Bump the npm_and_yarn group across 5 directories with 8 updates by dependabot[bot] · Pull Request #4398 · dubinc/dub

dependabot · 2026-08-26T17:27:58Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
nanoid	`5.0.1`	`5.1.16`
next	`15.5.8`	`15.5.21`
next-auth	`4.24.11`	`4.24.15`
sanitize-html	`2.17.0`	`2.17.5`
postcss	`8.4.31`	`8.5.23`
nodemailer	`6.9.3`	`9.0.1`

Bumps the npm_and_yarn group with 5 updates in the /apps/web directory:

Package	From	To
nanoid	`5.0.1`	`5.1.16`
next	`15.5.8`	`15.5.21`
next-auth	`4.24.11`	`4.24.15`
sanitize-html	`2.17.0`	`2.17.5`
postcss	`8.4.31`	`8.5.23`

Bumps the npm_and_yarn group with 1 update in the /packages/stripe-app directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: next.
Bumps the npm_and_yarn group with 1 update in the /packages/utils directory: next.

Updates nanoid from 5.0.1 to 5.1.16

Release notes

Sourced from nanoid's releases.

5.1.16

Fixed forever loop on negative size (by @spokodev).

5.1.15

Fixed random pool corruption on big ID sizes.

5.1.14

Fixed npm package size regression.

5.1.13

Fixed npm package size regression.

5.1.12

Moved to npm Provenance and Staged Publishing.

5.1.11

Fixed breaking Nano ID by requesting big ID.

5.1.10

Fixed breaking nanoid by requesting big ID (by @alanzabihi).

5.1.9

Fixed npm package size regression.

5.1.8

Made cusatomAlphabet 75% faster (by @saripovdenis).

5.1.7

Added --version to CLI (by @mahmoodhamdi).

Updated nanoid.js for CDN (by @mahmoodhamdi).

Fixed docs (by @mahmoodhamdi).

Fixed customRandom types (by @oguimbal).

5.1.6

Fixed infinite loop on 0 size for customAlphabet.

5.1.5

Fixed latest version on npm after 3.x release.

5.1.4

Fixed latest version on npm after 3.x release.

5.1.3

Fixed React Native support (by @steida).

5.1.2

Fixed module docs.

5.1.1

Fixed opaque types support for non-secure generator.

... (truncated)

Changelog

Sourced from nanoid's changelog.

5.1.16

Fixed forever loop on negative size (by @spokodev).

5.1.15

Fixed random pool corruption on big ID sizes.

5.1.14

Fixed npm package size regression.

5.1.13

Fixed npm package size regression.

5.1.12

Moved to npm Provenance and Staged Publishing.

5.1.11

Fixed breaking Nano ID by requesting big ID.

5.1.10

Fixed breaking Nano ID by requesting big ID (by @alanzabihi).

5.1.9

Fixed npm package size regression.

5.1.8

Made cusatomAlphabet 75% faster (by @saripovdenis).

5.1.7

Added --version to CLI (by @mahmoodhamdi).

Updated nanoid.js for CDN (by @mahmoodhamdi).

Fixed docs (by @mahmoodhamdi).

Fixed customRandom types (by @oguimbal).

5.1.6

Fixed infinite loop on 0 size for customAlphabet.

5.1.5

Fixed latest version on npm after 3.x release.

... (truncated)

Commits

6ccc67b Release 5.1.16 version
6de05d7 fix(non-secure): clamp negative size with a smaller guard (#600)
3925903 Update dependencies
0b69554 Release 5.1.15 version
333c5a0 Backport changelog changes for 3.x
266eb63 Remove debug code
a6a94d3 Do not allow to pollute pool
93fe197 Reduce ID size
e4b7a9a Release 5.1.14 version
6bf3469 Update release action
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates next from 15.5.8 to 15.5.21

Release notes

Sourced from next's releases.

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next-auth from 4.24.11 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.

OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.

Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.

An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.

Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.

next-auth@4.24.14

Bugfixes

providers: add issuer to GitHub provider for RFC 9207 compliance (#13412)

GitHub now returns an iss parameter in OAuth callbacks. openid-client validates it unconditionally, which was breaking authentication for apps that didn't configure an issuer. This sets the default GitHub provider issuer to https://github.com/login/oauth.

Commits

d857eec chore(release): next-auth@4.24.15 [skip ci]
5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
fa85858 chore: update uuid to v14, remove deprecated types (#13422)
2a39465 Merge commit from fork
19d2feb Merge commit from fork
e9a892a chore(release): bump version [skip ci]
0497da4 fix(providers): add issuer to github (#13412)
1a70ee8 chore(release): bump version [skip ci]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Updates sanitize-html from 2.17.0 to 2.17.5

Changelog

Sourced from sanitize-html's changelog.

2.17.5 (2026-06-10)

Security

Added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Some attributes are not supported at all by modern browsers but are included for completeness. Thanks to crattack for reporting the vulnerability.

Address a potential vulnerability when nonTextTags is configured in a nonstandard way. While it is never a good idea to remove known non-text tags from the standard list e.g. script, styles, etc., this change ensures that doing so does not result in nested tags being passed through without sanitization when they are not expressly allowed. (ApostropheCMS would never trigger this situation.) Thanks to Dipanshu singh for pointing out the issue and contributing the fix.

2.17.4

Changes

sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

2.17.2 (2026-03-19)

Changes

Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.

2.17.1 (2026-02-18)

Fixes

Fix unclosed tags (e.g., <hello) returning empty string in escape and recursiveEscape modes. Fixes #706. Thanks to Byeong Hyeon for the fix.

Commits

2427508 release and changelog edits (#5465)
5a88e96 Latest security q2 (#5464)
958d162 merge main to latest (#5460)
e9b0ab0 release only (changelogs formatted) (#5408)
f03fa5b Latest security merge (#5407)
96cf174 For release only (#5381)
7ca2d16 Merge commit from fork
297a422 Bump dependencies (#5376)
7e607c9 Changelog reconciliation for release (#5359)
49d0bb7 Port/sanitize html community contrib (#5337)
Additional commits viewable in compare view

Updates postcss from 8.4.31 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

... (truncated)

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates nodemailer from 6.9.3 to 9.0.1

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

8.0.8 (2026-05-23)

Bug Fixes

... (truncated)

Commits

69cf625 chore(master): release 9.0.1 (#1828)
a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
4e58450 chore: update dev dependencies
541f5fd chore(master): release 9.0.0 (#1827)
0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
6a947ac fix!: validate TLS certificates by default when fetching remote content
e3b1bda chore(master): release 8.0.11 (#1826)
4358caf refactor: remove dead checks flagged by Code Quality analysis
cf5195c chore: harden workflow token permissions and update GitHub Actions
067aebe fix: parse Ethereal response props without polynomial regex backtracking
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nodemailer since your current version.

Updates sharp from 0.34.4 to 0.34.5

Release notes

Sourced from sharp's releases.

v0.34.5

Upgrade to libvips v8.17.3 for upstream bug fixes.

Add experimental support for prebuilt Linux RISC-V 64-bit binaries.

Support building from source with npm v12+, deprecate --build-from-source flag. #4458

Add support for BigTIFF output. #4459 @throwbi

Improve error messaging when only warnings issued. #4465

Simplify ICC processing when retaining input profiles. #4468

v0.34.5-rc.1

Upgrade to libvips v8.17.3 for upstream bug fixes.

Add experimental support for prebuilt Linux RISC-V 64-bit binaries.

Support building from source with npm v12+, deprecate --build-from-source flag. #4458

Add support for BigTIFF output. #4459 @throwbi

Improve error messaging when only warnings issued. #4465

Simplify ICC processing when retaining input profiles. #4468

v0.34.5-rc.0

Upgrade to libvips v8.17.3 for upstream bug fixes.

Add experimental support for prebuilt Linux RISC-V 64-bit binaries.

Support building from source with npm v12+, deprecate --build-from-source flag. #4458

Add support for BigTIFF output. #4459 @throwbi

Improve error messaging when only warnings issued. #4465

... (truncated)

Commits

e062456 Release v0.34.5
6450c70 Prerelease v0.34.5-rc.1
f7c95d1 TypeScript: consolidate a few enum-like properties
ef86a75 Prerelease v0.34.5-rc.0
6c1e840 Use structured binding for tuples where possible
e1628d8 Simplify ICC processing when retaining input profiles #4468
4f9f817 Linter: apply all recommended biome settings
09d5aa8 Docs: update internal and libvips doc links
040b73c Upgrade to libvips v8.17.3
1f2f33d Ensure licensing headers are retained by code bundlers
Additional commits viewable in compare view

Install script changes

This version modifies install script that runs during installation. Review the package contents before updating.

Updates nanoid from 5.0.1 to 5.1.16

Release notes

Sourced from nanoid's releases.

5.1.16

Fixed forever loop on negative size (by @spokodev).

5.1.15

Fixed random pool corruption on big ID sizes.

5.1.14

Fixed npm package size regression.

5.1.13

Fixed npm package size regression.

5.1.12

Moved to npm Provenance and Staged Publishing.

5.1.11

Fixed breaking Nano ID by requesting big ID.

5.1.10

Fixed breaking nanoid by requesting big ID (by @alanzabihi).

5.1.9

Fixed npm package size regression.

5.1.8

Made cusatomAlphabet 75% faster (by @saripovdenis).

5.1.7

Added --version to CLI (by @mahmoodhamdi).

Updated nanoid.js for CDN (by @mahmoodhamdi).

Fixed docs (by @mahmoodhamdi).

Fixed customRandom types (by @oguimbal).

5.1.6

Fixed infinite loop on 0 size for customAlphabet.

5.1.5

Fixed latest version on npm after 3.x release.

5.1.4

Fixed latest version on npm after 3.x release.

5.1.3

Fixed React Native support (by @steida).

5.1.2

Fixed module docs.

5.1.1

Fixed opaque types support for non-secure generator.

... (truncated)

Changelog

Sourced from nanoid's changelog.

5.1.16

Fixed forever loop on negative size (by @spokodev).

5.1.15

Fixed random pool corruption on big ID sizes.

5.1.14

Fixed npm package size regression.

5.1.13

Fixed npm package size regression.

5.1.12

Moved to npm Provenance and Staged Publishing.

5.1.11

Fixed breaking Nano ID by requesting big ID.

5.1.10

Fixed breaking Nano ID by requesting big ID (by @alanzabihi).

5.1.9

Fixed npm package size regression.

5.1.8

Made cusatomAlphabet 75% faster (by @saripovdenis).

5.1.7

Added --version to CLI (by @mahmoodhamdi).

Updated nanoid.js for CDN (by @mahmoodhamdi).

Fixed docs (by @mahmoodhamdi).

Fixed customRandom types (by @oguimbal).

5.1.6

Fixed infinite loop on 0 size for customAlphabet.

5.1.5

Fixed latest version on npm after 3.x release.

... (truncated)

Commits

6ccc67b Release 5.1.16 version
6de05d7 fix(non-secure): clamp negative size with a smaller guard (#600)
3925903 Update dependencies
0b69554 Release 5.1.15 version
333c5a0 Backport changelog changes for 3.x
266eb63 Remove debug code
a6a94d3 Do not allow to pollute pool
93fe197 Reduce ID size
e4b7a9a Release 5.1.14 version
6bf3469 Update release action
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates next from 15.5.8 to 15.5.21

Release notes

Sourced from next's releases.

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next-auth from 4.24.11 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.

OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.

Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.

An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.

Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.

next-auth@4.24.14

Bugfixes

providers: add issuer to GitHub provider for RFC 9207 compliance (#13412)

GitHub now returns an iss parameter in OAuth callbacks. openid-client validates it unconditionally, which was breaking authentication for apps that didn't configure an issuer. This sets the default GitHub provider issuer to https://github.com/login/oauth.

Commits

d857eec chore(release): next-auth@4.24.15 [skip ci]
5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
fa85858 chore: update uuid to v14, remove deprecated types (#13422)
2a39465 Merge commit from fork
19d2feb Merge commit from fork
e9a892a chore(release): bump version [skip ci]
0497da4 fix(providers): add issuer to github (#13412)
1a70ee8 chore(release): bump version [skip ci]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Updates sanitize-html from 2.17.0 to 2.17.5

Changelog

Sourced from sanitize-html's changelog.

2.17.5 (2026-06-10)

Security

Added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Some attributes are not supported at all by modern browsers but are included for completeness. Thanks to crattack for reporting the vulnerability.

Address a potential vulnerability when nonTextTags is configured in a nonstandard way. While it is never a good idea to remove known non-text tags from the standard list e.g. script, styles, etc., this change ensures that doing so does not result in nested tags being passed through without sanitization when they are not expressly allowed. (ApostropheCMS would never trigger this situation.) Thanks to Dipanshu singh for pointing out the issue and contributing the fix.

2.17.4

Changes

sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

2.17.2 (2026-03-19)

Changes

Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.

2.17.1 (2026-02-18)

Fixes

Fix unclosed tags (e.g., <hello) returning empty string in escape and recursiveEscape modes. Fixes #706. Thanks to Byeong Hyeon for the fix.

Commits

2427508 release and changelog edits (#5465)
5a88e96 Latest security q2 (#5464)
958d162 merge main to latest (#5460)
e9b0ab0 release only (changelogs formatted) (#5408)
f03fa5b Latest security merge (#5407)
96cf174 For release only (#5381)
7ca2d16 Merge commi...
Description has been truncated

Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [nanoid](https://github.com/ai/nanoid) | `5.0.1` | `5.1.16` | | [next](https://github.com/vercel/next.js) | `15.5.8` | `15.5.21` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.11` | `4.24.15` | | [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.0` | `2.17.5` | | [postcss](https://github.com/postcss/postcss) | `8.4.31` | `8.5.23` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.9.3` | `9.0.1` | Bumps the npm_and_yarn group with 5 updates in the /apps/web directory: | Package | From | To | | --- | --- | --- | | [nanoid](https://github.com/ai/nanoid) | `5.0.1` | `5.1.16` | | [next](https://github.com/vercel/next.js) | `15.5.8` | `15.5.21` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.11` | `4.24.15` | | [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.0` | `2.17.5` | | [postcss](https://github.com/postcss/postcss) | `8.4.31` | `8.5.23` | Bumps the npm_and_yarn group with 1 update in the /packages/stripe-app directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/utils directory: [next](https://github.com/vercel/next.js). Updates `nanoid` from 5.0.1 to 5.1.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.0.1...5.1.16) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `sanitize-html` from 2.17.0 to 2.17.5 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.5/packages/sanitize-html) Updates `postcss` from 8.4.31 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.23) Updates `nodemailer` from 6.9.3 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.3...v9.0.1) Updates `sharp` from 0.34.4 to 0.34.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.4...v0.34.5) Updates `nanoid` from 5.0.1 to 5.1.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.0.1...5.1.16) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `sanitize-html` from 2.17.0 to 2.17.5 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.5/packages/sanitize-html) Updates `postcss` from 8.4.31 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.23) Updates `nodemailer` from 6.9.3 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.3...v9.0.1) Updates `sharp` from 0.34.4 to 0.34.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.4...v0.34.5) Updates `nanoid` from 5.0.1 to 5.1.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.0.1...5.1.16) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `nodemailer` from 6.9.3 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.3...v9.0.1) Updates `postcss` from 8.4.31 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.23) Updates `sanitize-html` from 2.17.0 to 2.17.5 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.5/packages/sanitize-html) Updates `sharp` from 0.34.4 to 0.34.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.4...v0.34.5) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `postcss` from 8.4.31 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.23) Updates `nanoid` from 5.0.1 to 5.1.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.0.1...5.1.16) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `nodemailer` from 6.9.3 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.3...v9.0.1) Updates `sanitize-html` from 2.17.0 to 2.17.5 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.5/packages/sanitize-html) Updates `sharp` from 0.34.4 to 0.34.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.4...v0.34.5) Updates `nanoid` from 5.0.1 to 5.1.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.0.1...5.1.16) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `nodemailer` from 6.9.3 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.3...v9.0.1) Updates `postcss` from 8.4.31 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.23) Updates `sanitize-html` from 2.17.0 to 2.17.5 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.5/packages/sanitize-html) Updates `sharp` from 0.34.4 to 0.34.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.4...v0.34.5) Updates `nanoid` from 5.0.1 to 5.1.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.0.1...5.1.16) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `sanitize-html` from 2.17.0 to 2.17.5 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.5/packages/sanitize-html) Updates `postcss` from 8.4.31 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.23) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next-auth` from 4.24.11 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.15) Updates `brace-expansion` from 1.1.11 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.18) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) Updates `next` from 15.5.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.8...v15.5.21) --- updated-dependencies: - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.34.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.34.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.34.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.34.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.34.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-08-26T17:28:02Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dub	Error		Aug 26, 2026 5:28pm

CLAassistant · 2026-08-26T17:28:07Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

socket-security · 2026-08-26T17:29:21Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
nanoid@5.0.7 ⏵ 5.1.16	⁺¹	⁺²³	^-1	^-1
postcss@8.5.6 ⏵ 8.5.26	⁺¹	⁺²⁴
next-auth@4.24.11 ⏵ 4.24.15	^-4	⁺⁷⁵		⁺⁸
@stripe/ui-extension-sdk@8.8.1 ⏵ 9.3.0	⁺⁶			⁺⁶

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 26, 2026

dependabot Bot mentioned this pull request Aug 26, 2026

Bump the npm_and_yarn group across 5 directories with 8 updates #4340

Closed

vercel Bot had a problem deploying to Preview August 26, 2026 17:28 Failure

Navigation Menu

Uh oh!

Bump the npm_and_yarn group across 5 directories with 8 updates - #4398

Bump the npm_and_yarn group across 5 directories with 8 updates#4398
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-46cb74bf43

dependabot Bot commented on behalf of github Aug 26, 2026

Uh oh!

vercel Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Aug 26, 2026

Uh oh!

socket-security Bot commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 26, 2026

5.1.16

5.1.15

5.1.14

5.1.13

5.1.12

5.1.11

5.1.10

5.1.9

5.1.8

5.1.7

5.1.6

5.1.5

5.1.4

5.1.3

5.1.2

5.1.1

5.1.16

5.1.15

5.1.14

5.1.13

5.1.12

5.1.11

5.1.10

5.1.9

5.1.8

5.1.7

5.1.6

5.1.5

v15.5.21

v15.5.20

next-auth@4.24.15

next-auth@4.24.14

Bugfixes

2.17.5 (2026-06-10)

Security

2.17.4

Changes

Security

2.17.3 (2026-04-15)

Security

2.17.2 (2026-03-19)

Changes

2.17.1 (2026-02-18)

Fixes

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

v8.0.11