Repository navigation
Bump the production group across 1 directory with 4 updates - #191
dependabot[bot] wants to merge 1 commit into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Bumps the production group with 4 updates in the / directory: [framer-motion](https://github.com/motiondivision/motion), [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react), [next](https://github.com/vercel/next.js) and [zustand](https://github.com/pmndrs/zustand). Updates `framer-motion` from 14.3.0 to 14.9.0 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v14.3.0...v14.9.0) Updates `lucide-react` from 1.58.0 to 1.65.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.65.0/packages/lucide-react) Updates `next` from 16.4.2 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.2...v16.4.3) Updates `zustand` from 5.0.15 to 5.0.16 - [Release notes](https://github.com/pmndrs/zustand/releases) - [Commits](pmndrs/zustand@v5.0.15...v5.0.16) --- updated-dependencies: - dependency-name: framer-motion dependency-version: 14.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: lucide-react dependency-version: 1.65.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: next dependency-version: 16.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: zustand dependency-version: 5.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com>
c51fd89 to
175db19
Compare
sykosyber
left a comment
sykosyber
left a comment
There was a problem hiding this comment.
I read AGENTS.md and CLAUDE.md. CONTRIBUTING.md is absent. I read the full diff against origin/main (package.json and package-lock.json), the manifest, the changed lockfile entries, dependabot.yml, ci.yml, githits-policy.yml, and the call sites for these four packages. Registry integrity hashes for next 16.4.3, @next/env, all eight @next/swc builds, framer-motion 14.9.0, motion-dom 14.9.0, motion-utils 14.7.0, lucide-react 1.65.0, and zustand 5.0.16 match the lockfile, and none of those tarballs declare install scripts. Lucide aliases used here still export. The zustand 5.0.15 to 5.0.16 diff is devtools and a getServerSnapshot callback change. OSV and npm audit --omit=dev do not list next. The vulnerable ranges come from the vercel/next.js GitHub advisories. I did not read every unchanged lockfile stanza, the full Next or Motion source diffs, or the private GitHits runtime. I ran npm ci --ignore-scripts, the repo postinstall patch, and npm test (92 files, 840 tests, all passed). I did not run typecheck, lint, build, build:next, test:e2e, or scan:bundle. GitHub CI on 175db19 already passed those gates.
| "lucide-react": "^1.58.0", | ||
| "next": "16.4.2", | ||
| "lucide-react": "^1.65.0", | ||
| "next": "16.4.3", |
There was a problem hiding this comment.
[P2] next 16.4.3 is inside published vulnerable ranges
The production pin is next 16.4.3, which is inside the ranges of GHSA-7qx7-33qx-rqx2, GHSA-pc58-hwjq-p385, GHSA-f3mh-rxg3-f5g2, GHSA-rhh4-g77r-r9qj, GHSA-vvgp-ww4w-46vf, GHSA-vc7v-qv4w-wrv8, and GHSA-mfr8-8qww-v76h (each covers versions through 16.4.4). This repo has no use cache, no edge runtime, and no next/image, and its route handlers rebuild JSON, but next start still ships the image optimizer those advisories mark vulnerable.
How to see it: next@16.4.3 matches >= 16.0.0, <= 16.4.4 on GHSA-7qx7-33qx-rqx2. next@16.4.5 does not, and the 16.4.5 release lists these fixes.
Smallest fix: set next to 16.4.5 and refresh the lockfile entries for next, @next/env, and the @next/swc-* packages.
Bumps the production group with 4 updates in the / directory: framer-motion, lucide-react, next and zustand.
Updates
framer-motionfrom 14.3.0 to 14.9.0Changelog
Sourced from framer-motion's changelog.
... (truncated)
Commits
7415b6cv14.9.0dd22962Updating changelog5166565Merge pull request #4033 from motiondivision/claude/project-thread-v31xwu3450444Raise Reorder and remix size budgets for roving focus8e33ea6Reorder: keep a rendered tab stop, and focus only rendered itemsf15ac99Test Reorder's tab stop with items unrendered or outside valuesdf0308aMerge pull request #4026 from motiondivision/claude/project-thread-bj5tihf98ee43Reorder: arrow keys move focus between items, with one tab stope2cd96dTest arrow keys moving focus between Reorder items4e8dc81Raise vanilla-all budget by the hook's 85 BUpdates
lucide-reactfrom 1.58.0 to 1.65.0Release notes
Sourced from lucide-react's releases.
... (truncated)
Commits
1668a0cchore(deps): bump rollup to 4.65.1 and keep typescript on v6 (#5110)e8f86fcfix(lucide-react): ignore stale DynamicIcon loads after the name changes (#5060)6657faachore(deps-dev): bump vite from 8.3.2 to 8.3.3 (#5052)1802f33feat(lucide-react): add package exports for per-icon imports without changing...20aef31chore(packages): Update sponsors (#5034)fa238cfchore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)Updates
nextfrom 16.4.2 to 16.4.3Release notes
Sourced from next's releases.
Commits
29bbeabv16.4.35117201[lts-active] Avoid loading standalone React in server bootstrap (#100610)37d603b[lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #1...cf9d27d[lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (...3f6a632[lts-active] test: Pin react-virtualized (#100545)f715bba[lts-active][cd] Gate release bot credentials behind GitHub environments (#10...c864c78[lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)f3ff943[lts-active] Don't load the app-page runtime in proxy.ts (#100423)f697cf5[lts-active] Fix extensionless Google font URLs in both bundlers (#100277)Updates
zustandfrom 5.0.15 to 5.0.16Release notes
Sourced from zustand's releases.
Commits
382d29cv5.0.16b488323chore(deps): update dev dependencies (#3593)da2706cfix(persist): preserve external devtools action arguments (#3592)a1fea2efix(devtools): preserve shared connections during store cleanup (#3580)d867e6ffix(devtools): apply serialize.reviver when parsing devtools messages (#3568)dac22e1perf(react): don't memoize getServerSnapshot in useStore (#3563)d7a5583Clarify maintainer-guided contribution workflow (#3587)b57db4fdocs(create): document that state cannot be read during initialization (#3569)f094eebci: build the docs with pmndrs/docs@v4 (#3570)ea612a5docs: fix broken migrating-to-v5 link in README (#3567)