Skip to content

chore(deps): bump postcss and next in /frontend - #151

Closed
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/npm_and_yarn/frontend/multi-09870eb53c
Closed

chore(deps): bump postcss and next in /frontend#151
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/npm_and_yarn/frontend/multi-09870eb53c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown

Bumps postcss to 8.5.23 and updates ancestor dependency next. These dependencies need to be updated together.

Updates postcss from 8.4.31 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates next from 14.2.35 to 16.3.1

Release notes

Sourced from next's releases.

v16.3.1

What's Changed

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.1-canary.24

Misc Changes

  • style(examples): remove redundant justify-content declaration: #97222
  • docs: rename Vercel Edge Config to Global Config in redirecting guide: #97456
  • fix: improve form accessibility by associating labels with inputs: #96335
  • [docs] fix: grammar typos in linking and navigating guide: #95544
  • fix(examples): correct error message typo: #97223
  • docs: fix typos in example links: #97149
  • Model prerenders as render candidates: #97431
  • Turbopack: support character class ranges in regex: #97502
  • docs: warn when catching permanentRedirect: #97496
  • Remove the development debug channel persistence: #97510
  • Stop the browser from restoring stale pages in development: #97505
  • Turbopack: gracefully handle outputFileTracingIncludes matching a symlink: #97507
  • docs: mention Valibot as validation library option in forms guides: #97468

Credits

Huge thanks to @​niketchandivade, @​molebox, @​seanbeirnes, @​0ldh, @​gnoff, @​mischnic, @​DavidIlie, @​unstubbable, and @​fabian-hiller for helping!

v16.3.1-canary.23

Misc Changes

... (truncated)

Commits
  • 3d32eb8 v16.3.1
  • 2b4b1ec [backport] Revert i18n localization change for dynamic Pages API routes (#949...
  • 228df5f [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fa...
  • 16eab3a [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops (#...
  • 75548c9 [backport] Fix Nav Inspector request loop on repeat captures (#97326)
  • f6bd714 [backport] [test] Compile the middleware redirect routes up front in dev (#97...
  • 43c1c60 [16.3] [ci] Use OIDC tokens to read private preview builds (#97258)
  • 9dbb357 [backport] Encode the cache item name built by unstable_cache (#97313)
  • 323a17c [backport] Discard only cache entries that predate a tag revalidation, and re...
  • 6d67f46 [backport] Keep the dev validation worker alive across HMR updates (#97315)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump postcss and next in /frontend
cc46509 
Bumps [postcss](https://github.com/postcss/postcss) to 8.5.23 and updates ancestor dependency [next](https://github.com/vercel/next.js). These dependencies need to be updated together.


Updates `postcss` from 8.4.31 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.31...8.5.23)

Updates `next` from 14.2.35 to 16.3.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v14.2.35...v16.3.1)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: indirect
- dependency-name: next
  dependency-version: 16.3.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 19, 2026
@dependabot dependabot Bot mentioned this pull request Aug 19, 2026
Closed
NetworkTheoryAppliedResearchInstitute
NetworkTheoryAppliedResearchInstitute approved these changes Sep 14, 2026
View reviewed changes

@NetworkTheoryAppliedResearchInstitute NetworkTheoryAppliedResearchInstitute left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving: dependency-only bump, all required checks green (hardcoded-urls, CodeQL, DCO). Reviewed as part of the 2026-09-14 org-wide advisory sweep.

@NetworkTheoryAppliedResearchInstitute

NetworkTheoryAppliedResearchInstitute commented Sep 14, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

This was referenced Sep 16, 2026
Open
Closed
@NetworkTheoryAppliedResearchInstitute

NetworkTheoryAppliedResearchInstitute commented Sep 16, 2026

Copy link
Copy Markdown
Collaborator

Superseded. The next half of this PR already landed on main via #158 (15.5.24), and #162 covers the postcss half, taking it to 8.5.28 (alerts 81, 128, 131, 150).

Worth recording why this one kept failing: next pins postcss to an exact 8.4.31, so Dependabot could never raise it on its own — that is why four postcss alerts stacked up since May. #162 fixes it with an overrides entry, which Dependabot does not propose.

@dependabot @github

dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/frontend/multi-09870eb53c branch September 16, 2026 17:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@NetworkTheoryAppliedResearchInstitute NetworkTheoryAppliedResearchInstitute NetworkTheoryAppliedResearchInstitute approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@NetworkTheoryAppliedResearchInstitute