[aamoghS]

Applies the open Dependabot PRs targeting dev in one branch, rebased onto the current dev tip:

• actions/upload-artifact 6 to 7 (chore(deps): bump actions/upload-artifact from 6 to 7 #488)
• actions/download-artifact 7 to 8 (chore(deps): bump actions/download-artifact from 7 to 8 #489)
• sanitize-html and @types/sanitize-html (chore(deps): bump sanitize-html and @types/sanitize-html #490)
• globals 17.12.0 to 17.13.0 (chore(deps): bump globals from 17.12.0 to 17.13.0 #491)
• stripe 22.6.2 to 23.0.0 (chore(deps): bump stripe from 22.6.2 to 23.0.0 #492)
• next 16.3.7 to 16.4.0 (chore(deps): bump next from 16.3.7 to 16.4.0 #493), which also covers the 16.3.8 security bumps opened against main (chore(deps): bump next from 16.3.7 to 16.3.8 in /sites/mainweb #495, chore(deps): bump next from 16.3.7 to 16.3.8 #496, chore(deps): bump next from 16.3.7 to 16.3.8 in /tooling/tailwind #497)

The stripe commit conflicted with the sanitize-html one in packages/api and sites/mainweb package.json; resolved to sanitize-html 2.18.0 plus stripe ^23.0.0 and regenerated the lockfile.

stripe 23 pins API version 2026-09-30.endive and drops payment_method_types from session/intent params. The code does not pass payment_method_types or a tolerance to constructEvent, so neither breaking change applies.

Verified locally on Node 22: pnpm install --frozen-lockfile, turbo lint typecheck, pnpm test (1976 passed), turbo build.

---

Note

Medium Risk
Stripe 23 is a major bump on payment paths and Next 16.4 touches the whole app stack; usage already avoids Stripe 23 breaking params per existing checkout code.

Overview
Bumps several Dependabot dependency updates in one branch: Next.js 16.3.7 → 16.4.0 (root, Hacklytics, mainweb, tailwind tooling), Stripe ^22.6.2 → ^23.0.0 and sanitize-html 2.17.7 → 2.18.0 (with @types/sanitize-html) in @query/api and mainweb, plus globals 17.12.0 → 17.13.0 for ESLint config.

CI now uses actions/upload-artifact@v7 and actions/download-artifact@v8 for the Hacklytics build artifact in verify, preview, and deploy jobs. The lockfile was regenerated for the version changes (including Next/sharp transitive updates).

No application source changes—only manifests, workflow pins, and pnpm-lock.yaml.

^{Reviewed by Cursor Bugbot for commit 0e9df53. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

View full job summary

[github-actions]

Visit the preview URL for this PR (updated for commit 0e9df53):

https://hacklytics2027--pr-498-vcht3hlp.web.app

_{(expires Mon, 26 Oct 2026 18:58:42 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: c48ba34db61581e25fe2978355160b5eefe0e83f}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] This PR appears safe to merge; no actionable issues were found.

Summary

Updates GitHub artifact actions and workspace dependencies.

• The workspace and sites use Next.js 16.4.0.
• The API and main site use newer HTML-sanitizing packages.
• The API and main site use Stripe's 23.0.0 SDK.
• CI uses newer actions to pass Hacklytics build artifacts.
• ESLint uses the updated globals package.

_{Reviews (1) · Last reviewed commit: "chore(deps): bump next from 16.3.7 to 16..." · Reviewed by Greptile}