Bump the development group across 1 directory with 7 updates by dependabot[bot] · Pull Request #24 · ActivistChecklist/riskmapper

dependabot · 2026-10-19T22:48:40Z

Bumps the development group with 7 updates in the / directory:

Package	From	To
@testing-library/user-event	`14.6.7`	`14.6.8`
@types/node	`24.19.1`	`24.19.2`
eslint	`10.11.0`	`10.13.0`
eslint-config-next	`16.4.0`	`16.4.2`
jsdom	`30.1.2`	`30.1.3`
next	`16.4.0`	`16.4.2`
vitest	`5.0.3`	`5.0.5`

Updates @testing-library/user-event from 14.6.7 to 14.6.8

Release notes

Sourced from @testing-library/user-event's releases.

v14.6.8

14.6.8 (2026-10-13)

Bug Fixes

treat programmatic null input values as empty string (#1329) (1951eb7)

Commits

1951eb7 fix: treat programmatic null input values as empty string (#1329)
See full diff in compare view

Updates @types/node from 24.19.1 to 24.19.2

Commits

See full diff in compare view

Updates eslint from 10.11.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)

a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)

66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

4783a68 docs: Update README (GitHub Actions Bot)

43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])

95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)

317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)

b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)

47b7063 chore: update dependency @eslint/json to ^2.1.1 (#21398) (renovate[bot])

e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

v10.12.0

Features

4618052 feat: handle astral letters in new-cap (#21357) (sary)

4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)

bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)

efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)

93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)

02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)

b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)

69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)

686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

67eb586 docs: Update README (GitHub Actions Bot)

5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)

8816c1d docs: Update README (GitHub Actions Bot)

3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

152067f chore: update ecosystem plugins (#21362) (ESLint Bot)

b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])

bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)

322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)

d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])

29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])

39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])

... (truncated)

Commits

4637f98 10.13.0
96df05c Build: changelog update for 10.13.0
4783a68 docs: Update README
b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
317fcb3 chore: update ecosystem plugins (#21409)
48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
43f0ac9 docs: clarify parameter description in getText (#21287)
a39d9fb feat: add globalThis to no-obj-calls (#21382)
b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
Additional commits viewable in compare view

Updates eslint-config-next from 16.4.0 to 16.4.2

Release notes

Sourced from eslint-config-next's releases.

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

2864b17 v16.4.2
7217011 v16.4.1
See full diff in compare view

Updates jsdom from 30.1.2 to 30.1.3

Release notes

Sourced from jsdom's releases.

v30.1.3

Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@scttcper, @asamuzaK)

Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@scttcper)

Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.

Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.

Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@rnavarro)

Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.

Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.

Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.

Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.

Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.

Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.

Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.

Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.

Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@asamuzaK)

Commits

058c0f5 30.1.3
fcd1fd1 Cascade parsed longhands independently
a3ee786 Cascade computed style properties on demand
f42dc15 Resolve colors before caching or using currentcolor
074b1fb Compute background-position lengths against the final font size
d19598c Apply style rules nested in multiple @media rules
45d626c Rule out attribute selector subjects before matching
3ff0a5b Upgrade Undici and remove abort workarounds
8813bb1 Ignore CSS declarations with unparseable math functions
63712d8 Fix XHR credentials across redirects
Additional commits viewable in compare view

Updates next from 16.4.0 to 16.4.2

Release notes

Sourced from next's releases.

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

2864b17 v16.4.2
a42cb59 Revert "[lts-active] Keep requests through middleware in a single OpenTelemet...
f0760ec [lts-active] Backport additional documentation fixes since v16.4.0 (#100262)
845007a [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions (#100211)
6a79d8a [lts-active] Backport docs fixes since v16.4.0 (#100246)
a75a782 [lts-active] Keep requests through middleware in a single OpenTelemetry trace...
8ad8524 [lts-active] Turbopack: Ignore realpath errors during module resolution, matc...
29d030e [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependenc...
3e50b82 [lts-active] fix(next-code-frame): snap visible window to char boundaries (#1...
9458fb9 [lts-active] Turbopack: backport Pages Router dev module graph chaining (#988...
Additional commits viewable in compare view

Updates vitest from 5.0.3 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

Keep vite default fs.deny with api token file - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)

Handle quoted file names in --changed - by @sheremet-va in vitest-dev/vitest#11583 (14921)

Add data to the import.meta.hot stub - by @sheremet-va in vitest-dev/vitest#11590 (3a828)

Set skip in skipIf, ignore undefined options - by @sheremet-va in vitest-dev/vitest#11591 (d523a)

Skip builtin loading in async leak detector - by @sheremet-va in vitest-dev/vitest#11598 (fe86a)

Keep the import frame in native loader errors - by @sheremet-va in vitest-dev/vitest#11599 (9697b)

Run hook cleanups when a later hook fails - by @sheremet-va in vitest-dev/vitest#11605 (6c5a4)

Release mocks of finished test files - by @sheremet-va in vitest-dev/vitest#11607 (e9c3d)

Abort all running tests on cancel - by @sheremet-va in vitest-dev/vitest#11606 (6621a)

browser:

Ignore synthetic pagehide events - by @sheremet-va in vitest-dev/vitest#11582 (ca081)

Run plugin buildStart on server creation - by @sheremet-va in vitest-dev/vitest#11593 (ea611)

Drop late connections of closed sessions - by @sheremet-va in vitest-dev/vitest#11600 (f161e)

Wait 30s for the browser to close - by @sheremet-va in vitest-dev/vitest#11601 (6498b)

Run global setup once with instances - by @sheremet-va in vitest-dev/vitest#11596 (8dd67)

reporter:

End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash - by @AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

v5.0.4

   🚀 Features

experimental:

Tag cache directories with CACHEDIR.TAG - by @lifeiscontent in vitest-dev/vitest#11461 (a8ea3)

Support test.ui.theme option - by @sheremet-va in vitest-dev/vitest#11499 (1da66)

Highlight selector multiple matches in trace view - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)

Print how many tests were affected and a total when running --changed - by @sheremet-va in vitest-dev/vitest#11424 (a2336)

Add an option to cache dependencies instead of statically parsing them - by @sheremet-va in vitest-dev/vitest#11515 (c0601)

Add fit and zoom controls to trace viewer - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

Fail the run on git and location filter errors - by @sheremet-va in vitest-dev/vitest#11430 (30d03)

Enable fsModuleCache by default - by @sheremet-va in vitest-dev/vitest#11435 (ad208)

Track project files and mocks with --changed - by @sheremet-va in vitest-dev/vitest#11432 (b0f2b)

Refactor caching, fix : in project and change the shape of results cache - by @sheremet-va in vitest-dev/vitest#11453 (9673c)

Keep full $ string values when taskTitleValueFormatTruncate is 0 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)

Resolve node builtins in client environments - by @sheremet-va in vitest-dev/vitest#11417 (56b31)

Fix module graph builtin externals after #11421 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)

Wrap module mocks during in-source testing - by @sheremet-va in vitest-dev/vitest#11505 (36d19)

Handle line endings in snapshot - by @sheremet-va in vitest-dev/vitest#11522 (4c468)

Respect root in projects - by @sheremet-va in vitest-dev/vitest#11521 (26642)

Resolve mocks in directories with spaces - by @sheremet-va in vitest-dev/vitest#11539 (caaef)

api:

Publish the api token atomically - by @umairnawaz333 in vitest-dev/vitest#11323 (6f990)

browser:

... (truncated)

Commits

7a825db chore: release v5.0.5 (#11609)
6621a72 fix: abort all running tests on cancel (#11606)
e9c3d72 fix: release mocks of finished test files (#11607)
8dd67c2 fix(browser): run global setup once with instances (#11596)
6c5a447 fix: run hook cleanups when a later hook fails (#11605)
9697b38 fix: keep the import frame in native loader errors (#11599)
6498b66 fix(browser): wait 30s for the browser to close (#11601)
f161e6d fix(browser): drop late connections of closed sessions (#11600)
fe86a64 fix: skip builtin loading in async leak detector (#11598)
6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the development group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.7` | `14.6.8` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.19.1` | `24.19.2` | | [eslint](https://github.com/eslint/eslint) | `10.11.0` | `10.13.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.0` | `16.4.2` | | [jsdom](https://github.com/jsdom/jsdom) | `30.1.2` | `30.1.3` | | [next](https://github.com/vercel/next.js) | `16.4.0` | `16.4.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.3` | `5.0.5` | Updates `@testing-library/user-event` from 14.6.7 to 14.6.8 - [Release notes](https://github.com/testing-library/user-event/releases) - [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md) - [Commits](testing-library/user-event@v14.6.7...v14.6.8) Updates `@types/node` from 24.19.1 to 24.19.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.11.0 to 10.13.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.11.0...v10.13.0) Updates `eslint-config-next` from 16.4.0 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.2/packages/eslint-config-next) Updates `jsdom` from 30.1.2 to 30.1.3 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v30.1.2...v30.1.3) Updates `next` from 16.4.0 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.0...v16.4.2) Updates `vitest` from 5.0.3 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) --- updated-dependencies: - dependency-name: "@testing-library/user-event" dependency-version: 14.6.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development - dependency-name: "@types/node" dependency-version: 24.19.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development - dependency-name: eslint dependency-version: 10.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development - dependency-name: eslint-config-next dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development - dependency-name: jsdom dependency-version: 30.1.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development - dependency-name: next dependency-version: 16.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-19T22:48:49Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 7cb32407-27f4-4af6-9819-5224c5ba4e05

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026

Navigation Menu

Repository navigation

Bump the development group across 1 directory with 7 updates - #24

Bump the development group across 1 directory with 7 updates#24
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-3a04d3a5b4

dependabot Bot commented on behalf of github Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 19, 2026

v14.6.8

14.6.8 (2026-10-13)

Bug Fixes

v10.13.0

Features

Bug Fixes

Documentation

Chores

v10.12.0

Features

Bug Fixes

Documentation

Chores

v16.4.2

What's Changed

v16.4.1

v30.1.3

v16.4.2

What's Changed

v16.4.1

v5.0.5

🐞 Bug Fixes

View changes on GitHub

v5.0.4

🚀 Features

🐞 Bug Fixes

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants