Bump the npm_and_yarn group across 6 directories with 8 updates by dependabot[bot] · Pull Request #4228 · dubinc/dub

dependabot · 2026-07-28T02:13:46Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
json-2-csv	`5.5.0`	`5.5.11`
next	`15.5.8`	`15.5.21`
next-auth	`4.24.11`	`4.24.15`
postcss	`8.4.31`	`8.5.18`
vite	`5.2.9`	`6.4.3`
nodemailer	`6.9.3`	`9.0.1`

Bumps the npm_and_yarn group with 5 updates in the /apps/web directory:

Package	From	To
json-2-csv	`5.5.0`	`5.5.11`
next	`15.5.8`	`15.5.21`
next-auth	`4.24.11`	`4.24.15`
postcss	`8.4.31`	`8.5.18`
vite	`7.2.2`	`7.3.5`

Bumps the npm_and_yarn group with 1 update in the /packages/email directory: nodemailer.
Bumps the npm_and_yarn group with 1 update in the /packages/stripe-app directory: form-data.
Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: next.
Bumps the npm_and_yarn group with 1 update in the /packages/utils directory: next.

Updates json-2-csv from 5.5.0 to 5.5.11

Release notes

Sourced from json-2-csv's releases.

NPM Release v5.5.10

Ability to rename individual field headers - thanks to @petterw03 - #280

NPM Audit Fix patches

NPM Release v5.5.9

Thanks to @jose-cabral for reporting #273 and implementing a fix for it in mrodrig/json-2-csv#275

NPM Release v5.5.8

Incorporates @sevrai's fix from #271

Dev Dependency vulnerability patch

NPM Release v5.5.7

Fixes the bug identified in #265

Patches a high severity vulnerability identified in a dependency by npm audit

NPM Release v5.5.6

Thanks @Altioc for finding and fixing #264

Patches a moderate severity vulnerability in the dependency chain via npm audit fix

NPM Release v5.5.5

Thanks to @bdudabeecoded for finding and fixing the double wrapping of header fields containing newlines - mrodrig/json-2-csv#260

NPM Release v5.5.4

csv2json type fix for unused option

Documentation update for CLI

NPM Release v5.5.3

Thanks for @diegoreis42 for swapping out the deprecated substr method calls with substring - mrodrig/json-2-csv#258

NPM Release v5.5.2

No release notes provided.

NPM Release v5.5.1

Resolves csv2json conversion parsing issue where keys ending with a . character would have a nested doc with an empty string key value - reported in #254

Commits

See full diff in compare view

Updates next from 15.5.8 to 15.5.21

Release notes

Sourced from next's releases.

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

15.5.19

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[15.5.x] Don't drop FormData entries (#94244)

Other

[15.5.x] Fix CI (#94281)

Credits

Huge thanks to @eps1lon for helping!

v15.5.18

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

... (truncated)

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next-auth from 4.24.11 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.

OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.

Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.

An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.

Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.

next-auth@4.24.14

Bugfixes

providers: add issuer to GitHub provider for RFC 9207 compliance (#13412)

GitHub now returns an iss parameter in OAuth callbacks. openid-client validates it unconditionally, which was breaking authentication for apps that didn't configure an issuer. This sets the default GitHub provider issuer to https://github.com/login/oauth.

Commits

d857eec chore(release): next-auth@4.24.15 [skip ci]
5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
fa85858 chore: update uuid to v14, remove deprecated types (#13422)
2a39465 Merge commit from fork
19d2feb Merge commit from fork
e9a892a chore(release): bump version [skip ci]
0497da4 fix(providers): add issuer to github (#13412)
1a70ee8 chore(release): bump version [skip ci]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Updates postcss from 8.4.31 to 8.5.18

Release notes

Sourced from postcss's releases.

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

... (truncated)

Commits

4c0d194 Release 8.5.18 version
92b4e78 Update dependencies
95663d3 Limit where source map can be loaded for security reasons
74e25ae Release 8.5.17 version
d1518af Fix Maximum call stack size exceeded error
2421312 Fix linter
a50352c Fix CI
33948f0 Prevent prototype hijacking in fromJSON
2131909 Update dependencies
93440ab Fix non-closed \<div align="center"> in README (#2110)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates vite from 5.2.9 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v5.4.21

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576

fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

6.4.2 (2026-04-06)

fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163

fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736

fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735

test: detect ts support via process.features (#20544) (7d99229), closes #20544

6.3.5 (2025-05-05)

fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

6.3.4 (2025-04-30)

fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965

fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940

... (truncated)

Commits

6c2c881 release: v6.4.3
96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
6b3fad0 release: v6.4.2
ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
5487f4f release: v6.4.1
1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
f12697c release: v6.4.0
ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.

Updates nodemailer from 6.9.3 to 9.0.1

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

8.0.8 (2026-05-23)

Bug Fixes

... (truncated)

Commits

69cf625 chore(master): release 9.0.1 (#1828)
a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
4e58450 chore: update dev dependencies
541f5fd chore(master): release 9.0.0 (#1827)
0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
6a947ac fix!: validate TLS certificates by default when fetching remote content
e3b1bda chore(master): release 8.0.11 (#1826)
4358caf refactor: remove dead checks flagged by Code Quality analysis
cf5195c chore: harden workflow token permissions and update GitHub Actions
067aebe fix: parse Ethereal response props without polynomial regex backtracking
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nodemailer since your current version.

Updates sharp from 0.34.4 to 0.34.5

Release notes

Sourced from sharp's releases.

v0.34.5

Upgrade to libvips v8.17.3 for upstream bug fixes.

Add experimental support for prebuilt Linux RISC-V 64-bit binaries.

Support building from source with npm v12+, deprecate --build-from-source flag. #4458

Add support for BigTIFF output. #4459 @throwbi

Improve error messaging when only warnings issued. #4465

Simplify ICC processing when retaining input profiles. #4468

v0.34.5-rc.1

Upgrade to libvips v8.17.3 for upstream bug fixes.

Add experimental support for prebuilt Linux RISC-V 64-bit binaries.

Support building from source with npm v12+, deprecate --build-from-source flag. #4458

Add support for BigTIFF output. #4459 @throwbi

Improve error messaging when only warnings issued. #4465

Simplify ICC processing when retaining input profiles. #4468

v0.34.5-rc.0

Upgrade to libvips v8.17.3 for upstream bug fixes.

Add experimental support for prebuilt Linux RISC-V 64-bit binaries.

Support building from source with npm v12+, deprecate --build-from-source flag. #4458

Add support for BigTIFF output. #4459 @throwbi

Improve error messaging when only warnings issued. #4465

... (truncated)

Commits

e062456 Release v0.34.5
6450c70 Prerelease v0.34.5-rc.1
f7c95d1 TypeScript: consolidate a few enum-like properties
ef86a75 Prerelease v0.34.5-rc.0
6c1e840 Use structured binding for tuples where possible
e1628d8 Simplify ICC processing when retaining input profiles #4468
4f9f817 Linter: apply all recommended biome settings
09d5aa8 Docs: update internal and libvips doc links
040b73c Upgrade to libvips v8.17.3
1f2f33d Ensure licensing headers are retained by code bundlers
Additional commits viewable in compare view

Install script changes

This version modifies install script that runs during installation. Review the package contents before updating.

Updates json-2-csv from 5.5.0 to 5.5.11

Release notes

Sourced from json-2-csv's releases.

NPM Release v5.5.10

Ability to rename individual field headers - thanks to @petterw03 - #280

NPM Audit Fix patches

NPM Release v5.5.9

Thanks to @jose-cabral for reporting #273 and implementing a fix for it in mrodrig/json-2-csv#275

NPM Release v5.5.8

Incorporates @sevrai's fix from #271

Dev Dependency vulnerability patch

NPM Release v5.5.7

Fixes the bug identified in #265

Patches a high severity vulnerability identified in a dependency by npm audit

NPM Release v5.5.6

Thanks @Altioc for finding and fixing #264

Patches a moderate severity vulnerability in the dependency chain via npm audit fix

NPM Release v5.5.5

Thanks to @bdudabeecoded for finding and fixing the double wrapping of header fields containing newlines - mrodrig/json-2-csv#260

NPM Release v5.5.4

csv2json type fix for unused option

Documentation update for CLI

NPM Release v5.5.3

Thanks for @diegoreis42 for swapping out the deprecated substr method calls with substring - mrodrig/json-2-csv#258

NPM Release v5.5.2

No release notes provided.

NPM Release v5.5.1

Resolves csv2json conversion parsing issue where keys ending with a . character would have a nested doc with an empty string key value - reported in #254

Commits

See full diff in compare view

Updates next from 15.5.8 to 15.5.21

Release notes

Sourced from next's releases.

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

15.5.19

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[15.5.x] Don't drop FormData entries (#94244)

Other

[15.5.x] Fix CI (#94281)

Credits

Huge thanks to @eps1lon for helping!

v15.5.18

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

... (truncated)

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next-auth from 4.24.11 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.

OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.

Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.

An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.

Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.

next-auth@4.24.14

Bugfixes

providers: add issuer to GitHub provider for RFC 9207 compliance (#13412)

GitHub now returns an iss parameter in OAuth callbacks. openid-client validates it unconditionally, which was breaking authentication for apps that didn't configure an issuer. This sets the default GitHub provider issuer to https://github.com/login/oauth.

Commits

d857eec chore(release): next-auth@4.24.15 [skip ci]
5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
fa85858 chore: update uuid to v14, remove deprecated types (#13422)
2a39465 Merge commit from fork
19d2feb Merge commit from fork
e9a892a chore(release): bump version [skip ci]
0497da4 fix(providers): add issuer to github (#13412)
1a70ee8 chore(release): bump version [skip ci]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Updates postcss from 8.4.31 to 8.5.18

Release notes

Sourced from postcss's releases.

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fix...
Description has been truncated

Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [json-2-csv](https://github.com/mrodrig/json-2-csv) | `5.5.0` | `5.5.11` | | [next](https://github.com/vercel/next.js) | `15.5.8` | `15.5.21` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.11` | `4.24.15` | | [postcss](https://github.com/postcss/postcss) | `8.4.31` | `8.5.18` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.2.9` | `6.4.3` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.9.3` | `9.0.1` | Bumps the npm_and_yarn group with 5 updates in the /apps/web directory: | Package | From | To | | --- | --- | --- | | [json-2-csv](https://github.com/mrodrig/json-2-csv) | `5.5.0` | `5.5.11` | | [next](https://github.com/vercel/next.js) | `15.5.8` | `15.5.21` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.11` | `4.24.15` | | [postcss](https://github.com/postcss/postcss) | `8.4.31` | `8.5.18` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.2.2` | `7.3.5` | Bumps the npm_and_yarn group with 1 update in the /packages/email directory: [nodemailer](https://github.com/nodemailer/nodemailer). Bumps the npm_and_yarn group with 1 update in the /packages/stripe-app directory: [form-data](https://github.com/form-data/form-data). Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/utils directory: [next](https://github.com/vercel/next.js). Updates `json-2-csv` from 5.5.0 to 5.5.11 - [Release notes](https://github.com/mrodrig/json-2-csv/releases) - [Commits](https://github.com/mrodrig/json-2-csv/commits) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `postcss` from 8.4.31 to 8.5.18 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.18) Updates `vite` from 5.2.9 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `nodemailer` from 6.9.3 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.3...v9.0.1) Updates `sharp` from 0.34.4 to 0.34.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.4...v0.34.5) Updates `json-2-csv` from 5.5.0 to 5.5.11 - [Release notes](https://github.com/mrodrig/json-2-csv/releases) - [Commits](https://github.com/mrodrig/json-2-csv/commits) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `postcss` from 8.4.31 to 8.5.18 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.18) Updates `vite` from 7.2.2 to 7.3.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `nodemailer` from 6.9.3 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.3...v9.0.1) Updates `form-data` from 3.0.1 to 3.0.5 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v3.0.1...v3.0.5) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) --- updated-dependencies: - dependency-name: json-2-csv dependency-version: 5.5.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.18 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.34.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: json-2-csv dependency-version: 5.5.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.18 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 3.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-07-28T02:13:49Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dub	Error		Jul 28, 2026 2:13am

CLAassistant · 2026-07-28T02:13:54Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

socket-security · 2026-07-28T02:14:38Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@15.5.21
	postcss@8.5.23
	vite@6.4.3
	json-2-csv@5.5.11
	next-auth@4.24.15
	nodemailer@9.0.1

View full report

socket-security · 2026-07-28T02:14:39Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `css-tree` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/vitest@4.0.8` → `npm/css-tree@3.2.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/css-tree@3.2.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `data-urls` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/vitest@4.0.8` → `npm/data-urls@6.0.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/data-urls@6.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `next` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: apps/web/package.json → `npm/next@15.5.21` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.5.21`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot · 2026-08-05T00:55:48Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 28, 2026

vercel Bot had a problem deploying to Preview July 28, 2026 02:13 Failure

Navigation Menu

Uh oh!

Bump the npm_and_yarn group across 6 directories with 8 updates - #4228

Bump the npm_and_yarn group across 6 directories with 8 updates#4228
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-c9f964394f

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Jul 28, 2026

Uh oh!

socket-security Bot commented Jul 28, 2026

Uh oh!

socket-security Bot commented Jul 28, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

NPM Release v5.5.10

NPM Release v5.5.9

NPM Release v5.5.8

NPM Release v5.5.7

NPM Release v5.5.6

NPM Release v5.5.5

NPM Release v5.5.4

NPM Release v5.5.3

NPM Release v5.5.2

NPM Release v5.5.1

v15.5.21

v15.5.20

15.5.19

Core Changes

Other

Credits

v15.5.18

next-auth@4.24.15

next-auth@4.24.14

Bugfixes

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

v6.4.3

v6.4.2

v6.4.1

v6.4.0

v6.3.7

v5.4.21

6.4.3 (2026-06-01)

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

6.3.7 (2025-10-14)

6.3.6 (2025-09-08)

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited

Loading

vercel Bot commented Jul 28, 2026 •

edited

Loading