fix(deps): bump next, @sentry/nextjs and vite to resolve Dependabot alerts by AviPeltz · Pull Request #9042 · ParadevAI/Paradev

AviPeltz · 2026-10-29T17:05:03Z

Summary

Bumps next 16.3.8 → 16.4.1 (root override + api, docs, marketing, web), @sentry/nextjs 10.68.0 → 10.75.2 (api, docs, marketing, web) and vite 7.3.5 → 7.3.7 (desktop, ui). Lockfile refreshed.

Also bumps @lingui/swc-plugin 6.6.0 → 6.7.1 in the same four Next apps. Next 16.4.1 cannot run 6.6.0 (built for swc_core 66.0.3): the Deploy jobs on #8821 failed with "Failed to execute @lingui/swc-plugin … Failed to deserialize program received from host". 6.7.x is built for swc_core 77.1.1 (see the plugin README's compatibility table).

This replaces #8821 (same bumps, without the swc-plugin fix; also conflicts with main) and the per-directory Dependabot PRs #8810, #8808, #8738 and #8694.

Alerts resolved:

chore(desktop): bump version to 0.0.25 #397, fix(desktop): fix sidebar and carousel bottom overflow #408, draft: test pr creation #412, chore(desktop): remove code quality section from AGENTS.md #417 (high): Next.js: Denial of Service in App Router using Server Actions
handle git remote head when local does not exist #398, create commit in change tab #409, Disable deployments for desktop app #413, chore: simplify project-structure-validator agent #418 (critical): Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
feat(desktop): add path and branch info to workspace header #400, Remove inline imports #411, feat(desktop): add Copy Path:Line to Monaco editor context menu #415, fix (desktop): fixed weird claude bug #420 (critical): Next.js: Unauthenticated Remote Code Execution in use cache functions returning typed arrays
foreign chicken dd3dbe #399, Fix Layout #410, chore(desktop): bump version to 0.0.26 #414, fix: PostHog cross-subdomain tracking and cookie consent #419 (critical): Sentry-Javascript: Middleware Bypass when using Tunnel route
fix: create PR on release script and prevent creating extra draft release #376, chore(desktop): bump version to 0.0.23 #386 (high): launch-editor: fs.existsSync() existence check can be bypassed on Windows (via vite)
fix (desktop): fixing escape sequences handling so its not pushed to input #388, Use shadcn tooltips #394 (medium): Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine
Update .env.example #377, feat(desktop): add editable Monaco diff view for uncommitted changes #387 (medium): launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (via vite)
feat(desktop): add OAuth authentication for desktop app #360, fix(auth): use Authorization header for cross-subdomain tRPC auth #373 (medium): launch-editor: escapeCmdArgs() omits % escaping on Windows (via vite)
fix(desktop): make error toast description readable in light mode #389, Fix sidebar tooltips #395 (low): Vite: Cross origin script execution through Vite custom middleware

Not in this PR:

zod: covered by fix(deps): bump zod to 4.6.6 to resolve Dependabot alerts #8844 (green, but conflicts with main).
storybook, @modelcontextprotocol/sdk, hono: covered by fix(deps): bump storybook, @modelcontextprotocol/sdk and hono in every workspace to resolve Dependabot alerts #8903 (green, but conflicts with main).
@azure/msal-node (Update finding Claude #444): covered by Dependabot PR chore(deps): bump @azure/msal-node from 5.5.0 to 7.1.0 in /packages/trpc #8836.
better-auth (fix(desktop): ensure Monaco editor loads syntax highlighting reliably #445–feat(marketing): add Features and FAQ sections to homepage #472): fixed only in 1.7.x, a breaking release that needs DB migrations. Left for a human.

Note: @sentry/nextjs 10.75 logs a deprecation warning at build time: import withSentryConfig from @sentry/nextjs/config. It still works and goes away in v11.

Test plan

bun install (Bun 1.4.3)
bun run lint:fix (clean, no fixes)
bunx sherif (no issues)
bun run typecheck in apps/api, docs, marketing, web, desktop and packages/ui
bun run build in apps/docs (Next 16.4.1 + Turbopack + swc-plugin 6.7.1): compiled, 244/244 static pages, no SWC plugin errors, no macro imports left in the compiled chunks
CI Deploy Preview jobs (API, Web, Marketing, Docs)

Summary by cubic

Bumps next 16.3.8→16.4.1, @sentry/nextjs 10.68.0→10.75.2, and vite 7.3.5→7.3.7 to resolve the outstanding Dependabot alerts, and @lingui/swc-plugin 6.6.0→6.7.1 because Next 16.4.1 can't run the old plugin — Turbopack builds fail with a deserialization error.

Alerts resolved

Critical Next.js unauthenticated RCEs in Image Optimization API (SVG) and use cache typed arrays, plus a DoS in App Router Server Actions.
Critical Sentry middleware bypass via the Tunnel route.
launch-editor command injection and Vite file-serving / cross-origin issues.

Note: @sentry/nextjs 10.75 logs a build-time deprecation warning to import withSentryConfig from @sentry/nextjs/config; it still works and the warning is removed in v11.

^{Written for commit 6296a42. Summary will update on new commits.}

Summary by CodeRabbit

Chores
- Updated the frameworks and development tools used across the API, web, documentation, marketing, desktop, and shared UI applications.
- Updates include application frameworks, monitoring integrations, localization and build tooling, and development servers.
- No direct changes to user-facing functionality or behavior are noted in this update. These updates are internal and do not add or remove product capabilities.

…lerts next 16.3.8 -> 16.4.1 (root override, api, docs, marketing, web), @sentry/nextjs 10.68.0 -> 10.75.2 (api, docs, marketing, web), vite 7.3.5 -> 7.3.7 (desktop, ui). next 16.4.1 cannot run @lingui/swc-plugin 6.6.0 (built for swc_core 66.0.3): Turbopack fails with "Failed to deserialize program received from host". Bump the plugin to 6.7.1 (swc_core 77.1.1) in the same four Next apps.

coderabbitai · 2026-10-29T17:05:29Z

Walkthrough

Package manifests update Next.js, Sentry, Lingui, and Vite dependency versions across the root and application packages.

Changes: Dependency version updates

Layer / File(s)	Summary
Application dependency versions `package.json`, `apps/api/package.json`, `apps/docs/package.json`, `apps/marketing/package.json`, `apps/web/package.json`	Next.js changes from 16.3.8 to 16.4.1, Sentry from 10.68.0 to 10.75.2, and Lingui from 6.6.0 to 6.7.1 across the listed manifests.
Vite version updates `apps/desktop/package.json`, `packages/ui/package.json`	Vite changes from 7.3.5 to 7.3.7.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: kitenite, saddlepaddle

Merge Risk: Minimal · up to 6296a

The supplied evidence identifies no merge-blocking impact from the dependency upgrades.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the dependency updates and the security-alert remediation. It is concise and uses conventional commit format.
Description check		The description provides the change summary, rationale, affected dependencies, resolved and excluded alerts, testing details, known deprecation warning, and remaining unchecked CI tests. It uses equiv…
Linked Issues check		The only linked issue is `#397` ("chore(desktop): bump version to 0.0.25"). It is closed and completed. It supplies background only. No active directly linked target remains. No linked-issue coding requ…
Out of Scope Changes check		With no active linked issue, scope is judged against the PR objectives and the current PR description. The reviewed package.json changes match the stated objectives. next 16.3.8 to 16.4.1 appears in t…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…

Full details: Description check

Explanation

The description provides the change summary, rationale, affected dependencies, resolved and excluded alerts, testing details, known deprecation warning, and remaining unchecked CI tests. It uses equivalent headings instead of the template headings but is substantially complete.

Full details: Linked Issues check

Explanation

The only linked issue is #397 ("chore(desktop): bump version to 0.0.25"). It is closed and completed. It supplies background only. No active directly linked target remains. No linked-issue coding requirements apply. The package.json changes in this PR do not change the desktop app version. This absence is not a failure, because #397 is not an active requirement. The current PR objectives also state that no active linked issue targets remain.

Full details: Out of Scope Changes check

Explanation

With no active linked issue, scope is judged against the PR objectives and the current PR description. The reviewed package.json changes match the stated objectives. next 16.3.8 to 16.4.1 appears in the root, apps/api, apps/docs, apps/marketing, and apps/web manifests. @sentry/nextjs 10.68.0 to 10.75.2 appears in apps/api, apps/docs, apps/marketing, and apps/web. vite 7.3.5 to 7.3.7 appears in apps/desktop and packages/ui. @lingui/swc-plugin 6.6.0 to 6.7.1 appears in apps/api, apps/docs, apps/marketing, and apps/web. The description states that the swc-plugin bump is required for Next 16.4.1 to run. No source change outside dependency manifests appears in the summary. bun.lock is excluded by the ignored_files rule, so lockfile content was not inspected. This does not affect the verdict, because the manifest changes alone account for the stated objectives.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (6 skipped: 6 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

greptile-apps · 2026-10-29T17:08:23Z

Confidence Score: 5/5

[High impact] The reviewed changes appear safe to merge; no actionable defects were found.

Summary

Updates dependency pins across the Next apps, desktop app, and shared UI package.

The Next.js apps use updated Next.js and Sentry releases.
The Next.js apps use a Lingui plugin built for the newer compiler.
Desktop and shared UI use the updated Vite release.
Bun’s lockfile records extra package entries from the dependency refresh.

_{Reviews (1) · Last reviewed commit: "fix(deps): bump next, @sentry/nextjs and..." · Reviewed by Greptile}

github-actions · 2026-10-29T17:11:46Z

🧹 Preview Cleanup Complete

The following preview resources have been cleaned up:

✅ Neon database branch

Thank you for your contribution! 🎉

…0-29 # Conflicts: # apps/api/package.json # apps/marketing/package.json # bun.lock

Sentry keeps its client under `__SENTRY__[SDK_VERSION]`. #9042 moved the API to @sentry/nextjs 10.75.2 but left packages/trpc on @sentry/core 10.68.0, so every span and captureException from trpc code running in the API has looked in an empty carrier and done nothing since 2026-10-29: the provision job's trace, the cloud-workspace start trace, and the exceptions meter.ts and wake.ts report.

AviPeltz temporarily deployed to preview October 29, 2026 17:05 — with GitHub Actions Inactive

Merge remote-tracking branch 'origin/main' into fix/dependabot-2026-1…

6296a42

…0-29 # Conflicts: # apps/api/package.json # apps/marketing/package.json # bun.lock

AviPeltz temporarily deployed to preview October 29, 2026 23:34 — with GitHub Actions Inactive

AviPeltz merged commit a0d4b79 into main Oct 29, 2026
18 checks passed

coderabbitai Bot mentioned this pull request Nov 1, 2026

fix(i18n): stop React Compiler from showing raw message ids, and catch it in check:i18n #9222

Merged

4 tasks done

saddlepaddle mentioned this pull request Nov 2, 2026

fix(trpc): match @sentry/core to the API's Sentry SDK #9281

Merged

Navigation Menu

Repository navigation

fix(deps): bump next, @sentry/nextjs and vite to resolve Dependabot alerts - #9042

fix(deps): bump next, @sentry/nextjs and vite to resolve Dependabot alerts#9042
AviPeltz merged 2 commits into
mainfrom
fix/dependabot-2026-10-29

AviPeltz commented Oct 29, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

AviPeltz commented Oct 29, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by cubic

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

github-actions Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧹 Preview Cleanup Complete

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

AviPeltz commented Oct 29, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading

greptile-apps Bot commented Oct 29, 2026 •

edited

Loading

github-actions Bot commented Oct 29, 2026 •

edited

Loading