chore(deps)(deps): Bump the "weekly-dependency-refresh" group with 2 updates across multiple ecosystems - #205
Open
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the weekly-dependency-refresh group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 4.2.2 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v4.2.2...v7) chore(deps)(deps): bump the weekly-dependency-refresh group with 8 updates Bumps the weekly-dependency-refresh group with 8 updates: | Package | From | To | | --- | --- | --- | | [@sentry/astro](https://github.com/getsentry/sentry-javascript) | `10.62.0` | `10.65.0` | | [i18next](https://github.com/i18next/i18next) | `26.3.3` | `26.3.6` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.22.0` | `1.24.0` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.4` | `9.39.5` | | [eslint](https://github.com/eslint/eslint) | `9.39.4` | `9.39.5` | | [prettier](https://github.com/prettier/prettier) | `3.9.1` | `3.9.5` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.62.0` | `8.63.0` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.10` | Updates `@sentry/astro` from 10.62.0 to 10.65.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.62.0...10.65.0) Updates `i18next` from 26.3.3 to 26.3.6 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](i18next/i18next@v26.3.3...v26.3.6) Updates `lucide-react` from 1.22.0 to 1.24.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.24.0/packages/lucide-react) Updates `@eslint/js` from 9.39.4 to 9.39.5 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v9.39.5/packages/js) Updates `eslint` from 9.39.4 to 9.39.5 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.4...v9.39.5) Updates `prettier` from 3.9.1 to 3.9.5 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.1...3.9.5) Updates `typescript-eslint` from 8.62.0 to 8.63.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint) Updates `vitest` from 4.1.9 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: weekly-dependency-refresh - dependency-name: "@sentry/astro" dependency-version: 10.65.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: weekly-dependency-refresh - dependency-name: i18next dependency-version: 26.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: weekly-dependency-refresh - dependency-name: lucide-react dependency-version: 1.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: weekly-dependency-refresh - dependency-name: "@eslint/js" dependency-version: 9.39.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: weekly-dependency-refresh - dependency-name: eslint dependency-version: 9.39.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: weekly-dependency-refresh - dependency-name: prettier dependency-version: 3.9.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: weekly-dependency-refresh - dependency-name: typescript-eslint dependency-version: 8.63.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: weekly-dependency-refresh - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: weekly-dependency-refresh ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security review: no high-confidence vulnerabilities found
Reviewed diff d140487c…8bc122a1 (dependency bumps only — no application source changes).
Scope reviewed
| Area | Result |
|---|---|
| Injection (SQL/command/template/path) | No new sinks or parsers introduced |
| Authn/authz bypass | No auth/permission code touched |
| Secrets / token leakage | No logging or credential-handling changes |
| Deserialization / SSRF / CSRF | No new network or parse surfaces |
| XSS | No markup/rendering changes in this PR |
| Supply chain | Version bumps only; see notes below |
Findings
No confirmed vulnerabilities introduced by this PR.
Supply-chain notes (informational, not blockers)
-
actions/checkout@v7.0.0— Security-positive. v7 blocks fork PR checkout in privilegedpull_request_target/workflow_runcontexts by default. This repo’s workflows usepull_request(e.g.commitlint.yml) and do not usepull_request_target, so no breakage expected. Pinning@v7→@v7.0.0also improves reproducibility. -
i18next26.3.3 → 26.3.6 — Recent prototype-pollution CVEs (CVE-2026-48713/48714) affecti18next-http-middlewareandi18next-fs-backend, which are not in this dependency tree. Corei18nexthere is initialized at build time with static JSON resources (src/i18n/i18next.ts) andkeySeparator: false; no server-sidemissingKeyHandleror untrusted key persistence. -
@sentry/astro10.62.0 → 10.65.0 — Transitive OpenTelemetry packages move to 2.9.0 / 0.220.0, which addresses known moderate advisories in older OTel core versions. No Sentry configuration or PII-scrubbing changes in this diff. -
Dev tooling bumps (
eslint,typescript-eslint,vitest,prettier) —js-yamlunder@eslint/eslintrcmoves 4.1.1 → 4.3.0 (likely fixes GHSA-h67p-54hq-rp68 DoS). Dev-only; not shipped to production.
Pre-existing context (outside this PR)
interpolation: { escapeValue: false }insrc/i18n/i18next.tsis intentional (Astro escapes); unchanged here.npm auditstill reports moderate issues in unrelated transitive deps (e.g. nested Spotlight/OTel copies,esbuildviaastro). These predate this bump and are not introduced by it.
Verdict
✅ Approve from a security perspective. Routine dependency refresh with net-neutral-to-positive supply-chain posture.
Automated security review by Cursor Automation
Sent by Cursor Automation: Find vulnerabilities
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps the weekly-dependency-refresh group with 1 update: actions/checkout.
Updates
actions/checkoutfrom 4.2.2 to 7.0.0Release notes
Sourced from actions/checkout's releases.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)df4cb1cUpdate changelog for v6.0.3 (#2446)Bumps the weekly-dependency-refresh group with 8 updates:
10.62.010.65.026.3.326.3.61.22.01.24.09.39.49.39.59.39.49.39.53.9.13.9.58.62.08.63.04.1.94.1.10Updates
@sentry/astrofrom 10.62.0 to 10.65.0Release notes
Sourced from @sentry/astro's releases.
... (truncated)
Changelog
Sourced from @sentry/astro's changelog.
... (truncated)
Commits
c66a815release: 10.65.0018c570Merge pull request #22179 from getsentry/prepare-release/10.65.05a1e331meta(changelog): Update changelog for 10.65.0e934b44feat(server-utils): Add orchestrion support for Vercel AI v4 (#22139)04bbb79fix(replay): Skip client reports for replay failures after stop (#22177)cb77f42test: Remove fixed container_name from node integration test docker-compose f...a84cc9dtest(node-integration-tests): Surface early scenario exit instead of hanging ...88e3b32feat(core): add isObjectLike guard and consolidate non-null-object checks (#2...7565c90ref(nitro, nuxt): inline== nullchecks for nullish detection (#22154)256b9b9feat(ember): Set url.template, url.path and url.full on router spans (#22095)Updates
i18nextfrom 26.3.3 to 26.3.6Release notes
Sourced from i18next's releases.
Changelog
Sourced from i18next's changelog.
Commits
e1c60d426.3.604da43efix: allow typescript 7 in optional peerDependencies range (react-i18next#1927)8eed4acbuild573ae7326.3.5cc54b05docs(changelog): 26.3.5 — multiline $t() options, replace mutation, escaped-l...3180d67fix: skip interpolation of placeholders inside escaped values (#2442)d16f5a2fix: stop mutating the passed replace object when returning details (#2441)bed56c1fix: parse $t() nesting options block that spans multiple lines (#2440)c19e458docs(changelog): link GHSA advisory for deepExtend fix7bb87d0docs(changelog): reference security advisory for deepExtend fixUpdates
lucide-reactfrom 1.22.0 to 1.24.0Release notes
Sourced from lucide-react's releases.
Commits
Updates
@eslint/jsfrom 9.39.4 to 9.39.5Release notes
Sourced from @eslint/js's releases.
Commits
202117bchore: package.json update for@eslint/jsreleaseUpdates
eslintfrom 9.39.4 to 9.39.5Release notes
Sourced from eslint's releases.
Commits
4a24e8c9.39.51fba874Build: changelog update for 9.39.5458205fchore: update@eslint/eslintrcand@eslint/jsfor v9.39.5 (#21077)202117bchore: package.json update for@eslint/jsreleased9eb6edtest: disable warning forvm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER(#21...253be16fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065)7b431a7chore: overridere2dependency for@metascraper/helpers(#21068)74930eddocs: switch build to Node.js 24 (#20894)daf7791chore: pin fflate@0.8.2 (#20895)eaec8bbdocs: Add ESLint v9.x EOL notice (#20828)Updates
prettierfrom 3.9.1 to 3.9.5Release notes
Sourced from prettier's releases.
Changelog
Sourced from prettier's changelog.
... (truncated)
Commits
b6c7d18Release 3.9.5cd54cccAvoid corrupting empty Markdown link with title (#19487)2bb67cePreserving comments'placementproperty (#19567)91bcac8Add more tests for comment-only object type (#19587)cbee737Remove space in empty object type (#19583)6394c73Align empty module declaration with TS (#19568)a4e6f7aPrevent the addition of space intype()with+(#19516)3d063b5Ignore dangling comments when checking type parameter comments (#19572)908503eHandle dangling comments inSwitchStatement(#19581)943a475Angular: Support expression for exhaustive typechecking (#19571)Updates
typescript-eslintfrom 8.62.0 to 8.63.0Release notes
Sourced from typescript-eslint's releases.