PRDCT-685: Dependabot bumps — September safe set (no framework majors)

[Iamfle4ka]

Jira issue(s): PRDCT-685

Rolls the three routine September Dependabot PRs into one lockfile pass. Keeping them apart means four reviews of the same package-lock.json, and #1125 / #1126 bump the same package (@vercel/node), so they would conflict with each other.

Same split as August: safe set here, framework major separate (#1066 / #1067).

Package	From	To	Source PR	How
svgo	4.0.2	4.1.0	#1121	transitive, lockfile only
smol-toml	1.5.2	1.7.1	#1125	transitive, lockfile only
@vercel/node	^5.8.4	^5.10.2	#1125, #1126	direct
js-yaml	^4.2.0	^4.3.2	#1126	direct

Method

package.json bumped by hand for the two direct deps, lockfile regenerated with npm install, then npm audit fix — never --force, which wants @vercel/node@4.0.0, a breaking downgrade. None of the bots' lock diffs were cherry-picked.

git diff package.json is exactly the two lines above. Verified in the lockfile that the majors did not move: astro 6.4.8, sharp 0.33.5, @astrojs/starlight 0.38.5, @astrojs/mdx 5.0.6.

Result

npm audit: 18 advisories (1 critical / 11 high / 5 moderate / 1 low) → 11 (1 critical / 4 high / 5 moderate / 1 low).

Seven highs closed: svgo, smol-toml, js-yaml, minimatch, nanoid, @vercel/build-utils, @vercel/python-analysis.

What did not close, stated plainly: the @vercel/node → undici / path-to-regexp chain survives the bump to 5.10.2. npm's only offered fix for it is the downgrade to 4.0.0, so it stays open — same conclusion #1066 reached in August. The rest (astro, sharp, starlight, mdx, astro-expressive-code) needs the major upgrade.

npm run check:cli passes (0 findings) and npm run build is clean, 363 pages.

Out of scope

• chore(deps): bump sharp, @astrojs/mdx, @astrojs/starlight and astro #1123 is deliberately not in this batch. It is the Astro 6 → 7 major (with starlight, mdx, sharp in tow) — the same upgrade already done by hand in PRDCT-690: chore(deps): Astro 6 → 7 major upgrade (+ Starlight 0.41) #1067, which also needed astro.config.mjs and src/pages/404.astro changes. Left open, nothing closed.
• chore(deps): bump svgo from 4.0.2 to 4.1.0 #1121 / chore(deps): bump smol-toml and @vercel/node #1125 / chore(deps-dev): bump js-yaml and @vercel/node #1126 are left open on purpose — Dependabot closes its own PRs once this lands.

Worth flagging

The single critical is on astro itself: vulnerable range <=7.2.7, fixed in 7.3.2. #1067 currently targets ^7.1.6, so it no longer closes this critical — its target needs raising to ≥7.3.2 (and sharp to 0.35.4) when it comes back into play.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
connection-docs	Ready	Preview	Sep 15, 2026 10:48am UTC

[linear-code]

PRDCT-685

[keboola-pr-reviewer-bot]

Verdict: needs_human (risk 4/5) · profile connection-docs

Dependency bump touching package.json and package-lock.json — escalating to a human per policy.

Impact flags: possible rollback re-introduction — see Check Run summary.

Suggested reviewers: @keboola/docs