chore(deps): bump the all group with 7 updates by dependabot[bot] · Pull Request #47 · kroqdotdev/statoss-standalone

dependabot · 2026-10-22T23:56:39Z

Bumps the all group with 7 updates:

Package	From	To
next	`16.4.0`	`16.4.2`
nodemailer	`10.1.0`	`10.1.7`
react	`19.3.0`	`19.3.1`
react-dom	`19.3.0`	`19.3.1`
@playwright/test	`1.64.0`	`1.64.1`
eslint-config-next	`16.4.0`	`16.4.2`
vitest	`5.0.4`	`5.0.5`

Updates next from 16.4.0 to 16.4.2

Release notes

Sourced from next's releases.

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

2864b17 v16.4.2
a42cb59 Revert "[lts-active] Keep requests through middleware in a single OpenTelemet...
f0760ec [lts-active] Backport additional documentation fixes since v16.4.0 (#100262)
845007a [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions (#100211)
6a79d8a [lts-active] Backport docs fixes since v16.4.0 (#100246)
a75a782 [lts-active] Keep requests through middleware in a single OpenTelemetry trace...
8ad8524 [lts-active] Turbopack: Ignore realpath errors during module resolution, matc...
29d030e [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependenc...
3e50b82 [lts-active] fix(next-code-frame): snap visible window to char boundaries (#1...
9458fb9 [lts-active] Turbopack: backport Pages Router dev module graph chaining (#988...
Additional commits viewable in compare view

Updates nodemailer from 10.1.0 to 10.1.7

Release notes

Sourced from nodemailer's releases.

v10.1.7

10.1.7 (2026-10-18)

Bug Fixes

mime-funcs: encode parameter values that look like encoded words (651d79b)

v10.1.6

10.1.6 (2026-10-18)

Bug Fixes

addressparser: read groups in the same pass as the rest of the list (ddf0de1)

v10.1.5

10.1.5 (2026-10-18)

Bug Fixes

addressparser: handle an address list without copying it per address (6bd09b3)

addressparser: tokenize into offsets instead of an object per token (3fd3f50)

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)

addressparser: bound group nesting at ten levels (ce63303)

addressparser: drop the obsolete route from an angle-addr (3dbc730)

addressparser: end a comment only at the ")" that closes the outermost one (0a87617)

addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)

addressparser: never read a mailbox out of a comment (a1538ea)

addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)

addressparser: read the first addr-spec of the display text (038940a)

split a domain literal off at the "@" in front of it (d5983b0)

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

format References and strip URLs in linear time, release any number of streams (2f18641)

v10.1.2

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.7 (2026-10-18)

Bug Fixes

mime-funcs: encode parameter values that look like encoded words (651d79b)

10.1.6 (2026-10-18)

Bug Fixes

addressparser: read groups in the same pass as the rest of the list (ddf0de1)

10.1.5 (2026-10-18)

Bug Fixes

addressparser: handle an address list without copying it per address (6bd09b3)

addressparser: tokenize into offsets instead of an object per token (3fd3f50)

10.1.4 (2026-10-18)

Bug Fixes

addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)

addressparser: bound group nesting at ten levels (ce63303)

addressparser: drop the obsolete route from an angle-addr (3dbc730)

addressparser: end a comment only at the ")" that closes the outermost one (0a87617)

addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)

addressparser: never read a mailbox out of a comment (a1538ea)

addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)

addressparser: read the first addr-spec of the display text (038940a)

split a domain literal off at the "@" in front of it (d5983b0)

10.1.3 (2026-10-18)

Bug Fixes

format References and strip URLs in linear time, release any number of streams (2f18641)

10.1.2 (2026-10-16)

Bug Fixes

bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

... (truncated)

Commits

7613a86 chore(master): release 10.1.7 (#1900)
651d79b fix(mime-funcs): encode parameter values that look like encoded words
84849fa test(addressparser): pin how an angle-addr followed by a group is read
a13654e chore(master): release 10.1.6 (#1899)
ddf0de1 fix(addressparser): read groups in the same pass as the rest of the list
7ab9ac1 chore(master): release 10.1.5 (#1898)
3fd3f50 fix(addressparser): tokenize into offsets instead of an object per token
6bd09b3 fix(addressparser): handle an address list without copying it per address
2a7e952 chore(master): release 10.1.4 (#1897)
038940a fix(addressparser): read the first addr-spec of the display text
Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Updates @playwright/test from 1.64.0 to 1.64.1

Release notes

Sourced from @playwright/test's releases.

v1.64.1

Bug Fixes

#43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0

#43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

Commits

cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
866cbb8 chore: mark v1.64.1 (#43354)
1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
See full diff in compare view

Updates eslint-config-next from 16.4.0 to 16.4.2

Release notes

Sourced from eslint-config-next's releases.

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

2864b17 v16.4.2
7217011 v16.4.1
See full diff in compare view

Updates vitest from 5.0.4 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

🐞 Bug Fixes

Keep vite default fs.deny with api token file - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)

Handle quoted file names in --changed - by @sheremet-va in vitest-dev/vitest#11583 (14921)

Add data to the import.meta.hot stub - by @sheremet-va in vitest-dev/vitest#11590 (3a828)

Set skip in skipIf, ignore undefined options - by @sheremet-va in vitest-dev/vitest#11591 (d523a)

Skip builtin loading in async leak detector - by @sheremet-va in vitest-dev/vitest#11598 (fe86a)

Keep the import frame in native loader errors - by @sheremet-va in vitest-dev/vitest#11599 (9697b)

Run hook cleanups when a later hook fails - by @sheremet-va in vitest-dev/vitest#11605 (6c5a4)

Release mocks of finished test files - by @sheremet-va in vitest-dev/vitest#11607 (e9c3d)

Abort all running tests on cancel - by @sheremet-va in vitest-dev/vitest#11606 (6621a)

browser:

Ignore synthetic pagehide events - by @sheremet-va in vitest-dev/vitest#11582 (ca081)

Run plugin buildStart on server creation - by @sheremet-va in vitest-dev/vitest#11593 (ea611)

Drop late connections of closed sessions - by @sheremet-va in vitest-dev/vitest#11600 (f161e)

Wait 30s for the browser to close - by @sheremet-va in vitest-dev/vitest#11601 (6498b)

Run global setup once with instances - by @sheremet-va in vitest-dev/vitest#11596 (8dd67)

reporter:

End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash - by @AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

View changes on GitHub

Commits

7a825db chore: release v5.0.5 (#11609)
6621a72 fix: abort all running tests on cancel (#11606)
e9c3d72 fix: release mocks of finished test files (#11607)
8dd67c2 fix(browser): run global setup once with instances (#11596)
6c5a447 fix: run hook cleanups when a later hook fails (#11605)
9697b38 fix: keep the import frame in native loader errors (#11599)
6498b66 fix(browser): wait 30s for the browser to close (#11601)
f161e6d fix(browser): drop late connections of closed sessions (#11600)
fe86a64 fix: skip builtin loading in async leak detector (#11598)
6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the all group with 7 updates: | Package | From | To | | --- | --- | --- | | [next](https://github.com/vercel/next.js) | `16.4.0` | `16.4.2` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `10.1.0` | `10.1.7` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.64.0` | `1.64.1` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.0` | `16.4.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.4` | `5.0.5` | Updates `next` from 16.4.0 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.0...v16.4.2) Updates `nodemailer` from 10.1.0 to 10.1.7 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v10.1.0...v10.1.7) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `@playwright/test` from 1.64.0 to 1.64.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.64.0...v1.64.1) Updates `eslint-config-next` from 16.4.0 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.2/packages/eslint-config-next) Updates `vitest` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) --- updated-dependencies: - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: nodemailer dependency-version: 10.1.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: "@playwright/test" dependency-version: 1.64.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all - dependency-name: eslint-config-next dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-22T23:57:10Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 92738ea6-5dee-467b-9c1d-550ccefe4143

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

…#49) `pnpm audit --audit-level=high` in **checks** fails on main, so every pull request is red, Dependabot's #47 and #48 included. - **next 16.4.0 to 16.4.2** (and eslint-config-next): GHSA-2464-fhr4-w9xw (critical, remote code execution through image optimization when `sharp` is older than 0.35.5 on glibc), GHSA-673q-mjm6-r5xr (critical, `use cache` returning typed arrays), GHSA-p3m5-59mp-jv5r (high, Server Actions denial of service). Checked against what runs: the published 0.5.0 image and the demo on statoss.com both carry `sharp` 0.35.5, and the app has no `use cache` and no Server Actions, so none of the three reaches a running copy. The bump is still due. - **vite 8.2.0 to 8.2.4** through an override in `pnpm-workspace.yaml`, as the repo does for other transitive fixes: six advisories in its development server, reached only through vitest. - The rest of #47: react and react-dom 19.3.1, nodemailer 10.1.7, @playwright/test 1.64.1, vitest 5.0.5. `pnpm audit` reports no known vulnerabilities. Local: lint, format check, typecheck, 509 tests and the build pass. CHANGELOG has a Security entry. Supersedes #47. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

kroqdotdev · 2026-10-24T17:48:19Z

Taken in by #49, which also overrides vite to 8.2.4 so pnpm audit passes.

dependabot · 2026-10-24T17:48:23Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 22, 2026

kroqdotdev mentioned this pull request Oct 24, 2026

chore(deps): next 16.4.2, react 19.3.1, nodemailer 10.1.7, vite 8.2.4 #49

Merged

kroqdotdev closed this Oct 24, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/all-17f26f651d branch October 24, 2026 17:48

Navigation Menu

Repository navigation

chore(deps): bump the all group with 7 updates - #47

chore(deps): bump the all group with 7 updates#47
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-17f26f651d

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

coderabbitai Bot commented Oct 22, 2026

Review skipped

Uh oh!

kroqdotdev commented Oct 24, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 22, 2026

v16.4.2

What's Changed

v16.4.1

v10.1.7

10.1.7 (2026-10-18)

Bug Fixes

v10.1.6

10.1.6 (2026-10-18)

Bug Fixes

v10.1.5

10.1.5 (2026-10-18)

Bug Fixes

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

v10.1.2

10.1.7 (2026-10-18)

Bug Fixes

10.1.6 (2026-10-18)

Bug Fixes

10.1.5 (2026-10-18)

Bug Fixes

10.1.4 (2026-10-18)

Bug Fixes

10.1.3 (2026-10-18)

Bug Fixes

10.1.2 (2026-10-16)

Bug Fixes

19.3.1 (October 14th, 2026)

React Server Components

19.3.1 (October 14th, 2026)

React Server Components

v1.64.1

Bug Fixes

v16.4.2

What's Changed

v16.4.1

v5.0.5

🐞 Bug Fixes

View changes on GitHub

Uh oh!

coderabbitai Bot commented Oct 22, 2026

Review skipped

Uh oh!

kroqdotdev commented Oct 24, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant