user-event` from 14.6.7 to 14.6.8 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](testing-library/user-event@v14.6.7...v14.6.8) Updates `eslint-plugin-storybook` from 10.6.1 to 10.6.3 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.6.3/code/lib/eslint-plugin) Updates `prettier` from 3.9.9 to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.9...3.9.10) Updates `storybook` from 10.6.1 to 10.6.3 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.6.3/code/core) Updates `typescript` from 5.8.3 to 5.9.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.8.3...v5.9.3) Updates `typescript-eslint` from 8.71.0 to 8.72.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/typescript-eslint) Updates `webpack` from 5.111.1 to 5.112.0 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.111.1...v5.112.0) --- updated-dependencies: - dependency-name: "@next/mdx" dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe-updates - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe-updates - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: safe-updates - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: safe-updates - dependency-name: shiki dependency-version: 0.14.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: safe-updates - dependency-name: zod dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: safe-updates - dependency-name: "@axe-core/playwright" dependency-version: 4.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: safe-updates - dependency-name: "@next/eslint-plugin-next" dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: safe-updates - dependency-name: "@playwright/test" dependency-version: 1.64.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: safe-updates - dependency-name: "@storybook/addon-links" dependency-version: 10.6.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: safe-updates - dependency-name: "@storybook/nextjs" dependency-version: 10.6.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: safe-updates - dependency-name: "@storybook/react" dependency-version: 10.6.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: safe-updates - dependency-name: "@testing-library/user-event" dependency-version: 14.6.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: safe-updates - dependency-name: eslint-plugin-storybook dependency-version: 10.6.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: safe-updates - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: safe-updates - dependency-name: storybook dependency-version: 10.6.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: safe-updates - dependency-name: typescript dependency-version: 5.9.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: safe-updates - dependency-name: typescript-eslint dependency-version: 8.72.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: safe-updates - dependency-name: webpack dependency-version: 5.112.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: safe-updates ... Signed-off-by: dependabot[bot] <support@github.com>
The safe-updates group moved shiki 0.10.1 -> 0.14.7. Code Hike 0.8 depends on shiki ^0.10.1, so npm nested a second copy for the highlighter and the top-level one only supplied `one-dark-pro.json` to mdx.plugins.ts. The 0.14 theme changes three UI colours Code Hike reads (`list.hoverForeground`, `input.foreground`, `tab.activeBorder`) and the escape-sequence token colour, which moved 9 visual baselines by 75-115 px on #266 for no gain. shiki is 0.x, so a minor is a breaking bump; the ignore rule now covers minors as well as majors until Code Hike moves.
Lockfile only. `npm update markdown-it` takes 14.3.3 (GHSA-vfgh-jcmw-g37q, GHSA-gfr2-rv44-r23c; supersedes #265) and `npm audit fix` moves pbkdf2 3.1.7, fast-uri 3.1.9 and puppeteer-core 25.16 / chromium-bidi 157, which drops the nested zod 3.25 that carried GHSA-mrhx-c7xc-m3w5. All of them are dev dependencies; `npm audit` is left with the six low-severity elliptic findings under @storybook/nextjs that have no non-breaking fix.
axe-core 4.14 enforces `label-content-name-mismatch` (WCAG 2.5.3) and flagged the header's repository button on every layout: its `aria-label` was "Repository status" while the visible text was the star count, and an `aria-label` replaces the content instead of adding to it. The label is now visually hidden text inside the button, so the accessible name reads "Repository status 1,234". No layout change: `.visuallyHidden` is absolutely positioned and takes no flex slot.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Oct 25, 2026 10:43a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
This was referenced Oct 25, 2026
xabierlameiro
marked this pull request as ready for review
October 25, 2026 12:08
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Carries #266 (Dependabot's 19 safe updates, commit kept as is) plus what it needed to go green, and folds #265 in. Supersedes both.
Why now.
npm audit --omit=devon master reports next 16.3.8 with two critical RCEs (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr) and one high DoS (GHSA-p3m5-59mp-jv5r), fixed in 16.4.1+. The audit gate fails on master and on every PR based on it, #265 included. 16.4.2 clears it; storybook 10.6.3 and zod 4.6.7 clear the other two direct advisories.What was red on #266 and how it is fixed here
Testing: 9 visual baselines off by 75–115 px on home, post and post-tag-facet. Cause: shiki 0.10.1 → 0.14.7. Code Hike 0.8 depends onshiki ^0.10.1, so the highlighter kept its own nested 0.10 whilemdx.plugins.tsread the theme JSON from the top-level 0.14, whoseone-dark-pro.jsonchanges three UI colours Code Hike reads. shiki stays on 0.10.1 and the Dependabot ignore now covers its minors too (0.x).Testing:label-content-name-mismatch(axe-core 4.14, WCAG 2.5.3) on the header's GitHub stars button on every layout:aria-labelsaid "Repository status" while the visible text was the count. The label is now visually hidden text inside the button so the name carries both. No layout change; unit test added.Lockfile only, dev dependencies: markdown-it 14.3.3 (#265), pbkdf2 3.1.7, fast-uri 3.1.9, puppeteer-core 25.16 / chromium-bidi 157 (drops the nested zod 3.25 under GHSA-mrhx-c7xc-m3w5).
npm auditis left with the six low elliptic findings under @storybook/nextjs, which have no non-breaking fix.Checked locally: lint (0 errors, same 6 warnings as master), typecheck, jest with coverage thresholds,
npm run audit:prod(0 findings).Generated by Claude Code