[marcleblanc2]

What

Closes 20 of the 24 open Dependabot alerts.

• next ^16.3.5 → ^16.3.8 (resolves to 16.4.3), eslint-config-next to match, sharp ^0.35.4 → ^0.35.5
• mermaid ^11.16 → ^12.2, which brings katex 0.18 and dompurify 3.4.17 within its own declared ranges. Mermaid.tsx pins layout: dagre and look: classic so diagrams render as they did under mermaid 11 (12 defaults to ELK layout and the "neo" look).
• pnpm update --depth 20 brace-expansion source-map-js @grpc/grpc-js dompurify: the parents already allowed the patched versions, the lockfile was just stale.
• pnpm.overrides for toml and uuid: their parents under contentlayer2 pin old majors, and contentlayer2 has no newer release. toml is only used for +++ TOML frontmatter, which no page has.
• esbuild ^0.25 as a devDependency: it is only a peer of contentlayer2 and mdx-bundler, which overrides do not reach.

Alert	Severity	Package	Was → now	Fixed by
#304	critical	next	16.3.5 → 16.4.3	bump
#308, #309, #310, #311, #319, #320	high … low	next	16.3.5 → 16.4.3	bump
#318	high	sharp	0.35.4 → 0.35.5	bump
#314	high	source-map-js	1.2.1 → 1.2.2	lockfile refresh
#306, #305	high, low	@grpc/grpc-js	1.14.4 → 1.14.6	lockfile refresh
#282, #281	high	toml	3.0.0 → 4.3.0	override
#303, #302	medium	brace-expansion	1.1.18 → 1.1.21, 5.0.9 → 5.0.12	lockfile refresh
#194	medium	uuid	9.0.1 → 11.1.1	override
#27	medium	esbuild	0.18.20 → 0.25.12	devDependency
#316, #307	low	dompurify	3.4.15 → 3.4.17	mermaid 12 + lockfile refresh
#315	low	katex	0.16.47 → 0.18.10	mermaid 12

#304 (RCE in next/og ImageResponse) is not exploitable here: src/app/api/og/[...path]/route.tsx is force-static with dynamicParams = false, so ImageResponse only ever sees page titles from our own MDX at build time. #308 (SSRF in image optimization) does not apply either; next.config.js has no images config.

Not in this PR

• Add notes about observability being non-configurable for Sourcegraph Cloud #234, fixing broken links #205 (@opentelemetry/propagator-jaeger, @opentelemetry/core): the fix is OTel SDK 2.x, and contentlayer2 → @effect-ts/otel pins 1.x with a different @opentelemetry/api peer. That tracing only runs inside contentlayer2 build and never reads a request header. Dismiss as "vulnerable code is not actually used".
• Remove old docs links from version 5.2 #317 (sprintf-js), #312 (braces): withdrawn advisories with no patched version. Dismiss.

Test plan

• pnpm install: no new peer warnings (the lucide-react / React 19 one is pre-existing); @opentelemetry/api stays at 1.9.0
• npx tsc --noEmit clean against mermaid 12
• pnpm run build: 1494 static pages, OG images render as 1200×630 PNGs
• pnpm run lint: 0 errors, same 8 pre-existing warnings as main
• pnpm start, loaded /admin/architecture and /self-hosted/sourcegraph-nginx-mermaid in headless Chrome: diagrams render with the same dagre layout and classic look as mermaid 11
• Vercel preview build on this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sourcegraph-docs	Ready	Preview	Oct 27, 2026 1:29am UTC

[github-actions]

Open the Diff Tour for this PR in Sourcegraph