Bump the npm_and_yarn group across 1 directory with 9 updates - #1
Open
dependabot[bot] wants to merge 1 commit into
Open
Bump the npm_and_yarn group across 1 directory with 9 updates#1dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the npm_and_yarn group with 2 updates in the / directory: [next](https://github.com/vercel/next.js) and [workflow](https://github.com/vercel/workflow/tree/HEAD/packages/workflow). Updates `next` from 16.0.10 to 16.2.6 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.0.10...v16.2.6) Updates `workflow` from 4.0.1-beta.24 to 4.2.0 - [Release notes](https://github.com/vercel/workflow/releases) - [Changelog](https://github.com/vercel/workflow/blob/main/packages/workflow/CHANGELOG.md) - [Commits](https://github.com/vercel/workflow/commits/workflow@4.2.0/packages/workflow) Updates `brace-expansion` from 2.0.2 to 2.1.2 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.1.2) Updates `defu` from 6.1.4 to 6.1.7 - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.7) Updates `devalue` from 5.5.0 to 5.6.3 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.5.0...v5.6.3) Updates `minimatch` from 5.1.6 to 5.1.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v5.1.6...v5.1.9) Updates `path-to-regexp` from 8.3.0 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](pillarjs/path-to-regexp@v8.3.0...v.0.1.13) Updates `picomatch` from 2.3.1 to 4.0.5 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...4.0.5) Updates `undici` from 6.19.0 to 7.22.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.19.0...v7.22.0) --- updated-dependencies: - dependency-name: next dependency-version: 16.2.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: workflow dependency-version: 4.2.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: defu dependency-version: 6.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.6.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 5.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.22.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![warpfix[bot]](https://avatars.githubusercontent.com/in/3537346?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔍 WarpFix PR Review
This pull request updates the
nextandworkflowpackages to their latest versions, addressing security vulnerabilities and bug fixes.
📖 Walkthrough
The package.json file has been modified to update the next package from version 16.0.10 to 16.2.6 and the workflow package from version 4.0.1-beta.24 to 4.2.0. The pnpm-lock.yaml file has also been updated, reflecting the changes in package versions and their dependencies. The updates include important security fixes that mitigate various vulnerabilities in the next package, which is crucial for maintaining application security.
📁 File Changes
| File | Change | Impact |
|---|---|---|
package.json |
Updated versions of next and workflow packages. |
🔴 high |
pnpm-lock.yaml |
Lockfile updated to reflect new package versions and dependencies. | 🔴 high |
⏱ Review Effort & Risk
| Metric | Value |
|---|---|
| Effort | ██░░░ 2/5 (Small) · ~15min |
| Risk | 🟡 MEDIUM |
Risk Factors
- Potential breaking changes in updated packages
- Need to verify compatibility with existing code
- Security vulnerabilities addressed but new ones may arise
Labels: dependencies security update
💡 Key Observations
The updates include critical security fixes that should be prioritized.
Ensure to run tests after merging to catch any potential issues from the updates.
🤖 Reviewed by WarpFix — AI-Powered Code Review + CI Repair · Security
| @@ -21,14 +21,14 @@ | |||
| "clsx": "^2.1.1", | |||
| "exa-js": "^2.0.11", | |||
There was a problem hiding this comment.
✨ Praise performance
Updated 'next' to a more recent version, which is great for keeping dependencies up to date.
🤖 WarpFix
| @@ -21,14 +21,14 @@ | |||
| "clsx": "^2.1.1", | |||
| "exa-js": "^2.0.11", | |||
| "lucide-react": "^0.545.0", | |||
There was a problem hiding this comment.
✨ Praise performance
Updated 'workflow' to a stable version, which is a good practice to avoid beta issues.
🤖 WarpFix
| @@ -21,14 +21,14 @@ | |||
| "clsx": "^2.1.1", | |||
There was a problem hiding this comment.
logic
Ensure that the new versions of 'next' and 'workflow' are compatible with the rest of your dependencies.
Suggested change
| "clsx": "^2.1.1", | |
| Run tests after updating to verify compatibility. |
🤖 WarpFix
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 2 updates in the / directory: next and workflow.
Updates
nextfrom 16.0.10 to 16.2.6Release notes
Sourced from next's releases.
... (truncated)
Commits
ee6e79bv16.2.6afa053dTurbopack: Match proxy matchers with webpack implementation (#93594)97a154eTurbopack: Fix middleware matcher suffix (#93590)83899bc[backport] Disable build caches for production/staging/force-preview deploys ...7b222b9[backport][test] Pin package manager to patch versions (#93595)a8dc24f[backport] Turbopack: more strict vergen setup (#93587)766148fv16.2.50dd9483fix: add explicit checks for RSC header (#83) (#98)d166096fix proxy matching for segment prefetch URLs (#89) (#96)9d50c0bStrip next-resume header from incoming requests (#92)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.
Updates
workflowfrom 4.0.1-beta.24 to 4.2.0Release notes
Sourced from workflow's releases.
... (truncated)
Changelog
Sourced from workflow's changelog.
... (truncated)
Commits
4e435e0Version Packages (#1621)29fe9deVersion Packages (beta) (#1600)45fd831Version Packages (beta) (#1593)7e33c62Rename 'Workflow Development Kit' / 'DevKit' to 'Workflow SDK' (#1595)8462c5dVersion Packages (beta) (#1563)91ba457Version Packages (beta) (#1550)cdf90d5Rename Workflow DevKit to Workflow SDK, remove beta badge, add tweet wall (#1...e11eebfVersion Packages (beta) (#1514)a375a3fVersion Packages (beta) (#1440)672d919Fix step/workflow not found errors to fail gracefully instead of queue retry ...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for workflow since your current version.
Updates
brace-expansionfrom 2.0.2 to 2.1.2Release notes
Sourced from brace-expansion's releases.
Commits
9e67a3b2.1.2835d6befix: v2 backport for CVE-2026-13149 (#123)64b71d32.1.1c3a817cBackport v5.0.6 change to v2 (#109)1ee4a902.1.0b0302acAdd opt-in { max } mitigation to v2 legacy line (#100)73b54592.0.3311ac0dBackport fix for GHSA-f886-m6hf-6m8v to v2 (#96)Updates
defufrom 6.1.4 to 6.1.7Release notes
Sourced from defu's releases.
Changelog
Sourced from defu's changelog.
... (truncated)
Commits
80c0146chore(release): v6.1.740d7ef4fix(defu.d.cts): export Defu types (#157)3d3a7c8build: correct thetypesexport entry (#160)001c290chore(release): v6.1.6407b516build: fix mixed types23e59e6chore(release): v6.1.511ba022fix: ignore inherited enumerable properties3942bfbfix: prevent prototype pollution via__proto__in defaults (#156)d3ef16dchore(deps): update actions/checkout action to v6 (#151)869a053chore(deps): update actions/setup-node action to v6 (#149)Updates
devaluefrom 5.5.0 to 5.6.3Release notes
Sourced from devalue's releases.
Changelog
Sourced from devalue's changelog.
Commits
a4a37d2Version Packages (#132)819f1acMerge commit from fork0f04d4dMerge commit from forkfcf4e88fix tests1d8a5eaVersion Packages (#131)1175584Merge commit from forke46afa6Merge commit from fork5e07a67Version Packages (#129)aa09604Bump js-yaml from 3.14.1 to 3.14.2 (#125)2161d44fix: add hasOwn check before calling reviver (#128)Updates
minimatchfrom 5.1.6 to 5.1.9Commits
4419b6e5.1.9383ce59docs: add warning about ReDoSb02ef18fix partial matching of globstar patternse92ae295.1.879e4447limit recursion for **, improve perf considerably85ec0fflockfile update647146elock node version to 1485646c85.1.7977c2d8update CI matrix and actions421ad12update test expectations for coalesced consecutive starsUpdates
path-to-regexpfrom 8.3.0 to 0.1.13Changelog
Sourced from path-to-regexp's changelog.
Commits
9fd0c870.1.13 (#425)7ccf02cfix: CVE-2026-4867640e6940.1.12f01c26aMerge commit from fork0c711920.1.118f09549Add error on bad input valuesc827fce0.1.1029b96b4Add backtrack protection to parametersac4c234Update repo url (#314)bdb66350.1.9Maintainer changes
This version was pushed to npm by ulisesgascon, a new releaser for path-to-regexp since your current version.
Updates
picomatchfrom 2.3.1 to 4.0.5Release notes
Sourced from picomatch's releases.
Changelog
Sourced from picomatch's changelog.
... (truncated)
Commits
4f41a8e4.0.502cfc1bUpdate .verb.md and run verb to generate README documentationcc52ff6Only run the upload code coverage step for 1 matrix permutation6d426d7Allow workflow to continue if the code coverage step to failsa00b954Merge branch 'codeql-coverage'9680381Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename648b4f2Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches70e6485Configure code coverage upload for CodeQLab8bc4dfix: honor the windows option when matching basenames6289307fix: preserve all branches when rewriting risky repeated extglobsUpdates
undicifrom 6.19.0 to 7.22.0Release notes
Sourced from undici's releases.
... (truncated)
Commits
0a23610Bumped v7.22.0 (#4829)f3c5c61feat: Support async cache stores in revalidation (#4826)9b78a44fix(deduplicate): avoid deduping methods not in methods option (#4818)0ce57babuild(deps-dev): bump esbuild from 0.25.12 to 0.27.3 (#4821)2453caffix: route websocket upgrades through new handler API (#4787)4658cdffeat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk (#4676)a821c56fix: use OR operator in includesCredentials per WHATWG URL Standard (#4816)b3326b5docs: fix syntax highlighting in WebSocket.md (#4814)393c0daBumped v7.21.0 (#4813)47f9b96fix: set finalizer only for fetch responses (#4803)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.