build(deps): fix security overrides in npm-deps group bump by dependabot[bot] · Pull Request #560 · d-oit/do-web-doc-resolver

dependabot · 2026-08-10T04:17:30Z

Summary

Bump the npm-deps group in /web (17 updates from dependabot): next 16.2.11 -> 16.3.0, react/react-dom 19.2.8, postcss 8.5.19 -> 8.5.26, @typescript-eslint 8.64 -> 8.66, eslint 10.8, @playwright/test 1.62.1, plus patch/minor updates.

Security fix

Removes the vulnerable next.postcss: 8.5.19 override and pins fixed versions:

postcss 8.5.26 (top-level override)
brace-expansion 5.0.9
js-yaml 4.3.1
nanoid 3.3.18

npm audit --audit-level=high now reports 0 vulnerabilities. Clears Trivy FS and Dependency Audit failures across the repo.

Testing

next build: pass
tsc --noEmit: pass
npm audit: 0 vulnerabilities

vercel · 2026-08-10T04:17:33Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
do-web-doc-resolover	Ready	Preview	Aug 10, 2026 8:16am

deepsource-io · 2026-08-10T04:17:53Z

DeepSource Code Review

We reviewed changes in 3b1f468...680f3ba on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Updated (UTC)	Details
JavaScript	Aug 10, 2026 8:16a.m.	Review ↗
Python	Aug 10, 2026 8:16a.m.	Review ↗
Rust	Aug 10, 2026 8:16a.m.	Review ↗
Shell	Aug 10, 2026 8:16a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

codacy-production · 2026-08-10T04:18:32Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric Results

Complexity 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

graphify-labs

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Graphify review — findings

This pull request updates dependency versions in web/package.json, bumping both runtime dependencies (e.g., next, react, react-dom, ipaddr.js) and devDependencies (e.g., eslint, typescript-eslint, postcss, @types/*, wait-on) to newer minor/patch releases. The corresponding package-lock.json is regenerated to reflect these changes.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 84 functions depend on the 84 functions this change touches.

Health — grade A; no new coupling hotspots.

Verification — 84 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

verification_scope: 84 function(s) in the blast radius were not formally verified this run

… updates Bumps the npm-deps group with 17 updates in the /web directory: | Package | From | To | | --- | --- | --- | | [ipaddr.js](https://github.com/whitequark/ipaddr.js) | `2.4.0` | `2.5.0` | | [next](https://github.com/vercel/next.js) | `16.2.11` | `16.3.0` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` | | [@next/eslint-plugin-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-plugin-next) | `16.2.10` | `16.3.0` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.1.2` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.64.0` | `8.66.0` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.64.0` | `8.66.0` | | [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.8.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.10` | `16.3.0` | | [eslint-plugin-playwright](https://github.com/mskelton/eslint-plugin-playwright) | `2.10.5` | `2.11.0` | | [globals](https://github.com/sindresorhus/globals) | `17.7.0` | `17.9.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.19` | `8.5.26` | | [wait-on](https://github.com/jeffbski/wait-on) | `9.0.10` | `9.1.0` | Updates `ipaddr.js` from 2.4.0 to 2.5.0 - [Changelog](https://github.com/whitequark/ipaddr.js/blob/main/Changes.md) - [Commits](https://github.com/whitequark/ipaddr.js/commits) Updates `next` from 16.2.11 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.11...v16.3.0) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `@types/react-dom` from 19.2.3 to 19.2.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@next/eslint-plugin-next` from 16.2.10 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-plugin-next) Updates `@playwright/test` from 1.61.1 to 1.62.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.61.1...v1.62.1) Updates `@types/node` from 26.1.1 to 26.1.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.3 to 19.2.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@typescript-eslint/eslint-plugin` from 8.64.0 to 8.66.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.64.0 to 8.66.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/parser) Updates `eslint` from 10.7.0 to 10.8.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.7.0...v10.8.0) Updates `eslint-config-next` from 16.2.10 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.0/packages/eslint-config-next) Updates `eslint-plugin-playwright` from 2.10.5 to 2.11.0 - [Release notes](https://github.com/mskelton/eslint-plugin-playwright/releases) - [Changelog](https://github.com/mskelton/eslint-plugin-playwright/blob/main/CHANGELOG.md) - [Commits](mskelton/eslint-plugin-playwright@v2.10.5...v2.11.0) Updates `globals` from 17.7.0 to 17.9.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.7.0...v17.9.0) Updates `postcss` from 8.5.19 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.19...8.5.26) Updates `wait-on` from 9.0.10 to 9.1.0 - [Release notes](https://github.com/jeffbski/wait-on/releases) - [Commits](jeffbski/wait-on@v9.0.10...v9.1.0) --- updated-dependencies: - dependency-name: ipaddr.js dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@types/react-dom" dependency-version: 19.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@next/eslint-plugin-next" dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: "@playwright/test" dependency-version: 1.62.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: "@types/node" dependency-version: 26.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@types/react-dom" dependency-version: 19.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.66.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: "@typescript-eslint/parser" dependency-version: 8.66.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: eslint-config-next dependency-version: 16.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: eslint-plugin-playwright dependency-version: 2.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: globals dependency-version: 17.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-deps - dependency-name: wait-on dependency-version: 9.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-deps ... Signed-off-by: dependabot[bot] <support@github.com>

- Remove next.postcss 8.5.19 pin, add top-level postcss 8.5.26 override - Pin brace-expansion 5.0.9, js-yaml 4.3.1, nanoid 3.3.18 to clear npm audit - npm audit --audit-level=high now reports 0 vulnerabilities

dependabot Bot added dependencies Pull requests that update a dependency file frontend labels Aug 10, 2026

github-advanced-security AI found potential problems Aug 10, 2026

View reviewed changes

Comment thread web/package-lock.json Fixed

vercel Bot deployed to Preview August 10, 2026 04:18 View deployment

graphify-labs Bot reviewed Aug 10, 2026

View reviewed changes

This was referenced Aug 10, 2026

build(deps)(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /web #542

Closed

build(deps)(deps): bump postcss and next in /web #555

Closed

fix(resolver): ensure nightly Python-Rust bridge formatting compliance #554

Closed

dependabot Bot and others added 2 commits August 10, 2026 09:59

build(deps): fix CVE-2026-69153 and audit-clean dependency overrides

b70876c

- Remove next.postcss 8.5.19 pin, add top-level postcss 8.5.26 override - Pin brace-expansion 5.0.9, js-yaml 4.3.1, nanoid 3.3.18 to clear npm audit - npm audit --audit-level=high now reports 0 vulnerabilities

d-oit force-pushed the dependabot/npm_and_yarn/web/npm-deps-ac7007caa9 branch from d7473ab to b70876c Compare August 10, 2026 08:01

vercel Bot deployed to Preview August 10, 2026 08:01 View deployment

d-oit changed the title ~~build(deps)(deps): bump the npm-deps group across 1 directory with 17 updates~~ build(deps): bump the npm-deps group across 1 directory with 17 updates Aug 10, 2026

chore(ci): retrigger title lint after fixing PR title scope

07f501f

vercel Bot deployed to Preview August 10, 2026 08:09 View deployment

d-oit changed the title ~~build(deps): bump the npm-deps group across 1 directory with 17 updates~~ build(deps): fix security overrides in npm-deps group bump Aug 10, 2026

chore(ci): retrigger after PR body length fix

680f3ba

vercel Bot deployed to Preview August 10, 2026 08:16 View deployment

d-oit merged commit 519fc30 into main Aug 10, 2026
50 checks passed

d-oit deleted the dependabot/npm_and_yarn/web/npm-deps-ac7007caa9 branch August 10, 2026 08:21

Navigation Menu

build(deps): fix security overrides in npm-deps group bump - #560

build(deps): fix security overrides in npm-deps group bump#560
d-oit merged 4 commits into
mainfrom
dependabot/npm_and_yarn/web/npm-deps-ac7007caa9

dependabot Bot commented on behalf of github Aug 10, 2026 •

edited by d-oit

Loading

Uh oh!

vercel Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

deepsource-io Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

codacy-production Bot commented Aug 10, 2026

Uh oh!

graphify-labs Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Aug 10, 2026 • edited by d-oit Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security fix

Testing

Uh oh!

vercel Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deepsource-io Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

Uh oh!

codacy-production Bot commented Aug 10, 2026

Up to standards ✅

Uh oh!

graphify-labs Bot left a comment

Choose a reason for hiding this comment

Graphify review — findings

Impact & health

Graphify review

Gate & verification

graphify gate

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot Bot commented on behalf of github Aug 10, 2026 •

edited by d-oit

Loading

vercel Bot commented Aug 10, 2026 •

edited

Loading

deepsource-io Bot commented Aug 10, 2026 •

edited

Loading