build(deps): bump the production-dependencies group with 5 updates by dependabot[bot] · Pull Request #145 · fintrack-team/FinTrack

dependabot · 2026-10-04T15:05:24Z

Bumps the production-dependencies group with 5 updates:

Package	From	To
next	`16.3.7`	`16.3.8`
@rolldown/binding-linux-x64-gnu	`1.2.11`	`1.2.12`
@rolldown/binding-linux-x64-musl	`1.2.11`	`1.2.12`
@rollup/rollup-linux-x64-gnu	`4.63.5`	`4.63.6`
mongoose	`9.10.2`	`9.10.3`

Updates next from 16.3.7 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Server-Side Request Forgery in Image Optimization

Medium:

Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Pending use cache fill can leak Draft Mode content into regular responses and persisted pages

Cache leak across root param values in nested 'use cache' functions

Low:

Information disclosure in the Next.js development server's Model Context Protocol endpoint

Commits

b0fad0d v16.3.8
719e4c6 [lts-active] Scope response cache keys to their source route (#218)
e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
See full diff in compare view

Updates @rolldown/binding-linux-x64-gnu from 1.2.11 to 1.2.12

Release notes

Sourced from @rolldown/binding-linux-x64-gnu's releases.

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @hyfdev

experimental inlineCommonChunks support (#10899) by @hyfdev

dev: ship imported bindings for HMR partial accept (#10856) by @h-a-n-a

🐛 Bug Fixes

chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @hyfdev

code-splitting: gate member-read init paths on the reading statement (#11039) by @hyfdev

code-splitting: retain initialization paths through re-exported namespaces (#11037) by @hyfdev

dev: reject non-ESM output formats in dev mode (#11038) by @h-a-n-a

dev: align import.meta.hot.accept deps with Vite (#10997) by @h-a-n-a

dev: clear the resolver cache when a file is created or deleted (#10986) by @waltuov

error: name the resolved specifier in unresolved import diagnostics (#11014) by @linyiru

make entries-aware chunk merging deterministic (#11002) by @hyfdev

watch: avoid restarting macOS watcher for unchanged paths (#10992) by @sep2

🚜 Refactor

dev: ship the dev runtime entry as one file (#10998) by @h-a-n-a

binding: remove __internalForcePanic (#10989) by @IWANABETHATGUY

📚 Documentation

fix cloudflare preview builds (#10996) by @sapphi-red

fix build config loader warning (#10994) by @sapphi-red

deps: use Vite 8 (#10993) by @sapphi-red

⚡ Performance

dev: only ship rows with dynamic edges in registerGraph (#11019) by @h-a-n-a

🧪 Testing

code-splitting: cover more re-exported namespace shapes (#11042) by @hyfdev

webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @shulaoda

dev: pin the runtime entry file layout that Vite serves (#10983) by @h-a-n-a

⚙️ Miscellaneous Tasks

pin VOID_API_URL for the docs deploy (#11041) by @shulaoda

opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @shulaoda

deps: upgrade oxc to 0.152.0 (#11018) by @camc314

deps: update rust crates (#11012) by @renovate[bot]

deps: update npm packages (#11011) by @renovate[bot]

deps: update crate-ci/typos action to v1.50.3 (#11023) by @renovate[bot]

... (truncated)

Changelog

Sourced from @rolldown/binding-linux-x64-gnu's changelog.

[1.2.12] - 2026-09-30

🚀 Features

inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @hyfdev

experimental inlineCommonChunks support (#10899) by @hyfdev

dev: ship imported bindings for HMR partial accept (#10856) by @h-a-n-a

🐛 Bug Fixes

chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @hyfdev

code-splitting: gate member-read init paths on the reading statement (#11039) by @hyfdev

code-splitting: retain initialization paths through re-exported namespaces (#11037) by @hyfdev

dev: reject non-ESM output formats in dev mode (#11038) by @h-a-n-a

dev: align import.meta.hot.accept deps with Vite (#10997) by @h-a-n-a

dev: clear the resolver cache when a file is created or deleted (#10986) by @waltuov

error: name the resolved specifier in unresolved import diagnostics (#11014) by @linyiru

make entries-aware chunk merging deterministic (#11002) by @hyfdev

watch: avoid restarting macOS watcher for unchanged paths (#10992) by @sep2

🚜 Refactor

dev: ship the dev runtime entry as one file (#10998) by @h-a-n-a

binding: remove __internalForcePanic (#10989) by @IWANABETHATGUY

📚 Documentation

fix cloudflare preview builds (#10996) by @sapphi-red

fix build config loader warning (#10994) by @sapphi-red

deps: use Vite 8 (#10993) by @sapphi-red

⚡ Performance

dev: only ship rows with dynamic edges in registerGraph (#11019) by @h-a-n-a

🧪 Testing

code-splitting: cover more re-exported namespace shapes (#11042) by @hyfdev

webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @shulaoda

dev: pin the runtime entry file layout that Vite serves (#10983) by @h-a-n-a

⚙️ Miscellaneous Tasks

pin VOID_API_URL for the docs deploy (#11041) by @shulaoda

opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @shulaoda

deps: upgrade oxc to 0.152.0 (#11018) by @camc314

deps: update rust crates (#11012) by @renovate[bot]

deps: update npm packages (#11011) by @renovate[bot]

deps: update crate-ci/typos action to v1.50.3 (#11023) by @renovate[bot]

deps: update test262 submodule for tests (#11022) by @rolldown-guard[bot]

... (truncated)

Commits

45e407b release: v1.2.12 (#11046)
6450f2e feat: inline common chunks containing import() and deduplicate shared code in...
bad4b6e feat: experimental inlineCommonChunks support (#10899)
02d65a6 chore(deps): upgrade oxc to 0.152.0 (#11018)
8546e7a fix(dev): clear the resolver cache when a file is created or deleted (#10986)
3f76b5c perf(dev): only ship rows with dynamic edges in registerGraph (#11019)
57dfa85 refactor(dev): ship the dev runtime entry as one file (#10998)
30c7703 fix: make entries-aware chunk merging deterministic (#11002)
b3b93d9 feat(dev): ship imported bindings for HMR partial accept (#10856)
bb87268 test(dev): pin the runtime entry file layout that Vite serves (#10983)
Additional commits viewable in compare view

Updates @rolldown/binding-linux-x64-musl from 1.2.11 to 1.2.12

Release notes

Sourced from @rolldown/binding-linux-x64-musl's releases.

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @hyfdev

experimental inlineCommonChunks support (#10899) by @hyfdev

dev: ship imported bindings for HMR partial accept (#10856) by @h-a-n-a

🐛 Bug Fixes

chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @hyfdev

code-splitting: gate member-read init paths on the reading statement (#11039) by @hyfdev

code-splitting: retain initialization paths through re-exported namespaces (#11037) by @hyfdev

dev: reject non-ESM output formats in dev mode (#11038) by @h-a-n-a

dev: align import.meta.hot.accept deps with Vite (#10997) by @h-a-n-a

dev: clear the resolver cache when a file is created or deleted (#10986) by @waltuov

error: name the resolved specifier in unresolved import diagnostics (#11014) by @linyiru

make entries-aware chunk merging deterministic (#11002) by @hyfdev

watch: avoid restarting macOS watcher for unchanged paths (#10992) by @sep2

🚜 Refactor

dev: ship the dev runtime entry as one file (#10998) by @h-a-n-a

binding: remove __internalForcePanic (#10989) by @IWANABETHATGUY

📚 Documentation

fix cloudflare preview builds (#10996) by @sapphi-red

fix build config loader warning (#10994) by @sapphi-red

deps: use Vite 8 (#10993) by @sapphi-red

⚡ Performance

dev: only ship rows with dynamic edges in registerGraph (#11019) by @h-a-n-a

🧪 Testing

code-splitting: cover more re-exported namespace shapes (#11042) by @hyfdev

webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @shulaoda

dev: pin the runtime entry file layout that Vite serves (#10983) by @h-a-n-a

⚙️ Miscellaneous Tasks

pin VOID_API_URL for the docs deploy (#11041) by @shulaoda

opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @shulaoda

deps: upgrade oxc to 0.152.0 (#11018) by @camc314

deps: update rust crates (#11012) by @renovate[bot]

deps: update npm packages (#11011) by @renovate[bot]

deps: update crate-ci/typos action to v1.50.3 (#11023) by @renovate[bot]

... (truncated)

Changelog

Sourced from @rolldown/binding-linux-x64-musl's changelog.

[1.2.12] - 2026-09-30

🚀 Features

inline common chunks containing import() and deduplicate shared code in lazy chunks (#11034) by @hyfdev

experimental inlineCommonChunks support (#10899) by @hyfdev

dev: ship imported bindings for HMR partial accept (#10856) by @h-a-n-a

🐛 Bug Fixes

chunking: re-derive chunk exec orders after the runtime leaves its host chunk (#11005) by @hyfdev

code-splitting: gate member-read init paths on the reading statement (#11039) by @hyfdev

code-splitting: retain initialization paths through re-exported namespaces (#11037) by @hyfdev

dev: reject non-ESM output formats in dev mode (#11038) by @h-a-n-a

dev: align import.meta.hot.accept deps with Vite (#10997) by @h-a-n-a

dev: clear the resolver cache when a file is created or deleted (#10986) by @waltuov

error: name the resolved specifier in unresolved import diagnostics (#11014) by @linyiru

make entries-aware chunk merging deterministic (#11002) by @hyfdev

watch: avoid restarting macOS watcher for unchanged paths (#10992) by @sep2

🚜 Refactor

dev: ship the dev runtime entry as one file (#10998) by @h-a-n-a

binding: remove __internalForcePanic (#10989) by @IWANABETHATGUY

📚 Documentation

fix cloudflare preview builds (#10996) by @sapphi-red

fix build config loader warning (#10994) by @sapphi-red

deps: use Vite 8 (#10993) by @sapphi-red

⚡ Performance

dev: only ship rows with dynamic edges in registerGraph (#11019) by @h-a-n-a

🧪 Testing

code-splitting: cover more re-exported namespace shapes (#11042) by @hyfdev

webcontainer: cover the WebContainer download fallback in plain Node (#10966) by @shulaoda

dev: pin the runtime entry file layout that Vite serves (#10983) by @h-a-n-a

⚙️ Miscellaneous Tasks

pin VOID_API_URL for the docs deploy (#11041) by @shulaoda

opt into the WebContainer smoke test for napi bumps and loader changes (#10967) by @shulaoda

deps: upgrade oxc to 0.152.0 (#11018) by @camc314

deps: update rust crates (#11012) by @renovate[bot]

deps: update npm packages (#11011) by @renovate[bot]

deps: update crate-ci/typos action to v1.50.3 (#11023) by @renovate[bot]

deps: update test262 submodule for tests (#11022) by @rolldown-guard[bot]

... (truncated)

Commits

45e407b release: v1.2.12 (#11046)
6450f2e feat: inline common chunks containing import() and deduplicate shared code in...
bad4b6e feat: experimental inlineCommonChunks support (#10899)
02d65a6 chore(deps): upgrade oxc to 0.152.0 (#11018)
8546e7a fix(dev): clear the resolver cache when a file is created or deleted (#10986)
3f76b5c perf(dev): only ship rows with dynamic edges in registerGraph (#11019)
57dfa85 refactor(dev): ship the dev runtime entry as one file (#10998)
30c7703 fix: make entries-aware chunk merging deterministic (#11002)
b3b93d9 feat(dev): ship imported bindings for HMR partial accept (#10856)
bb87268 test(dev): pin the runtime entry file layout that Vite serves (#10983)
Additional commits viewable in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.63.5 to 4.63.6

Release notes

Sourced from @rollup/rollup-linux-x64-gnu's releases.

v4.63.6

4.63.6

2026-10-01

Bug Fixes

Ensure external reexports are always imported when used in a reified dynamic namespace (#6540)

Pull Requests

#6527: Update minor/patch updates (@renovate[bot])

#6529: Update dependency eslint-plugin-unicorn to v76 (@renovate[bot])

#6530: Lock file maintenance (@renovate[bot])

#6535: Lock file maintenance (@renovate[bot], @lukastaegert)

#6540: Import external re-exports used by shared-chunk namespace objects (@00200200)

Changelog

Sourced from @rollup/rollup-linux-x64-gnu's changelog.

4.63.6

2026-10-01

Bug Fixes

Ensure external reexports are always imported when used in a reified dynamic namespace (#6540)

Pull Requests

#6527: Update minor/patch updates (@renovate[bot])

#6529: Update dependency eslint-plugin-unicorn to v76 (@renovate[bot])

#6530: Lock file maintenance (@renovate[bot])

#6535: Lock file maintenance (@renovate[bot], @lukastaegert)

#6540: Import external re-exports used by shared-chunk namespace objects (@00200200)

Commits

966ac85 4.63.6
cf36f1c Import external re-exports used by shared-chunk namespace objects (#6540)
5376264 Lock file maintenance (#6535)
299f95c Update dependency eslint-plugin-unicorn to v76 (#6529)
dd9c7d4 Lock file maintenance (#6530)
afdd518 Update minor/patch updates (#6527)
See full diff in compare view

Updates mongoose from 9.10.2 to 9.10.3

Release notes

Sourced from mongoose's releases.

9.10.3 / 2026-09-29

fix(model): preserve unsaved documents after ordered bulkSave errors #16533 #16532 IbrahimHafez1

fix(model): don't mutate the caller's update object in bulkWrite updateMany #16526 fadiroot

fix(schema): run setters declared on the union path itself #16528 giaBaoJS

fix(collection): open collection if connection was already opened #16527 #16525 #16524

fix(query+model): replace {MODEL} in cast error messages from update and bulkWrite casting #16529 #16502 #16480

Changelog

Sourced from mongoose's changelog.

9.10.3 / 2026-09-29

fix(model): preserve unsaved documents after ordered bulkSave errors #16533 #16532 IbrahimHafez1

fix(model): don't mutate the caller's update object in bulkWrite updateMany #16526 fadiroot

fix(schema): run setters declared on the union path itself #16528 giaBaoJS

fix(collection): open collection if connection was already opened #16527 #16525 #16524

fix(query+model): replace {MODEL} in cast error messages from update and bulkWrite casting #16529 #16502 #16480

Commits

d5841fe chore: release 9.10.3
6779047 Merge pull request #16537 from Automattic/vkarpov15/gh-16529
5ed18f4 Merge pull request #16533 from IbrahimHafez1/fix/ordered-bulk-save-state
780de3f refactor(model): track bulkSave document indexes
04a985a refactor(model): separate ordered and unordered bulkSave results
519f399 fix(query+model): replace {MODEL} in cast error messages from update and bulk...
4093445 Merge pull request #16528 from giaBaoJS/fix/union-path-setters
dd91af4 Merge pull request #16527 from Automattic/vkarpov15/gh-16524
3d905bb fix(model): preserve unsaved documents after ordered bulkSave errors
5d3bafd fix(schema): run setters declared on the union path itself
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production-dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [next](https://github.com/vercel/next.js) | `16.3.7` | `16.3.8` | | [@rolldown/binding-linux-x64-gnu](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.2.11` | `1.2.12` | | [@rolldown/binding-linux-x64-musl](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.2.11` | `1.2.12` | | [@rollup/rollup-linux-x64-gnu](https://github.com/rollup/rollup) | `4.63.5` | `4.63.6` | | [mongoose](https://github.com/Automattic/mongoose) | `9.10.2` | `9.10.3` | Updates `next` from 16.3.7 to 16.3.8 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.7...v16.3.8) Updates `@rolldown/binding-linux-x64-gnu` from 1.2.11 to 1.2.12 - [Release notes](https://github.com/rolldown/rolldown/releases) - [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rolldown/rolldown/commits/v1.2.12/packages/rolldown) Updates `@rolldown/binding-linux-x64-musl` from 1.2.11 to 1.2.12 - [Release notes](https://github.com/rolldown/rolldown/releases) - [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rolldown/rolldown/commits/v1.2.12/packages/rolldown) Updates `@rollup/rollup-linux-x64-gnu` from 4.63.5 to 4.63.6 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.63.5...v4.63.6) Updates `mongoose` from 9.10.2 to 9.10.3 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@9.10.2...9.10.3) --- updated-dependencies: - dependency-name: next dependency-version: 16.3.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@rolldown/binding-linux-x64-gnu" dependency-version: 1.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@rolldown/binding-linux-x64-musl" dependency-version: 1.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@rollup/rollup-linux-x64-gnu" dependency-version: 4.63.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: mongoose dependency-version: 9.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-10-04T15:05:30Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
fintrack-web	Ready	Preview	Oct 4, 2026 3:06pm UTC

dependabot · 2026-10-11T15:07:43Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 4, 2026

vercel Bot deployed to Preview – fintrack-web October 4, 2026 15:06

View deployment

dependabot Bot closed this Oct 11, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-d26de7d13e branch October 11, 2026 15:07

Navigation Menu

Repository navigation

build(deps): bump the production-dependencies group with 5 updates - #145

build(deps): bump the production-dependencies group with 5 updates#145
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-dependencies-d26de7d13e

dependabot Bot commented on behalf of github Oct 4, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 4, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 11, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.3.8

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

🧪 Testing

⚙️ Miscellaneous Tasks

[1.2.12] - 2026-09-30

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

🧪 Testing

⚙️ Miscellaneous Tasks

v1.2.12

[1.2.12] - 2026-09-30

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

🧪 Testing

⚙️ Miscellaneous Tasks

[1.2.12] - 2026-09-30

🚀 Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

⚡ Performance

🧪 Testing

⚙️ Miscellaneous Tasks

v4.63.6

4.63.6

Bug Fixes

Pull Requests

4.63.6

Bug Fixes

Pull Requests

9.10.3 / 2026-09-29

9.10.3 / 2026-09-29

Uh oh!

vercel Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Oct 11, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 4, 2026 •

edited

Loading

vercel Bot commented Oct 4, 2026 •

edited

Loading