Bump the npm_and_yarn group across 5 directories with 8 updates by dependabot[bot] · Pull Request #4340 · dubinc/dub

dependabot · 2026-08-17T14:20:52Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
nanoid	`5.0.1`	`5.1.16`
next	`15.5.8`	`15.5.21`
next-auth	`4.24.11`	`4.24.15`
sanitize-html	`2.17.0`	`2.17.5`
postcss	`8.4.31`	`8.5.23`
nodemailer	`6.9.3`	`9.0.1`

Bumps the npm_and_yarn group with 5 updates in the /apps/web directory:

Package	From	To
nanoid	`5.0.1`	`5.1.16`
next	`15.5.8`	`15.5.21`
next-auth	`4.24.11`	`4.24.15`
sanitize-html	`2.17.0`	`2.17.5`
postcss	`8.4.31`	`8.5.23`

Bumps the npm_and_yarn group with 1 update in the /packages/stripe-app directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: next.
Bumps the npm_and_yarn group with 1 update in the /packages/utils directory: next.

Updates nanoid from 5.0.1 to 5.1.16

Changelog

Sourced from nanoid's changelog.

5.1.16

Fixed forever loop on negative size (by @spokodev).

5.1.15

Fixed random pool corruption on big ID sizes.

5.1.14

Fixed npm package size regression.

5.1.13

Fixed npm package size regression.

5.1.12

Moved to npm Provenance and Staged Publishing.

5.1.11

Fixed breaking Nano ID by requesting big ID.

5.1.10

Fixed breaking Nano ID by requesting big ID (by @alanzabihi).

5.1.9

Fixed npm package size regression.

5.1.8

Made cusatomAlphabet 75% faster (by @saripovdenis).

5.1.7

Added --version to CLI (by @mahmoodhamdi).

Updated nanoid.js for CDN (by @mahmoodhamdi).

Fixed docs (by @mahmoodhamdi).

Fixed customRandom types (by @oguimbal).

5.1.6

Fixed infinite loop on 0 size for customAlphabet.

5.1.5

Fixed latest version on npm after 3.x release.

... (truncated)

Commits

6ccc67b Release 5.1.16 version
6de05d7 fix(non-secure): clamp negative size with a smaller guard (#600)
3925903 Update dependencies
0b69554 Release 5.1.15 version
333c5a0 Backport changelog changes for 3.x
266eb63 Remove debug code
a6a94d3 Do not allow to pollute pool
93fe197 Reduce ID size
e4b7a9a Release 5.1.14 version
6bf3469 Update release action
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates next from 15.5.8 to 15.5.21

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next-auth from 4.24.11 to 4.24.15

Commits

d857eec chore(release): next-auth@4.24.15 [skip ci]
5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
fa85858 chore: update uuid to v14, remove deprecated types (#13422)
2a39465 Merge commit from fork
19d2feb Merge commit from fork
e9a892a chore(release): bump version [skip ci]
0497da4 fix(providers): add issuer to github (#13412)
1a70ee8 chore(release): bump version [skip ci]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Updates sanitize-html from 2.17.0 to 2.17.5

Changelog

Sourced from sanitize-html's changelog.

2.17.5 (2026-06-10)

Security

Added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Some attributes are not supported at all by modern browsers but are included for completeness. Thanks to crattack for reporting the vulnerability.

Address a potential vulnerability when nonTextTags is configured in a nonstandard way. While it is never a good idea to remove known non-text tags from the standard list e.g. script, styles, etc., this change ensures that doing so does not result in nested tags being passed through without sanitization when they are not expressly allowed. (ApostropheCMS would never trigger this situation.) Thanks to Dipanshu singh for pointing out the issue and contributing the fix.

2.17.4

Changes

sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

2.17.2 (2026-03-19)

Changes

Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.

2.17.1 (2026-02-18)

Fixes

Fix unclosed tags (e.g., <hello) returning empty string in escape and recursiveEscape modes. Fixes #706. Thanks to Byeong Hyeon for the fix.

Commits

2427508 release and changelog edits (#5465)
5a88e96 Latest security q2 (#5464)
958d162 merge main to latest (#5460)
e9b0ab0 release only (changelogs formatted) (#5408)
f03fa5b Latest security merge (#5407)
96cf174 For release only (#5381)
7ca2d16 Merge commit from fork
297a422 Bump dependencies (#5376)
7e607c9 Changelog reconciliation for release (#5359)
49d0bb7 Port/sanitize html community contrib (#5337)
Additional commits viewable in compare view

Updates postcss from 8.4.31 to 8.5.23

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

... (truncated)

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates nodemailer from 6.9.3 to 9.0.1

Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

8.0.8 (2026-05-23)

Bug Fixes

... (truncated)

Commits

69cf625 chore(master): release 9.0.1 (#1828)
a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
4e58450 chore: update dev dependencies
541f5fd chore(master): release 9.0.0 (#1827)
0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
6a947ac fix!: validate TLS certificates by default when fetching remote content
e3b1bda chore(master): release 8.0.11 (#1826)
4358caf refactor: remove dead checks flagged by Code Quality analysis
cf5195c chore: harden workflow token permissions and update GitHub Actions
067aebe fix: parse Ethereal response props without polynomial regex backtracking
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nodemailer since your current version.

Updates sharp from 0.34.4 to 0.34.5

Commits

e062456 Release v0.34.5
6450c70 Prerelease v0.34.5-rc.1
f7c95d1 TypeScript: consolidate a few enum-like properties
ef86a75 Prerelease v0.34.5-rc.0
6c1e840 Use structured binding for tuples where possible
e1628d8 Simplify ICC processing when retaining input profiles #4468
4f9f817 Linter: apply all recommended biome settings
09d5aa8 Docs: update internal and libvips doc links
040b73c Upgrade to libvips v8.17.3
1f2f33d Ensure licensing headers are retained by code bundlers
Additional commits viewable in compare view

Install script changes

This version modifies install script that runs during installation. Review the package contents before updating.

Updates nanoid from 5.0.1 to 5.1.16

Changelog

Sourced from nanoid's changelog.

5.1.16

Fixed forever loop on negative size (by @spokodev).

5.1.15

Fixed random pool corruption on big ID sizes.

5.1.14

Fixed npm package size regression.

5.1.13

Fixed npm package size regression.

5.1.12

Moved to npm Provenance and Staged Publishing.

5.1.11

Fixed breaking Nano ID by requesting big ID.

5.1.10

Fixed breaking Nano ID by requesting big ID (by @alanzabihi).

5.1.9

Fixed npm package size regression.

5.1.8

Made cusatomAlphabet 75% faster (by @saripovdenis).

5.1.7

Added --version to CLI (by @mahmoodhamdi).

Updated nanoid.js for CDN (by @mahmoodhamdi).

Fixed docs (by @mahmoodhamdi).

Fixed customRandom types (by @oguimbal).

5.1.6

Fixed infinite loop on 0 size for customAlphabet.

5.1.5

Fixed latest version on npm after 3.x release.

... (truncated)

Commits

6ccc67b Release 5.1.16 version
6de05d7 fix(non-secure): clamp negative size with a smaller guard (#600)
3925903 Update dependencies
0b69554 Release 5.1.15 version
333c5a0 Backport changelog changes for 3.x
266eb63 Remove debug code
a6a94d3 Do not allow to pollute pool
93fe197 Reduce ID size
e4b7a9a Release 5.1.14 version
6bf3469 Update release action
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates next from 15.5.8 to 15.5.21

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next-auth from 4.24.11 to 4.24.15

Commits

d857eec chore(release): next-auth@4.24.15 [skip ci]
5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
fa85858 chore: update uuid to v14, remove deprecated types (#13422)
2a39465 Merge commit from fork
19d2feb Merge commit from fork
e9a892a chore(release): bump version [skip ci]
0497da4 fix(providers): add issuer to github (#13412)
1a70ee8 chore(release): bump version [skip ci]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Updates sanitize-html from 2.17.0 to 2.17.5

Changelog

Sourced from sanitize-html's changelog.

2.17.5 (2026-06-10)

Security

Added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Some attributes are not supported at all by modern browsers but are included for completeness. Thanks to crattack for reporting the vulnerability.

Address a potential vulnerability when nonTextTags is configured in a nonstandard way. While it is never a good idea to remove known non-text tags from the standard list e.g. script, styles, etc., this change ensures that doing so does not result in nested tags being passed through without sanitization when they are not expressly allowed. (ApostropheCMS would never trigger this situation.) Thanks to Dipanshu singh for pointing out the issue and contributing the fix.

2.17.4

Changes

sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

2.17.2 (2026-03-19)

Changes

Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.

2.17.1 (2026-02-18)

Fixes

Fix unclosed tags (e.g., <hello) returning empty string in escape and recursiveEscape modes. Fixes #706. Thanks to Byeong Hyeon for the fix.

Commits

2427508 release and changelog edits (#5465)
5a88e96 Latest security q2 (#5464)
958d162 merge main to latest (#5460)
e9b0ab0 release only (changelogs formatted) (#5408)
f03fa5b Latest security merge (#5407)
96cf174 For release only (#5381)
7ca2d16 Merge commit from fork
297a422 Bump dependencies (#5376)
7e607c9 Changelog reconciliation for release (#5359)
49d0bb7 Port/sanitize html community contrib (#5337)
Additional commits viewable in compare view

Updates postcss from 8.4.31 to 8.5.23

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

... (truncated)

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates brace-expansion from 1.1.11 to 1.1.18

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
Additional commits viewable in compare view

Updates next from 15.5.8 to 15.5.21

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next from 15.5.8 to 15.5.21

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [nanoid](https://github.com/ai/nanoid) | `5.0.1` | `5.1.16` | | [next](https://github.com/vercel/next.js) | `15.5.8` | `15.5.21` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.11` | `4.24.15` | | [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.0` | `2.17.5` | | [postcss](https://github.com/postcss/postcss) | `8.4.31` | `8.5.23` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.9.3` | `9.0.1` | Bumps the npm_and_yarn group with 5 updates in the /apps/web directory: | Package | From | To | | --- | --- | --- | | [nanoid](https://github.com/ai/nanoid) | `5.0.1` | `5.1.16` | | [next](https://github.com/vercel/next.js) | `15.5.8` | `15.5.21` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.11` | `4.24.15` | | [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.0` | `2.17.5` | | [postcss](https://github.com/postcss/postcss) | `8.4.31` | `8.5.23` | Bumps the npm_and_yarn group with 1 update in the /packages/stripe-app directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/utils directory: [next](https://github.com/vercel/next.js). Updates `nanoid` from 5.0.1 to 5.1.16 - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.0.1...5.1.16) Updates `next` from 15.5.8 to 15.5.21 - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next-auth` from 4.24.11 to 4.24.15 - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `sanitize-html` from 2.17.0 to 2.17.5 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.5/packages/sanitize-html) Updates `postcss` from 8.4.31 to 8.5.23 - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.23) Updates `nodemailer` from 6.9.3 to 9.0.1 - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.3...v9.0.1) Updates `sharp` from 0.34.4 to 0.34.5 - [Commits](lovell/sharp@v0.34.4...v0.34.5) Updates `nanoid` from 5.0.1 to 5.1.16 - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.0.1...5.1.16) Updates `next` from 15.5.8 to 15.5.21 - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next-auth` from 4.24.11 to 4.24.15 - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `sanitize-html` from 2.17.0 to 2.17.5 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.5/packages/sanitize-html) Updates `postcss` from 8.4.31 to 8.5.23 - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.23) Updates `brace-expansion` from 1.1.11 to 1.1.18 - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.18) Updates `next` from 15.5.8 to 15.5.21 - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Commits](vercel/next.js@v15.5.8...v15.5.21) --- updated-dependencies: - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.34.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

CLAassistant · 2026-08-17T14:21:11Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

socket-security · 2026-08-17T14:22:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Maintenance
next@15.5.21
nanoid@5.1.16
postcss@8.5.26
sanitize-html@2.17.5
next-auth@4.24.15
nodemailer@9.0.1
@stripe/ui-extension-sdk@8.8.1 ⏵ 9.2.1	⁺⁶	⁺⁶

View full report

socket-security · 2026-08-17T14:22:29Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `data-urls` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/vitest@4.0.8` → `npm/data-urls@6.0.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/data-urls@6.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `next` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: apps/web/package.json → `npm/next@15.5.21` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.5.21`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

vercel · 2026-08-17T14:34:47Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dub	Error		Aug 17, 2026 2:34pm

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 17, 2026

vercel Bot had a problem deploying to Preview August 17, 2026 14:34 Failure

Navigation Menu

Uh oh!

Bump the npm_and_yarn group across 5 directories with 8 updates - #4340

Bump the npm_and_yarn group across 5 directories with 8 updates#4340
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-4d61c83b82

dependabot Bot commented on behalf of github Aug 17, 2026

Uh oh!

CLAassistant commented Aug 17, 2026

Uh oh!

socket-security Bot commented Aug 17, 2026

Uh oh!

socket-security Bot commented Aug 17, 2026

Uh oh!

vercel Bot commented Aug 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 17, 2026

5.1.16

5.1.15

5.1.14

5.1.13

5.1.12

5.1.11

5.1.10

5.1.9

5.1.8

5.1.7

5.1.6

5.1.5

2.17.5 (2026-06-10)

Security

2.17.4

Changes

Security

2.17.3 (2026-04-15)

Security

2.17.2 (2026-03-19)

Changes

2.17.1 (2026-02-18)

Fixes

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

9.0.1 (2026-06-17)

Bug Fixes

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

8.0.11 (2026-06-10)

Bug Fixes

8.0.10 (2026-05-29)

Bug Fixes

8.0.9 (2026-05-26)

Bug Fixes

8.0.8 (2026-05-23)

Bug Fixes

5.1.16

5.1.15

5.1.14

5.1.13

5.1.12

5.1.11

5.1.10

5.1.9

5.1.8

5.1.7

5.1.6

5.1.5

2.17.5 (2026-06-10)

Security

2.17.4

Changes

Security

2.17.3 (2026-04-15)

Security

2.17.2 (2026-03-19)

Changes

2.17.1 (2026-02-18)

Fixes

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

vercel Bot commented Aug 17, 2026 •

edited

Loading