[mikecao]

Summary

Security-only fix for master, so the open Dependabot alerts close without waiting for the next dev release. The same changes are already on dev (8432801), except next, which is already 16.4.0 there.

 package.json
-  "next": "16.3.4"
+  "next": "16.3.8"          # critical RCE in next/og, SSRF in image optimization, cache poisoning, info disclosure

 packages/mcp/package.json
-  "@modelcontextprotocol/client": "^2.0.0"
+  "@modelcontextprotocol/client": "^2.2.0"   # OAuth credential leak (GHSA-6qxp-vccf-f47h)

 pnpm-workspace.yaml  (overrides)
-  'brace-expansion@<1.1.18': 1.1.18
-  'brace-expansion@>=2.0.0 <2.1.4': 2.1.4
+  'brace-expansion@<1.1.21': 1.1.21
+  'brace-expansion@>=2.0.0 <2.1.7': 2.1.7
+  'brace-expansion@>=4.0.0 <5.0.12': 5.0.12
-  'fast-uri@>=3.0.0 <3.1.6': 3.1.6
+  'fast-uri@>=3.0.0 <3.1.8': 3.1.8
+  'postcss-selector-parser@>=7.0.0 <7.1.6': 7.1.6
+  'sharp@>=0.35.0 <0.35.5': 0.35.5
-  'shell-quote@<1.9.0': 1.9.0
+  'shell-quote@<1.11.0': 1.11.0
+  'source-map-js@>=1.0.0 <1.2.2': 1.2.2
+  'undici@>=8.0.0 <8.10.2': 8.11.2

Supersedes #4629 (next) and #4632 (source-map-js).

Evidence

• Before: 25 open Dependabot alerts (2 critical, 8 high). pnpm audit on master also flags shell-quote (critical), sharp, brace-expansion 5.x, postcss-selector-parser and @modelcontextprotocol/client.
  After: pnpm audit → No known vulnerabilities found
• pnpm test → 118 files, 882 tests passing. packages/mcp typecheck and 27 tests pass.
• next build succeeds.
• tsc --noEmit shows the same 4 errors that are already on master. None are new.

Merge Danger

Door: two-way

Only dependency versions change. Revert the commit to roll back.

Blast Radius: app-wide

next 16.3.4 → 16.3.8 is a patch bump in the runtime. Everything else is transitive or test-only, except sharp (image optimization) and the MCP client (used only by packages/mcp). Merging master back into dev may conflict in pnpm-lock.yaml and pnpm-workspace.yaml. Keep dev's side.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
umami	Ready	Preview	Oct 19, 2026 9:47pm UTC

3 Skipped Deployments

Project	Deployment	Actions	Updated
umami-analytics-eu	Ignored		Oct 19, 2026 9:47pm UTC
umami-analytics-us	Ignored		Oct 19, 2026 9:47pm UTC
umami-postgresql	Ignored		Oct 19, 2026 9:47pm UTC

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issue was found.

Summary

Updates dependencies to address reported security advisories.

• The Umami web app now runs on a newer Next.js release.
• The MCP package’s development client now resolves to a newer release.
• Workspace installs now select newer versions of affected shared packages.

No actionable issues were found. Tests and builds were not run during this review.

_{Reviews (1) · Last reviewed commit: "Fix security vulnerabilities in next and..." · Reviewed by Greptile}