chore(deps): bump the npm_and_yarn group across 5 directories with 8 updates by dependabot[bot] · Pull Request #2356 · alchemyplatform/aa-sdk

dependabot · 2026-02-22T11:30:48Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package	From	To
js-yaml	`4.1.0`	`4.1.1`
esbuild	`0.20.2`	`0.25.0`
minimatch	`9.0.5`	`10.2.1`
next	`14.2.29`	`15.5.10`
bn.js	`4.12.2`	`4.12.3`
node-forge	`1.3.1`	`1.3.3`
undici	`6.21.3`	`6.23.0`
vite	`5.4.19`	`5.4.21`

Bumps the npm_and_yarn group with 1 update in the /account-kit/plugingen directory: esbuild.
Bumps the npm_and_yarn group with 1 update in the /examples/alchemy-privy-integration-example directory: next.
Bumps the npm_and_yarn group with 1 update in the /examples/ui-demo directory: next.
Bumps the npm_and_yarn group with 1 update in the /templates/eslint directory: minimatch.

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

Commits

cc482e7 4.1.1 released
50968b8 dist rebuild
d092d86 lint fix
383665f fix prototype pollution in merge (<<)
0d3ca7a README.md: HTTP => HTTPS (#678)
49baadd doc: 'empty' style option for !!null
ba3460e Fix demo link (#618)
See full diff in compare view

Updates esbuild from 0.20.2 to 0.25.0

Release notes

Sourced from esbuild's releases.

v0.25.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.24.0 or ~0.24.0. See npm's documentation about semver for more information.
Restrict access to esbuild's development server (GHSA-67mh-4wv8-2f99)

This change addresses esbuild's first security vulnerability report. Previously esbuild set the Access-Control-Allow-Origin header to * to allow esbuild's development server to be flexible in how it's used for development. However, this allows the websites you visit to make HTTP requests to esbuild's local development server, which gives read-only access to your source code if the website were to fetch your source code's specific URL. You can read more information in the report.

Starting with this release, CORS will now be disabled, and requests will now be denied if the host does not match the one provided to --serve=. The default host is 0.0.0.0, which refers to all of the IP addresses that represent the local machine (e.g. both 127.0.0.1 and 192.168.0.1). If you want to customize anything about esbuild's development server, you can put a proxy in front of esbuild and modify the incoming and/or outgoing requests.

In addition, the serve() API call has been changed to return an array of hosts instead of a single host string. This makes it possible to determine all of the hosts that esbuild's development server will accept.

Thanks to @sapphi-red for reporting this issue.

Delete output files when a build fails in watch mode (#3643)

It has been requested for esbuild to delete files when a build fails in watch mode. Previously esbuild left the old files in place, which could cause people to not immediately realize that the most recent build failed. With this release, esbuild will now delete all output files if a rebuild fails. Fixing the build error and triggering another rebuild will restore all output files again.
Fix correctness issues with the CSS nesting transform (#3620, #3877, #3933, #3997, #4005, #4037, #4038)

This release fixes the following problems:
Naive expansion of CSS nesting can result in an exponential blow-up of generated CSS if each nesting level has multiple selectors. Previously esbuild sometimes collapsed individual nesting levels using :is() to limit expansion. However, this collapsing wasn't correct in some cases, so it has been removed to fix correctness issues.
/* Original code */
.parent {
  > .a,
  > .b1 > .b2 {
    color: red;
  }
}
/* Old output (with --supported:nesting=false) */
.parent > :is(.a, .b1 > .b2) {
color: red;
}
/* New output (with --supported:nesting=false) */
.parent > .a,
.parent > .b1 > .b2 {
color: red;
}
Thanks to @tim-we for working on a fix.
The & CSS nesting selector can be repeated multiple times to increase CSS specificity. Previously esbuild ignored this possibility and incorrectly considered && to have the same specificity as &. With this release, this should now work correctly:
/* Original code (color should be red) */

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

e9174d6 publish 0.25.0 to npm
c27dbeb fix hosts in plugin-tests.js
6794f60 fix hosts in node-unref-tests.js
de85afd Merge commit from fork
da1de1b fix #4065: bitwise operators can return bigints
f4e9d19 switch case liveness: default is always last
7aa47c3 fix #4028: minify live/dead switch cases better
22ecd30 minify: more constant folding for strict equality
4cdf03c fix #4053: reordering of .tsx in node_modules
dc71977 fix #3692: 0 now picks a random ephemeral port
Additional commits viewable in compare view

Updates minimatch from 9.0.5 to 10.2.1

Changelog

Sourced from minimatch's changelog.

change log

10.2

Add braceExpandMax option

10.1

Add magicalBraces option for escape

Fix makeRe when partial: true is set.

Fix makeRe when pattern ends in a final ** path part.

10.0

Require node 20 or 22 and higher

9.0

No default export, only named exports.

8.0

Recursive descent parser for extglob, allowing correct support for arbitrarily nested extglob expressions

Bump required Node.js version

7.4

Add escape() method

Add unescape() method

Add Minimatch.hasMagic() method

7.3

Add support for posix character classes in a unicode-aware way.

7.2

Add windowsNoMagicRoot option

7.1

Add optimizationLevel configuration option, and revert the default back to the 6.2 style minimal optimizations, making the advanced transforms introduced in 7.0 opt-in. Also, process provided file paths in the same way in optimizationLevel:2 mode, so most things that matched with optimizationLevel 1 or 0 should match with level 2 as well. However, level 1 is the default, out of an abundance of caution.

... (truncated)

Commits

6d7ac34 10.2.1
2e111f3 coalesce consecutive non-globstar * characters
1a62a2a 10.2.0
758b5a3 changelog 10.2
903e50b add braceExpandMax option, format
a50a110 10.1.3
a08c046 move back to og brace-expansion
fde70d1 10.1.2
05210d8 update deps
ba4093c update workflows and package stuff
Additional commits viewable in compare view

Updates next from 14.2.29 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

60a2aa9 v15.5.10
e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
bf9f084 Sync DoS mitigations for React Flight
c5de33e v15.5.9
dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
7526cd6 v15.5.8
1e9ec41 Update React Version (#41)
16141e5 Update React Version (#30)
e01e589 Backport Next.js changes to v15.5.8 (#23)
Additional commits viewable in compare view

Updates bn.js from 4.12.2 to 4.12.3

Commits

39fe438 4.12.3
67ecb35 backport(4.x): fix imaskn state (#317)
See full diff in compare view

Updates node-forge from 1.3.1 to 1.3.3

Changelog

Sourced from node-forge's changelog.

1.3.3 - 2025-12-02

Fixed

[pkcs12] Make digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2.

1.3.2 - 2025-11-25

Security

HIGH: ASN.1 Validator Desynchronization

An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

Reported by Hunter Wodzenski.

CVE ID: CVE-2025-12816

GHSA ID: GHSA-5gfm-wpxj-wjgq

HIGH: ASN.1 Unbounded Recursion

An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.

Reported by Hunter Wodzenski.

CVE ID: CVE-2025-66031

GHSA ID: GHSA-554w-wpv2-vw27

MODERATE: ASN.1 OID Integer Truncation

An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.

Reported by Hunter Wodzenski.

CVE ID: CVE-2025-66030

GHSA ID: GHSA-65ch-62r8-g69g

Fixed

[asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.

[asn1] Add fromDer() max recursion depth check.

Add a asn1.maxDepth global configurable maximum depth of 256.

Add a asn1.fromDer() per-call maxDepth option.

NOTE: The default maximum is assumed to be higher than needed for valid data. If this assumption is false then this could be a breaking change. Please file an issue if there are use cases that need a higher maximum.

NOTE: The per-call maxDepth parameter has not been exposed up through all of the API stack due to the complexities involved. Please file an issue if there are use cases that require this instead of changing the default

... (truncated)

Commits

1cea0af Release 1.3.3.
5265989 Update changelog.
e4f3961 Fix changelog for release.
503979b Update changelog.
c3b3b32 Make digestAlgorithm parameters optional
6f70043 Update CVE details.
f547b0d Start 1.3.3-0.
235ad3e Release 1.3.2.
2598244 Update changelog.
0032dd0 Fix typos.
Additional commits viewable in compare view

Updates undici from 6.21.3 to 6.23.0

Release notes

Sourced from undici's releases.

v6.23.0

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

Full Changelog: nodejs/undici@v6.22.0...v6.23.0

v6.22.0

What's Changed

fix: fix wrong stream canceled up after cloning (v6) by @snyamathi in nodejs/undici#4414

[Backport v6.x] fix: fix EnvHttpProxyAgent for the Node.js bundle by @github-actions[bot] in nodejs/undici#4432

feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#4180) by @metcoder95 in nodejs/undici#4433

feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#4180) (#4340) by @metcoder95 in nodejs/undici#4445

Backport 4472 to v6.x by @Uzlopak in nodejs/undici#4480

Full Changelog: nodejs/undici@v6.21.3...v6.22.0

Commits

fbc31e2 Bumped v6.23.0
3477c94 chore: release flow using provenance
d3aafea fix: limit Content-Encoding chain to 5 to prevent resource exhaustion
f9c9185 Bumped v6.22.0
f670f2a feat: make UndiciErrors reliable to instanceof (#4472) (#4480)
422e397 feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#41...
4a06ffe feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#4180)...
4cb3974 fix: fix EnvHttpProxyAgent for the Node.js bundle (#4064) (#4432)
44c23e5 fix: fix wrong stream canceled up after cloning (v6) (#4414)
See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Updates vite from 5.4.19 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970

chore: update CHANGELOG (ca88ed7)

5.4.20 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (482000f), closes #20736

fix: port sirv@3.0.2 changes to sirv@2.0.4 (#20737) (4f1c35b), closes #20737

Commits

adce3c2 release: v5.4.21
cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
ca88ed7 chore: update CHANGELOG
997700f release: v5.4.20
482000f fix: apply fs.strict check to HTML files (#20736)
See full diff in compare view

Updates esbuild from 0.20.2 to 0.27.3

Release notes

Sourced from esbuild's releases.

v0.25.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.24.0 or ~0.24.0. See npm's documentation about semver for more information.
Restrict access to esbuild's development server (GHSA-67mh-4wv8-2f99)

This change addresses esbuild's first security vulnerability report. Previously esbuild set the Access-Control-Allow-Origin header to * to allow esbuild's development server to be flexible in how it's used for development. However, this allows the websites you visit to make HTTP requests to esbuild's local development server, which gives read-only access to your source code if the website were to fetch your source code's specific URL. You can read more information in the report.

Starting with this release, CORS will now be disabled, and requests will now be denied if the host does not match the one provided to --serve=. The default host is 0.0.0.0, which refers to all of the IP addresses that represent the local machine (e.g. both 127.0.0.1 and 192.168.0.1). If you want to customize anything about esbuild's development server, you can put a proxy in front of esbuild and modify the incoming and/or outgoing requests.

In addition, the serve() API call has been changed to return an array of hosts instead of a single host string. This makes it possible to determine all of the hosts that esbuild's development server will accept.

Thanks to @sapphi-red for reporting this issue.

Delete output files when a build fails in watch mode (#3643)

It has been requested for esbuild to delete files when a build fails in watch mode. Previously esbuild left the old files in place, which could cause people to not immediately realize that the most recent build failed. With this release, esbuild will now delete all output files if a rebuild fails. Fixing the build error and triggering another rebuild will restore all output files again.
Fix correctness issues with the CSS nesting transform (#3620, #3877, #3933, #3997, #4005, #4037, #4038)

This release fixes the following problems:
Naive expansion of CSS nesting can result in an exponential blow-up of generated CSS if each nesting level has multiple selectors. Previously esbuild sometimes collapsed individual nesting levels using :is() to limit expansion. However, this collapsing wasn't correct in some cases, so it has been removed to fix correctness issues.
/* Original code */
.parent {
  > .a,
  > .b1 > .b2 {
    color: red;
  }
}
/* Old output (with --supported:nesting=false) */
.parent > :is(.a, .b1 > .b2) {
color: red;
}
/* New output (with --supported:nesting=false) */
.parent > .a,
.parent > .b1 > .b2 {
color: red;
}
Thanks to @tim-we for working on a fix.
The & CSS nesting selector can be repeated multiple times to increase CSS specificity. Previously esbuild ignored this possibility and incorrectly considered && to have the same specificity as &. With this release, this should now work correctly:
/* Original code (color should be red) */

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

e9174d6 publish 0.25.0 to npm
c27dbeb fix hosts in plugin-tests.js
6794f60 fix hosts in node-unref-tests.js
de85afd Merge commit from fork
da1de1b fix #4065: bitwise operators can return bigints
f4e9d19 switch case liveness: default is always last
7aa47c3 fix #4028: minify live/dead switch cases better
22ecd30 minify: more constant folding for strict equality
4cdf03c fix #4053: reordering of .tsx in node_modules
dc71977 fix #3692: 0 now picks a random ephemeral port
Additional commits viewable in compare view

Updates next from 14.2.35 to 16.1.6

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

60a2aa9 v15.5.10
e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
bf9f084 Sync DoS mitigations for React Flight
c5de33e v15.5.9
dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
7526cd6 v15.5.8
1e9ec41 Update React Version (#41)
16141e5 Update React Version (#30)
e01e589 Backport Next.js changes to v15.5.8 (#23)
Additional commits viewable in compare view

Updates next from 14.2.29 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

60a2aa9 v15.5.10
e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
bf9f084 Sync DoS mitigations for React Flight
c5de33e v15.5.9
dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
7526cd6 v15.5.8
1e9ec41 Update React Version (#41)
16141e5 Update React Version (#30)
e01e589 Backport Next.js changes to v15.5.8 (#23)
Additional commits viewable in compare view

Updates minimatch from 9.0.6 to 10.2.2

Changelog

Sourced from minimatch's changelog.

change log

10.2

Add braceExpandMax option

10.1

Add magicalBraces option for escape

Fix makeRe when partial: true is set.

Fix makeRe when pattern ends in a final ** path part.

10.0

Require node 20 or 22 and higher

9.0

No default export, only named exports.

8.0

Recursive descent parser for extglob, allowing correct support for arbitrarily nested extglob expressions

Bump required Node.js version

7.4

Add escape() method

Add unescape() method

Add Minimatch.hasMagic() method

7.3

Add support for posix character classes in a unicode-aware way.

7.2

Add windowsNoMagicRoot option

7.1

Add optimizationLevel configuration option, and revert the default back to the 6.2 style minimal optimizations, making the advanced transforms introduced in 7.0 opt-in. Also, process provided file paths in the same way in optimizationLevel:2 mode, so most things that matched with optimizationLevel 1 or 0 should match with level 2 as well. However, level 1 is the default, out of an abundance of caution.

... (truncated)

Commits

6d7ac34 10.2.1
2e111f3 coalesce consecutive non-globstar * characters
1a62a2a 10.2.0
758b5a3 changelog 10.2
903e50b add braceExpandMax option, format
a50a110 10.1.3
a08c046 move back to og brace-expansion
fde70d1 10.1.2
05210d8 update deps
ba4093c update workflows and package stuff
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

PR-Codex overview

This PR focuses on updating dependencies across several package.json files and the yarn.lock file, primarily upgrading the versions of next, minimatch, and esbuild, among others.

Detailed summary

Updated next from 14.2.29 to 15.5.10 in examples/ui-demo/package.json.
Updated minimatch from 9.0.4 to 10.2.2 in templates/eslint/package.json.
Updated esbuild from 0.20.1 to 0.27.3 in account-kit/plugingen/package.json.
Updated next from ^14.0.0 to ^16.1.6 in examples/alchemy-privy-integration-example/package.json.
Updated various dependencies in yarn.lock, including @emnapi/runtime and @esbuild packages to newer versions.
Removed deprecated versions of several packages from yarn.lock.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

vercel · 2026-02-22T11:30:51Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aa-sdk-ui-demo	Error		Feb 24, 2026 6:39pm

github-actions · 2026-02-22T11:31:06Z

🔗 Preview Mode

Name	Status	Preview	Updated (UTC)
Alchemy Docs	❌ Failed		Feb 22, 2026, 11:31 AM

…updates Bumps the npm_and_yarn group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` | | [esbuild](https://github.com/evanw/esbuild) | `0.20.2` | `0.25.0` | | [minimatch](https://github.com/isaacs/minimatch) | `9.0.5` | `10.2.1` | | [next](https://github.com/vercel/next.js) | `14.2.29` | `15.5.10` | | [bn.js](https://github.com/indutny/bn.js) | `4.12.2` | `4.12.3` | | [node-forge](https://github.com/digitalbazaar/forge) | `1.3.1` | `1.3.3` | | [undici](https://github.com/nodejs/undici) | `6.21.3` | `6.23.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.19` | `5.4.21` | Bumps the npm_and_yarn group with 1 update in the /account-kit/plugingen directory: [esbuild](https://github.com/evanw/esbuild). Bumps the npm_and_yarn group with 1 update in the /examples/alchemy-privy-integration-example directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /examples/ui-demo directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /templates/eslint directory: [minimatch](https://github.com/isaacs/minimatch). Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `esbuild` from 0.20.2 to 0.25.0 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.20.2...v0.25.0) Updates `minimatch` from 9.0.5 to 10.2.1 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v10.2.1) Updates `next` from 14.2.29 to 15.5.10 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.2.29...v15.5.10) Updates `bn.js` from 4.12.2 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v4.12.2...v4.12.3) Updates `node-forge` from 1.3.1 to 1.3.3 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.3.1...v1.3.3) Updates `undici` from 6.21.3 to 6.23.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.21.3...v6.23.0) Updates `vite` from 5.4.19 to 5.4.21 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `esbuild` from 0.20.2 to 0.27.3 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.20.2...v0.25.0) Updates `next` from 14.2.35 to 16.1.6 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.2.29...v15.5.10) Updates `next` from 14.2.29 to 15.5.10 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.2.29...v15.5.10) Updates `minimatch` from 9.0.6 to 10.2.2 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v10.2.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 10.2.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-forge dependency-version: 1.3.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.23.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 5.4.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.27.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.1.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 10.2.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 22, 2026

dependabot bot requested review from 0xfourzerofour and dancoombs as code owners February 22, 2026 11:30

dependabot bot added the dependencies Pull requests that update a dependency file label Feb 22, 2026

dependabot bot requested review from jakehobbs, niveda-krish and pavelm as code owners February 22, 2026 11:30

dependabot bot added the javascript Pull requests that update javascript code label Feb 22, 2026

dependabot bot requested review from Richard-Dang, SahilAujla, avarobinson, blakecduncan, florrdv and thebrianchen as code owners February 22, 2026 11:30

dependabot bot mentioned this pull request Feb 22, 2026

chore(deps): bump the npm_and_yarn group across 5 directories with 7 updates #2354

Closed

github-actions bot had a problem deploying to docs-preview February 22, 2026 11:31 Failure

vercel bot had a problem deploying to Preview February 22, 2026 11:39 Failure

dependabot bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-5a685a1236 branch from 8a1e1da to 2f74dce Compare February 24, 2026 18:31

vercel bot had a problem deploying to Preview February 24, 2026 18:39 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 5 directories with 8 updates#2356

chore(deps): bump the npm_and_yarn group across 5 directories with 8 updates#2356
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-5a685a1236

dependabot bot commented on behalf of github Feb 22, 2026 •

edited

Loading

Uh oh!

vercel bot commented Feb 22, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

[4.1.1] - 2025-11-12

Security

v0.25.0

Changelog: 2024

0.24.2

0.24.1

change log

10.2

10.1

10.0

9.0

8.0

7.4

7.3

7.2

7.1

v15.5.10

v15.4.11

v15.3.9

v15.2.9

v15.1.12

v15.0.8

1.3.3 - 2025-12-02

Fixed

1.3.2 - 2025-11-25

Security

Fixed

v6.23.0

⚠️ Security Release

v6.22.0

What's Changed

v5.4.21

v5.4.20

5.4.21 (2025-10-20)

5.4.20 (2025-09-08)

v0.25.0

Changelog: 2024

0.24.2

0.24.1

v15.5.10

v15.4.11

v15.3.9

v15.2.9

v15.1.12

v15.0.8

v15.5.10

v15.4.11

v15.3.9

v15.2.9

v15.1.12

v15.0.8

change log

10.2

10.1

10.0

9.0

8.0

7.4

7.3

7.2

7.1

PR-Codex overview

Detailed summary

Uh oh!

vercel bot commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔗 Preview Mode

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

dependabot bot commented on behalf of github Feb 22, 2026 •

edited

Loading

vercel bot commented Feb 22, 2026 •

edited

Loading

github-actions bot commented Feb 22, 2026 •

edited

Loading