chore(deps): bump the npm-production group with 7 updates - #2010
chore(deps): bump the npm-production group with 7 updates#2010dependabot[bot] wants to merge 12 commits into
Conversation
Bumps the npm-production group with 7 updates: | Package | From | To | | --- | --- | --- | | [@next/env](https://github.com/vercel/next.js/tree/HEAD/packages/next-env) | `16.3.0` | `16.3.1` | | [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.69.0` | `10.70.0` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.69.0` | `10.70.0` | | [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.2` | `2.112.3` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.29.0` | `1.31.0` | | [mammoth](https://github.com/mwilliamson/mammoth.js) | `1.12.0` | `1.12.1` | | [next](https://github.com/vercel/next.js) | `16.3.0` | `16.3.1` | Updates `@next/env` from 16.3.0 to 16.3.1 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.1/packages/next-env) Updates `@sentry/nextjs` from 10.69.0 to 10.70.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.70.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.69.0...10.70.0) Updates `@sentry/node` from 10.69.0 to 10.70.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.70.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.69.0...10.70.0) Updates `@supabase/supabase-js` from 2.112.2 to 2.112.3 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.112.3/packages/core/supabase-js) Updates `lucide-react` from 1.29.0 to 1.31.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.31.0/packages/lucide-react) Updates `mammoth` from 1.12.0 to 1.12.1 - [Release notes](https://github.com/mwilliamson/mammoth.js/releases) - [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS) - [Commits](mwilliamson/mammoth.js@1.12.0...1.12.1) Updates `next` from 16.3.0 to 16.3.1 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.0...v16.3.1) --- updated-dependencies: - dependency-name: "@next/env" dependency-version: 16.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: "@sentry/nextjs" dependency-version: 10.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: "@sentry/node" dependency-version: 10.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: "@supabase/supabase-js" dependency-version: 2.112.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: lucide-react dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production - dependency-name: mammoth dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production - dependency-name: next dependency-version: 16.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 36221231 | Triggered | Generic High Entropy Secret | dd19994 | tests/rag-adversarial-fixtures.test.ts | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
CI triageCI failed on this PR. Automated classification of the 2 failed job(s):
Compared with main CI run #11455 (success). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
* chore(ledger): record Run PR sweep results for 6 synced + 2 investigated PRs Sweep synced 6 behind-but-clean open PRs (#2010, #2011, #2012, #2013, #2072, #2073) from origin/main via the authenticated update-branch API, and investigated a GitGuardian failure on #2040/#2041 that turned out to be a false positive (no secrets in either diff) rather than a real leak. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HhswQFFRjzhZnv467HL82y * style: prettier format on the PR #2040 ledger record Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HhswQFFRjzhZnv467HL82y * fix(ledger): restore content-addressed record's original bytes A prior "prettier format" commit (bed47de) escaped the literal `*` to `\*` inside this immutable, content-addressed review record, breaking the filename/content SHA-256 invariant that check-branch-review-ledger.mjs enforces. Immutable records must never be edited after creation; revert to the exact original row content (verified: sha256 matches the filename again). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015qDHwBNZYyRLdJHqSkiYTg --------- Co-authored-by: Claude <noreply@anthropic.com>
|
·@·d·ependabot r·ebase Branch is behind Generated by Claude Code |
GitGuardian failure diagnosis — false positive, not in the lockfileThe failing The finding
Neither digitBearing.canaryRegistry[0].token = ["CANARY-PHI-MRN", "1"].join("-");The real canary tokens are conspicuously non-secret synthetic strings — Why it appears here at all The hand-made merge commit from 2026-08-17 pulled that file in from
Confidence: high. No credential, key, or token appears anywhere in this diff. Recommended action: Generated by Claude Code |
Correction: the rebase request above is inert — please re-post it manuallyMy earlier comment did not reach Dependabot. The tooling I posted through strips bot mentions, so the command was stored with separator characters injected into the name (it renders as Verified 10 minutes after posting: head is still Action needed from you: post a new comment on this PR containing only the rebase command, typed normally — the word The GitGuardian analysis in my previous comment stands unchanged and is unaffected by this. Generated by Claude Code |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 92487d4235
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "node_modules/@sentry/browser-utils/node_modules/@sentry/core": { | ||
| "version": "10.70.0", |
There was a problem hiding this comment.
When this lockfile is installed, @sentry/bundler-plugins remains on 10.69.0 and pins the hoisted @sentry/core to 10.69.0, so the exact 10.70.0 requirement of every updated Sentry package is installed separately under its own node_modules. This commit consequently adds twelve duplicate core entries where the parent had one, inflating every clean install and deployment artifact and causing the runtime packages to resolve separate core module instances. Update or dedupe the complete Sentry subtree so the bundler plugin and core can resolve to 10.70.0 together.
Useful? React with 👍 / 👎.
|
@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. The only repository destination is BigSimmo/Database, and the only branch destination is the pull request head branch dependabot/npm_and_yarn/npm-production-0af95c93ad at starting commit c4840c0; never publish fixes to a detached or synthetic work branch and never create a stacked pull request. Use the authenticated GitHub connector to commit each approved fix to BigSimmo/Database:dependabot/npm_and_yarn/npm-production-0af95c93ad, then verify that the pull request head contains the published commit before reporting success. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. For a fixed thread, reply with as the first line and as the second line. For a no-code disposition, use followed by . These result markers authorize the workflow to close that exact thread only after it verifies a fixed commit is the pull request head; a local-only commit is not a fix. If publication or verification fails, do not use either result marker, do not claim success, and leave the thread open with the blocker. If human input or new authorization is required, do the same. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation. |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@dependabot recreate |
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
1 participant
Bumps the npm-production group with 7 updates:
16.3.016.3.110.69.010.70.010.69.010.70.02.112.22.112.31.29.01.31.01.12.01.12.116.3.016.3.1Updates
@next/envfrom 16.3.0 to 16.3.1Release notes
Sourced from @next/env's releases.
... (truncated)
Commits
3d32eb8v16.3.1Updates
@sentry/nextjsfrom 10.69.0 to 10.70.0Release notes
Sourced from @sentry/nextjs's releases.
... (truncated)
Changelog
Sourced from @sentry/nextjs's changelog.
Commits
0356ffdrelease: 10.70.0c2ac1bemeta(changelog): Update changelog for 10.70.0 (#23217)9c2f31dfix(v10/core,browser): Handle errors from other realms (#23201)8ad6cd1fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)4b5e80afix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy ...91af62cfix(v10/cloudflare): Set conversation id independent of session name (#23193)2096839fix(v10/cloudflare): Get original waituntil in workflows (#23192)0062819fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23...390b05afeat(v10/core): Support stable MCP SDK v2 (#22986)3b56ecbfeat(v10/solid,solidstart): Support@solidjs/routerv1 (#23163)Updates
@sentry/nodefrom 10.69.0 to 10.70.0Release notes
Sourced from @sentry/node's releases.
... (truncated)
Changelog
Sourced from @sentry/node's changelog.
Commits
0356ffdrelease: 10.70.0c2ac1bemeta(changelog): Update changelog for 10.70.0 (#23217)9c2f31dfix(v10/core,browser): Handle errors from other realms (#23201)8ad6cd1fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)4b5e80afix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy ...91af62cfix(v10/cloudflare): Set conversation id independent of session name (#23193)2096839fix(v10/cloudflare): Get original waituntil in workflows (#23192)0062819fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23...390b05afeat(v10/core): Support stable MCP SDK v2 (#22986)3b56ecbfeat(v10/solid,solidstart): Support@solidjs/routerv1 (#23163)Updates
@supabase/supabase-jsfrom 2.112.2 to 2.112.3Release notes
Sourced from @supabase/supabase-js's releases.
Changelog
Sourced from @supabase/supabase-js's changelog.
Commits
e44447cfix(supabase): improve trace propagation sampling and diagnostics (#2604)9f0358cfix(supabase): add trace context headers to canonical CORS allow-list (#2603)84beab1chore(release): version 2.112.2 changelogs (#2599)Updates
lucide-reactfrom 1.29.0 to 1.31.0Release notes
Sourced from lucide-react's releases.
Commits
0f8d48btest(packages): updates unit test snapshots with face-slightly-smiling (#4676)Updates
mammothfrom 1.12.0 to 1.12.1Changelog
Sourced from mammoth's changelog.
Commits
e3b9cecBump version to 1.12.1c69ea62Ignore numbering levels that use numStyleLink to refer to themselvesfbf5e22Check image content type for backslashes1a495a9Add note on performanceee59684Remove donations sectionUpdates
nextfrom 16.3.0 to 16.3.1Release notes
Sourced from next's releases.
... (truncated)
Commits
3d32eb8v16.3.12b4b1ec[backport] Revert i18n localization change for dynamic Pages API routes (#949...228df5f[backport] Retain fewer stale cache versions and use a TTL, plus the mtime fa...16eab3a[backport] Fix: Optimistic routing bugs leading to repeated prefetch loops (#...75548c9[backport] Fix Nav Inspector request loop on repeat captures (#97326)f6bd714[backport] [test] Compile the middleware redirect routes up front in dev (#97...43c1c60[16.3] [ci] Use OIDC tokens to read private preview builds (#97258)9dbb357[backport] Encode the cache item name built byunstable_cache(#97313)323a17c[backport] Discard only cache entries that predate a tag revalidation, and re...6d67f46[backport] Keep the dev validation worker alive across HMR updates (#97315)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions