Update dependencies to fix security vulnerabilities

[heisbrot]

Issue ticket number and link

No ticket. Consolidates the open Dependabot security PRs #826, #832, #833 and #835.

Documentation

Select exactly one:

• I added/updated documentation for this change
• Documentation is not needed for this change (explain why)

Dependency updates only; no user-facing behavior changes.

Changes

Package	From	To	Advisory severity
next	16.3.4	16.3.8	critical
undici (transitive)	7.29.0	7.30.0	high
brace-expansion (transitive)	5.0.9	5.0.12	high
source-map-js (transitive)	1.2.1	1.2.2	high
ip-address	10.5.0	10.7.3	moderate
eslint-config-next	16.3.0	16.3.8	kept in step with next

next goes to 16.3.8 rather than Dependabot's 16.3.6, because npm audit flags everything up to 16.3.5. next stays pinned to an exact version.

npm audit drops from 14 vulnerabilities (1 critical, 10 high, 3 moderate) to 9 (7 high, 2 moderate).

Not included

• Bump postcss-selector-parser and tailwindcss #834 (tailwindcss 3 → 4): a major upgrade that needs a styling migration, so it should be its own PR. It fixes postcss-selector-parser (GHSA-rj75-hqrm-r3gf), which Tailwind 3 pins to v6.
• braces (GHSA-vfj7-8cjw-p6xm): no patched release exists. It reaches us through Tailwind 3 (chokidar, micromatch, fast-glob) and through @next/eslint-plugin-next, so even Tailwind 4 would not clear it.

All remaining findings are in build and lint tooling that only processes our own source, not in the shipped bundle.

Verification

• tsc --noEmit passes.
• vitest run: 55 files, 769 tests pass.
• npm run build succeeds.
• npm run lint reports existing simple-import-sort and react-hooks errors. Those plugins are unchanged by this PR, so the errors are not introduced here.

Summary by CodeRabbit

• Maintenance
  • Updated underlying application tooling and network-address handling components to newer releases. These are maintenance updates; this release does not include changes to user-facing features or functionality. The updates are limited to the app’s underlying software and do not introduce new controls, screens, or workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ac555d29-8127-4a02-a3aa-41fcf057942e

📥 Commits

Reviewing files that changed from the base of the PR and between 2ca354b and 189e382.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

Three dependency versions changed in package.json: ip-address, next, and eslint-config-next.

Changes

Dependency version updates

Layer / File(s)	Summary
Update dependency versions package.json	Updated ip-address from ^10.2.0 to ^10.7.3, next from 16.3.4 to 16.3.8, and eslint-config-next from ^16.3.0 to ^16.3.8.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 189e3

No actionable merge risk is evident in the dependency updates; the lockfile matches the manifest, including its existing Node requirement.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the dependency updates and their security-fix purpose.
Description check	✅ Passed	The description identifies the ticket status, explains why documentation is not needed, and provides detailed changes and verification results. The E2E section is optional.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the package list,
Three versions hop to something new.
The numbers change; the file stays neat,
The rabbit nibbles clover, too.
Then bounds away beneath the moon.}

_{Comment @coderabbitai help to get the list of available commands.}

[heisbrot]

Superseded by the Tailwind 4 upgrade PR, which includes these dependency updates.

[heisbrot]

Superseded by #838.