Bump the security group across 1 directory with 4 updates by dependabot[bot] · Pull Request #36 · mellowagain/website

dependabot · 2026-10-19T20:39:10Z

Bumps the security group with 4 updates in the / directory: next, seroval, shell-quote and source-map-js.

Updates next from 16.3.6 to 16.3.8

Release notes

v16.3.8

This release contains security fixes for the following advisories:

High:

Server-Side Request Forgery in Image Optimization

Medium:

Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Pending use cache fill can leak Draft Mode content into regular responses and persisted pages

Cache leak across root param values in nested 'use cache' functions

Low:

Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @lukesandberg for helping!

Commits

b0fad0d v16.3.8
719e4c6 [lts-active] Scope response cache keys to their source route (#218)
e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
4c20699 v16.3.7
2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
See full diff in compare view

Updates seroval from 1.5.4 to 1.6.11

Release notes

Sourced from seroval's releases.

1.5.5

fix: streaming serialization cleanup (#77)

fix: preserve own proto properties through serialize (#81)

fix: preserve circular own proto properties through deferred assignment (#82)

fix: use element length for bigint typed array views (#83)

fix: unescape regexp source in the serialized output (#84)

Credits to @spokodev and @greymoth-jp

Commits

See full diff in compare view

Updates shell-quote from 1.9.0 to 1.12.0

Changelog

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

[New] parse: support here-documents (<<) [#31](https://github.com/ljharb/shell-quote/issues/31)

Commits

[New] parse: support tab-stripping here-documents (<<-) dbfac37

[New] parse: support output process substitution (>() 2053315

[New] parse: support the case test-next terminator (;;&) 7d688b9

[New] parse: support the case fall-through terminator (;&) f27010e

[New] parse: support redirecting output despite noclobber (>|) b78d19c

[New] parse: support opening a file for reading and writing (<>) 21cc333

[New] parse: support redirecting stdout and stderr (&>) 6ad6cd2

[New] parse: support appending stdout and stderr (&>>) 90cde9c

[Dev Deps] update @ljharb/eslint-config 3a7b4ae

v1.11.0 - 2026-09-29

Fixed

[Refactor] quote: drop a replace that can never match in the single-quote branch [#15](https://github.com/ljharb/shell-quote/issues/15)

[New] parse: support bash ANSI-C quoting ($'...') [#32](https://github.com/ljharb/shell-quote/issues/32)

Commits

[Fix] quote: reject line terminators in tokens after a comment 6002b2e

[Fix] parse: preserve text after special shell parameters 81b08a5

[Fix] parse: an escaped backslash does not escape the character after it d708019

[Fix] quote: preserve ! in arguments that also contain ' ad39927

[Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd

[Fix] quote: preserve empty glob patterns 35c9b97

[Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e

[meta] npmignore some files ebfc308

[actions] add permissions 3429b0d

[actions] set least-privilege cache-mode 36f2394

[Dev Deps] update eslint 6de9a41

v1.10.0 - 2026-07-10

Merged

[New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

[Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8

[Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

... (truncated)

Commits

6ecb8aa v1.12.0
3a7b4ae [Dev Deps] update @ljharb/eslint-config
7d688b9 [New] parse: support the case test-next terminator (;;&)
f27010e [New] parse: support the case fall-through terminator (;&)
90cde9c [New] parse: support appending stdout and stderr (&>>)
6ad6cd2 [New] parse: support redirecting stdout and stderr (&>)
2053315 [New] parse: support output process substitution (>()
b78d19c [New] parse: support redirecting output despite noclobber (>|)
21cc333 [New] parse: support opening a file for reading and writing (\<>)
dbfac37 [New] parse: support tab-stripping here-documents (<<-)
Additional commits viewable in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the security group with 4 updates in the / directory: [next](https://github.com/vercel/next.js), [seroval](https://github.com/lxsmnsyc/seroval), [shell-quote](https://github.com/ljharb/shell-quote) and [source-map-js](https://github.com/7rulnik/source-map-js). Updates `next` from 16.3.6 to 16.3.8 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.6...v16.3.8) Updates `seroval` from 1.5.4 to 1.6.11 - [Release notes](https://github.com/lxsmnsyc/seroval/releases) - [Commits](https://github.com/lxsmnsyc/seroval/commits) Updates `shell-quote` from 1.9.0 to 1.12.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.9.0...v1.12.0) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: next dependency-version: 16.3.8 dependency-type: direct:production dependency-group: security - dependency-name: seroval dependency-version: 1.6.11 dependency-type: indirect dependency-group: security - dependency-name: shell-quote dependency-version: 1.12.0 dependency-type: indirect dependency-group: security - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: security ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-10-19T20:39:12Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mari.zip	Ready	Preview	Oct 19, 2026 8:40pm UTC

coderabbitai · 2026-10-19T20:39:20Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 9bfaaa63-8369-4ec4-942c-acbb394ab739

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026

vercel Bot deployed to Preview October 19, 2026 20:40

View deployment

Navigation Menu

Repository navigation

Bump the security group across 1 directory with 4 updates - #36

Bump the security group across 1 directory with 4 updates#36
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/security-ac2c9ccfa8

dependabot Bot commented on behalf of github Oct 19, 2026

Uh oh!

vercel Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Review skipped

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 19, 2026

v16.3.8

v16.3.7

Core Changes

Credits

1.5.5

v1.12.0 - 2026-10-02

Fixed

Commits

v1.11.0 - 2026-09-29

Fixed

Commits

v1.10.0 - 2026-07-10

Merged

Commits

v1.2.2

1.2.2

Uh oh!

vercel Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Review skipped

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented Oct 19, 2026 •

edited

Loading