fix(deps): close Dependabot critical/high/medium advisories

[moygospadin]

Closes 56 of 57 open Dependabot alerts — 21 of 22 unique advisories, including the single critical and every medium. Everything is transitive except the next devDependency, so the bulk of the fix tightens the existing overrides block, which in several cases still admitted the vulnerable version (shell-quote: ">=1.8.4 <2" allowed exactly the vulnerable 1.8.4).

Ranges tightened

Package	Before	After	Severity
seroval	>=1.4.1 <2	>=1.5.3 <2	critical (GHSA-mv8w-475r-vwqw)
shell-quote	>=1.8.4 <2	>=1.9.0 <2	high (GHSA-395f-4hp3-45gv)
fast-uri	>=3.1.2 <4	>=3.1.4 <4	2 high
svgo	>=4.0.1 <5	>=4.0.2 <5	high (GHSA-2p49-hgcm-8545)
postcss	<8.5.10	<8.5.18	2 high
js-yaml (4.x)	<4.2.0	<4.3.0	high (GHSA-52cp-r559-cp3m)

Added

sharp >=0.35.0 <0.36 (high, GHSA-f88m-g3jw-g9cj), diff@>=6 <8.0.3: 8.0.3 (low, GHSA-73rr-hh4g-fpgx), @babel/core@<7.29.6: 7.29.6 (low, GHSA-4x5r-pxfx-6jf8).

next 16.2.9/16.2.10 → 16.2.11 in packages/compiler, packages/new-compiler, packages/react and demo/new-compiler-next16 (4 high + 5 medium).

brace-expansion: three lines, three routes

The tree carried brace-expansion 1.x, 2.x and 5.x, one per minimatch major, and GHSA-mh99-v99m-4gvg is only patched in 5.0.8+ with no backport to the older lines.

• 5.x (minimatch 9/10) — pinned to 5.0.8, closing both advisories. The minimatch@>=10 pin also moves to 10.2.6 so the 10.x line depends on brace-expansion@^5.0.8 on its own.
• 2.x (minimatch 5.1.8 ← filelist ← jake ← ejs) — the line had to go, so the minimatch override widens to >=4 <6: 10.2.6. filelist only calls minimatch.match(list, pattern, options), which minimatch 10 still exports with an unchanged signature.
• 1.x (minimatch 3.1.4 ← the eslint plugins) — left at 1.1.16, which closes GHSA-3jxr-9vmj-r5cp. See below.

Not fixed

GHSA-mh99-v99m-4gvg still matches brace-expansion@1.1.16; no 1.x release carries the expansion caps added in 5.0.8. The line enters through minimatch@3.1.4, required by eslint-plugin-react — latest (7.37.5) still declares minimatch: ^3.1.2 and calls it as a callable default export (minimatch(prop, pattern) in forbid-component-props.js), while minimatch 10 exposes only named exports. Forcing the bump there breaks the plugin. Dev tooling only — no published package ships it.

Verification

• pnpm install --frozen-lockfile — exit 0
• pnpm typecheck — exit 0 (13 tasks)
• pnpm test — exit 0 (20 tasks, 147 test files)
• pnpm build — exit 0 (19 tasks), which also runs the syncpack lint-semver-ranges prebuild gate
• pnpm changeset status --since origin/main — exit 0

🤖 Generated with Claude Code

compiler-e2e is red, and it is not from this PR

compiler-e2e fails here (3 runs, 3 failures). The cause is a pre-existing, intermittent corruption in the Tailwind v4 PostCSS output, not the dependency changes.

Turbopack rejects the generated tests/fixtures/next/app/globals.css because an arbitrary-value utility comes out with garbage bytes in it:

.bg-\[b??\:var\(--my-\f ?\$\)\] {      <- corrupted
    background-color: b^@?:var(--my-^O^@$);
.bg-\[color\:var\(--my-color\)\] {     <- what it should be
Unexpected token Delim('\u{f}')
Generated code of PostCSS transform of file content of .../globals.css

That 500s the Next fixture, and whichever tests are still queued when it happens fail or get skipped — which is why the failing set moves between the Next.js and Vite cases from run to run.

Control: run 30347392469 on fix/model-response-placeholder-quoting (commit 912d53e6, next 16.2.9, postcss 8.5.10 — none of this PR's changes) hits Parsing CSS source code failed 18 times with the byte-identical corrupted class. The same three Vite tests fail there too, and that branch had green runs on the same code.

Locally the full suite passes on this branch (turbo run test:e2e, fixtures prepared, genuine cache miss — 6/6 in 57s), consistent with the corruption being nondeterministic.

Worth its own issue; flagging rather than papering over it.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR bumps the next devDependency to 16.2.11 across packages/compiler, packages/react, packages/new-compiler, and the demo app, addresses nine security advisories, adds a changeset for patch releases, and tightens several pnpm-workspace.yaml dependency override versions.

Changes

Dependency version bumps

Layer / File(s)	Summary
next devDependency bump and changeset packages/compiler/package.json, packages/react/package.json, packages/new-compiler/package.json, demo/new-compiler-next16/package.json, .changeset/dependabot-security-bumps.md	Updates the next dependency to 16.2.11 in four package manifests and adds a changeset with patch release entries documenting the security update.
Workspace override tightening pnpm-workspace.yaml	Raises minimum override versions for shell-quote, seroval, fast-uri, svgo, adds an override for sharp, and tightens ranges for minimatch, brace-expansion, postcss, js-yaml, diff, and @babel/core.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• lingodotdev/lingo.dev#2125: Both PRs update the same next dependencies and workspace security overrides.
• lingodotdev/lingo.dev#2164: Both PRs update dependency versions and security overrides in packages/compiler/package.json, packages/react/package.json, and pnpm-workspace.yaml.
• lingodotdev/lingo.dev#2108: Both PRs update minimatch in the workspace configuration for security remediation.

Suggested reviewers: cherkanovart

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	No pull request description was provided, so the required summary, changes, testing, visuals, and checklist information is missing.	Add a description that follows the repository template and documents the dependency changes, verification results, changeset, and remaining advisory.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the dependency updates that address security advisories.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-alerts

---

_{Comment @coderabbitai help to get the list of available commands.}