Skip to content

chore(deps): bump the npm_and_yarn group across 2 directories with 9 updates - #810

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-5c1116eccb
Open

chore(deps): bump the npm_and_yarn group across 2 directories with 9 updates#810
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-5c1116eccb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package From To
next 16.2.6 16.3.0
next-auth 5.0.0-beta.30 5.0.0-beta.32
@hono/node-server 1.19.13 2.1.0
fast-uri 3.1.2 3.1.5
immutable 5.1.5 5.1.9
ip-address 10.2.0 10.4.0

Bumps the npm_and_yarn group with 1 update in the /tools/env-generator directory: liquidjs.

Updates next from 16.2.6 to 16.3.0

Release notes

Sourced from next's releases.

v16.3.0

Core Changes

  • Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
  • Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
  • Normalize encoded dynamic placeholders in app routes: #91603
  • Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
  • Update tokio from 1.43.0 to 1.47.3: #90945
  • [turbopack] Simplify snapshotting logic: #91178
  • Turbopack: enable server HMR for app route handlers: #91466
  • turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
  • [turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
  • Skip loadBindings() Lightning CSS check during next start: #91538
  • turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
  • Turbopack: Add importModule() support to webpack loaders: #89630
  • turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
  • turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
  • feat(node-streams): add config flag, define-env, and env precedence test: #90427
  • Rename /_next/webpack-hmr to /_next/hmr: #91415
  • Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
  • Handle encoded params further: #91627
  • [turbopack] Respect {eval:true} in worker_threads constructors: #91666
  • Fix missing route in otel spans without base-server: #91665
  • [turbopack] Optimize compaction cpu usage: #91468
  • Fix layout segment optimization: move app-page imports to server-utility transition: #91701
  • Fix server actions in standalone mode with cacheComponents: #91711
  • turbo-persistence: remove Unmergeable mmap advice: #91713
  • turbopack: move "compact database" tracing span to backend layer: #91693
  • Turbopack: lazy require metadata and handle TLA: #91705
  • Fix adapter outputs for dynamic metadata routes: #91680
  • Turbopack: fix webpack loader runner layer: #91727
  • [turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
  • Add module count field to module graph tracing spans: #91697
  • turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
  • Turbopack: pull in updated vercel/nft tests: #91651
  • [turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
  • [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
  • [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
  • Avoid deprecated TS node10 moduleResolution defaults: #91847
  • [turbopack] Rebuild the docker build scripts: #91799
  • Fix TS6 baseUrl deprecation for extended tsconfig: #91855
  • Add next internal post-build CLI command for Turbopack database compaction: #91336
  • Turbopack: Define Effect as a trait instead of a closure: #89080
  • Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
  • turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
  • Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
  • Use charCodeAt for normalizePathTrailingSlash: #91380
  • Turbopack: Only patch lockfile when bindings fails to load: #91379
  • [create-next-app] Skip interactive prompts when CLI flags are provided: #91840
  • [devtools] Make instant navs panel draggable: #91914
  • [Segment Bundling] Bundle static prefetches based on size: #91439

... (truncated)

Commits

Updates next-auth from 5.0.0-beta.30 to 5.0.0-beta.32

Release notes

Sourced from next-auth's releases.

next-auth@5.0.0-beta.32

Beta release for the v5 line.

Picks up the @​auth/core@​0.41.3 security fixes (malformed Bearer token handling in getToken, provider-bound OAuth check cookies, and NFKC email normalization).

Fixes auth checks failing open on provider configuration errors: a non-OK session response now yields no session instead of an error object, so checks like !!auth fail closed.

next-auth@5.0.0-beta.31

Bugfixes (via @​auth/core@​0.41.2)

  • providers: add issuer to GitHub provider for RFC 9207 compliance (#13410).
    • Supports both github.com and GitHub Enterprise Server (dynamic ${baseUrl}/login/oauth).
  • signin/send-token: stricter email address validation (rejects quoted, multi-@, and empty-domain inputs).

Dependency bump

  • @auth/core: 0.41.0 → 0.41.2. Resolves a peer-dep inconsistency in 5.0.0-beta.30 where next-auth declared nodemailer: ^7.0.7 while pinning @auth/core@0.41.0 (which wanted ^6.8.0). Both now align at ^7.0.7.

No changes to next-auth's own source.

Commits
  • e293b37 chore(release): next-auth@5.0.0-beta.32 [skip ci]
  • b690d91 chore: add npm bugs metadata and fix repository field format (#13452)
  • 5af7357 chore(release): bump package version(s) [skip ci]
  • 8a933f9 fix(core): document that getToken returns null for malformed authorization he...
  • 5b1aa47 chore(ci): pin surrealdb test server to the v2 image for the 1.3 client (#13468)
  • 1116034 Chore/nodemailer 8 peer deps (#13434)
  • 7b35fc3 fix(docs): repair docs build broken by floating TypeScript resolution (#13450)
  • b24abfa fix(proxy): override Vercel build command so it doesn't run turbo (#13448)
  • a99514b chore(deps): resolve remaining Dependabot alerts via cross-major dependency u...
  • d008b9b Merge commit from fork
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.


Updates @auth/core from 0.41.0 to 0.41.3

Release notes

Sourced from @​auth/core's releases.

@​auth/core@​0.41.3

Bugfixes

  • core: getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value
  • core: OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback
  • core: email addresses are Unicode-normalized (NFKC) before validation in the default email normalizer, closing a homoglyph @ bypass

Other

  • deps: resolve Dependabot alerts via cross-major dependency upgrades (#13449)
  • deps: resolve Dependabot security advisories via pnpm overrides (#13441)
  • deps: allow nodemailer 8 in peer dependency ranges (#13434)
  • CI formatting and proxy deploy repairs (#13444)

@​auth/core@​0.41.2

Bugfixes

  • providers: add issuer to GitHub provider for RFC 9207 compliance (#13410)

Other

  • sync package versions with npm registry (#13414)

@​auth/core@​0.41.1

Bugfixes

  • security issue from nodemailer (#13305)

Other

  • update links for Credentials-based Authentication (#13258)
Commits
  • 5af7357 chore(release): bump package version(s) [skip ci]
  • 8a933f9 fix(core): document that getToken returns null for malformed authorization he...
  • 5b1aa47 chore(ci): pin surrealdb test server to the v2 image for the 1.3 client (#13468)
  • 1116034 Chore/nodemailer 8 peer deps (#13434)
  • 7b35fc3 fix(docs): repair docs build broken by floating TypeScript resolution (#13450)
  • b24abfa fix(proxy): override Vercel build command so it doesn't run turbo (#13448)
  • a99514b chore(deps): resolve remaining Dependabot alerts via cross-major dependency u...
  • d008b9b Merge commit from fork
  • af42d8f chore: lint (#13446)
  • e707770 Merge commit from fork
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for @​auth/core since your current version.


Updates @hono/node-server from 1.19.13 to 2.1.0

Release notes

Sourced from @​hono/node-server's releases.

v2.1.0

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

New Contributors

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.


Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

Updates immutable from 5.1.5 to 5.1.9

Release notes

Sourced from immutable's releases.

v5.1.9

What's Changed

Full Changelog: immutable-js/immutable-js@v5.1.8...v5.1.9

v5.1.8

What's Changed

Full Changelog: immutable-js/immutable-js@v5.1.7...v5.1.8

v5.1.7

What's Changed

internal

New Contributors

Full Changelog: immutable-js/immutable-js@v5.1.6...v5.1.7

v5.1.6

What's Changed

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.9

  • fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

5.1.8

4.3.9

5.1.7

  • fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063
  • fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203
  • [TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

  • fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196
Commits
  • 329f7a6 5.1.9
  • 21fabd9 changelog
  • 009164f Merge pull request #2235 from immutable-js/fix/avoid-null-when-setsize33
  • 5b65bfb fix(List): preserve undefined values when grown past 32 elements
  • 50bf39e Update CHANGELOG.md for versions 5.1.8 and 4.3.9
  • 6496539 5.1.8
  • 808a83a Merge commit from fork
  • e51d49f perf(Map): index large hash-collision buckets for faster lookups
  • 25c58b0 fix typescript in tests
  • a1a1ee4 Merge commit from fork
  • Additional commits viewable in compare view

Updates ip-address from 10.2.0 to 10.4.0

Release notes

Sourced from ip-address's releases.

v10.4.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits
  • fbb8db2 10.4.0
  • 45a2b11 Validate the byte arrays Address6 is given (#217)
  • bac8810 Keep the package loadable on node 12, and enforce it (#216)
  • 9b3d848 Add a security policy and a README section on security posture
  • e84a7b3 Order the README API reference Address4, Address6, AddressError
  • 015160b Collapse each class in the README API reference
  • 34061a8 Pin checkout and setup-node to commits in the release job
  • c5fae5d Pin action-gh-release to a commit and move it to 3.0.2
  • e0ef048 Replace CircleCI with GitHub Actions
  • 5e3ceb7 Add GitHub Actions CI across Node 20, 22, 24 and 25 (#213)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates sharp from 0.34.5 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

  • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

  • Improve code bundler support by resolving path to libvips binary.

  • Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

  • Emit warning about binaries provided by Electron for use on Linux.

  • Add hasAlpha property to output info. #4500

  • TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

  • Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

  • Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

  • Reject infinite values when validating numbers. #4553 @​metsw24-max

  • Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

  • Verify background colour values are numbers. #4556 @​metsw24-max

  • Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

  • Tighten recomb and affine matrix verification. #4560 @​chatman-media

  • Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

  • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits
  • 1018449 Release v0.35.3
  • ba303a7 Prerelease v0.35.3-rc.2
  • 4f94fc5 Upgrade to sharp-libvips v1.3.2
  • c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
  • 9a8d002 Docs: Add changelog entry and note about transferable #4520
  • 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
  • e000d0b Prerelease v0.35.3-rc.1
  • 9554ca9 Prerelease v0.35.3-rc.0
  • 6a29fd5 Emit warning about native binaries on Linux Electron
  • 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
  • Additional commits viewable in compare view

Updates liquidjs from 10.26.0 to 10.27.1

Release notes

Sourced from liquidjs's releases.

v10.27.1

10.27.1 (2026-06-23)

Bug Fixes

  • improve round function; improvement to #873 (#901) (956b51e)
  • security: charge pop filter allocation to memoryLimit (#907) (8a0c74a)
  • strip_html: infinite loop for strip_html (5c3522f)

Performance Improvements

  • parser: memoize createTrie to avoid rebuilding tries per Tokenizer (#911) (3a0d80d)

v10.27.0

10.27.0 (2026-05-15)

Features

  • context: null-prototype scope frames via createScope (#899) (47d3f1b)
Changelog

Sourced from liquidjs's changelog.

10.27.1 (2026-06-23)

Bug Fixes

  • improve round function; improvement to #873 (#901) (956b51e)
  • security: charge pop filter allocation to memoryLimit (#907) (8a0c74a)
  • strip_html: infinite loop for strip_html (5c3522f)

Performance Improvements

  • parser: memoize createTrie to avoid rebuilding tries per Tokenizer (#911) (3a0d80d)

10.27.0 (2026-05-15)

Features

  • context: null-prototype scope frames via createScope (#899) (47d3f1b)
Commits
  • ed48986 chore(release): 10.27.1 [skip ci]
  • afec88b docs(readme): README overhaul, used-by grid, and docs homepage (#914)
  • 3a0d80d perf(parser): memoize createTrie to avoid rebuilding tries per Tokenizer (#911)
  • 956b51e fix: improve round function; improvement to #873 (#901)
  • 5c3522f fix(strip_html): infinite loop for strip_html
  • 6d00257 docs: add AGENTS.md and llms.txt for AI agents (#919)
  • 03a30e6 docs: replace CookieHub with cookieconsent (#918)
  • 4775227 docs(security): route vulnerability reports to GitHub Advisories (#913)
  • 8a0c74a fix(security): charge pop filter allocation to memoryLimit (#907)
  • ed15a52 docs: revisit wording & style for liquidjs.com (#906)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the npm_and_yarn group across 2 directories with 9 …
e003c3a 
…updates

Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `16.2.6` | `16.3.0` |
| [next-auth](https://github.com/nextauthjs/next-auth) | `5.0.0-beta.30` | `5.0.0-beta.32` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.13` | `2.1.0` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.5` |
| [immutable](https://github.com/immutable-js/immutable-js) | `5.1.5` | `5.1.9` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.4.0` |

Bumps the npm_and_yarn group with 1 update in the /tools/env-generator directory: [liquidjs](https://github.com/harttle/liquidjs).


Updates `next` from 16.2.6 to 16.3.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.6...v16.3.0)

Updates `next-auth` from 5.0.0-beta.30 to 5.0.0-beta.32
- [Release notes](https://github.com/nextauthjs/next-auth/releases)
- [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.30...next-auth@5.0.0-beta.32)

Updates `@auth/core` from 0.41.0 to 0.41.3
- [Release notes](https://github.com/nextauthjs/next-auth/releases)
- [Commits](https://github.com/nextauthjs/next-auth/compare/@auth/core@0.41.0...@auth/core@0.41.3)

Updates `@hono/node-server` from 1.19.13 to 2.1.0
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.13...v2.1.0)

Updates `fast-uri` from 3.1.2 to 3.1.5
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.5)

Updates `immutable` from 5.1.5 to 5.1.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9)

Updates `ip-address` from 10.2.0 to 10.4.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.4.0)

Updates `sharp` from 0.34.5 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.3)

Updates `liquidjs` from 10.26.0 to 10.27.1
- [Release notes](https://github.com/harttle/liquidjs/releases)
- [Changelog](https://github.com/harttle/liquidjs/blob/master/CHANGELOG.md)
- [Commits](harttle/liquidjs@v10.26.0...v10.27.1)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.3.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next-auth
  dependency-version: 5.0.0-beta.32
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@auth/core"
  dependency-version: 0.41.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: liquidjs
  dependency-version: 10.27.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 5, 2026
@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants