build(deps): Bump the npm_and_yarn group across 1 directory with 4 updates by dependabot[bot] · Pull Request #8952 · thirdweb-dev/js

dependabot · 2026-09-11T14:28:28Z

Bumps the npm_and_yarn group with 3 updates in the / directory: toml, sharp and next.

Updates toml from 3.0.0 to 4.2.0

Changelog

4.2.0 - July 13 2026

Address security advisory GHSA-82x6-q7mm-w9cf (CVE pending), in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).

4.1.2 - June 30 2026

Address CVE-2026-63376, in which a specially crafted TOML string could pollute Object.prototype process-wide.

4.1.1 - March 31 2026

Increase performance ~5x (#68)

4.1.0 - March 31 2026

Add spec v1.1.0 support (#67)

4.0.1 - March 31 2026

Minor packaging changes

4.0.0 - March 31 2026

Modernize tooling and support TOML v1.0.0 spec (#66)

2.3.0 - July 13 2015

Correctly handle quoted keys (#21)

2.2.3 - June 8 2015

Support empty inline tables (#24)

Do not allow implicit table definitions to replace value (#23)

Don't allow tables to replace inline tables (#25)

2.2.2 - April 3 2015

Correctly handle newlines at beginning of string (#22)

2.2.1 - March 17 2015

... (truncated)

Commits

6d42b7e 4.2.0
b71c439 Merge pull request #72 from BinaryMuse/fix/nesting-depth-dos
a2d6dbb Update changelog
967b8b0 fix: bound nesting depth to prevent stack-overflow DoS
91e0de3 Merge pull request #71 from BinaryMuse/fix/utf8-bom-spec
5d62d38 fix: allow leading UTF-8 BOM
a6d7152 Update changelog
49759be 4.1.2
efec08a Merge commit from fork
def6ab5 fix: prevent prototype traversal during table resolution
Additional commits viewable in compare view

Updates sharp from 0.35.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

Bound resize dimensions to coordinate limit.

Bound composite left and top to coordinate limit. #4564 @metsw24-max

Round palette bit depth up for png and gif colours. #4569 @metsw24-max

Ensure tiff.subifd input option is used. #4572 @metsw24-max

Ensure info.pages is correct when limiting input page range. #4578 @metsw24-max

Improve support for input Streams finishing before output is requested. #4584 @Jaybhade

v0.35.4-rc.0

Upgrade to libvips v8.18.6 for upstream bug fixes.

Bound resize dimensions to coordinate limit.

Bound composite left and top to coordinate limit. #4564 @metsw24-max

Round palette bit depth up for png and gif colours. #4569 @metsw24-max

Ensure tiff.subifd input option is used. #4572 @metsw24-max

Ensure info.pages is correct when limiting input page range. #4578 @metsw24-max

Improve support for input Streams finishing before output is requested. #4584 @Jaybhade

Commits

7f1a0a2 Release v0.35.4
f927818 Upgrade to sharp-libvips v1.3.3
e802092 Prerelease v0.35.4-rc.0
e13eb2f CI: Fix wasm32 build (#4589)
a82a0b3 Upgrade to libvips v8.18.6
8044fe4 Bound resize dimensions to coordinate limit
147f859 Docs: changelog entries for #4578 #4584
ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
Additional commits viewable in compare view

Updates next from 15.3.8 to 15.5.24

Release notes

Sourced from next's releases.

v15.5.24

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v15.5.23

What's Changed

[15.x] Port ReplyServer traversal guards to FlightClient @eps1lon in vercel/next.js#96405

Full Changelog: vercel/next.js@v15.5.22...v15.5.23

v15.5.22

What's Changed

[15.5] Reject TypeScript >= 7.0 with an actionable error by @lukesandberg in vercel/next.js#96110

Full Changelog: vercel/next.js@v15.5.21...v15.5.22

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

Commits

b6c45b4 v15.5.24
b0f3460 [15.5.x] Fix ISR misses with backslashes in segments when deployed on Windows
409772e [15.5.x] [next/image]: disable avif image optimization
9c44b88 [15.x] support sharp 0.34 and 0.35
144fa5d [15.5.x] Remove generated error codes (#97783)
ddd94f0 [15.5.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
1da7a0a [15.5] [ci] Use OIDC tokens to read private preview builds (#97259)
70ab0fe [15.x] Default deploy e2e tests to the repo next version (#96899)
e57d564 v15.5.23
c4914aa [15.x] Port ReplyServer traversal guards to FlightClient (#96405)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates @vitest/mocker from 3.2.4 to 5.0.0

Release notes

Sourced from @vitest/mocker's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

🚨 Breaking Changes

Replace loupe.inspect with pretty-format - by @hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)

Remove quotes from string values in test.for/each title $ variable (take 2) - by @hi-ogawa in vitest-dev/vitest#10170 (04d37)

Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/ - by @MdSadiqMd in vitest-dev/vitest#10186 (1ba73)

Remove sequential test/suite options in favor of concurrent - by @hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)

Represent locator as an object instead of a string - by @sheremet-va in vitest-dev/vitest#10212 (80f07)

Inline expect package - by @sheremet-va in vitest-dev/vitest#10221 (ad162)

Remove deprecated entry points - by @sheremet-va in vitest-dev/vitest#10222 (994c6)

Require Node.js 22 and Vite 6.4 - by @sheremet-va in vitest-dev/vitest#10178 (38762)

Fail expect.poll when function didn't resolve in time - by @hi-ogawa and OpenAI Codex in vitest-dev/vitest#10233 (4df04)

Throw an error if hoistable methods are outside the top level scope - by @sheremet-va in vitest-dev/vitest#10460 (d0b4f)

toHaveTextContent is strict, add toMatchTextContent as alternative - by @sheremet-va in vitest-dev/vitest#10473 (18f30)

Don't lookup config file from ancestor directories - by @hi-ogawa, OpenAI Codex and Hiroshi Ogawa in vitest-dev/vitest#10428 (945d9)

Inline @vitest/runner package, do not publish it anymore - by @sheremet-va in vitest-dev/vitest#10511 (6d6e4)

Allow mutating happy-dom/jsdom window object - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10373 (206e8)

Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based - by @sheremet-va in vitest-dev/vitest#10516 (bdd98)

Add screenshotDirectory config to browser.expect.toMatchScreenshot - by @macarie in vitest-dev/vitest#10592 (a60de)

Update @sinonjs/fake-timers and support mocking Temporal - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10654 (f8b15)

Remove webdriverio package - by @sheremet-va in vitest-dev/vitest#10675 (5fed6)

Clear mocks by default before each test - by @sheremet-va in vitest-dev/vitest#10613 (0f646)

Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start - by @sheremet-va in vitest-dev/vitest#10293 (334ed)

Separate config resolution from the server creation - by @sheremet-va in vitest-dev/vitest#10554 (1c0ec)

Inline projects extend the root config by default - by @sheremet-va in vitest-dev/vitest#10750 (fec00)

Enable mocking Temporal without fake timers - by @fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10757 (ac2d4)

Support nested projects - by @sheremet-va in vitest-dev/vitest#10846 (ec367)

Use > as separator in -t, calculate only once - by @sheremet-va in vitest-dev/vitest#10686 (a0b20)

Fail the test when an asynchronous assertion is not awaited - by @sheremet-va in vitest-dev/vitest#10868 (86d4a)

Share the Vite server between inline projects - by @sheremet-va in vitest-dev/vitest#10848 (d87c9)

Parse files statically in vitest list by default - by @sheremet-va in vitest-dev/vitest#11088 (51e94)

benchmark:

Rewrite the public API - by @sheremet-va in vitest-dev/vitest#10113 (19f6e)

browser:

Iframe scale - by @macarie in vitest-dev/vitest#9745 (b6398)

Enable locators.exact by default - by @sheremet-va in vitest-dev/vitest#10430 (e2032)

Require sessionId for orchestrator html request - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10522 (79b7d)

Save failure screenshots in attachmentsDir - by @macarie in vitest-dev/vitest#10917 (3b5bb)

coverage:

include/exclude globs too eager - by @AriPerkkio in vitest-dev/vitest#9818 (edacb)

Allow thresholds.perFile to accept an object - by @vladlenskiy and @AriPerkkio in vitest-dev/vitest#10190 (13b78)

expect:

Fix toThrow("") behavior by reverting #6710 - by @hi-ogawa in vitest-dev/vitest#9643 and vitest-dev/vitest#6710 (6c3e4)

mocker:

Deserialize automock as automock - by @nami8824 in vitest-dev/vitest#10192 (2f892)

reporters:

blob reporter and --merge-reports default to .vitest/blob/ - by @AriPerkkio in vitest-dev/vitest#10232 (d22b0)

Write json and junit reporter output files to .vitest by default - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @AriPerkkio in vitest-dev/vitest#10621 (58577)

... (truncated)

Commits

f441c6f chore: release v5.0.0 (#11130)
897f51f chore: release v5.0.0-rc.4 (#11107)
7db80dc chore: release v5.0.0-rc.3 (#11089)
732df2c fix(deps): update all non-major dependencies (#11043)
1e9f80e perf(vm): don't prewarm modules the worker never requests (#11033)
af83d1b chore: release v5.0.0-rc.2 (#10976)
8ff9b9a fix(mocker): restrict redirect mocks to the fs allowlist (#10972)
65263d7 fix(deps): update all non-major dependencies (#10966)
a7fa111 chore: release v5.0.0-rc.1 (#10920)
0553851 chore: add Knip checks (#10847)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @vitest/mocker since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 3 updates in the / directory: [toml](https://github.com/BinaryMuse/toml-node), [sharp](https://github.com/lovell/sharp) and [next](https://github.com/vercel/next.js). Updates `toml` from 3.0.0 to 4.2.0 - [Changelog](https://github.com/BinaryMuse/toml-node/blob/master/CHANGELOG.md) - [Commits](BinaryMuse/toml-node@v3.0.0...v4.2.0) Updates `sharp` from 0.35.3 to 0.35.4 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.3...v0.35.4) Updates `next` from 15.3.8 to 15.5.24 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.3.8...v15.5.24) Updates `@vitest/mocker` from 3.2.4 to 5.0.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/mocker) --- updated-dependencies: - dependency-name: toml dependency-version: 4.2.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.24 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@vitest/mocker" dependency-version: 5.0.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-09-11T14:28:33Z

⚠️ No Changeset found

Latest commit: 141cb3c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2026-09-11T14:28:35Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-v2	Error		Sep 11, 2026 2:39pm UTC
nebula	Ready	Preview	Sep 11, 2026 2:39pm UTC
thirdweb_playground	Error		Sep 11, 2026 2:39pm UTC
thirdweb-www	Ready	Preview	Sep 11, 2026 2:39pm UTC
wallet-ui	Ready	Preview	Sep 11, 2026 2:39pm UTC

coderabbitai · 2026-09-11T14:28:38Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f034812c-8685-4b6a-a47c-73a2fd160f71

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-09-11T14:29:28Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
next@15.3.8 ⏵ 15.5.24		⁺⁷⁵	⁺¹
@ai-sdk/provider-utils@5.0.39
vitest@3.2.4 ⏵ 5.0.0	⁺¹	⁺⁷⁵	⁺¹
postcss@8.5.23 ⏵ 8.5.24	⁺¹		⁺¹	⁺²
toml@3.0.0 ⏵ 4.2.0	⁺¹	⁺²²	⁺²

View full report

socket-security · 2026-09-11T14:29:30Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@walletconnect/sign-client` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/@walletconnect/sign-client@2.23.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@walletconnect/sign-client@2.23.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `yargs` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/vitest@5.0.0` → `npm/@coinbase/wallet-mobile-sdk@1.1.2` → `npm/expo-application@6.0.1` → `npm/@mobile-wallet-protocol/client@1.0.0` → `npm/expo-linking@8.0.8` → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/expo-web-browser@15.0.9` → `npm/wagmi@2.19.4` → `npm/yargs@17.7.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/yargs@17.7.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot · 2026-09-11T14:40:05Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the Dependencies Pull requests that update a dependency file label Sep 11, 2026

dependabot Bot requested a review from a team as a code owner September 11, 2026 14:28

dependabot Bot added the javascript Pull requests that update Javascript code label Sep 11, 2026

dependabot Bot requested a review from a team as a code owner September 11, 2026 14:28

dependabot Bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 11, 2026

vercel Bot had a problem deploying to Preview – docs-v2 September 11, 2026 14:31 Failure

vercel Bot deployed to Preview – wallet-ui September 11, 2026 14:32

View deployment

vercel Bot deployed to Preview – nebula September 11, 2026 14:33

View deployment

vercel Bot had a problem deploying to Preview – thirdweb_playground September 11, 2026 14:35 Failure

vercel Bot deployed to Preview – thirdweb-www September 11, 2026 14:39

View deployment

dependabot Bot closed this Sep 11, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-26c4386217 branch September 11, 2026 14:40

Navigation Menu

Repository navigation

build(deps): Bump the npm_and_yarn group across 1 directory with 4 updates - #8952

build(deps): Bump the npm_and_yarn group across 1 directory with 4 updates#8952
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-26c4386217

dependabot Bot commented on behalf of github Sep 11, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Sep 11, 2026

Uh oh!

vercel Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 11, 2026

Review skipped

Uh oh!

socket-security Bot commented Sep 11, 2026

Uh oh!

socket-security Bot commented Sep 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 11, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

4.2.0 - July 13 2026

4.1.2 - June 30 2026

4.1.1 - March 31 2026

4.1.0 - March 31 2026

4.0.1 - March 31 2026

4.0.0 - March 31 2026

2.3.0 - July 13 2015

2.2.3 - June 8 2015

2.2.2 - April 3 2015

v0.35.4

v0.35.4-rc.0

v15.5.24

v15.5.23

What's Changed

v15.5.22

What's Changed

v15.5.21

v5.0.0

🚨 Breaking Changes

Uh oh!

changeset-bot Bot commented Sep 11, 2026

⚠️ No Changeset found

Uh oh!

vercel Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 11, 2026

Review skipped

Uh oh!

socket-security Bot commented Sep 11, 2026

Uh oh!

socket-security Bot commented Sep 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 11, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 11, 2026 •

edited

Loading

vercel Bot commented Sep 11, 2026 •

edited

Loading