[zytact]

After the next bump there were still about 40 open alerts, all in dev tooling or next's own dependencies. pnpm audit is clean after this.

• vitest and @vitest/coverage-v8 go 3 -> 4.1.11. This fixes the critical vitest advisory, and the tests needed no changes.
• vite is now a direct dev dependency at ^7.3.6. It used to come in only as a peer of the vitest plugins, so the lockfile kept it stuck on 7.2.6.
• next pins postcss@8.4.31 exactly, so pnpm.overrides forces next>postcss to ^8.5.28. The build output is unchanged.
• Everything else (js-yaml, sharp, minimatch, picomatch, brace-expansion, ws, rollup, etc.) is a targeted pnpm update --depth Infinity of just the flagged packages.

I tried a full pnpm update first. It pulled in React 19.3 and newer Radix, and the canvas test suite went from 9s to 229s with 5 timeouts. So this PR only moves the packages with advisories.

Lint, tsc, all 55 tests and next build pass.

CI runs bun install with no bun lockfile, so it ignores pnpm-lock.yaml and the override. Worth fixing separately.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strokeshare	Ready	Preview	Sep 13, 2026 8:51pm UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a44104d5-d4b9-4440-bf95-4970486d0a2c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}