[devtools-agent]

Description of the change

Resolves every open Dependabot alert on the repo in one PR, and also fixes advisories that GitHub's dependency graph hasn't raised as alerts yet. All the vulnerable packages are dev/example dependencies. Nothing changes in the published @rollbar/react package or the root lockfile.

Version bumps (option A from the SDK-803 plan)

Example	Change	Fixes
react-17, typescript	vite ^8.3.0 → ^8.3.5, vitest ^4.1.11 → ^4.1.12	12 vite alerts (#755–#766) and 4 @vitest/mocker alerts (#767–#770)
nextjs, nextjs-approuter	next and eslint-config-next 16.3.8 → 16.4.3, still pinned exactly	critical unauthenticated RCEs GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr, plus a high DoS. These aren't open alerts yet because the graph is stale.
all four	lockfile refresh of zod (→ 4.6.7)	high zod advisory via eslint-plugin-react-hooks
react-17, typescript	lockfile refresh of undici (→ 7.30.1)	undici via jsdom. The Next.js examples use jsdom 20 and don't lock undici

No major-version bumps and no peer conflicts. The other lockfile changes are transitive patch/minor updates: rolldown, @vitest/*, postcss, chai and nanoid. The .yalc/@rollbar/react entry in the two Next.js lockfiles is now in sync with the current package manifest. It had been stale since prop-types moved to dependencies (#178).

The 4 react-router alerts (#626, #627, #633, #719) were fixed on main by #173 (react-17 no longer uses react-router, and typescript is on 7.18.4). GitHub's dependency graph still lists 6.30.6. This PR rewrites both of those lockfiles, which should make GitHub rebuild the graph and close them. If they're still open after merge, they can be dismissed as "inaccurate".

.github/dependabot.yml (option D): the repo had no Dependabot config, so each advisory arrived as one PR per package per example. Those PRs touch the same lockfiles and conflict with each other (e.g. #183 and #185). The new config:

• covers npm in / and /examples/*, plus github-actions
• groups all security updates per ecosystem (applies-to: security-updates), so it's one PR per directory instead of one per package
• keeps routine version updates off (open-pull-requests-limit: 0, which doesn't affect security updates)
• runs on the most frequent schedule Dependabot allows, a daily cron (0 0 * * *), per review. Dependabot rejects cron expressions that fire more often than every 24 hours, and interval: daily skips weekends. The schedule only affects version updates. Security updates are raised when an alert opens.

Supersedes Dependabot PRs #182, #183 and #185, which can be closed once this merges.

How this was validated

On Node 20.19 / npm 10.9 (the CI floor), from a clean install, in the same order as ci.yaml:

• npm run install:all -- ci ✅
• npm run lint -- --max-warnings 0 ✅. prettier --check passes on every changed file (the 13 files it flags were already flagged on main).
• npm run lint:examples ✅
• npm run typecheck ✅
• npm run build:all ✅ (Next.js 16.4.3 builds both Next examples, and vite 8.3.5 builds react-17 and typescript)
• npm run test ✅ (13 tests) and npm run test:examples ✅
• npm audit in each example: 0 vulnerabilities in all four

CI covers Node 22 and 24.

Type of change

• Maintenance

Related issues

• Linear: SDK-803

🤖 Generated with Claude Code

[linear-code]

SDK-803

CR-589

[devtools-agent]

AI Agent Review LGTM (openai, openai-astra)

LGTM. No blocking findings were found.

Bumps next/eslint-config-next 16.3.8 → 16.4.3 in the two Next.js examples and vite/vitest in react-17 and typescript, refreshes lockfiles, and adds .github/dependabot.yml. No issues found.

Verified in the checkout

• Lockfiles still match their dependencies. Every new dependency range set by a bumped package is met by what is already locked, so npm ci shouldn't reject the lockfiles:
  • eslint-config-next 16.4.3 needs eslint-plugin-react-hooks ^7.1.0 and typescript-eslint ^8.56.0. Locked: 7.1.1 and 8.70.0 (examples/nextjs/package-lock.json:4905, :10008; examples/nextjs-approuter/package-lock.json:4990, :10120).
  • next 16.4.3 needs sharp ^0.35.5. Locked: 0.35.5 (examples/nextjs/package-lock.json:9082, examples/nextjs-approuter/package-lock.json:9182).
  • vite 8.3.5 needs postcss ^8.5.30 and rolldown ~1.2.14. Locked: 8.5.31 and 1.2.15.
  • jsdom needs undici ^7.25.0. Locked: 7.30.1 (examples/react-17/package-lock.json:2994, :4375).
  • vitest 4.1.12's @vitest/* dependencies are all at 4.1.12 (examples/react-17/package-lock.json:4509-4529).
• The .yalc/@rollbar/react entry matches the package. It now records version 1.2.1, prop-types under dependencies, and the rollbar peer range ^2.26.4 || ^3.0.0-alpha.3 || ^4.0.0, the same as package.json:3, :56-59, :107-110. scripts/install-all.js:31-35 regenerates this entry with yalc add on every install. prop-types 15.8.1 is still locked in both Next.js lockfiles (examples/nextjs/package-lock.json:8590-8599).
• No old versions are left. Nothing in examples/ still contains 16.3.8, vite 8.3.0 or vitest 4.1.11.
• .github/dependabot.yml follows the repo's formatting. Its single quotes match prettier.config.js:6 (singleQuote: true).

Notes (not findings)

• Error in the PR description. It says undici was refreshed in all four examples. Only react-17 and typescript lock undici. The Next.js examples use jsdom 20.0.3 (examples/nextjs/package-lock.json:7370-7371) and have no undici entry. Their lockfiles change only zod, which is correctly at 4.6.7.
• Dependabot may not handle the Next.js examples (not verified). They depend on file:.yalc/@rollbar/react, and .yalc/ is gitignored (.gitignore:66), so that folder is not in the repo. I could not confirm from the checkout whether Dependabot can update those two folders. This predates the PR.
• Claims I could not check. The advisory IDs, the alert numbers, the claim that [SDK-757] Clear react-router Dependabot alerts in the examples #173 already fixed the react-router alerts, and the claim that this PR supersedes Dependabot PRs build(deps-dev): bump vite from 8.3.0 to 8.3.5 in /examples/react-17 #182, build(deps-dev): bump vite from 8.3.0 to 8.3.5 in /examples/typescript #183 and build(deps): bump @vitest/mocker and vitest in /examples/typescript #185 are declared in the description only. None of those PRs are checked out here.
• CI and tests. The CI results, the 13 passing tests and the npm audit output are the author's own report. The diff cannot confirm them, and I did not run anything.

[devtools-agent]

AI Agent Review LGTM (openai, openai-astra)

LGTM. No blocking findings were found.

No findings. The manifest bumps and lockfile refreshes are consistent, and no vulnerable versions remain in the four examples.

What I checked

• Manifests match lockfiles. In all four examples the lockfile's top-level entry agrees with package.json: next/eslint-config-next are pinned to 16.4.3 (examples/nextjs/package.json:15,29, examples/nextjs-approuter/package.json:15,29), and vite ^8.3.5 / vitest ^4.1.12 are set in examples/react-17/package.json:21-22 and examples/typescript/package.json:30-31.
• New dependency ranges are met by the locked versions:
  • Next.js examples: eslint-plugin-react-hooks 7.1.1 meets ^7.1.0 (examples/nextjs/package-lock.json:4905), typescript-eslint 8.70.0 meets ^8.56.0 (:10008), and sharp 0.35.5 meets ^0.35.5 (:9082). The approuter lockfile matches (examples/nextjs-approuter/package-lock.json:4990,9182,10120).
  • Vite examples: vite 8.3.5 needs rolldown ~1.2.14 (locked 1.2.15) and postcss ^8.5.30 (locked 8.5.31). source-map-js is 1.2.2 (examples/react-17/package-lock.json:4196, examples/typescript/package-lock.json:3569).
• No old versions left. Searching all four example lockfiles for vite 8.3.0, vitest/@vitest/mocker 4.1.11, zod below 4.6.7, undici 7.29.x, rolldown 1.2.10 and next 16.3.8 found nothing, and there are no nested copies of those packages.
• The .yalc/@rollbar/react lockfile entry now matches the real package: version 1.2.1, prop-types under dependencies, and rollbar peer range including ^4.0.0 (package.json:3,56-59,107-110). This is harmless for npm ci: the dependency is a link (examples/nextjs/package-lock.json:2071-2074), and scripts/install-all.js:31-35 runs yalc add again before installing.

Not verified (depends on GitHub's service, not this repo)

• .github/dependabot.yml is well-formed. Whether interval: cron with cronjob, the 24-hour minimum the comments describe, the /examples/* glob under directories, and grouped security updates behave as described can't be confirmed from this checkout.
• Worth watching after merge: both Next.js examples depend on file:.yalc/@rollbar/react (examples/nextjs/package.json:14), but .yalc/ is gitignored (.gitignore:66). Dependabot can't fetch that path from the repo, so check its first run on those two directories for resolution errors.

Declared in the description, not verified

• Superseding Dependabot PRs build(deps-dev): bump vite from 8.3.0 to 8.3.5 in /examples/react-17 #182, build(deps-dev): bump vite from 8.3.0 to 8.3.5 in /examples/typescript #183 and build(deps): bump @vitest/mocker and vitest in /examples/typescript #185: declared, not verified.
• react-router alerts fixed by [SDK-757] Clear react-router Dependabot alerts in the examples #173: partly consistent with the checkout. examples/react-17/package.json:6-11 has no react-router, and examples/typescript/package.json:11 has ^7.18.4. Whether GitHub closes the alerts is not verified.
• The advisory IDs, alert numbers, npm audit results and the local CI run are the author's claims; the diff doesn't prove any tests passed.

[pacoesteban]

LGTM. Resolved versions in all four lockfiles match the manifests (next 16.4.3, vite 8.3.5, vitest and @vitest/mocker 4.1.12, undici 7.30.1, zod 4.6.7), the two Next.js RCE advisories are patched from 16.4.1, and the .yalc entries now match the root package.json. The four remaining react-router alerts are stale graph data: react-17 no longer pulls react-router and typescript is on 7.18.4.

Remember to close #182, #183 and #185 once this merges.