build(deps): Bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #8763 · thirdweb-dev/js

dependabot · 2026-05-06T03:02:04Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
happy-dom	`17.4.4`	`20.8.9`
vite	`7.1.7`	`7.3.2`
next	`15.3.8`	`15.5.18`
postcss	`8.5.6`	`8.5.10`
fast-xml-parser	`5.2.5`	`5.7.0`

Updates happy-dom from 17.4.4 to 20.8.9

Release notes

Sourced from happy-dom's releases.

v20.8.9

👷‍♂️ Patch fixes

Fixes issue where cookies from the current origin was being forwarded to the target origin in fetch requests - By @capricorn86 in task #2117

A security advisory (GHSA-w4gp-fjgq-3q4g) was reported for this security vulnerability. Big thanks to @r74tech for reporting this!

v20.8.8

👷‍♂️ Patch fixes

Fixes issue where export names can be interpolated as executable code in ESM - By @capricorn86 in task #2113

A security advisory (GHSA-6q6h-j7hj-3r64) has been reported that shows a security vulnerability where it may be possible to escape the VM context and get access to process level functionality in unsafe environments using CommonJS. Big thanks to @tndud042713 for reporting this!

v20.8.7

👷‍♂️ Patch fixes

Replace implementing Node.js Console with common IConsole interface to support latest version of Bun - By @YevheniiKotyrlo in task #1845

v20.8.6

👷‍♂️ Patch fixes

Request.formData() should honor "Content-Type" header - By @brianhelba in task #2106

v20.8.5

👷‍♂️ Patch fixes

Fixes error thrown when modifying DOM structure in connectedCallback() - By @capricorn86 in task #2110

v20.8.4

👷‍♂️ Patch fixes

Replace ConsoleConstructor import with indexed access type - By @YevheniiKotyrlo in task #1845

v20.8.3

👷‍♂️ Patch fixes

Throw error if event is not of type Event in EventTarget.dispatchEvent() - By @capricorn86 in task #2054

v20.8.2

👷‍♂️ Patch fixes

Resets Event.cancelBubble and Event.defaultPrevented when calling Event.initEvent() - By @capricorn86 in task #2090

v20.8.1

👷‍♂️ Patch fixes

Make "inert" attribute block focus interactions - By @coffeeandwork in task #1422

v20.8.0

🎨 Features

Adds support for setPointerCapture, hasPointerCapture, and releasePointerCapture to Element - By @coffeeandwork in task #1733

v20.7.2

👷‍♂️ Patch fixes

Properly decode CSS escape sequences in attribute selector values - By @silverwind

v20.7.1

👷‍♂️ Patch fixes

Fixes issue related to parsing direct descendants (>) and universal (*) query selectors - By @Cherry in task #2078

... (truncated)

Commits

68324c2 fix: #2117 Fixes issue related to cookies from the current origin being for...
5437fdf fix: #2113 Fixes issue where export names can be interpolated as executable...
7e97acb fix: #1845 Replace implementing Node js Console with common IConsole interf...
3373929 fix: #2106 Request.formData() should honor Content-Type header (#2107)
55c17ba fix: #2110 Fixes error thrown when modifying DOM structure in connectedCall...
82a0888 fix: #1845 Replace ConsoleConstructor import with indexed access type (#2095)
5998eea fix: #2054 Throw error if event is not of type Event in dispatchEvent (#2092)
7a11238 fix: #2090 Resets cancelBubble and defaultPrevented when calling initEvent ...
7d27984 fix: #1422 Make inert attribute block focus interactions (#2083)
53e4ec9 feat: #1733 Adds support for setPointerCapture, hasPointerCapture, and rele...
Additional commits viewable in compare view

Updates vite from 7.1.7 to 7.3.2

Release notes

Sourced from vite's releases.

v7.3.2

Please refer to CHANGELOG.md for details.

v7.3.1

Please refer to CHANGELOG.md for details.

v7.3.0

Please refer to CHANGELOG.md for details.

v7.2.7

Please refer to CHANGELOG.md for details.

v7.2.6

Please refer to CHANGELOG.md for details.

v7.2.5

Please refer to CHANGELOG.md for details.

Note: 7.2.5 failed to publish so it is skipped on npm

v7.2.4

Please refer to CHANGELOG.md for details.

v7.2.3

Please refer to CHANGELOG.md for details.

v7.2.2

Please refer to CHANGELOG.md for details.

plugin-legacy@7.2.1

Please refer to CHANGELOG.md for details.

v7.2.1

Please refer to CHANGELOG.md for details.

plugin-legacy@7.2.0

Please refer to CHANGELOG.md for details.

v7.2.0

Please refer to CHANGELOG.md for details.

v7.2.0-beta.1

Please refer to CHANGELOG.md for details.

v7.2.0-beta.0

Please refer to CHANGELOG.md for details.

v7.1.12

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

7.3.2 (2026-04-06)

Bug Fixes

avoid path traversal with optimize deps sourcemap handler (#22161) (09d8c90)

backport #22159, apply server.fs check to env transport (#22162) (19db0f2)

check server.fs after stripping query as well (#22160) (f8103cc)

7.3.1 (2026-01-07)

Features

add ignoreOutdatedRequests option to optimizeDeps (#21364) (9d39d37)

7.3.0 (2025-12-15)

Features

deps: update esbuild from ^0.25.0 to ^0.27.0 (#21183) (cff26ec)

7.2.7 (2025-12-08)

Bug Fixes

plugin shortcut support (#21211) (721f163)

7.2.6 (2025-12-01)

7.2.5 (2025-12-01)

Bug Fixes

config: handle shebang properly (#21158) (df5a30d)

deps: update all non-major dependencies (#21146) (a3cd262)

deps: update all non-major dependencies (#21175) (72e398a)

fix external: true merging (#21164) (5ef557a)

shortcuts not rebound after server restart (#21166) (3765f7b)

Performance Improvements

deps: replace debug with obug (#21137) (203a551)

Documentation

clarify manifest.json imports field is JS chunks only (#21136) (46d3077)

Miscellaneous Chores

deps: update rolldown-related dependencies (#21174) (74559c9)

7.2.4 (2025-11-20)

Bug Fixes

revert "perf(deps): replace debug with obug (#21107)" (2d66b7b)

7.2.3 (2025-11-20)

... (truncated)

Commits

cc383e0 release: v7.3.2
09d8c90 fix: avoid path traversal with optimize deps sourcemap handler (#22161)
f8103cc fix: check server.fs after stripping query as well (#22160)
19db0f2 fix: backport #22159, apply server.fs check to env transport (#22162)
95e8923 release: v7.3.1
9d39d37 feat: add ignoreOutdatedRequests option to optimizeDeps (#21364)
acf7e05 release: v7.3.0
cff26ec feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (#21183)
317b3b2 release: v7.2.7
721f163 fix: plugin shortcut support (#21211)
Additional commits viewable in compare view

Updates next from 15.3.8 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.16

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits

9ff92ce v15.5.18
00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
62c97ab v15.5.17
423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
fa78739 Turbopack: Fix middleware matcher suffix (#93590)
36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
36589b5 [backport][test] Pin package manager to patch versions (#93596)
ad6fd4e v15.5.16
79d7dff Ignore malformed CSP nonce headers (#103)
c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates postcss from 8.5.6 to 8.5.10

Release notes

Sourced from postcss's releases.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

Changelog

Sourced from postcss's changelog.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

Commits

33b9790 Release 8.5.10 version
536c79e Escape </style> in CSS output (#2074)
afa96b2 Update dependencies (#2073)
effe88b Typo (#2072)
3ee79a2 Thread model (#2071)
2e0683d Create incident response docs (#2070)
fe88ac2 Release 8.5.9 version
c551632 Avoid RegExp when we can use simple JS
89a6b74 Move SECURITY.txt for docs folder to keep GitHub page cleaner
6ceb8a4 Create SECURITY.md
Additional commits viewable in compare view

Updates fast-xml-parser from 5.2.5 to 5.7.0

Release notes

Sourced from fast-xml-parser's releases.

use @nodable/entities to replace entities

No API change

No change in performance for basic usage

No typing change

No config change

new dependency

breaking: error messages for entities might have been changed.

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.12...v5.6.0

performance improvment, increase entity expansion default limit

increase default entity explansion limit as many projects demand for that
maxEntitySize: 10000,
maxExpansionDepth: 10000,
maxTotalExpansions: Infinity,
maxExpandedLength: 100000,
maxEntityCount: 1000,
performance improvement

reduce calls to toString

early return when entities are not present

prepare rawAttrsForMatcher only if user sets jPath: false

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.9...v5.5.10

fix typins and matcher instance in callbacks

combine typings file to avoid configuration changes pass readonly instance of matcher to the call backs to avoid accidental push/pop call

fix bugs of entity parsing and value parsing

fix: entity expansion limits update strnum package to 2.2.0

fix entity expansion and incorrect replacement and performance

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.5...v5.5.6

support onDangerousProperty

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.3...v5.5.5

update dependecies to fix typings

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.1...v5.5.2

integrate path-expression-matcher

support path-expression-matcher

fix: stopNode should not be parsed

performance improvement for stopNode checking

Separate Builder

XML Builder was the part of fast-xml-parser for years. But considering that any bug in builder may false-alarm the users who are only using parser and vice-versa, we have decided to split it into a separate package.

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

*5.8.0

integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)

This will consider xml-version as well. '1.0' is default

update strnum to 2.3.0

You can set octal and binary parsing which is bydeault off

update fast-xml-builder to 1.2.0

can sanitize tag names if found invalid

fix format output

5.7.3 / 2006-05-05

fix: alwaysCreateTextNode should create text node when attributes are present for self closing node

fix stop node expression when ns prefix is removed (found by iruizsalinas)

update XML Builder to 1.1.7

mark addEntity deprecated

5.7.2 / 2026-04-25

allow numerical external entity for backward compatibility

fix #705: attributesGroupName working with preserveOrder

fix #817: stackoverflow when tag expression is very long

5.7.1 / 2026-04-20

fix typo in CJS typing file

5.7.0 / 2026-04-17

Use @nodable/entities v2.1.0

breaking changes

single entity scan. You're not allowed to user entity value to form another entity name.

you cant add numeric external entity

entity error message when expantion limit is crossed might change

typings are updated for new options related to process entity

please follow documentation of @nodable/entities for more detail.

performance

if processEntities is false, then there should not be impact on performance.

if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%

if processEntities is true, and you pass entity decoder separately

if no entity then performance should be same as before

if there are entities then performance should be increased from past versions

ignoreAttributes is not required to be set to set xml version for NCR entity value

update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

5.6.0 / 2026-04-15

fix: entity replacement for numeric entities

use @nodable/entities to replace entities

this may change some error messages related to entities expansion limit or inavlid use

post check would be exposed in future version

... (truncated)

Commits

f529642 update to release v5.7.0
52a8583 Revert "improve performance of attributes reading"
8d187f9 update builder
e174168 improve performance of attributes reading
79a8dde update docs
f5cd5a5 set xml version to decoder even if attributes are ignored
f44b923 remove unwanted tests
869ec8b Use @nodable/entities v2.1.0
7cb49e5 update release detail
1b14fa7 include currency entities in default list
Additional commits viewable in compare view

PR-Codex overview

This PR focuses on updating various package dependencies across multiple files, including package.json and pnpm-lock.yaml, to newer versions for improved functionality and security.

Detailed summary

Updated vite from 7.1.7 to 7.3.2 in apps/wagmi-demo/package.json.
Updated happy-dom from 17.4.4 to 20.8.9 in packages/thirdweb/package.json.
Updated next from 15.3.8 to 15.5.18 in several package.json files.
Updated postcss from 8.5.6 to 8.5.10 in multiple package.json files.
Updated fast-xml-parser from 5.2.5 to 5.7.0 in apps/dashboard/package.json.
Updated prettier and msw versions in relevant files.
Various updates to pnpm-lock.yaml reflecting changes in package versions.

The following files were skipped due to too many changes: pnpm-lock.yaml

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

graphite-app · 2026-05-06T03:02:07Z

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

merge-queue - adds this PR to the back of the merge queue
hotfix - for urgent changes, fast-track this PR to the front of the merge queue

You must have a Graphite account in order to use the merge queue. Sign up using this link.

_{An organization admin has enabled the Graphite Merge Queue in this repository.} _{Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.}

changeset-bot · 2026-05-06T03:02:08Z

⚠️ No Changeset found

Latest commit: be2c14f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2026-05-06T03:02:13Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-v2	Error		May 11, 2026 10:34pm
nebula	Ready	Preview, Comment	May 11, 2026 10:34pm
thirdweb_playground	Error		May 11, 2026 10:34pm
thirdweb-www	Error		May 11, 2026 10:34pm
wallet-ui	Ready	Preview, Comment	May 11, 2026 10:34pm

socket-security · 2026-05-06T03:03:53Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
next@15.3.8 ⏵ 15.5.18	^-13	⁺⁷⁵	⁺¹
happy-dom@18.0.1 ⏵ 20.8.9		⁺⁷⁵
@wagmi/cli@2.8.0 ⏵ 2.10.0	^-20			^-2
postcss@8.5.6 ⏵ 8.5.10	⁺¹	⁺²
fast-xml-parser@5.2.5 ⏵ 5.7.0		⁺⁷⁵	⁺¹

View full report

…dates Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [happy-dom](https://github.com/capricorn86/happy-dom) | `17.4.4` | `20.8.9` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.1.7` | `7.3.2` | | [next](https://github.com/vercel/next.js) | `15.3.8` | `15.5.18` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.10` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.2.5` | `5.7.0` | Updates `happy-dom` from 17.4.4 to 20.8.9 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v17.4.4...v20.8.9) Updates `vite` from 7.1.7 to 7.3.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite) Updates `next` from 15.3.8 to 15.5.18 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.3.8...v15.5.18) Updates `postcss` from 8.5.6 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.10) Updates `fast-xml-parser` from 5.2.5 to 5.7.0 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.2.5...v5.7.0) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.7.0 dependency-type: direct:production - dependency-name: happy-dom dependency-version: 20.8.9 dependency-type: direct:development - dependency-name: next dependency-version: 15.5.15 dependency-type: direct:production - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development - dependency-name: vite dependency-version: 7.3.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-05-11T22:30:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@internationalized/date` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/@internationalized/date@3.12.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@internationalized/date@3.12.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@walletconnect/sign-client` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/@walletconnect/sign-client@2.23.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@walletconnect/sign-client@2.23.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `happy-dom` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: packages/thirdweb/package.json → `npm/happy-dom@20.8.9` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/happy-dom@20.8.9`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `next` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: apps/dashboard/package.json → `npm/next@15.5.18` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.5.18`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `node-fetch-native` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/node-fetch-native@1.6.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-fetch-native@1.6.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `node-forge` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@coinbase/wallet-mobile-sdk@1.1.2` → `npm/expo-application@6.0.1` → `npm/@mobile-wallet-protocol/client@1.0.0` → `npm/expo-linking@8.0.8` → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/expo-web-browser@15.0.9` → `npm/wagmi@2.19.4` → `npm/node-forge@1.4.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-forge@1.4.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 6, 2026

dependabot Bot requested review from a team as code owners May 6, 2026 03:02

vercel Bot had a problem deploying to Preview – docs-v2 May 6, 2026 03:04 Failure

vercel Bot deployed to Preview – wallet-ui May 6, 2026 03:05 View deployment

vercel Bot deployed to Preview – nebula May 6, 2026 03:05 View deployment

vercel Bot had a problem deploying to Preview – thirdweb-www May 6, 2026 03:07 Failure

vercel Bot had a problem deploying to Preview – thirdweb_playground May 6, 2026 03:07 Failure

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-7a47737f2d branch from 82311c5 to be2c14f Compare May 11, 2026 22:28

vercel Bot had a problem deploying to Preview – docs-v2 May 11, 2026 22:31 Failure

vercel Bot deployed to Preview – wallet-ui May 11, 2026 22:31 View deployment

vercel Bot deployed to Preview – nebula May 11, 2026 22:33 View deployment

vercel Bot had a problem deploying to Preview – thirdweb-www May 11, 2026 22:33 Failure

vercel Bot had a problem deploying to Preview – thirdweb_playground May 11, 2026 22:34 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): Bump the npm_and_yarn group across 1 directory with 5 updates#8763

build(deps): Bump the npm_and_yarn group across 1 directory with 5 updates#8763
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-7a47737f2d

dependabot Bot commented on behalf of github May 6, 2026 •

edited by pr-codex Bot

Loading

Uh oh!

graphite-app Bot commented May 6, 2026

Uh oh!

changeset-bot Bot commented May 6, 2026 •

edited

Loading

Uh oh!

vercel Bot commented May 6, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 6, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 6, 2026 • edited by pr-codex Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v20.8.9

👷‍♂️ Patch fixes

v20.8.8

👷‍♂️ Patch fixes

v20.8.7

👷‍♂️ Patch fixes

v20.8.6

👷‍♂️ Patch fixes

v20.8.5

👷‍♂️ Patch fixes

v20.8.4

👷‍♂️ Patch fixes

v20.8.3

👷‍♂️ Patch fixes

v20.8.2

👷‍♂️ Patch fixes

v20.8.1

👷‍♂️ Patch fixes

v20.8.0

🎨 Features

v20.7.2

👷‍♂️ Patch fixes

v20.7.1

👷‍♂️ Patch fixes

v7.3.2

v7.3.1

v7.3.0

v7.2.7

v7.2.6

v7.2.5

v7.2.4

v7.2.3

v7.2.2

plugin-legacy@7.2.1

v7.2.1

plugin-legacy@7.2.0

v7.2.0

v7.2.0-beta.1

v7.2.0-beta.0

v7.1.12

7.3.2 (2026-04-06)

Bug Fixes

7.3.1 (2026-01-07)

Features

7.3.0 (2025-12-15)

Features

7.2.7 (2025-12-08)

Bug Fixes

7.2.6 (2025-12-01)

7.2.5 (2025-12-01)

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

7.2.4 (2025-11-20)

Bug Fixes

7.2.3 (2025-11-20)

v15.5.18

v15.5.16

v15.5.15

v15.5.14

8.5.10

8.5.9

8.5.8

8.5.7

8.5.10

8.5.9

8.5.8

8.5.7

use @​nodable/entities to replace entities

performance improvment, increase entity expansion default limit

fix typins and matcher instance in callbacks

fix bugs of entity parsing and value parsing

fix entity expansion and incorrect replacement and performance

support onDangerousProperty

update dependecies to fix typings

integrate path-expression-matcher

dependabot Bot commented on behalf of github May 6, 2026 •

edited by pr-codex Bot

Loading

use `@nodable/entities` to replace entities

changeset-bot Bot commented May 6, 2026 •

edited

Loading

vercel Bot commented May 6, 2026 •

edited

Loading

socket-security Bot commented May 6, 2026 •

edited

Loading