Skip to content

chore: bump the web-development group in /web with 2 updates - #450

Merged
G1NG4R merged 2 commits into
mainfrom
dependabot/npm_and_yarn/web/web-development-b35f27f585
Oct 17, 2026
Merged

chore: bump the web-development group in /web with 2 updates#450
G1NG4R merged 2 commits into
mainfrom
dependabot/npm_and_yarn/web/web-development-b35f27f585

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the web-development group in /web with 2 updates: @next/mdx and eslint-config-next.

Updates @next/mdx from 16.3.6 to 16.3.8

Release notes

Sourced from @​next/mdx's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Medium:

Low:

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

Commits

Updates eslint-config-next from 16.3.6 to 16.3.8

Release notes

Sourced from eslint-config-next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Medium:

Low:

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore: bump the web-development group in /web with 2 updates
a6af453 
Bumps the web-development group in /web with 2 updates: [@next/mdx](https://github.com/vercel/next.js/tree/HEAD/packages/next-mdx) and [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next).


Updates `@next/mdx` from 16.3.6 to 16.3.8
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.8/packages/next-mdx)

Updates `eslint-config-next` from 16.3.6 to 16.3.8
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.8/packages/eslint-config-next)

---
updated-dependencies:
- dependency-name: "@next/mdx"
  dependency-version: 16.3.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-development
- dependency-name: eslint-config-next
  dependency-version: 16.3.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from G1NG4R as a code owner October 14, 2026 22:29
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026
@dependabot dependabot Bot mentioned this pull request Oct 14, 2026
Closed
@G1NG4R
G1NG4R merged commit 592da9d into main Oct 17, 2026
13 checks passed
@G1NG4R
G1NG4R deleted the dependabot/npm_and_yarn/web/web-development-b35f27f585 branch October 17, 2026 00:41
@G1NG4R G1NG4R mentioned this pull request Oct 17, 2026
Merged
G1NG4R added a commit that referenced this pull request Oct 17, 2026
@G1NG4R @claude
docs(backlog): one read of health is not an identity (#456)
a60f44c 
Backlog only — no code. The night's measurements, including two
corrections to
figures I published a few hours ago.

## What it carries

- **`e2e` on `main` runs 12:40 to 34:57, not to 17:38.** `944a1e4` took
**34:57 and went green**, double the upper bound the entry below claims
from
six samples. Long does not mean red, which also retires the suspicion
that a
long `e2e` is one retrying a failure. The rule "start the witness as
soon as
`e2e` is `in_progress`" survives — it is the only start that still has
lead
time at 35 minutes — but the 1800 s rail does not, so both later runs
used
  `WITNESS_MAX_SEC=2700`.
- **A single read of `/api/health` can report a process that is already
gone.**
Nine seconds after the `944a1e4` deploy it reported `startedAt
00:39:53.604Z`,
*before* `ops.lastDeploy.at` — the first negative offset of the series,
and a
  finding-shaped one. Ten samples later the serving process is
`00:40:16.706Z`, i.e. **+12.7 s**, squarely in the known band. During a
rollout `/api/health` is balanced across two processes, so one read is a
sample, not an identity. Same family as the stale-`p95` note in #452:
there
  the number is old, here the process is.
- **Two swaps, both clean:** 339 × 200 and 1087 × 200 per path, zero
non-200.
The first witness of the night ran its full 1800 s with no deploy in it;
a
chained successor took over with a **4 s gap** and logged the identity
before
  starting, so the handover is proven rather than assumed.
- **#453 now has four data points** and the pattern holds: coverage
after the
  serving process comes up is 30 s minus the twin gap — 26.6 s → 3.4 s,
15.6 s → 14.4 s, 16.7 s → 13.3 s, 16.3 s → 13.7 s. The normal gap is
around
  16 s; the 26.6 s outlier is the one that shuts the window.
- **#450's red `e2e` was the #429 count test**, and after `gh pr
update-branch`
the fresh run was green on its own — the one permitted rerun went
unused.
Its premise was checked in `.github/dependabot.yml`: `next`, `@next/mdx`
and
`eslint-config-next` are held for semver-**minor** only, so a 16.3.6 →
16.3.8
  patch is what #445 intended to keep arriving.

The idle-drop tally gains three rows and stands at 6 drops in roughly 35
440
requests, eleven swap runs in a row without one. #304 gains **no** new
evidence
from tonight: four witnessed swaps, all clean.

`make check` green.

Co-authored-by: Claude Code <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@G1NG4R G1NG4R Awaiting requested review from G1NG4R G1NG4R is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@G1NG4R