Skip to content

Fix Dependabot security alerts - #258

Open
lio-p wants to merge 2 commits into
mainfrom
fix-dependabot-alerts-sep-2026
Open

Fix Dependabot security alerts#258
lio-p wants to merge 2 commits into
mainfrom
fix-dependabot-alerts-sep-2026

Conversation

@lio-p

@lio-p lio-p commented Sep 9, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Bump Next.js (and eslint-config-next / @next/third-parties) from 15.5.16 to 15.5.25, covering the open Next.js Dependabot alerts (patched at 15.5.21+) and the later 15.5.24 image-optimizer release.
  • Bump PostCSS to 8.5.23 (direct dep + override).
  • Pin patched transitive versions via overrides: brace-expansion 1.1.18 / 5.0.9, browserslist 4.28.8, nanoid 3.3.18, js-yaml 4.3.2, protobufjs 7.6.6, fflate 0.4.9 / 0.7.5, sharp 0.35.4.

This should close the open Dependabot PRs for next, postcss, brace-expansion, browserslist, nanoid, and js-yaml once merged.

Left unpatched (breaking majors)

  • echarts 5.6 → 6.1: XSS is in the lines (geo) series tooltip. We only use regular line charts, so this is not reachable. Jumping to 6.x would be a chart rewrite.
  • @opentelemetry/core 1.x → 2.8: no 1.x backport; a 2.x bump would force HyperDX / @vercel/otel majors.

Test plan

  • Vercel preview builds on Node 22
  • Homepage + a package dashboard still render (charts, images, date picker)
  • Confirm Dependabot alerts drop after merge (except echarts / otel)

Made with Cursor

…tives.

Co-authored-by: Cursor <cursoragent@cursor.com>
@vercel

vercel Bot commented Sep 9, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clickgems Error Error Sep 9, 2026 1:53pm UTC
clickpy Ready Ready Preview Sep 9, 2026 1:53pm UTC

Request Review

…ing alerts.

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant