Skip to content

chore(deps): bump the npm_and_yarn group across 5 directories with 12 updates#3

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-93094e4071
Open

chore(deps): bump the npm_and_yarn group across 5 directories with 12 updates#3
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-93094e4071

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 25, 2026

Bumps the npm_and_yarn group with 10 updates in the / directory:

Package From To
ajv 8.17.1 8.18.0
axios 1.12.2 1.13.5
undici 6.21.2 6.24.0
lodash 4.17.21 4.17.23
@sentry/node 10.19.0 10.27.0
fastify 4.28.1 5.8.3
dompurify 3.3.0 3.3.2
next 15.4.11 15.5.14
@hono/node-server 1.13.7 1.19.10
hono 4.10.6 4.12.7

Bumps the npm_and_yarn group with 2 updates in the /cli directory: ajv and undici.
Bumps the npm_and_yarn group with 3 updates in the /controlplane directory: lodash, @sentry/node and fastify.
Bumps the npm_and_yarn group with 1 update in the /keycloak/theme directory: minimatch.
Bumps the npm_and_yarn group with 4 updates in the /studio directory: axios, lodash, dompurify and next.

Updates ajv from 8.17.1 to 8.18.0

Release notes

Sourced from ajv's releases.

v8.18.0

What's Changed

New Contributors

Full Changelog: ajv-validator/ajv@v8.17.1...v8.18.0

Commits
  • 142ce84 8.18.0
  • 720a23f fix(pattern): use configured RegExp engine with $data keyword to mitigate ReD...
  • 82735a1 fix: typos in schema-language.md (#2507)
  • b17ec32 fix: small grammatical error in managing-schemas.md (#2508)
  • 69568d0 fix: #2482 Infinity and NaN serialise to null (#2487)
  • f06766f feat: allow tree-shaking by adding ``"sideEffects": falsetopackage.json` ...
  • See full diff in compare view

Updates axios from 1.12.2 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

  • Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
  • Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

  • Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

  • Fix/5657. (PR #7313)
  • Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

  • Add input validation to isAbsoluteURL. (PR #7326)
  • Refactor: bump minor package versions. (PR #7356)

Documentation

  • Clarify object-check comment. (PR #7323)
  • Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

  • Chore: fix issues with YAML. (PR #7355)
  • CI: update workflow YAMLs. (PR #7372)
  • CI: fix run condition. (PR #7373)
  • Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
  • Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

  • fix: issues with version 1.13.3 (#7352) (ee90dfc)
    • Fixed issues discovered in v1.13.3 release

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

  • http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
  • interceptor: handle the error in the same interceptor (#6269) (5945e40)
  • main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
  • package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
  • silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
  • turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
  • types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
  • types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
  • unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

Reverts

  • Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
  • deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

... (truncated)

Commits
  • 29f7542 chore(release): prepare release 1.13.5 (#7379)
  • 431c3a3 ci: fix run condition (#7373)
  • 9ff3a78 ci: update ymls (#7372)
  • 265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
  • 475e75a feat: add input validation to isAbsoluteURL (#7326)
  • 28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
  • 04cf019 docs: clarify object check comment (#7323)
  • 696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
  • 569f028 fix: added a option to choose between legacy and the new request/response int...
  • 44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.


Updates undici from 6.21.2 to 6.24.0

Release notes

Sourced from undici's releases.

v6.24.0

Undici v6.24.0 Security Release Notes (LTS)

This release backports fixes for security vulnerabilities affecting the v6 line.

Upgrade guidance

All users on v6 should upgrade to v6.24.0 or later.

Fixed advisories

Not applicable to v6

Affected and patched ranges (v6)

References

v6.23.0

⚠️ Security Release

... (truncated)

Commits
  • 8873c94 Bumped v6.24.0
  • 411bd01 test(websocket): use node:assert for Node 18 compatibility
  • 844bf59 test: fix http2 lint regressions in backport
  • a444e4f test: stabilize h2 and tls-cert-leak under current test runner
  • dc032a1 fix: h2 CI (#4395)
  • 4cd3f4b test: increase bitness in test/fixtures/*.pem (#3659)
  • 7df6442 fix: adapt websocket frame-limit handling for v6 parser
  • 4e0179a fix: reject duplicate content-length and host headers
  • 5a97f08 Fix websocket 64-bit length overflow
  • e43e898 fix: validate upgrade header to prevent CRLF injection
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.


Updates lodash from 4.17.21 to 4.17.23

Commits

Updates @sentry/node from 10.19.0 to 10.27.0

Release notes

Sourced from @​sentry/node's releases.

10.27.0

Important Changes

  • feat(deps): Bump OpenTelemetry (#18239)

    • Bump @​opentelemetry/context-async-hooks from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/core from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/resources from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/sdk-trace-base from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/sdk-trace-node from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/instrumentation from 0.204.0 to 0.208.0
    • Bump @​opentelemetry/instrumentation-amqplib from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-aws-sdk from 0.59.0 to 0.64.0
    • Bump @​opentelemetry/instrumentation-connect from 0.48.0 to 0.52.0
    • Bump @​opentelemetry/instrumentation-dataloader from 0.22.0 to 0.26.0
    • Bump @​opentelemetry/instrumentation-express from 0.53.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-fs from 0.24.0 to 0.28.0
    • Bump @​opentelemetry/instrumentation-generic-pool from 0.48.0 to 0.52.0
    • Bump @​opentelemetry/instrumentation-graphql from 0.52.0 to 0.56.0
    • Bump @​opentelemetry/instrumentation-hapi from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-http from 0.204.0 to 0.208.0
    • Bump @​opentelemetry/instrumentation-ioredis from 0.52.0 to 0.56.0
    • Bump @​opentelemetry/instrumentation-kafkajs from 0.14.0 to 0.18.0
    • Bump @​opentelemetry/instrumentation-knex from 0.49.0 to 0.53.0
    • Bump @​opentelemetry/instrumentation-koa from 0.52.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-lru-memoizer from 0.49.0 to 0.53.0
    • Bump @​opentelemetry/instrumentation-mongodb from 0.57.0 to 0.61.0
    • Bump @​opentelemetry/instrumentation-mongoose from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-mysql from 0.50.0 to 0.54.0
    • Bump @​opentelemetry/instrumentation-mysql2 from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-nestjs-core from 0.50.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-pg from 0.57.0 to 0.61.0
    • Bump @​opentelemetry/instrumentation-redis from 0.53.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-tedious from 0.23.0 to 0.27.0
    • Bump @​opentelemetry/instrumentation-undici from 0.15.0 to 0.19.0
    • Bump @​prisma/instrumentation from 6.15.0 to 6.19.0

  • feat(browserprofiling): Add manual mode and deprecate old profiling (#18189)

    Adds the manual lifecycle mode for UI profiling (the default mode), allowing profiles to be captured manually with Sentry.uiProfiler.startProfiler() and Sentry.uiProfiler.stopProfiler(). The previous transaction-based profiling is with profilesSampleRate is now deprecated in favor of the new UI Profiling with profileSessionSampleRate.

Other Changes

  • feat(core): Add gibibyte and pebibyte to InformationUnit type (#18241)
  • feat(core): Add scope attribute APIs (#18165)
  • feat(core): Re-add _experiments.enableLogs option (#18299)
  • feat(core): Use maxValueLength on error messages (#18301)
  • feat(deps): bump @​sentry/bundler-plugin-core from 4.3.0 to 4.6.1 (#18273)
  • feat(deps): bump @​sentry/cli from 2.56.0 to 2.58.2 (#18271)
  • feat(node): Add tracing support for AzureOpenAI (#18281)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.27.0

Important Changes

  • feat(deps): Bump OpenTelemetry (#18239)

    • Bump @​opentelemetry/context-async-hooks from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/core from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/resources from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/sdk-trace-base from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/sdk-trace-node from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/instrumentation from 0.204.0 to 0.208.0
    • Bump @​opentelemetry/instrumentation-amqplib from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-aws-sdk from 0.59.0 to 0.64.0
    • Bump @​opentelemetry/instrumentation-connect from 0.48.0 to 0.52.0
    • Bump @​opentelemetry/instrumentation-dataloader from 0.22.0 to 0.26.0
    • Bump @​opentelemetry/instrumentation-express from 0.53.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-fs from 0.24.0 to 0.28.0
    • Bump @​opentelemetry/instrumentation-generic-pool from 0.48.0 to 0.52.0
    • Bump @​opentelemetry/instrumentation-graphql from 0.52.0 to 0.56.0
    • Bump @​opentelemetry/instrumentation-hapi from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-http from 0.204.0 to 0.208.0
    • Bump @​opentelemetry/instrumentation-ioredis from 0.52.0 to 0.56.0
    • Bump @​opentelemetry/instrumentation-kafkajs from 0.14.0 to 0.18.0
    • Bump @​opentelemetry/instrumentation-knex from 0.49.0 to 0.53.0
    • Bump @​opentelemetry/instrumentation-koa from 0.52.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-lru-memoizer from 0.49.0 to 0.53.0
    • Bump @​opentelemetry/instrumentation-mongodb from 0.57.0 to 0.61.0
    • Bump @​opentelemetry/instrumentation-mongoose from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-mysql from 0.50.0 to 0.54.0
    • Bump @​opentelemetry/instrumentation-mysql2 from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-nestjs-core from 0.50.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-pg from 0.57.0 to 0.61.0
    • Bump @​opentelemetry/instrumentation-redis from 0.53.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-tedious from 0.23.0 to 0.27.0
    • Bump @​opentelemetry/instrumentation-undici from 0.15.0 to 0.19.0
    • Bump @​prisma/instrumentation from 6.15.0 to 6.19.0

  • feat(browserprofiling): Add manual mode and deprecate old profiling (#18189)

    Adds the manual lifecycle mode for UI profiling (the default mode), allowing profiles to be captured manually with Sentry.uiProfiler.startProfiler() and Sentry.uiProfiler.stopProfiler(). The previous transaction-based profiling is with profilesSampleRate is now deprecated in favor of the new UI Profiling with profileSessionSampleRate.

Other Changes

  • feat(core): Add gibibyte and pebibyte to InformationUnit type (#18241)
  • feat(core): Add scope attribute APIs (#18165)
  • feat(core): Re-add _experiments.enableLogs option (#18299)
  • feat(core): Use maxValueLength on error messages (#18301)
  • feat(deps): bump @​sentry/bundler-plugin-core from 4.3.0 to 4.6.1 (#18273)
  • feat(deps): bump @​sentry/cli from 2.56.0 to 2.58.2 (#18271)

... (truncated)

Commits
  • 0b0151d release: 10.27.0
  • 930863e Merge pull request #18312 from getsentry/prepare-release/10.27.0
  • 02aa2ea meta(changelog): Update changelog for 10.27.0
  • 6ce620e fix(core): Always redact content of sensitive headers regardless of `sendDefa...
  • 235c865 feat(core): Re-add _experiments.enableLogs option (#18299)
  • 4b92c64 fix(nextjs): universal random tunnel path support (#18257)
  • 6240191 feat(core): Use maxValueLength on error messages (#18301)
  • 1525603 feat(browserprofiling): Add manual mode and deprecate old profiling (#18189)
  • 3d48cc6 chore: Add external contributor to CHANGELOG.md (#18300)
  • b8127fb doc(sveltekit): Update documentation link for SvelteKit guide (#18298)
  • Additional commits viewable in compare view

Updates fastify from 4.28.1 to 5.8.3

Release notes

Sourced from fastify's releases.

v5.8.3

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.2...v5.8.3

v5.8.2

What's Changed

New Contributors

... (truncated)

Commits
  • a3e77ce Bumped v5.8.3
  • 4e1db5b fix: gate host and protocol getters on proxy trust function
  • a22217f ci(lock-threads): use shared lock-threads workflow (#6592)
  • 1851f20 docs: update links (#6593)
  • 9cc5187 types: Allow port to be null in request type definition (#6589)
  • 722d83b docs: replace redirected npm.im http-errors link (#6588)
  • a1413de docs: fix incorrect code examples in Reply and Request reference (#6582)
  • d7f01b6 docs: clarify content-type parser/schema mismatch is outside threat model (#6...
  • a0649e9 docs: update syntax markdown, absolute paths and links (#6569)
  • d477915 ci(link-checker): fix root-relative links resolution (#6535)
  • Additional commits viewable in compare view

Updates dompurify from 3.3.0 to 3.3.2

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.2

  • Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
  • Fixed a prototype pollution issue when working with custom elements, thanks @​christos-eth
  • Fixed a lenient config parsing in _isValidAttribute, thanks @​christos-eth
  • Bumped and removed several dependencies, thanks @​Rotzbua
  • Fixed the test suite after bumping dependencies, thanks @​Rotzbua

DOMPurify 3.3.1

  • Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @​MariusRumpf
  • Updated the ESM import syntax to be more correct, thanks @​binhpv
Commits
  • 5e56114 Getting 3.x branch ready for 3.3.2 release (#1208)
  • e8c95f4 fix: Fixed the broken package-lock.json
  • 9636037 Update package-lock.json
  • 5cad4ce Getting 3.x branch ready for 3.3.2 releas (#1205)
  • 6fc446a Merge pull request #1175 from cure53/main
  • 3b3bf91 Merge branch 'main' of github.com:cure53/DOMPurify
  • 9863f41 chore: Preparing 3.3.1 release
  • b4e0295 chore: Preparing 3.3.0 release
  • 077746b build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1170)
  • 4de68bb build(deps): bump actions/checkout from 5 to 6 (#1171)
  • Additional commits viewable in compare view

Updates next from 15.4.11 to 15.5.14

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)
  • Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @​styfle and @​lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

  • fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

Commits
  • d7b012d v15.5.14
  • 2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
  • f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
  • cfd5f53 v15.5.13
  • 15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
  • d23f41c v15.5.12
  • 8e75765 fix unlock in publish-native
  • 6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
  • 7a94645 Apply needs for publishRelease
  • bbfd4e3 v15.5.11
  • Additional commits viewable in compare view

Updates @hono/node-server from 1.13.7 to 1.19.10

Release notes

Sourced from @​hono/node-server's releases.

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

v1.19.9

What's Changed

Full Changelog: honojs/node-server@v1.19.8...v1.19.9

v1.19.8

What's Changed

New Contributors

Full Changelog: honojs/node-server@v1.19.7...v1.19.8

v1.19.7

What's Changed

New Contributors

Full Changelog: honojs/node-server@v1.19.6...v1.19.7

v1.19.6

What's Changed

Full Changelog: honojs/node-server@v1.19.5...v1.19.6

v1.19.5

What's Changed

Full Changelog: honojs/node-server@v1.19.4...v1.19.5

v1.19.4

... (truncated)

Commits

@dependabot
chore(deps): bump the npm_and_yarn group across 5 directories with 12…
7e384cb 
… updates

Bumps the npm_and_yarn group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [ajv](https://github.com/ajv-validator/ajv) | `8.17.1` | `8.18.0` |
| [axios](https://github.com/axios/axios) | `1.12.2` | `1.13.5` |
| [undici](https://github.com/nodejs/undici) | `6.21.2` | `6.24.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.19.0` | `10.27.0` |
| [fastify](https://github.com/fastify/fastify) | `4.28.1` | `5.8.3` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.3.0` | `3.3.2` |
| [next](https://github.com/vercel/next.js) | `15.4.11` | `15.5.14` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.13.7` | `1.19.10` |
| [hono](https://github.com/honojs/hono) | `4.10.6` | `4.12.7` |

Bumps the npm_and_yarn group with 2 updates in the /cli directory: [ajv](https://github.com/ajv-validator/ajv) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 3 updates in the /controlplane directory: [lodash](https://github.com/lodash/lodash), [@sentry/node](https://github.com/getsentry/sentry-javascript) and [fastify](https://github.com/fastify/fastify).
Bumps the npm_and_yarn group with 1 update in the /keycloak/theme directory: [minimatch](https://github.com/isaacs/minimatch).
Bumps the npm_and_yarn group with 4 updates in the /studio directory: [axios](https://github.com/axios/axios), [lodash](https://github.com/lodash/lodash), [dompurify](https://github.com/cure53/DOMPurify) and [next](https://github.com/vercel/next.js).


Updates `ajv` from 8.17.1 to 8.18.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v8.17.1...v8.18.0)

Updates `axios` from 1.12.2 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.12.2...v1.13.5)

Updates `undici` from 6.21.2 to 6.24.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.2...v6.24.0)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `@sentry/node` from 10.19.0 to 10.27.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.19.0...10.27.0)

Updates `fastify` from 4.28.1 to 5.8.3
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v4.28.1...v5.8.3)

Updates `dompurify` from 3.3.0 to 3.3.2
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.0...3.3.2)

Updates `next` from 15.4.11 to 15.5.14
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.4.11...v15.5.14)

Updates `@hono/node-server` from 1.13.7 to 1.19.10
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.13.7...v1.19.10)

Updates `hono` from 4.10.6 to 4.12.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.10.6...v4.12.7)

Updates `rollup` from 3.29.5 to 4.9.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v3.29.5...v4.9.5)

Updates `ajv` from 8.17.1 to 8.18.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v8.17.1...v8.18.0)

Updates `undici` from 6.21.2 to 6.24.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.2...v6.24.0)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `@sentry/node` from 10.19.0 to 10.27.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.19.0...10.27.0)

Updates `fastify` from 4.28.1 to 5.8.3
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v4.28.1...v5.8.3)

Updates `minimatch` from 10.2.2 to 10.2.4
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.2.2...v10.2.4)

Updates `axios` from 1.12.2 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.12.2...v1.13.5)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `dompurify` from 3.3.0 to 3.3.2
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.0...3.3.2)

Updates `next` from 15.4.11 to 15.5.14
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.4.11...v15.5.14)

---
updated-dependencies:
- dependency-name: ajv
  dependency-version: 8.18.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.24.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@sentry/node"
  dependency-version: 10.27.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.8.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.3.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.14
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.9.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ajv
  dependency-version: 8.18.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.24.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@sentry/node"
  dependency-version: 10.27.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.8.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 10.2.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.3.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.14
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 25, 2026
@dependabot dependabot bot mentioned this pull request Mar 25, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants