[brunomenezes]

Summary

Bumps every dependency that moves without breaking anything, plus pnpm and the GitHub Actions, and fixes pnpm check-types on a clean checkout. It closes three critical Next.js RCEs in the deployed playground.

pnpm audit drops from 55 findings to 5. Apart from the playground's, all of them sit in development and build tooling, and none is a runtime dependency of a published package.

Commits order fix(rollup) → bump dependencies → cm-playground → docs → pnpm → actions → release-age exclusions, and each one builds on its own.

Changes

• @cartesi/rollup's type check now builds its workspace dependencies first, so pnpm check-types passes on a fresh clone
• Dependencies refreshed within their ranges, viem kept at 2.56.3, with a patch changeset for codec, rpc and wagmi-plugin
• cm-playground: Next.js 16.4.3, React 19.3.1, @cartesi/machine 1.0.0-alpha.3. Changesets now rewrites only workspace: ranges, so a machine release no longer moves this pin to an unpublished version (fix: rollback playground to alpha.1 and regenerate pnpm-lock.yaml #201)
• docs: vocs 2.11.1, waku 1.0.0-rc.4, React 19.3.1
• pnpm 12.15.0
• GitHub Actions moved to their latest releases
• Dropped the minimumReleaseAgeExclude entries; every package they covered has aged out

Security

Fixes that reach cm-playground, the only deployed Node runtime:

• next 16.3.4 → 16.4.3
  • Critical: GHSA-vcvr-r3jv-pc5j (RCE in next/og), GHSA-2464-fhr4-w9xw (RCE in Image Optimization with SVG), GHSA-673q-mjm6-r5xr (RCE in use cache); no CVEs assigned yet
  • High: CVE-2026-94483 (SSRF in Image Optimization), CVE-2026-94482 (DoS via Server Actions)
  • Moderate: CVE-2026-94484, CVE-2026-94485, CVE-2026-94543, CVE-2026-94544, CVE-2026-103004
• sharp 0.35.4 → 0.35.5, Next's image optimizer: CVE-2026-114111 (high, librsvg)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cartesi-playground	Ready	Preview	Oct 27, 2026 5:58pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: d7b5ed6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@cartesi/codec	Patch
@cartesi/rpc	Patch
@cartesi/wagmi-plugin	Patch
@cartesi/client	Patch
@cartesi/react	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR