fix(deps): bump next, @sentry/nextjs and vite to resolve Dependabot alerts

Merged
AV
10d ago
+151-59

Summary

Bumps next 16.3.8 → 16.4.1 (root override + api, docs, marketing, web), @sentry/nextjs 10.68.0 → 10.75.2 (api, docs, marketing, web) and vite 7.3.5 → 7.3.7 (desktop, ui). Lockfile refreshed.

Also bumps @lingui/swc-plugin 6.6.0 → 6.7.1 in the same four Next apps. Next 16.4.1 cannot run 6.6.0 (built for swc_core 66.0.3): the Deploy jobs on #8821 failed with "Failed to execute @lingui/swc-plugin … Failed to deserialize program received from host". 6.7.x is built for swc_core 77.1.1 (see the plugin README's compatibility table).

This replaces #8821 (same bumps, without the swc-plugin fix; also conflicts with main) and the per-directory Dependabot PRs #8810, #8808, #8738 and #8694.

Alerts resolved:

  • #397, #408, #412, #417 (high): Next.js: Denial of Service in App Router using Server Actions
  • #398, #409, #413, #418 (critical): Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
  • #400, #411, #415, #420 (critical): Next.js: Unauthenticated Remote Code Execution in use cache functions returning typed arrays
  • #399, #410, #414, #419 (critical): Sentry-Javascript: Middleware Bypass when using Tunnel route
  • #376, #386 (high): launch-editor: fs.existsSync() existence check can be bypassed on Windows (via vite)
  • #388, #394 (medium): Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine
  • #377, #387 (medium): launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (via vite)
  • #360, #373 (medium): launch-editor: escapeCmdArgs() omits % escaping on Windows (via vite)
  • #389, #395 (low): Vite: Cross origin script execution through Vite custom middleware

Not in this PR:

  • zod: covered by #8844 (green, but conflicts with main).
  • storybook, @modelcontextprotocol/sdk, hono: covered by #8903 (green, but conflicts with main).
  • @azure/msal-node (#444): covered by Dependabot PR #8836.
  • better-auth (#445–#472): fixed only in 1.7.x, a breaking release that needs DB migrations. Left for a human.

Note: @sentry/nextjs 10.75 logs a deprecation warning at build time: import withSentryConfig from @sentry/nextjs/config. It still works and goes away in v11.

Test plan

  • bun install (Bun 1.4.3)
  • bun run lint:fix (clean, no fixes)
  • bunx sherif (no issues)
  • bun run typecheck in apps/api, docs, marketing, web, desktop and packages/ui
  • bun run build in apps/docs (Next 16.4.1 + Turbopack + swc-plugin 6.7.1): compiled, 244/244 static pages, no SWC plugin errors, no macro imports left in the compiled chunks
  • CI Deploy Preview jobs (API, Web, Marketing, Docs)

Summary by cubic

Bumps next 16.3.8→16.4.1, @sentry/nextjs 10.68.0→10.75.2, and vite 7.3.5→7.3.7 to resolve the outstanding Dependabot alerts, and @lingui/swc-plugin 6.6.0→6.7.1 because Next 16.4.1 can't run the old plugin — Turbopack builds fail with a deserialization error.

Alerts resolved

  • Critical Next.js unauthenticated RCEs in Image Optimization API (SVG) and use cache typed arrays, plus a DoS in App Router Server Actions.
  • Critical Sentry middleware bypass via the Tunnel route.
  • launch-editor command injection and Vite file-serving / cross-origin issues.

Note: @sentry/nextjs 10.75 logs a build-time deprecation warning to import withSentryConfig from @sentry/nextjs/config; it still works and the warning is removed in v11.

Summary by CodeRabbit

  • Chores
    • Updated the frameworks and development tools used across the API, web, documentation, marketing, desktop, and shared UI applications.
    • Updates include application frameworks, monitoring integrations, localization and build tooling, and development servers.
    • No direct changes to user-facing functionality or behavior are noted in this update. These updates are internal and do not add or remove product capabilities.