chore(deps)(deps): bump the security group across 1 directory with 4 updates - #1163
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
the
dependencies
Contributor
Contributor
📊 Coverage + size by packagePer-package bundle size on this PR (no JS/TS source changes detected under
"Coverage" is each package's own |
Contributor
Storybook visual diff⏭️ Skipped: the apollo-design preview deployment did not succeed, so no comparison ran. Logs Updated (PT): Sep 14, 2026, 06:34:10 AM |
There was a problem hiding this comment.
🟡 Changes recommended
Address the lockfile churn and add or await the required release-age exemptions.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Updates security-sensitive dependencies across Apollo’s documentation and Vertex apps.
Changes:
- Upgrades Next.js to 16.3.3.
- Updates Tiptap Core to 3.30.5.
- Updates Sharp and baseline browser mapping dependencies.
- Refreshes the pnpm lockfile.
File summaries
| File | Summary |
|---|---|
pnpm-lock.yaml |
Contains moderate unreviewed toolchain churn and two critical missing release-age exemptions for @tiptap/core@3.30.5 and next@16.3.3. |
apps/apollo-vertex/package.json |
Updates Next.js. |
apps/apollo-docs/package.json |
Updates Next.js. |
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 2/3 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+6263
to
+6264
| '@tiptap/core@3.30.5': | ||
| resolution: {integrity: sha512-3O7N0FyKIfuLV+xrdWyDM3V5eUY/q2CgLjhhMwOAbM1Pu7VPp9VP+TpEYOdH8aRyB+h1vj5hX5A747D8ZrPfHA==} |
Comment on lines
+10507
to
+10508
| next@16.3.3: | ||
| resolution: {integrity: sha512-tuRTx1nQ/yVw83cwJBo9F+njGUgMn3UHQycreWHB8XsStvvAh1AthbI8/4IpKnFaF58F+iSiHejYOlMQ/eq83g==} |
| vite: | ||
| specifier: ^7.3.6 | ||
| version: 7.3.6(@types/node@24.10.1)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.43.1)(tsx@4.22.4)(yaml@2.8.3) | ||
| version: 7.3.6(@types/node@24.10.1)(jiti@2.7.0)(lightningcss@1.33.0)(terser@5.43.1)(tsx@4.22.4)(yaml@2.8.3) |
…updates Bumps the security group with 2 updates in the / directory: [@tiptap/core](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/core) and [next](https://github.com/vercel/next.js). Updates `@tiptap/core` from 3.30.4 to 3.30.5 - [Release notes](https://github.com/ueberdosis/tiptap/releases) - [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.30.5/packages/core/CHANGELOG.md) - [Commits](https://github.com/ueberdosis/tiptap/commits/v3.30.5/packages/core) Updates `next` from 16.2.11 to 16.3.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.11...v16.3.3) Updates `baseline-browser-mapping` from 2.10.31 to 2.11.23 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.31...v2.11.23) Updates `sharp` from 0.35.3 to 0.35.4 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.3...v0.35.4) --- updated-dependencies: - dependency-name: "@tiptap/core" dependency-version: 3.30.5 dependency-type: direct:production dependency-group: security - dependency-name: baseline-browser-mapping dependency-version: 2.11.23 dependency-type: indirect dependency-group: security - dependency-name: next dependency-version: 16.3.3 dependency-type: direct:production dependency-group: security - dependency-name: sharp dependency-version: 0.35.4 dependency-type: indirect dependency-group: security ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/security-c0667e47bf
branch
from
September 14, 2026 13:31
c4b2118 to
f5144d4
Compare
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved dependency constraints, quarantine exemptions, and unrelated lockfile churn remain.
Get a fresh assessment by requesting another Copilot review.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (3)
pnpm-lock.yaml:672
- The lockfile now selects
@tiptap/core@3.30.5, butpnpm-workspace.yamlonly exempts@tiptap/core@3.30.4from the repository's 14-day release quarantine. Because the override is>=3.30.4, a fresh install can reject or resolve back to the still-vulnerable 3.30.4 instead of reliably installing this security fix. Add a version-scoped exemption for 3.30.5 after vetting that release.
pnpm-lock.yaml:9912 - This lockfile update re-resolves unrelated toolchain packages in addition to the four updates described by the PR: for example, Vite's
lightningcssmoves from 1.32.0 to 1.33.0 even though neithernextnor Tiptap requires Vite. Similar unrelated ESLint, Acorn, js-yaml, flatted, and picomatch changes are included elsewhere. Please regenerate the lockfile surgically so the PR does not ship unreviewed dependency churn.
pnpm-lock.yaml:10508 - The repository's quarantine configuration has a name-scoped exemption for
@next/*, but not for the unscopednextpackage. This introducesnext@16.3.3without a version-scoped exemption; because this is the new critical security release, addnext@16.3.3after the required vetting (or document that it has aged past 14 days), otherwise clean installs can reject or resolve this update differently.
- Files reviewed: 2/3 changed files
- Comments generated: 1
- Review effort level: Lite
| '@tiptap/core': | ||
| specifier: '>=3.30.4' | ||
| version: 3.30.4(@tiptap/pm@3.30.4) | ||
| version: 3.30.5(@tiptap/pm@3.30.4) |
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/security-c0667e47bf
branch
September 15, 2026 04:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the security group with 2 updates in the / directory: @tiptap/core and next.
Updates
@tiptap/corefrom 3.30.4 to 3.30.5Release notes
Sourced from @tiptap/core's releases.
Changelog
Sourced from @tiptap/core's changelog.
Commits
b0c188bchore(release): release new stable release (#8261)d0d499bMerge commit from forkUpdates
nextfrom 16.2.11 to 16.3.3Release notes
Sourced from next's releases.
... (truncated)
Commits
a9a1cb7v16.3.3968b9fc[16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows3a15b4a[16.3.x] [next/image]: disable avif image optimization7378b51Backport/docs fixes 16.3 (#97649)528c1cd[16.3.x] Stop generating error codes (#97780)d0ac882v16.3.281deb92[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...cd714d9[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)5ac2327[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)0ccb3e7[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)Updates
baseline-browser-mappingfrom 2.10.31 to 2.11.23Release notes
Sourced from baseline-browser-mapping's releases.
Commits
ebdc72fPatch to 2.11.23 because browser or feature data changed55fa3a1Browser or feature data changed5ac60dbUpdating static siteaf7c3c4Patch to 2.11.22 because browser or feature data changed7e10cadBrowser or feature data changedebb9702Updating static siteecc57a3Updating static site0e5ed80Patch to 2.11.21 because browser or feature data changed11da0b6Browser or feature data changed69fcc81Updating static siteUpdates
sharpfrom 0.35.3 to 0.35.4Release notes
Sourced from sharp's releases.
Commits
7f1a0a2Release v0.35.4f927818Upgrade to sharp-libvips v1.3.3e802092Prerelease v0.35.4-rc.0e13eb2fCI: Fix wasm32 build (#4589)a82a0b3Upgrade to libvips v8.18.68044fe4Bound resize dimensions to coordinate limit147f859Docs: changelog entries for #4578 #4584ee5bfb8Tests: use yauzl directly rather than via extract-zip wrapper7a77889Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)ea5bef2Improve support for input Streams finishing before output is requested (#4584)