chore(deps): bump the vercel group across 1 directory with 4 updates by dependabot[bot] · Pull Request #9135 · nodejs/nodejs.org

dependabot · 2026-09-01T17:31:58Z

Bumps the vercel group with 4 updates in the / directory: turbo, next-intl, @next/eslint-plugin-next and next.

Updates turbo from 2.10.6 to 2.10.12

Release notes

Turborepo v2.10.12

What's Changed

Changelog

chore: Release Turborepo 2.10.11 by @github-actions[bot] in vercel/turborepo#13765

feat: Refresh documentation social cards by @christopherkindl in vercel/turborepo#13764

fix: Preserve showcase logo sizes by @christopherkindl in vercel/turborepo#13766

fix: Refine mobile homepage interactions by @christopherkindl in vercel/turborepo#13767

fix: Align homepage KPIs to the right by @christopherkindl in vercel/turborepo#13769

fix: Prevent homepage KPI overflow by @christopherkindl in vercel/turborepo#13770

chore: Update Geistdocs to 1.20.4 by @molebox in vercel/turborepo#13771

perf: Skip unused Package Configuration stats by @vercel-gh-bot-4[bot] in vercel/turborepo#13746

chore: Update with-solid example by @vercel-gh-bot-5[bot] in vercel/turborepo#13752

chore: Update with-tailwind example by @vercel-gh-bot-5[bot] in vercel/turborepo#13762

perf: Stream dry-run JSON output by @vercel-gh-bot-4[bot] in vercel/turborepo#13760

chore: Update with-ultracite example by @vercel-gh-bot-5[bot] in vercel/turborepo#13772

perf: Merge same-prefix tree-wildcard globs into one directory walk by @vercel-gh-bot-5[bot] in vercel/turborepo#13763

chore: Update with-svelte example by @floriansalihovic in vercel/turborepo#13118

chore: Add unified agent control plane by @anthonyshew in vercel/turborepo#13757

fix: Remove incremental task caching by @anthonyshew in vercel/turborepo#13773

chore: Rename agents app to factory by @anthonyshew in vercel/turborepo#13774

chore: Update oxlint and oxfmt by @charpeni in vercel/turborepo#13777

feat: Add security.txt endpoint by @charpeni in vercel/turborepo#13778

feat: Redesign factory control plane by @anthonyshew in vercel/turborepo#13775

perf: Replace regex captures with hand-written parsers in berry lockfile identifiers by @vercel-gh-bot-2[bot] in vercel/turborepo#13776

chore: Upgrade the factory eve agent to 0.39.3 by @anthonyshew in vercel/turborepo#13783

chore: Update with-rsbuild-module-federation example by @vercel-gh-bot-4[bot] in vercel/turborepo#13786

perf: Index Berry lockfile resolution overrides by dependency name by @vercel-gh-bot-5[bot] in vercel/turborepo#13787

chore: Update remote cache action to v1.1.0 by @anthonyshew in vercel/turborepo#13789

docs: Fix reference links and validation by @charpeni in vercel/turborepo#13784

feat: Add SSH command affordance for factory sandboxes by @anthonyshew in vercel/turborepo#13779

fix: Show invalid affected task glob by @anthonyshew in vercel/turborepo#13793

perf: Skip unused repository indexing for package listings by @vercel-gh-bot-4[bot] in vercel/turborepo#13792

feat: Rebuild the factory image on every merge to main by @anthonyshew in vercel/turborepo#13781

chore: Add full-page terminal SSH sessions to Factory sandbox inventory by @anthonyshew in vercel/turborepo#13780

chore: Update with-shell-commands example by @vercel-gh-bot-4[bot] in vercel/turborepo#13791

chore: Allow SSH terminal for completed-run sandboxes in Factory by @anthonyshew in vercel/turborepo#13782

fix: Decouple graceful shutdown tests from the shell commands example by @anthonyshew in vercel/turborepo#13799

feat: Start ad-hoc factory work from the operator page by @anthonyshew in vercel/turborepo#13798

chore: Update with-solid example by @vercel-gh-bot-4[bot] in vercel/turborepo#13797

fix: Rebuild factory images without custom workflows by @anthonyshew in vercel/turborepo#13801

feat: Add factory navigation by @anthonyshew in vercel/turborepo#13802

refactor: Migrate Factory styles to Tailwind by @anthonyshew in vercel/turborepo#13803

feat: Add durable Factory workspaces by @anthonyshew in vercel/turborepo#13804

feat: Stream Factory sandbox as terminal by @anthonyshew in vercel/turborepo#13807

fix: Restore Factory workspace creation by @anthonyshew in vercel/turborepo#13812

fix: Update Factory session network policy by @anthonyshew in vercel/turborepo#13814

fix: Improve Factory terminal line spacing by @anthonyshew in vercel/turborepo#13815

fix: Install Factory publishing skill by @anthonyshew in vercel/turborepo#13817

... (truncated)

Commits

53752d4 publish 2.10.12 to registry
9d2b03b fix: Run pnpm directly on Windows (#13843)
c97782b feat: Require high confidence for issue fixes (#13842)
f153cda chore: Alert Slack for low-confidence issues (#13841)
e1674e4 chore: Add automatic issue handling (#13840)
7107f26 fix: Escape ampersands in RSS feed enclosure URLs (#13839)
a76330b chore: Handle feedback on Factory pull requests (#13836)
3787c06 chore: Use geistdocs 1.23.1 (#13834)
bbe5406 chore: Skip redundant Factory PR approval (#13837)
72805d7 fix: Move model selector to workspace creation (#13835)
Additional commits viewable in compare view

Updates next-intl from 4.13.4 to 4.14.0

Release notes

Sourced from next-intl's releases.

v4.14.0

4.14.0 (2026-08-27)

Features

useExtracted improvements (#2346) (4ccf3b8) – by @amannn

⚠️ If you're using useExtracted and the po format, this requires an update to your messages.

Please see amannn/next-intl#2393 for details and an upgrade prompt.

v4.13.7

4.13.7 (2026-08-17)

Bug Fixes

Pin @swc/core to a range that is compatible with the extractor plugin (#2389) (a37d8aa) – by @amannn

v4.13.6

4.13.6 (2026-08-10)

Bug Fixes

Deprecate requestLocale param of getRequestConfig (#2380) (ae770af) – by @amannn

See the blog post on next/root-params.

v4.13.5

4.13.5 (2026-08-04)

Bug Fixes

Deprecate setRequestLocale and add blog post on next/root-params (#1632) – by @amannn

Changelog

Sourced from next-intl's changelog.

4.14.0 (2026-08-27)

Features

useExtracted improvements (#2346) (4ccf3b8) – by @amannn

4.13.7 (2026-08-17)

Bug Fixes

Pin @swc/core to a range that is compatible with the extractor plugin (#2389) (a37d8aa) – by @amannn

4.13.6 (2026-08-10)

Bug Fixes

Deprecate requestLocale param of getRequestConfig (#2380) (ae770af) – by @amannn

4.13.5 (2026-08-04)

Bug Fixes

Deprecate setRequestLocale and add blog post on next/root-params (#1632) (1446d0d) – by @amannn

Commits

38845ed v4.14.0
4ccf3b8 feat: useExtracted improvements (#2346)
2e3ddfc docs: Update eloqnt links after the rename to eloqnt/cli (#2391)
4e5d46b v4.13.7
a37d8aa fix: Pin @swc/core to a range that is compatible with the extractor plugin ...
41e027b v4.13.6
ae770af fix: Deprecate requestLocale param of getRequestConfig (#2380)
729233f docs: Use "CLI" as label for eloqnt links (#2378)
caab5da docs: Mention planned Route Handler and Server Action support for root params...
4a98b12 docs: Hide precompilation blog post from sidebar navigation (#2374)
Additional commits viewable in compare view

Updates @next/eslint-plugin-next from 16.2.11 to 16.3.3

Release notes

Sourced from @next/eslint-plugin-next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)

[backport] Fix catch-all index page being served for every other slug (#97416)

[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)

[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)

[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)

[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

v16.3.1

What's Changed

[16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @lukesandberg in vercel/next.js#96653

[16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @lukesandberg in vercel/next.js#96655

[16.x] [turbopack] Collapse nested promises in the analyzer by @sampoder in vercel/next.js#96675

[16.x] fix(next/image): preserve image response after optimization by @styfle in vercel/next.js#96733

[16.3.x] Default deploy e2e tests to the repo next version by @eps1lon in vercel/next.js#96900

[backport] Bump @swc/helpers by @mischnic in vercel/next.js#96885

[backport] [turbopack] Raise registration calls in hoisted modules to the top by @lukesandberg in vercel/next.js#97308

[backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @lukesandberg in vercel/next.js#97302

[backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @lukesandberg in vercel/next.js#97317

[backport] Restore the live headers() view of the incoming request by @unstubbable in vercel/next.js#97311

[backport] Allow literal exports in 'use cache' files by @unstubbable in vercel/next.js#97312

[backport] Keep the dev validation worker alive across HMR updates by @unstubbable in vercel/next.js#97315

[backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @unstubbable in vercel/next.js#97314

[backport] Encode the cache item name built by unstable_cache by @unstubbable in vercel/next.js#97313

[16.3] [ci] Use OIDC tokens to read private preview builds by @eps1lon in vercel/next.js#97258

[backport] [test] Compile the middleware redirect routes up front in dev by @lukesandberg in vercel/next.js#97328

[backport] Fix Nav Inspector request loop on repeat captures by @acdlite in vercel/next.js#97326

[backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @acdlite in vercel/next.js#97325

[backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @lukesandberg in vercel/next.js#97304

[backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

... (truncated)

Commits

a9a1cb7 v16.3.3
d0ac882 v16.3.2
3d32eb8 v16.3.1
d73f562 v16.3.0
4fd843f v16.3.0-canary.107
9480f7f v16.3.0-canary.106
a8dcd25 v16.3.0-canary.105
38f0cde v16.3.0-canary.104
f3edea1 v16.3.0-canary.103
0d5ff0d v16.3.0-canary.102
Additional commits viewable in compare view

Updates next from 16.3.0-preview.9 to 16.3.3

Release notes

Sourced from next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)

[backport] Fix catch-all index page being served for every other slug (#97416)

[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)

[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)

[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)

[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

v16.3.1

What's Changed

[16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @lukesandberg in vercel/next.js#96653

[16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @lukesandberg in vercel/next.js#96655

[16.x] [turbopack] Collapse nested promises in the analyzer by @sampoder in vercel/next.js#96675

[16.x] fix(next/image): preserve image response after optimization by @styfle in vercel/next.js#96733

[16.3.x] Default deploy e2e tests to the repo next version by @eps1lon in vercel/next.js#96900

[backport] Bump @swc/helpers by @mischnic in vercel/next.js#96885

[backport] [turbopack] Raise registration calls in hoisted modules to the top by @lukesandberg in vercel/next.js#97308

[backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @lukesandberg in vercel/next.js#97302

[backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @lukesandberg in vercel/next.js#97317

[backport] Restore the live headers() view of the incoming request by @unstubbable in vercel/next.js#97311

[backport] Allow literal exports in 'use cache' files by @unstubbable in vercel/next.js#97312

[backport] Keep the dev validation worker alive across HMR updates by @unstubbable in vercel/next.js#97315

[backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @unstubbable in vercel/next.js#97314

[backport] Encode the cache item name built by unstable_cache by @unstubbable in vercel/next.js#97313

[16.3] [ci] Use OIDC tokens to read private preview builds by @eps1lon in vercel/next.js#97258

[backport] [test] Compile the middleware redirect routes up front in dev by @lukesandberg in vercel/next.js#97328

[backport] Fix Nav Inspector request loop on repeat captures by @acdlite in vercel/next.js#97326

[backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @acdlite in vercel/next.js#97325

[backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @lukesandberg in vercel/next.js#97304

[backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

... (truncated)

Commits

a9a1cb7 v16.3.3
968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
3a15b4a [16.3.x] [next/image]: disable avif image optimization
7378b51 Backport/docs fixes 16.3 (#97649)
528c1cd [16.3.x] Stop generating error codes (#97780)
d0ac882 v16.3.2
81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
Additional commits viewable in compare view

vercel · 2026-09-01T17:32:01Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nodejs-org	Ready	Preview	Sep 3, 2026 7:57pm UTC

codecov · 2026-09-01T17:34:01Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.02%. Comparing base (b2c051b) to head (517c9c5).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9135      +/-   ##
==========================================
- Coverage   86.10%   86.02%   -0.09%     
==========================================
  Files          86       86              
  Lines        6046     6046              
  Branches      357      358       +1     
==========================================
- Hits         5206     5201       -5     
- Misses        836      841       +5     
  Partials        4        4

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

github-actions · 2026-09-01T17:44:15Z

📦 Build Size Comparison

Summary

Metric	Value
Old Total First Load JS	7.06 MB
New Total First Load JS	7.10 MB
Delta	32.36 KB (+0.45%)

Changes

🔄 Modified Routes (5)

Route	Old First Load JS	New First Load JS	Delta
`/[locale]`	1.66 MB	1.67 MB	📈 6.51 KB (+0.38%)
`/[locale]/[...path]`	1.66 MB	1.67 MB	📈 6.51 KB (+0.38%)
`/[locale]/blog/[...path]`	1.66 MB	1.67 MB	📈 6.51 KB (+0.38%)
`/[locale]/download/archive/[version]`	1.66 MB	1.67 MB	📈 6.51 KB (+0.38%)
`/_not-found`	438.00 KB	444.33 KB	📈 6.33 KB (+1.45%)

Bumps the vercel group with 4 updates in the / directory: [turbo](https://github.com/vercel/turborepo), [next-intl](https://github.com/amannn/next-intl), [@next/eslint-plugin-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-plugin-next) and [next](https://github.com/vercel/next.js). Updates `turbo` from 2.10.6 to 2.10.12 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.10.6...v2.10.12) Updates `next-intl` from 4.13.4 to 4.14.0 - [Release notes](https://github.com/amannn/next-intl/releases) - [Changelog](https://github.com/amannn/next-intl/blob/main/CHANGELOG.md) - [Commits](amannn/next-intl@v4.13.4...v4.14.0) Updates `@next/eslint-plugin-next` from 16.2.11 to 16.3.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.3.3/packages/eslint-plugin-next) Updates `next` from 16.3.0-preview.9 to 16.3.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.0-preview.9...v16.3.3) --- updated-dependencies: - dependency-name: "@next/eslint-plugin-next" dependency-version: 16.3.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: vercel - dependency-name: next dependency-version: 16.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: vercel - dependency-name: next-intl dependency-version: 4.13.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: vercel - dependency-name: turbo dependency-version: 2.10.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: vercel ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-08T19:22:22Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added auto-merge Ready to automatically merge after being open for 48 hours dependencies Pull requests that update a dependency file github_actions:pull-request Trigger Pull Request Checks javascript Pull requests that update javascript code labels Sep 1, 2026

dependabot Bot requested review from a team as code owners September 1, 2026 17:31

dependabot Bot added github_actions:pull-request Trigger Pull Request Checks dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code auto-merge Ready to automatically merge after being open for 48 hours labels Sep 1, 2026

github-actions Bot removed the github_actions:pull-request Trigger Pull Request Checks label Sep 1, 2026

vercel Bot deployed to Preview September 1, 2026 17:33 View deployment

avivkeller approved these changes Sep 2, 2026

View reviewed changes

avivkeller added this pull request to the merge queue Sep 3, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Sep 3, 2026

dependabot Bot changed the title ~~chore(deps): bump the vercel group with 4 updates~~ chore(deps): bump the vercel group across 1 directory with 4 updates Sep 3, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/vercel-c2917a4247 branch from b7e4af4 to 517c9c5 Compare September 3, 2026 19:55

vercel Bot deployed to Preview September 3, 2026 19:57 View deployment

avivkeller added this pull request to the merge queue Sep 8, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Sep 8, 2026

dependabot Bot closed this Sep 8, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/vercel-c2917a4247 branch September 8, 2026 19:22

Navigation Menu

Uh oh!

chore(deps): bump the vercel group across 1 directory with 4 updates - #9135

chore(deps): bump the vercel group across 1 directory with 4 updates#9135
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vercel-c2917a4247

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 1, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Sep 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 1, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Turborepo v2.10.12

What's Changed

Changelog

v4.14.0

4.14.0 (2026-08-27)

Features

v4.13.7

4.13.7 (2026-08-17)

Bug Fixes

v4.13.6

4.13.6 (2026-08-10)

Bug Fixes

v4.13.5

4.13.5 (2026-08-04)

Bug Fixes

4.14.0 (2026-08-27)

Features

4.13.7 (2026-08-17)

Bug Fixes

4.13.6 (2026-08-10)

Bug Fixes

4.13.5 (2026-08-04)

Bug Fixes

v16.3.3

v16.3.2

Core Changes

Credits

v16.3.1

What's Changed

v16.3.3

v16.3.2

Core Changes

Credits

v16.3.1

What's Changed

Uh oh!

vercel Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Build Size Comparison

Summary

Changes

Uh oh!

dependabot Bot commented on behalf of github Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited

Loading

vercel Bot commented Sep 1, 2026 •

edited

Loading

codecov Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading