Skip to content

Bump the all-dependencies group across 1 directory with 34 updates - #2187

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-dependencies-e7f10a16b2
Open

Bump the all-dependencies group across 1 directory with 34 updates#2187
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-dependencies-e7f10a16b2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 34 updates in the / directory:

Package From To
@amplitude/analytics-browser 2.23.7 2.45.6
@ledgerhq/hw-app-str 7.2.9 7.7.7
@ledgerhq/hw-transport-webhid 6.30.9 6.36.0
@next/third-parties 15.5.7 16.3.2
@sentry/nextjs 10.29.0 10.70.0
@stellar-expert/contract-wasm-interface-parser 4.1.0 5.0.1
@tanstack/react-query 5.87.4 5.101.4
@tanstack/react-query-devtools 5.87.4 5.101.4
@trezor/connect-web 9.6.4 9.7.3
bignumber.js 9.3.1 11.1.5
dompurify 3.2.6 3.4.14
html-react-parser 5.2.6 6.1.7
immer 10.1.3 11.1.18
lodash 4.17.21 4.18.1
@types/lodash 4.17.20 4.17.25
lossless-json 4.2.0 4.3.1
next 15.5.15 16.3.2
papaparse 5.5.3 5.6.0
@types/papaparse 5.3.16 5.5.2
uuid 11.1.0 14.0.2
zustand-querystring 0.0.19 0.7.0
@next/eslint-plugin-next 15.5.3 16.3.2
@playwright/test 1.57.0 1.62.1
@types/node 24.3.1 26.2.0
@typescript-eslint/eslint-plugin 8.62.0 8.67.0
@typescript-eslint/parser 8.62.0 8.67.0
eslint 9.35.0 10.9.0
eslint-config-next 15.4.4 16.3.2
eslint-plugin-react-hooks 5.2.0 7.1.1
jest 30.2.0 30.4.2
lint-staged 16.1.6 17.3.0
prettier 3.6.2 3.9.6
sass 1.92.1 1.103.1
typescript 5.9.2 7.0.2

Updates @amplitude/analytics-browser from 2.23.7 to 2.45.6

Release notes

Sourced from @​amplitude/analytics-browser's releases.

@​amplitude/analytics-browser@​2.45.6

2.45.6 (2026-08-12)

Bug Fixes

  • deps: remediate Semgrep supply chain findings (#1921) (e131df0)

@​amplitude/analytics-browser@​2.45.5

2.45.5 (2026-07-28)

Note: Version bump only for package @​amplitude/analytics-browser

@​amplitude/analytics-browser@​2.45.4

2.45.4 (2026-07-22)

Note: Version bump only for package @​amplitude/analytics-browser

Commits
  • 744a2fa chore(release): publish
  • f82e521 fix(build): use @​babel/preset-env in snippet build scripts (#1933)
  • fa799ea fix(analytics-node): add a request timeout to the HTTP transport (#1923)
  • a53cfc3 chore: fix analytics-browser test coverage failure on node 26 (#1928)
  • 379347c chore: fix session-replay-browser test coverage failure (#1927)
  • 55b61d6 chore(deps): bump nanoid from 3.3.4 to 3.3.12 in /packages/analytics-browser/...
  • 343f9e6 chore: test node v26 (#1926)
  • 87486e9 fix(analytics-core): drop events with an empty event type before upload (#1920)
  • e131df0 fix(deps): remediate Semgrep supply chain findings (#1921)
  • 7ec3411 chore(analytics-browser): add platform and web_environment tags to diagnostic...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​amplitude/analytics-browser since your current version.


Updates @ledgerhq/hw-app-str from 7.2.9 to 7.7.7

Release notes

Sourced from @​ledgerhq/hw-app-str's releases.

gh-attach attachments

This is a dummy release used by gh-attach as storage for attachment files linked from issues and pull requests.

[!WARNING] Do not delete this release or its assets — doing so will break attachment links and embeds that reference them.

Commits

Updates @ledgerhq/hw-transport-webhid from 6.30.9 to 6.36.0

Release notes

Sourced from @​ledgerhq/hw-transport-webhid's releases.

gh-attach attachments

This is a dummy release used by gh-attach as storage for attachment files linked from issues and pull requests.

[!WARNING] Do not delete this release or its assets — doing so will break attachment links and embeds that reference them.

Commits
  • 782f01b Merge release into main
  • e60462f chore(release): 🚀 prepare release [skip ci]
  • bbdd288 Merge pull request #19127 from LedgerHQ/lwd_410_release_notes
  • 5c97666 LWD 4.10 release notes
  • bace3e1 Merge pull request #19109 from LedgerHQ/support/qaa_release_fix_settings
  • 9b71dcf Merge pull request #19106 from LedgerHQ/support/qaa_fix_my_wallet_setting
  • 4e38e75 chore(prerelease): 🚀 release prerelease [LLD(4.10.0-next.6), LLM(4.10....
  • eec1dad Merge pull request #19098 from LedgerHQ/support/cherry-pick-ff-env-resolve-at...
  • 6a0d89f Merge pull request #19097 from LedgerHQ/support/release_fix_q1_w40
  • 98eb6d6 Merge pull request #19073 from LedgerHQ/fix/ff-env-flags-base-resolved
  • Additional commits viewable in compare view

Updates @next/third-parties from 15.5.7 to 16.3.2

Release notes

Sourced from @​next/third-parties's releases.

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.1-canary.26

Misc Changes

  • docs: document deploymentId build ID override and Pages Router skew in 16.2: #97645
  • Upgrade React from eb8feb71-20260814 to eafeac09-20260819: #97636
  • Turbopack: rename to use turbopack: no side effects: #94427
  • refactor: move useDynamic{Route,Search}Params to reduce snapshot churn: #97360

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​next/third-parties since your current version.


Updates @sentry/nextjs from 10.29.0 to 10.70.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.70.0

  • feat(v10/core): Support stable MCP SDK v2 (#22986)
  • feat(v10/deps): Bump @sentry/node-cpu-profiler to 2.4.3 (#22992)
  • feat(v10/solid,solidstart): Support @solidjs/router v1 (#23163)
  • fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23189)
  • fix(v10/cloudflare): Get original waituntil in workflows (#23192)
  • fix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy (#23190)
  • fix(v10/cloudflare): Set agent conversation id on the onRequest path (#22985)
  • fix(v10/cloudflare): Set conversation id independent of session name (#23193)
  • fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)
  • fix(v10/cloudflare): Use gen_ai.agent.name for class names (#22987)
  • fix(v10/core,browser): Handle errors from other realms (#23201)
  • fix(v10/core): Sample errors after beforeSend while preserving session updates (#22819)
  • fix(v10/hono): Include originalException in captured exception hint (#22990)
  • fix(v10/nextjs): meriyah issue for standalone build (#23055)
  • fix(v10/nextjs): Remove tracing from middleware wrappers (#22904)
  • fix(v10/profiling-node): Respect profileSessionSampleRate in trace profile lifecycle (#22940)
  • fix(v10/react-router): Preserve sourcemaps.disable when unstable_sentryVitePluginOptions is set (#22966)
  • fix(v10/react): Remove routes from shared set on <Routes> unmount (#22948)
  • fix(v10/sveltekit): Export metrics from worker entry point (#23027)
  • test(v10/e2e): Add missing @sentry/core dep to nextjs-16-userfeedback (#23009)
  • test(v10/e2e): Fix failing sveltekit-3 test (#23016)
  • test(v10/e2e): Fix type error in nextjs ai-error tests (#23011)
  • test(v10/e2e): Pin tanstackstart-react e2e deps to unblock tunnel tests (#23048)

Work in this release was contributed by @​davidmurdoch, @​Jxxunnn, and @​kamilogorek. Thank you for your contributions!

Bundle size 📦

Path Size
@​sentry/browser 27.09 KB
@​sentry/browser - with treeshaking flags 25.58 KB
@​sentry/browser (incl. Tracing) 45.5 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.24 KB
@​sentry/browser (incl. Tracing, Profiling) 50.13 KB
@​sentry/browser (incl. Tracing, Replay) 83.82 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.7 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.42 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.78 KB
@​sentry/browser (incl. Feedback) 43.87 KB
@​sentry/browser (incl. sendFeedback) 31.78 KB
@​sentry/browser (incl. FeedbackAsync) 36.79 KB
@​sentry/browser (incl. Metrics) 28.16 KB

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.70.0

  • feat(v10/core): Support stable MCP SDK v2 (#22986)
  • feat(v10/deps): Bump @sentry/node-cpu-profiler to 2.4.3 (#22992)
  • feat(v10/solid,solidstart): Support @solidjs/router v1 (#23163)
  • fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23189)
  • fix(v10/cloudflare): Get original waituntil in workflows (#23192)
  • fix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy (#23190)
  • fix(v10/cloudflare): Set agent conversation id on the onRequest path (#22985)
  • fix(v10/cloudflare): Set conversation id independent of session name (#23193)
  • fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)
  • fix(v10/cloudflare): Use gen_ai.agent.name for class names (#22987)
  • fix(v10/core,browser): Handle errors from other realms (#23201)
  • fix(v10/core): Sample errors after beforeSend while preserving session updates (#22819)
  • fix(v10/hono): Include originalException in captured exception hint (#22990)
  • fix(v10/nextjs): meriyah issue for standalone build (#23055)
  • fix(v10/nextjs): Remove tracing from middleware wrappers (#22904)
  • fix(v10/profiling-node): Respect profileSessionSampleRate in trace profile lifecycle (#22940)
  • fix(v10/react-router): Preserve sourcemaps.disable when unstable_sentryVitePluginOptions is set (#22966)
  • fix(v10/react): Remove routes from shared set on <Routes> unmount (#22948)
  • fix(v10/sveltekit): Export metrics from worker entry point (#23027)
  • test(v10/e2e): Add missing @sentry/core dep to nextjs-16-userfeedback (#23009)
  • test(v10/e2e): Fix failing sveltekit-3 test (#23016)
  • test(v10/e2e): Fix type error in nextjs ai-error tests (#23011)
  • test(v10/e2e): Pin tanstackstart-react e2e deps to unblock tunnel tests (#23048)

Work in this release was contributed by @​davidmurdoch, @​Jxxunnn, and @​kamilogorek. Thank you for your contributions!

10.69.0

Important Changes

  • feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#22786)

The Cloudflare SDK adds a new instrumentAgentWithSentry API for Cloudflare Agents. It works like instrumentDurableObjectWithSentry for Agent classes from the agents SDK and additionally creates spans for @callable RPC methods and automatically sets the conversationId based on the agent's name. When building with the Sentry Vite plugin, Agents are instrumented automatically (#22788).

Other Changes

  • feat(v10/cloudflare): Add Spotlight integration for local dev event forwarding (#22796)
  • feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)
  • feat(v10/cloudflare): Filter framework-internal Durable Object storage spans (#22770)
  • feat(v10/cloudflare): Instrument Agents automatically (#22788)
  • feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)
  • fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)

... (truncated)

Commits
  • 0356ffd release: 10.70.0
  • c2ac1be meta(changelog): Update changelog for 10.70.0 (#23217)
  • 9c2f31d fix(v10/core,browser): Handle errors from other realms (#23201)
  • 8ad6cd1 fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)
  • 4b5e80a fix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy ...
  • 91af62c fix(v10/cloudflare): Set conversation id independent of session name (#23193)
  • 2096839 fix(v10/cloudflare): Get original waituntil in workflows (#23192)
  • 0062819 fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23...
  • 390b05a feat(v10/core): Support stable MCP SDK v2 (#22986)
  • 3b56ecb feat(v10/solid,solidstart): Support @solidjs/router v1 (#23163)
  • Additional commits viewable in compare view

Updates @stellar-expert/contract-wasm-interface-parser from 4.1.0 to 5.0.1

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates @tanstack/react-query from 5.87.4 to 5.101.4

Changelog

Sourced from @​tanstack/react-query's changelog.

5.101.4

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.101.4

5.101.3

Patch Changes

  • Updated dependencies [7e3c822]:
    • @​tanstack/query-core@​5.101.3

5.101.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.101.2

5.101.1

Patch Changes

  • Updated dependencies [9eff92e]:
    • @​tanstack/query-core@​5.101.1

5.101.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.101.0

5.100.14

Patch Changes

  • fix(react-query): do not go into optimistic fetching state when not subscribed (#10759)

  • Updated dependencies []:

    • @​tanstack/query-core@​5.100.14

5.100.13

Patch Changes

  • Updated dependencies [d423168]:
    • @​tanstack/query-core@​5.100.13

... (truncated)

Commits
  • 86bb8a6 ci: Version Packages (#11094)
  • 181ea82 ci: Version Packages (#11089)
  • 6d55b07 test({react,preact}-query): use the '.then()' convention consistently (#11085)
  • 44f38df test({react,preact,solid}-query/useInfiniteQuery): inline the shared 'fetchIt...
  • d1558c1 test({react,preact}-query/usePrefetchQuery): inline the 'generateQueryFn' fac...
  • 99690d1 test({react,preact}-query/usePrefetchInfiniteQuery): inline single-use helper...
  • 10770f0 test({react,preact}-query/usePrefetchInfiniteQuery): inline the shared 'Suspe...
  • dbd5a86 test({react,preact}-query/usePrefetchQuery): inline the shared 'Suspended' co...
  • b955f60 test({react,preact}-query/useSuspenseQuery): assert the 'loading' fallback is...
  • b9c657e test({react,preact}-query/usePrefetchQuery): assert the 'Loading...' fallback...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tanstack/react-query since your current version.


Updates @tanstack/react-query-devtools from 5.87.4 to 5.101.4

Changelog

Sourced from @​tanstack/react-query-devtools's changelog.

5.101.4

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.101.4
    • @​tanstack/react-query@​5.101.4

5.101.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.101.3
    • @​tanstack/react-query@​5.101.3

5.101.2

Patch Changes

5.101.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.101.1
    • @​tanstack/react-query@​5.101.1

5.101.0

Patch Changes

5.100.14

Patch Changes

  • Updated dependencies [ed20b6d]:
    • @​tanstack/react-query@​5.100.14
    • @​tanstack/query-devtools@​5.100.14

5.100.13

... (truncated)

Commits
  • 86bb8a6 ci: Version Packages (#11094)
  • 181ea82 ci: Version Packages (#11089)
  • c476781 test({react,preact}-query-devtools): assert the forwarded 'onClose' callback ...
  • 6a5bc45 test(react-query-devtools): extract shared test setup into 'beforeEach' (#11026)
  • cb115ea test(react-query-devtools/ReactQueryDevtools): add tests for forwarding optio...
  • 610e8d1 ci: Version Packages (#10996)
  • b809297 ci: Version Packages (#10977)
  • f3d8d2a ci: Version Packages (#10774)
  • 2d27c4e test(react-query-devtools/ReactQueryDevtools{,Panel}): add tests for the full...
  • e0245c7 test(react-query-devtools/ReactQueryDevtools): add tests for forwarding 'butt...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tanstack/react-query-devtools since your current version.


Updates @trezor/connect-web from 9.6.4 to 9.7.3

Release notes

Sourced from @​trezor/connect-web's releases.

v26.7.2@mobile

Trezor Suite 26.7.2 for Android is now available also on: https://data.trezor.io/suite/releases/mobile/v26.7.2

🚀 New features

  • Added support for Robinhood Chain network
  • Tron staking has been added with view-only functionality
  • Stablecoin yield added, enabling you to earn yield on USDC and USDT directly in the app
  • Solana staking management added, letting you stake, unstake, and track your staking position, pending actions, and staking & rewards history
  • Preview step added to the Buy flow, making it easier to review important transaction details
  • Custom backend configuration now available for all supported networks on mobile
  • URI handlers for Bitcoin payments (BIP-321) added, simplifying on-chain payments via QR code
  • Transaction labels can be imported / exported using the BIP-329 format
  • Address chunking possible for Solana, making it easier to confirm addresses

🎨 Improvements

  • Account Settings relocated to the Account Details menu
  • UX improvements for DEX trading flows
  • Clear Signing coverage enhanced for 1inch transactions
  • Slippage performance improved for trades
  • Transaction signing blocked when a Sell quote expires before confirmation
  • Coins are now renamed as ‘Networks’ in the application settings
  • Multiple UX & UI fixes and performance improvements throughout the app

🔧 Bug fixes

  • Fixed Stellar account discovery issues
  • APY breakdown messaging added and aligned with the desktop app
  • Fiat balances now shown for the native coin rather than the entire account
  • Internal transfers now shown in transaction history
  • Transaction flow fixed for Swaps requiring token approval
  • Coin and token terminology fixed to match desktop app
  • Minor bugs and usability improvements across the app

v26.7.1@mobile

Trezor Suite 26.7.1 for Android is now available also on: https://data.trezor.io/suite/releases/mobile/v26.7.1

🚀 New features

  • Tron staking has been added with view-only functionality
  • Stablecoin yield added, enabling you to earn yield on USDC and USDT directly in the app
  • Solana staking management added, letting you stake, unstake, and track your staking position, pending actions, and staking & rewards history
  • Preview step added to the Buy flow, making it easier to review important transaction details
  • Custom backend configuration now available for all supported networks on mobile
  • URI handlers for Bitcoin payments (BIP-321) added, simplifying on-chain payments via QR code
  • Transaction labels can be imported / exported using the BIP-329 format
  • Address chunking possible for Solana, making it easier to confirm addresses

🎨 Improvements

  • Account Settings relocated to the Account Details menu
  • UX improvements for DEX trading flows
  • Clear Signing coverage enhanced for 1inch transactions
  • Slippage performance improved for trades

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​trezor/connect-web since your current version.

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.


Updates bignumber.js from 9.3.1 to 11.1.5

Release notes

Sourced from bignumber.js's releases.

v11.1.3

v11.1 adds a few useful improvements around formatting, parsing, rounding, and interoperability.

BigNumber.sum() now returns zero when called with no arguments, which makes patterns like BigNumber.sum(...arr) work cleanly even when the array is empty.

BigNumber.sum(...[]).toString()      // "0"

toBigInt() has been added, so BigNumber values can now be converted directly to native BigInt values.

new BigNumber("123.9").toBigInt(BigNumber.ROUND_DOWN)        // 123n

There is also a new BigNumber.fromFormat() method for parsing formatted strings back into BigNumber values.

const options =  {  prefix"€",  groupSeparator".",  decimalSeparator"," }
BigNumber.fromFormat("€1.234.567,89", options).toString()      // "1234567.89"

Negative decimal places are now supported by decimalPlaces(), toFixed(), and toFormat(), making it easier to round to tens, hundreds, and thousands etc.

new BigNumber("1234.5").toFormat(-2)      // "1,200"

toFormat() has also been expanded to support minimum and maximum decimal places, and per-call formatting options now fall back to the configured global FORMAT values for anything not explicitly overridden.

new BigNumber("12.3456789").toFormat([2, 5])      // "12.34568"

This release also includes a fix for slow hexadecimal integer base conversion when DECIMAL_PLACES is very large, plus improved TypeScript API test coverage.

Changelog

Sourced from bignumber.js's changelog.

11.1.5

  • 05/07/26
  • #409 toFraction returning a sub-optimal rational approximation.

11.1.4

  • 16/06/26
  • [BUGFIX] #407 Fix toFormat duplicating the fraction when groupSize is 0.

11.1.3

  • 05/06/26
  • #406 Fix EXPONENTIAL_AT default value documentation.

11.1.2

  • 30/05/26
  • [BUGFIX] #405 Fix invalid toFormat output for -0.

11.1.1

  • 02/05/26
  • Docs: fix version number and decimalPlaces API description.

11.1.0

  • 30/04/26
  • #401 BigNumber.sum: return zero if there are no arguments.
  • #352 Add toBigInt method.
  • #286 Add fromFormat method.
  • #262 decimalPlaces, toFixed and toFormat: support negative decimal places.
  • #260 toFormat: support minimum/maximum decimal places.
  • toFormat: fallback to FORMAT for each property not in options.
  • [BUGFIX] #342 Large DECIMAL_PLACES causing slow hex integer base conversion.
  • Typescript: add test_api.ts to improved typed API test coverage.

11.0.0

  • 14/04/26
  • Add STRICT configuration option: if true (default), throw an exception on invalid input. if false, return NaN on invalid input.
  • toFraction: return [1, 0] for Infinity and [0, 0] for NaN.
  • Support underscores as separators.
  • If a base is supplied, reject non-finite values and base prefixes.

10.0.2

  • 24/02/26

... (truncated)

Commits

Updates dompurify from 3.2.6 to 3.4.14

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.14

  • Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
  • Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
  • Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
  • Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
  • Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
  • Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.11

  • Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
  • Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
  • Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
  • Updated up the linting tool-chain and removed now-redundant lint directives
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.10

  • Refactored codebase for clarity: extracted the public type declarations into types.ts
  • Decomposed the three largest sanitizer functions into focused helpers
  • Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
  • Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
  • Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
  • Reduced CI cost by running the full three-engine browser suite once per PR
  • Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
  • Documented the bench and test:happydom scripts in the README
  • Completed the Attack Classes & Bypass History wiki page
  • Bumped several dependencies where possible

DOMPurify 3.4.9

  • Further improved the handling of Trusted Types config options, thanks @​offset
  • Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
  • Added more test coverage for IN_PLACE and Trusted Types related usage
  • Bumped several dependencies where possible
  • Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

... (truncated)

Commits

Bumps the all-dependencies group with 34 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@amplitude/analytics-browser](https://github.com/amplitude/Amplitude-TypeScript) | `2.23.7` | `2.45.6` |
| [@ledgerhq/hw-app-str](https://github.com/LedgerHQ/ledger-live) | `7.2.9` | `7.7.7` |
| [@ledgerhq/hw-transport-webhid](https://github.com/LedgerHQ/ledger-live) | `6.30.9` | `6.36.0` |
| [@next/third-parties](https://github.com/vercel/next.js/tree/HEAD/packages/third-parties) | `15.5.7` | `16.3.2` |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.29.0` | `10.70.0` |
| [@stellar-expert/contract-wasm-interface-parser](https://github.com/stellar-expert/contract-wasm-interface-parser) | `4.1.0` | `5.0.1` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.87.4` | `5.101.4` |
| [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.87.4` | `5.101.4` |
| [@trezor/connect-web](https://github.com/trezor/trezor-suite) | `9.6.4` | `9.7.3` |
| [bignumber.js](https://github.com/MikeMcl/bignumber.js) | `9.3.1` | `11.1.5` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.2.6` | `3.4.14` |
| [html-react-parser](https://github.com/remarkablemark/html-react-parser) | `5.2.6` | `6.1.7` |
| [immer](https://github.com/immerjs/immer) | `10.1.3` | `11.1.18` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.20` | `4.17.25` |
| [lossless-json](https://github.com/josdejong/lossless-json) | `4.2.0` | `4.3.1` |
| [next](https://github.com/vercel/next.js) | `15.5.15` | `16.3.2` |
| [papaparse](https://github.com/mholt/PapaParse) | `5.5.3` | `5.6.0` |
| [@types/papaparse](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/papaparse) | `5.3.16` | `5.5.2` |
| [uuid](https://github.com/uuidjs/uuid) | `11.1.0` | `14.0.2` |
| [zustand-querystring](https://github.com/nitedani/zustand-querystring) | `0.0.19` | `0.7.0` |
| [@next/eslint-plugin-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-plugin-next) | `15.5.3` | `16.3.2` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.57.0` | `1.62.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.3.1` | `26.2.0` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.62.0` | `8.67.0` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.62.0` | `8.67.0` |
| [eslint](https://github.com/eslint/eslint) | `9.35.0` | `10.9.0` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `15.4.4` | `16.3.2` |
| [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) | `5.2.0` | `7.1.1` |
| [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.2.0` | `30.4.2` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `16.1.6` | `17.3.0` |
| [prettier](https://github.com/prettier/prettier) | `3.6.2` | `3.9.6` |
| [sass](https://github.com/sass/dart-sass) | `1.92.1` | `1.103.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.2` | `7.0.2` |



Updates `@amplitude/analytics-browser` from 2.23.7 to 2.45.6
- [Release notes](https://github.com/amplitude/Amplitude-TypeScript/releases)
- [Commits](https://github.com/amplitude/Amplitude-TypeScript/compare/@amplitude/analytics-browser@2.23.7...@amplitude/analytics-browser@2.45.6)

Updates `@ledgerhq/hw-app-str` from 7.2.9 to 7.7.7
- [Release notes](https://github.com/LedgerHQ/ledger-live/releases)
- [Commits](https://github.com/LedgerHQ/ledger-live/commits/@ledgerhq/hw-app-str@7.7.7)

Updates `@ledgerhq/hw-transport-webhid` from 6.30.9 to 6.36.0
- [Release notes](https://github.com/LedgerHQ/ledger-live/releases)
- [Commits](https://github.com/LedgerHQ/ledger-live/compare/@ledgerhq/hw-transport-http@6.30.9...@ledgerhq/hw-transport-webhid@6.36.0)

Updates `@next/third-parties` from 15.5.7 to 16.3.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.2/packages/third-parties)

Updates `@sentry/nextjs` from 10.29.0 to 10.70.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.70.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.29.0...10.70.0)

Updates `@stellar-expert/contract-wasm-interface-parser` from 4.1.0 to 5.0.1
- [Commits](https://github.com/stellar-expert/contract-wasm-interface-parser/commits)

Updates `@tanstack/react-query` from 5.87.4 to 5.101.4
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.4/packages/react-query)

Updates `@tanstack/react-query-devtools` from 5.87.4 to 5.101.4
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.101.4/packages/react-query-devtools)

Updates `@trezor/connect-web` from 9.6.4 to 9.7.3
- [Release notes](https://github.com/trezor/trezor-suite/releases)
- [Commits](https://github.com/trezor/trezor-suite/commits)

Updates `bignumber.js` from 9.3.1 to 11.1.5
- [Release notes](https://github.com/MikeMcl/bignumber.js/releases)
- [Changelog](https://github.com/MikeMcl/bignumber.js/blob/main/CHANGELOG.md)
- [Commits](MikeMcl/bignumber.js@v9.3.1...v11.1.5)

Updates `dompurify` from 3.2.6 to 3.4.14
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.2.6...3.4.14)

Updates `html-react-parser` from 5.2.6 to 6.1.7
- [Release notes](https://github.com/remarkablemark/html-react-parser/releases)
- [Changelog](https://github.com/remarkablemark/html-react-parser/blob/master/CHANGELOG.md)
- [Commits](remarkablemark/html-react-parser@v5.2.6...v6.1.7)

Updates `immer` from 10.1.3 to 11.1.18
- [Release notes](https://github.com/immerjs/immer/releases)
- [Commits](immerjs/immer@v10.1.3...v11.1.18)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `@types/lodash` from 4.17.20 to 4.17.25
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

Updates `lossless-json` from 4.2.0 to 4.3.1
- [Changelog](https://github.com/josdejong/lossless-json/blob/main/CHANGELOG.md)
- [Commits](josdejong/lossless-json@v4.2.0...v4.3.1)

Updates `next` from 15.5.15 to 16.3.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v15.5.15...v16.3.2)

Updates `papaparse` from 5.5.3 to 5.6.0
- [Release notes](https://github.com/mholt/PapaParse/releases)
- [Changelog](https://github.com/mholt/PapaParse/blob/master/CHANGELOG.md)
- [Commits](mholt/PapaParse@5.5.3...5.6.0)

Updates `@types/papaparse` from 5.3.16 to 5.5.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/papaparse)

Updates `uuid` from 11.1.0 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v11.1.0...v14.0.2)

Updates `zustand-querystring` from 0.0.19 to 0.7.0
- [Release notes](https://github.com/nitedani/zustand-querystring/releases)
- [Commits](https://github.com/nitedani/zustand-querystring/commits)

Updates `@next/eslint-plugin-next` from 15.5.3 to 16.3.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.2/packages/eslint-plugin-next)

Updates `@playwright/test` from 1.57.0 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.57.0...v1.62.1)

Updates `@types/lodash` from 4.17.20 to 4.17.25
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

Updates `@types/node` from 24.3.1 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/papaparse` from 5.3.16 to 5.5.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/papaparse)

Updates `@typescript-eslint/eslint-plugin` from 8.62.0 to 8.67.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.62.0 to 8.67.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/parser)

Updates `eslint` from 9.35.0 to 10.9.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.35.0...v10.9.0)

Updates `eslint-config-next` from 15.4.4 to 16.3.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.2/packages/eslint-config-next)

Updates `eslint-plugin-react-hooks` from 5.2.0 to 7.1.1
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/eslint-plugin-react-hooks@7.1.1/packages/eslint-plugin-react-hooks)

Updates `jest` from 30.2.0 to 30.4.2
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.4.2/packages/jest)

Updates `lint-staged` from 16.1.6 to 17.3.0
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v16.1.6...v17.3.0)

Updates `prettier` from 3.6.2 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.6.2...3.9.6)

Updates `sass` from 1.92.1 to 1.103.1
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.92.1...1.103.1)

Updates `typescript` from 5.9.2 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.2...v7.0.2)

---
updated-dependencies:
- dependency-name: "@amplitude/analytics-browser"
  dependency-version: 2.45.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@ledgerhq/hw-app-str"
  dependency-version: 7.7.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@ledgerhq/hw-transport-webhid"
  dependency-version: 6.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@next/third-parties"
  dependency-version: 16.3.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@sentry/nextjs"
  dependency-version: 10.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@stellar-expert/contract-wasm-interface-parser"
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.101.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@tanstack/react-query-devtools"
  dependency-version: 5.101.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@trezor/connect-web"
  dependency-version: 9.7.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: bignumber.js
  dependency-version: 11.1.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: dompurify
  dependency-version: 3.4.14
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: html-react-parser
  dependency-version: 6.1.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: immer
  dependency-version: 11.1.18
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@types/lodash"
  dependency-version: 4.17.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: lossless-json
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: next
  dependency-version: 16.3.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: papaparse
  dependency-version: 5.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@types/papaparse"
  dependency-version: 5.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: zustand-querystring
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@next/eslint-plugin-next"
  dependency-version: 16.3.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@playwright/test"
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@types/lodash"
  dependency-version: 4.17.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@types/papaparse"
  dependency-version: 5.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: eslint
  dependency-version: 10.9.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: eslint-config-next
  dependency-version: 16.3.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: eslint-plugin-react-hooks
  dependency-version: 7.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: jest
  dependency-version: 30.4.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: lint-staged
  dependency-version: 17.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: sass
  dependency-version: 1.103.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 25, 2026
Copilot AI balanced review requested due to automatic review settings August 25, 2026 13:25
@github-project-automation github-project-automation Bot moved this to Backlog (Not Ready) in DevX Aug 25, 2026
@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
License policy violation: npm @ethereumjs/rlp under MPL-2.0

Location: Package overview

From: pnpm-lock.yamlnpm/@trezor/connect-web@9.7.3npm/@creit.tech/stellar-wallets-kit@2.5.0npm/@trezor/connect-plugin-stellar@9.2.3npm/@ethereumjs/rlp@10.1.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@ethereumjs/rlp@10.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @ethereumjs/tx under MPL-2.0

Location: Package overview

From: pnpm-lock.yamlnpm/@trezor/connect-web@9.7.3npm/@creit.tech/stellar-wallets-kit@2.5.0npm/@trezor/connect-plugin-stellar@9.2.3npm/@ethereumjs/tx@10.1.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@ethereumjs/tx@10.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @ethereumjs/util under MIT AND MPL-2.0

Location: Package overview

From: pnpm-lock.yamlnpm/@trezor/connect-web@9.7.3npm/@creit.tech/stellar-wallets-kit@2.5.0npm/@trezor/connect-plugin-stellar@9.2.3npm/@ethereumjs/util@10.1.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@ethereumjs/util@10.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-libvips-darwin-arm64 under LGPL-3.0-or-later

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-libvips-darwin-arm64@1.3.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-darwin-arm64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-libvips-darwin-x64 under LGPL-3.0-or-later

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-libvips-darwin-x64@1.3.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-darwin-x64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-libvips-linux-arm under LGPL-3.0-or-later

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-libvips-linux-arm@1.3.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-arm@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-libvips-linux-arm64 under LGPL-3.0-or-later

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-libvips-linux-arm64@1.3.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-arm64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-libvips-linux-ppc64 under LGPL-3.0-or-later

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-libvips-linux-ppc64@1.3.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-ppc64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-libvips-linux-riscv64 under LGPL-3.0-or-later

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-libvips-linux-riscv64@1.3.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-riscv64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-libvips-linux-s390x under LGPL-3.0-or-later

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-libvips-linux-s390x@1.3.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-s390x@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-libvips-linux-x64 under LGPL-3.0-or-later

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-libvips-linux-x64@1.3.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-x64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-libvips-linuxmusl-arm64 under LGPL-3.0-or-later

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-libvips-linuxmusl-arm64@1.3.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linuxmusl-arm64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-libvips-linuxmusl-x64 under LGPL-3.0-or-later

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-libvips-linuxmusl-x64@1.3.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linuxmusl-x64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-wasm32

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-wasm32@0.35.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-wasm32@0.35.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-win32-arm64

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-win32-arm64@0.35.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-win32-arm64@0.35.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-win32-ia32

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-win32-ia32@0.35.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-win32-ia32@0.35.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @img/sharp-win32-x64

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.3.2npm/@img/sharp-win32-x64@0.35.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-win32-x64@0.35.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @sentry/cli under LicenseRef-FSL-1.1-MIT

License: LicenseRef-FSL-1.1-MIT - The applicable license policy does not permit this license (5) (package/LICENSE)

From: pnpm-lock.yamlnpm/@sentry/nextjs@10.70.0npm/@sentry/cli@2.58.6

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/cli@2.58.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @sentry/node-core is 60.0% likely obfuscated

Confidence: 0.60

Location: Package overview

From: pnpm-lock.yamlnpm/@sentry/nextjs@10.70.0npm/@sentry/node-core@10.70.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/node-core@10.70.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @trezor/blockchain-link under LicenseRef-T-RSL

License: LicenseRef-T-RSL - The applicable license policy does not permit this license (5) (package/LICENSE.md)

From: pnpm-lock.yamlnpm/@trezor/connect-web@9.7.3npm/@creit.tech/stellar-wallets-kit@2.5.0npm/@trezor/connect-plugin-stellar@9.2.3npm/@trezor/blockchain-link@2.6.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@trezor/blockchain-link@2.6.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @trezor/connect-web under LicenseRef-T-RSL

License: LicenseRef-T-RSL - The applicable license policy does not permit this license (5) (package/LICENSE.md)

From: package.jsonnpm/@trezor/connect-web@9.7.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@trezor/connect-web@9.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @trezor/connect under LicenseRef-T-RSL

License: LicenseRef-T-RSL - The applicable license policy does not permit this license (5) (package/LICENSE.md)

From: pnpm-lock.yamlnpm/@trezor/connect-web@9.7.3npm/@creit.tech/stellar-wallets-kit@2.5.0npm/@trezor/connect-plugin-stellar@9.2.3npm/@trezor/connect@9.7.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@trezor/connect@9.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @trezor/transport under LicenseRef-T-RSL

License: LicenseRef-T-RSL - The applicable license policy does not permit this license (5) (package/LICENSE.md)

From: pnpm-lock.yamlnpm/@trezor/connect-web@9.7.3npm/@creit.tech/stellar-wallets-kit@2.5.0npm/@trezor/connect-plugin-stellar@9.2.3npm/@trezor/transport@1.6.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@trezor/transport@1.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-aix-ppc64 under MIT-Khronos-old

License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt)

From: pnpm-lock.yamlnpm/typescript@7.0.2npm/@typescript/typescript-aix-ppc64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-aix-ppc64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-darwin-arm64 under MIT-Khronos-old

License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt)

From: pnpm-lock.yamlnpm/typescript@7.0.2npm/@typescript/typescript-darwin-arm64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-darwin-x64 under MIT-Khronos-old

License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt)

From: pnpm-lock.yamlnpm/typescript@7.0.2npm/@typescript/typescript-darwin-x64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 22 more rows in the dashboard

View full report

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates 34 runtime and development dependencies across the application.

Changes:

  • Upgrades Next.js and related tooling to v16.
  • Updates blockchain, state, analytics, and utility packages.
  • Advances TypeScript, ESLint, Jest, and Playwright tooling.
Suppressed comments (2)

package.json:73

  • This lint-toolchain upgrade is incomplete. Next 16 removes the next lint command still used by pnpm lint (package.json:15), and ESLint 10 no longer loads the repository's legacy .eslintrc.json. As written, the lint command cannot run; replace it with the ESLint CLI and migrate to a flat eslint.config.*, or retain compatible versions.
    "eslint": "^10.9.0",
    "eslint-config-next": "16.3.2",

package.json:82

  • TypeScript 7 is outside the supported peer ranges of the retained tooling: ts-jest@29.4.6 requires TypeScript <6, and the resolved typescript-eslint stack requires <6.1.0. This leaves unit-test transforms and lint parsing on an unsupported compiler. Keep TypeScript 5.x or upgrade both consumers to releases that explicitly support TypeScript 7.
    "typescript": "^7.0.2"

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread package.json
"immer": "^11.1.18",
"lodash": "^4.18.1",
"lossless-json": "^4.3.1",
"next": "16.3.2",
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

Status: Backlog (Not Ready)

Development

Successfully merging this pull request may close these issues.

1 participant