[AviPeltz]

Summary

Bumps next 16.3.8 → 16.4.1 (root override + api, docs, marketing, web), @sentry/nextjs 10.68.0 → 10.75.2 (api, docs, marketing, web) and vite 7.3.5 → 7.3.7 (desktop, ui). Lockfile refreshed.

Alerts resolved:

• chore(desktop): bump version to 0.0.25 #397, draft: test pr creation #412, fix(desktop): fix sidebar and carousel bottom overflow #408, chore(desktop): remove code quality section from AGENTS.md #417 (high): Next.js DoS in App Router using Server Actions
• handle git remote head when local does not exist #398, Disable deployments for desktop app #413, create commit in change tab #409, chore: simplify project-structure-validator agent #418 (critical): Next.js RCE in Image Optimization API with SVG files
• feat(desktop): add path and branch info to workspace header #400, feat(desktop): add Copy Path:Line to Monaco editor context menu #415, Remove inline imports #411, fix (desktop): fixed weird claude bug  #420 (critical): Next.js RCE in use cache functions returning typed arrays
• foreign chicken dd3dbe #399, chore(desktop): bump version to 0.0.26 #414, Fix Layout #410, fix: PostHog cross-subdomain tracking and cookie consent #419 (critical): Sentry-Javascript middleware bypass when using Tunnel route
• Fix sidebar tooltips #395, Use shadcn tooltips #394, feat(desktop): add editable Monaco diff view for uncommitted changes #387, chore(desktop): bump version to 0.0.23 #386, fix(auth): use Authorization header for cross-subdomain tRPC auth #373 (ui) and fix(desktop): make error toast description readable in light mode #389, fix (desktop): fixing escape sequences handling so its not pushed to input #388, Update .env.example #377, fix: create PR on release script and prevent creating extra draft release #376, feat(desktop): add OAuth authentication for desktop app #360 (desktop): Vite / launch-editor alerts (low to high)

Not in this PR:

• storybook, @modelcontextprotocol/sdk, hono: covered by fix(deps): bump storybook, @modelcontextprotocol/sdk and hono to resolve Dependabot alerts #8776 and the open Dependabot PRs.
• electron (Disable linting error in monaco #402–feature(desktop): manage worktrees better #407, Fix changes sidebar #390): needs 42.11.9, a 41 → 42 major bump. Left for a human (chore(deps-dev): bump electron from 41.10.7 to 42.11.3 in /apps/desktop #8739 only reaches 42.11.3).

Test plan

• bun install
• bun run lint:fix (clean, no fixes)
• bun run typecheck in apps/api, docs, marketing, web, desktop and packages/ui
• CI

---

Summary by cubic

Bumps next 16.3.8 → 16.4.1, @sentry/nextjs 10.68.0 → 10.75.2, and vite 7.3.5 → 7.3.7 to resolve Dependabot alerts for Next.js DoS/RCE and Sentry tunnel route bypass. Lockfile refreshed; lint, typecheck, and install all pass.

• Applies the root next override plus updates in api, docs, marketing, web, and vite in desktop and ui.
• Leaves out electron alert fixes – they require a 41 → 42 major bump that should be handled separately.

^{Written for commit fc653d4. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Updated the frameworks and development tooling used across the API, desktop app, documentation, marketing site, web app, and shared UI package.
  • These maintenance updates do not change user-facing features.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0fa08a6a-9372-4d89-896b-40a7dbdfb0cb

📥 Commits

Reviewing files that changed from the base of the PR and between 7ffe706 and fc653d4.

⛔ Files ignored due to path filters: 1

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing: 7

• apps/api/package.json
• apps/desktop/package.json
• apps/docs/package.json
• apps/marketing/package.json
• apps/web/package.json
• package.json
• packages/ui/package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Package manifests update Next.js, Sentry, and Vite dependency versions across the API, desktop, docs, marketing, web, and UI packages. The root Next.js override is updated to match.

Changes: Next.js and Sentry updates

Layer / File(s)	Summary
Update Next.js and Sentry versions apps/api/package.json, apps/docs/package.json, apps/marketing/package.json, apps/web/package.json, package.json	The four application packages update Next.js from 16.3.8 to 16.4.1 and Sentry from 10.68.0 to 10.75.2. The root Next.js override changes to 16.4.1.

Vite updates

Layer / File(s)	Summary
Update Vite versions apps/desktop/package.json, packages/ui/package.json	Both packages update the Vite development dependency from 7.3.5 to 7.3.7.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: saddlepaddle

Merge Risk: ⚪ Minimal · up to fc653

The dependency updates are mergeable with no identified actionable risk.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title is concise, uses conventional commit format, and accurately describes the dependency updates made to resolve Dependabot alerts.
Description check		The description explains the dependency changes, security alerts addressed, exclusions, and testing performed. It uses Summary and Test plan headings instead of the template headings, and the CI check…
Linked Issues check		The only directly linked issue is #397, and it is closed and completed. It supplies historical context only. No active directly linked issue adds coding requirements for this pull request.
Out of Scope Changes check		The reviewed changes update the declared next, @sentry/nextjs, and vite versions in the package manifests. These changes match the pull request dependency-update scope. The lockfile is intention…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Description check

Explanation

The description explains the dependency changes, security alerts addressed, exclusions, and testing performed. It uses Summary and Test plan headings instead of the template headings, and the CI check remains unchecked, but the required information is mostly complete.

Full details: Out of Scope Changes check

Explanation

The reviewed changes update the declared next, @sentry/nextjs, and vite versions in the package manifests. These changes match the pull request dependency-update scope. The lockfile is intentionally excluded from review, so its contents do not provide additional scope evidence.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (7 skipped: 7 unsupported.)

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🚀 Preview Deployment

🔗 Preview Links

Service	Status	Link
Database (Neon)	✅	View Branch
API (Vercel)	❌	Failed to deploy
Web (Vercel)	❌	Failed to deploy
Marketing (Vercel)	❌	Failed to deploy
Docs (Vercel)	❌	Failed to deploy

---

Preview updates automatically with new commits

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates pinned dependencies and refreshes bun.lock:

• The Next.js apps use version 16.4.1.
• The Next.js apps use Sentry’s updated monitoring package.
• Desktop and shared UI tooling use Vite 7.3.7.

No actionable issues were established. Builds and tests were not run during this review.

_{Reviews (1) · Last reviewed commit: "fix(deps): bump next, @sentry/nextjs and..." · Reviewed by Greptile}