[dependabot]

Bumps the dependencies group with 9 updates in the / directory:

Package	From	To
@next/eslint-plugin-next	16.4.0	16.4.1
tsup	8.5.1	9.0.0
typescript-eslint	8.71.1	8.71.2
@sentry/node	11.6.0	11.7.0
warframe-worldstate-data	3.16.10	3.17.1
next	16.4.0	16.4.1
postcss	8.5.28	8.5.30
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1

Updates @next/eslint-plugin-next from 16.4.0 to 16.4.1

Release notes

Sourced from @​next/eslint-plugin-next's releases.

v16.4.1

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

Commits

• 7217011 v16.4.1
• See full diff in compare view

Updates tsup from 8.5.1 to 9.0.0

Release notes

Sourced from tsup's releases.

v9.0.0

   🚨 Breaking Changes

• Migrate to obug, drop node < 22.18  -  by @​sxzz (59bfd)

   🚀 Features

• Upgrade esbuild & chokidar  -  by @​sxzz (a2c08)
• type: Expose the Plugin type  -  by @​Sunny-117 in egoist/tsup#1264 (3079e)

   🐞 Bug Fixes

• Remove baseUrl in tsconfig  -  by @​pxseu in egoist/tsup#1390 (98052)

    View changes on GitHub

Commits

• 198479b chore: release v9.0.0
• 3079ea3 feat(type): expose the Plugin type (#1264)
• 13f68eb ci: enable npm stage publishing
• 380e94e test: fix failing tests
• b601adf chore: merge test lockfile into the root as a pnpm workspace
• 00139a4 chore: cleanup lockfile
• 6cec950 chore: build tsup with its own source via tsx
• 6705d39 chore: upgrade deps, replace source-map with source-map-js
• a2c0810 feat: upgrade esbuild & chokidar
• 980525e fix: remove baseUrl in tsconfig (#1390)
• Additional commits viewable in compare view

Updates typescript-eslint from 8.71.1 to 8.71.2

Release notes

Sourced from typescript-eslint's releases.

v8.71.2

8.71.2 (2026-10-12)

🩹 Fixes

• eslint-plugin: [no-unused-vars] avoid false-positives when not using our parser (#12989)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type templates (#12974)
• eslint-plugin: [no-unused-vars] ignore type-only refs for after-used (#12977)
• eslint-plugin: [no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements (#12995)
• eslint-plugin: [prefer-optional-chain] safe fix when the chain ends with a strict null comparison (#12805)
• type-utils: match linked packages and packages with missing version in TypeOrValueSpecifier (#12948)

❤️ Thank You

• Abraham Guo
• Brad Zacher @​bradzacher
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Vinccool96
• Younsang Na @​nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.71.2 (2026-10-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 7488d68 chore(release): publish 8.71.2
• See full diff in compare view

Updates @sentry/node from 11.6.0 to 11.7.0

Release notes

Sourced from @​sentry/node's releases.

11.7.0

Important Changes

• feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#25014)

  The new cronTriggersIntegration sends check-ins for Cron Triggers. Each check-in includes the schedule from controller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.

  Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare Vite plugin, add the integration to src/instrument.server.ts:

  // src/monitorSlugs.ts
  export const monitorSlugs: Record<string, string> = {
    '30 9 * * MON-FRI': 'daily-report',
  };
  // src/instrument.server.ts
  import * as Sentry from '@​sentry/cloudflare';
  import { monitorSlugs } from './monitorSlugs';
  export default Sentry.defineCloudflareOptions(env => ({
  dsn: env.SENTRY_DSN,
  integrations: [Sentry.cronTriggersIntegration({ monitorSlug: cron => monitorSlugs[cron] })],
  }));
  // src/index.ts
  import { monitorSlugs } from './monitorSlugs';
  export default {
  async scheduled(controller, env) {
  switch (monitorSlugs[controller.cron]) {
  case 'daily-report':
  // Your daily report job
  break;
  }
  },
  };

  The monitorSlug function can also return monitor settings, for example { monitorSlug: 'daily-report', maxRuntime: 30 }, or undefined to send no check-ins for a trigger. Without monitorSlug, the SDK derives the slug from the cron expression. If you deploy with wrangler directly, pass the same integration to Sentry.withSentry.

• feat(node): Add neonIntegration for @​neondatabase/serverless (#25164, #25176)

  The new neonIntegration creates db spans for queries of the @neondatabase/serverless driver: for the WebSocket Client and Pool, and for the HTTP neon() function. This includes the neon-http and neon-serverless adapters of Drizzle. The integration is on by default when tracing is enabled.

• feat(node): Stop sending the process session once request sessions are tracked (#24915)

  Node servers sent release health data two times: as request session aggregates, and as the process session of processSessionIntegration. An error in a request also marked the process session as errored, so the SDK counted the error two times. Now the SDK drops the process session when it tracks the first request session. Scripts, CLIs and workers that do not serve requests keep the process session, and so do servers with httpServerIntegration({ sessions: false }). This changes the release health numbers of Node servers, because they no longer send the errored or crashed update of the process session.

• feat(server-utils): Record decide calls as gen_ai.decide spans (#25270, #25272, #25274, #25281)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

11.7.0

Important Changes

• feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#25014)

  The new cronTriggersIntegration sends check-ins for Cron Triggers. Each check-in includes the schedule from controller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.

  Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare Vite plugin, add the integration to src/instrument.server.ts:

  // src/monitorSlugs.ts
  export const monitorSlugs: Record<string, string> = {
    '30 9 * * MON-FRI': 'daily-report',
  };
  // src/instrument.server.ts
  import * as Sentry from '@​sentry/cloudflare';
  import { monitorSlugs } from './monitorSlugs';
  export default Sentry.defineCloudflareOptions(env => ({
  dsn: env.SENTRY_DSN,
  integrations: [Sentry.cronTriggersIntegration({ monitorSlug: cron => monitorSlugs[cron] })],
  }));
  // src/index.ts
  import { monitorSlugs } from './monitorSlugs';
  export default {
  async scheduled(controller, env) {
  switch (monitorSlugs[controller.cron]) {
  case 'daily-report':
  // Your daily report job
  break;
  }
  },
  };

  The monitorSlug function can also return monitor settings, for example { monitorSlug: 'daily-report', maxRuntime: 30 }, or undefined to send no check-ins for a trigger. Without monitorSlug, the SDK derives the slug from the cron expression. If you deploy with wrangler directly, pass the same integration to Sentry.withSentry.

• feat(node): Add neonIntegration for @​neondatabase/serverless (#25164, #25176)

  The new neonIntegration creates db spans for queries of the @neondatabase/serverless driver: for the WebSocket Client and Pool, and for the HTTP neon() function. This includes the neon-http and neon-serverless adapters of Drizzle. The integration is on by default when tracing is enabled.

• feat(node): Stop sending the process session once request sessions are tracked (#24915)

  Node servers sent release health data two times: as request session aggregates, and as the process session of processSessionIntegration. An error in a request also marked the process session as errored, so the SDK counted the error two times. Now the SDK drops the process session when it tracks the first request session. Scripts, CLIs and workers that do not serve requests keep the process session, and so do servers with httpServerIntegration({ sessions: false }). This changes the release health numbers of Node servers, because they no longer send the errored or crashed update of the process session.

• feat(server-utils): Record decide calls as gen_ai.decide spans (#25270, #25272, #25274, #25281)

... (truncated)

Commits

• 47dff7d release: 11.7.0
• 72588e6 Merge pull request #25296 from getsentry/prepare-release/11.7.0
• 323307a meta(changelog): Update changelog for 11.7.0
• 87bdc84 fix(bundler-plugins): Escape JSON in generated injection code (#25265)
• b80300b fix(server-utils): Stop treating previous_response_id as the OpenAI conversat...
• 236c0ce fix(browser): Apply urlQueryParams to breadcrumb and element timing URLs (#...
• ee04661 fix(browser): Apply urlQueryParams to event URLs, static span names and LCP...
• 1e86178 fix(nuxt): Keep @sentry/server-runtime-injection external on Nitro v3 (#24901)
• 8a6b9ca test(node-integration): Stop exporting NODE_VERSION and RUNTIME from the ...
• 9f7cbad feat(server-utils): Map Mastra classifier evaluations to gen_ai.decide spans ...
• Additional commits viewable in compare view

Updates warframe-worldstate-data from 3.16.10 to 3.17.1

Release notes

Sourced from warframe-worldstate-data's releases.

v3.17.1

3.17.1 (2026-10-12)

Bug Fixes

• l10n: new translations (#956) (b912e07)

v3.17.0

3.17.0 (2026-10-12)

Features

• add missing Archimedea deviation translations (#955) (0c5abba)

Commits

• b912e07 fix(l10n): new translations (#956)
• 0c5abba feat: add missing Archimedea deviation translations (#955)
• 6c3e63f ci: bump the dependencies group with 4 updates (#954)
• 4a242a1 ci: bump github/codeql-action from 4.38.1 to 4.38.2 (#953)
• bf8c345 ci: bump serialize-javascript from 7.1.1 to 7.1.2 (#952)
• a8528f4 ci: bump brace-expansion from 5.0.9 to 5.0.12 (#951)
• 2aa780c ci: bump the dependencies group with 2 updates (#950)
• See full diff in compare view

Updates next from 16.4.0 to 16.4.1

Release notes

Sourced from next's releases.

v16.4.1

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

Commits

• 7217011 v16.4.1
• 1798e42 [cd] Allow branch to get published
• 9571ec8 [lts-active][next/image] Bump sharp (#234)
• a4cea6a [lts-active][react] Improve Server Component transport protocol (#193)
• 8df0d97 [lts-active][test] Backport various deploy test fixes (#100114)
• ac9afcc [lts-active] Fix google tag manager e2e test, assume GTM 200s instead of 404i...
• See full diff in compare view

Updates postcss from 8.5.28 to 8.5.30

Release notes

Sourced from postcss's releases.

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Commits

• f1aca7e Release 8.5.30 version
• 9d83445 Update dependencies
• 6c9bc73 Fix invalid source map mapping on escaping before new line (#2169)
• 1fd8f88 Add missed changes in changelog
• a7a1f34 Release 8.5.29 version
• b55a36d Update dependencies
• 7647a81 Escape </style> in output of non-Root nodes (#2163)
• 7ac9026 Do not split list.comma() and list.space() on separators inside comments (#2162)
• ebffa97 Add postcss-smooth-corners plugin
• 57d6401 Speed up source map cleaning
• Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
@sentry/node	[>= 8.a, < 9]
@sentry/node	[>= 9.a, < 10]
@sentry/node	[>= 10.a, < 11]

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 21fc6f84-23f7-460e-bde4-48ed3ec6eedf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[wfcd-bot-boi]

🎉 This PR is included in version 3.2.0 🎉

The release is available on:

• GitHub release
• v3.2.0
• v3.2.0
• v3.2.0
• v3.2.0

Your semantic-release bot 📦🚀