build(deps)(deps): bump postcss and next in /web - #555
Conversation
Bumps [postcss](https://github.com/postcss/postcss) and [next](https://github.com/vercel/next.js). These dependencies needed to be updated together. Updates `postcss` from 8.5.19 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.19...8.5.25) Updates `next` from 16.2.11 to 16.3.0 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.11...v16.3.0) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.25 dependency-type: direct:development - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
| "node_modules/next/node_modules/postcss": { | ||
| "version": "8.5.19", | ||
| "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.19.tgz", | ||
| "integrity": "sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ==", | ||
| "funding": [ | ||
| { | ||
| "type": "opencollective", | ||
| "url": "https://opencollective.com/postcss/" | ||
| }, | ||
| { | ||
| "type": "tidelift", | ||
| "url": "https://tidelift.com/funding/github/npm/postcss" | ||
| }, | ||
| { | ||
| "type": "github", | ||
| "url": "https://github.com/sponsors/ai" | ||
| } | ||
| ], | ||
| "license": "MIT", | ||
| "dependencies": { | ||
| "nanoid": "^3.3.12", | ||
| "picocolors": "^1.1.1", | ||
| "source-map-js": "^1.2.1" | ||
| }, | ||
| "engines": { | ||
| "node": "^10 || ^12 || >=14" | ||
| } | ||
| }, |
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Aug 5, 2026 9:48p.m. | Review ↗ |
| Python | |
Aug 5, 2026 9:48p.m. | Review ↗ |
| Rust | |
Aug 5, 2026 9:48p.m. | Review ↗ |
| Shell | |
Aug 5, 2026 9:48p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
There was a problem hiding this comment.
Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).
Graphify reviewed this change.
Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).
Graphify review — findings
This pull request updates dependencies in the web package. Specifically, it bumps the next dependency from ^16.2.9 to ^16.3.0 and the postcss dev dependency from 8.5.19 to 8.5.25 in package.json, with corresponding changes reflected in the package-lock.json file. The surface area is limited to dependency version management for the web frontend.
No blocking issues surfaced.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 84 functions depend on the 84 functions this change touches.
Health — grade A; no new coupling hotspots.
Verification — 84 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 84 function(s) in the blast radius were not formally verified this run
Bumps postcss and next. These dependencies needed to be updated together.
Updates
postcssfrom 8.5.19 to 8.5.25Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
08c989cRelease 8.5.25 version24f6814Fix 8.5.17 visitor regressionf2fa53fAdd supply chain security requirement to PostCSS plugin guide10edf0bfix: return empty array for empty string in list.split (#2121)0ebe8adRelease 8.5.24 version73218c6Update dependencies9a114f6Preserve the BOM when stringifying (#2119)9069261Fix types checkeb9e1feRelease 8.5.23 version9d19c78Update dependenciesUpdates
nextfrom 16.2.11 to 16.3.0Release notes
Sourced from next's releases.
... (truncated)
Commits
d73f562v16.3.02e0d4cbEdits to turbopackFileSystemCache (#96531)86df9c7docs: cover direct visits and client navigations in the instant() e2e example...47a52c0[turbopack / next.js] Add an end-to-end test for new root detection (#96544)8e878d4Remove implicit Partial Prefetching opt-in frominstant(#96539)e37ddd1Fix deploy test TypeScript exclusions (#96545)8a4920cdocs: clarify first-party Skills workflows (#96495)4344b83Flag newly disabled deploy tests (#96505)459617afix: double fragment on navigation (#93132)cbf0cefEnable TypeScript CLI by default (#96497)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.