build(deps): Bump the npm_and_yarn group across 8 directories with 3 updates by dependabot[bot] · Pull Request #8953 · thirdweb-dev/js

dependabot · 2026-09-11T14:32:48Z

Bumps the npm_and_yarn group with 1 update in the /apps/dashboard directory: next.
Bumps the npm_and_yarn group with 1 update in the /apps/nebula directory: next.
Bumps the npm_and_yarn group with 1 update in the /apps/playground-web directory: next.
Bumps the npm_and_yarn group with 1 update in the /apps/portal directory: next.
Bumps the npm_and_yarn group with 1 update in the /apps/wallet-ui directory: next.
Bumps the npm_and_yarn group with 1 update in the /packages/service-utils directory: vitest.
Bumps the npm_and_yarn group with 2 updates in the /packages/thirdweb directory: toml and vitest.
Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: next.

Updates next from 15.3.8 to 15.5.24

Release notes

Sourced from next's releases.

v15.5.24

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v15.5.23

What's Changed

[15.x] Port ReplyServer traversal guards to FlightClient @eps1lon in vercel/next.js#96405

Full Changelog: vercel/next.js@v15.5.22...v15.5.23

v15.5.22

What's Changed

[15.5] Reject TypeScript >= 7.0 with an actionable error by @lukesandberg in vercel/next.js#96110

Full Changelog: vercel/next.js@v15.5.21...v15.5.22

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

Commits

b6c45b4 v15.5.24
b0f3460 [15.5.x] Fix ISR misses with backslashes in segments when deployed on Windows
409772e [15.5.x] [next/image]: disable avif image optimization
9c44b88 [15.x] support sharp 0.34 and 0.35
144fa5d [15.5.x] Remove generated error codes (#97783)
ddd94f0 [15.5.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
1da7a0a [15.5] [ci] Use OIDC tokens to read private preview builds (#97259)
70ab0fe [15.x] Default deploy e2e tests to the repo next version (#96899)
e57d564 v15.5.23
c4914aa [15.x] Port ReplyServer traversal guards to FlightClient (#96405)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next from 15.3.8 to 15.5.24

Release notes

Sourced from next's releases.

v15.5.24

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v15.5.23

What's Changed

[15.x] Port ReplyServer traversal guards to FlightClient @eps1lon in vercel/next.js#96405

Full Changelog: vercel/next.js@v15.5.22...v15.5.23

v15.5.22

What's Changed

[15.5] Reject TypeScript >= 7.0 with an actionable error by @lukesandberg in vercel/next.js#96110

Full Changelog: vercel/next.js@v15.5.21...v15.5.22

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

Commits

b6c45b4 v15.5.24
b0f3460 [15.5.x] Fix ISR misses with backslashes in segments when deployed on Windows
409772e [15.5.x] [next/image]: disable avif image optimization
9c44b88 [15.x] support sharp 0.34 and 0.35
144fa5d [15.5.x] Remove generated error codes (#97783)
ddd94f0 [15.5.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
1da7a0a [15.5] [ci] Use OIDC tokens to read private preview builds (#97259)
70ab0fe [15.x] Default deploy e2e tests to the repo next version (#96899)
e57d564 v15.5.23
c4914aa [15.x] Port ReplyServer traversal guards to FlightClient (#96405)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next from 15.3.8 to 15.5.24

Release notes

Sourced from next's releases.

v15.5.24

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v15.5.23

What's Changed

[15.x] Port ReplyServer traversal guards to FlightClient @eps1lon in vercel/next.js#96405

Full Changelog: vercel/next.js@v15.5.22...v15.5.23

v15.5.22

What's Changed

[15.5] Reject TypeScript >= 7.0 with an actionable error by @lukesandberg in vercel/next.js#96110

Full Changelog: vercel/next.js@v15.5.21...v15.5.22

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

Commits

b6c45b4 v15.5.24
b0f3460 [15.5.x] Fix ISR misses with backslashes in segments when deployed on Windows
409772e [15.5.x] [next/image]: disable avif image optimization
9c44b88 [15.x] support sharp 0.34 and 0.35
144fa5d [15.5.x] Remove generated error codes (#97783)
ddd94f0 [15.5.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
1da7a0a [15.5] [ci] Use OIDC tokens to read private preview builds (#97259)
70ab0fe [15.x] Default deploy e2e tests to the repo next version (#96899)
e57d564 v15.5.23
c4914aa [15.x] Port ReplyServer traversal guards to FlightClient (#96405)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next from 15.3.8 to 15.5.24

Release notes

Sourced from next's releases.

v15.5.24

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v15.5.23

What's Changed

[15.x] Port ReplyServer traversal guards to FlightClient @eps1lon in vercel/next.js#96405

Full Changelog: vercel/next.js@v15.5.22...v15.5.23

v15.5.22

What's Changed

[15.5] Reject TypeScript >= 7.0 with an actionable error by @lukesandberg in vercel/next.js#96110

Full Changelog: vercel/next.js@v15.5.21...v15.5.22

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

Commits

b6c45b4 v15.5.24
b0f3460 [15.5.x] Fix ISR misses with backslashes in segments when deployed on Windows
409772e [15.5.x] [next/image]: disable avif image optimization
9c44b88 [15.x] support sharp 0.34 and 0.35
144fa5d [15.5.x] Remove generated error codes (#97783)
ddd94f0 [15.5.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
1da7a0a [15.5] [ci] Use OIDC tokens to read private preview builds (#97259)
70ab0fe [15.x] Default deploy e2e tests to the repo next version (#96899)
e57d564 v15.5.23
c4914aa [15.x] Port ReplyServer traversal guards to FlightClient (#96405)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next from 15.3.8 to 15.5.24

Release notes

Sourced from next's releases.

v15.5.24

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v15.5.23

What's Changed

[15.x] Port ReplyServer traversal guards to FlightClient @eps1lon in vercel/next.js#96405

Full Changelog: vercel/next.js@v15.5.22...v15.5.23

v15.5.22

What's Changed

[15.5] Reject TypeScript >= 7.0 with an actionable error by @lukesandberg in vercel/next.js#96110

Full Changelog: vercel/next.js@v15.5.21...v15.5.22

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

Commits

b6c45b4 v15.5.24
b0f3460 [15.5.x] Fix ISR misses with backslashes in segments when deployed on Windows
409772e [15.5.x] [next/image]: disable avif image optimization
9c44b88 [15.x] support sharp 0.34 and 0.35
144fa5d [15.5.x] Remove generated error codes (#97783)
ddd94f0 [15.5.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
1da7a0a [15.5] [ci] Use OIDC tokens to read private preview builds (#97259)
70ab0fe [15.x] Default deploy e2e tests to the repo next version (#96899)
e57d564 v15.5.23
c4914aa [15.x] Port ReplyServer traversal guards to FlightClient (#96405)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates vitest from 3.2.4 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

... (truncated)

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates toml from 3.0.0 to 4.2.0

Changelog

Sourced from toml's changelog.

4.2.0 - July 13 2026

Address security advisory GHSA-82x6-q7mm-w9cf (CVE pending), in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).

4.1.2 - June 30 2026

Address CVE-2026-63376, in which a specially crafted TOML string could pollute Object.prototype process-wide.

4.1.1 - March 31 2026

Increase performance ~5x (#68)

4.1.0 - March 31 2026

Add spec v1.1.0 support (#67)

4.0.1 - March 31 2026

Minor packaging changes

4.0.0 - March 31 2026

Modernize tooling and support TOML v1.0.0 spec (#66)

2.3.0 - July 13 2015

Correctly handle quoted keys (#21)

2.2.3 - June 8 2015

Support empty inline tables (#24)

Do not allow implicit table definitions to replace value (#23)

Don't allow tables to replace inline tables (#25)

2.2.2 - April 3 2015

Correctly handle newlines at beginning of string (#22)

2.2.1 - March 17 2015

... (truncated)

Commits

6d42b7e 4.2.0
b71c439 Merge pull request #72 from BinaryMuse/fix/nesting-depth-dos
a2d6dbb Update changelog
967b8b0 fix: bound nesting depth to prevent stack-overflow DoS
91e0de3 Merge pull request #71 from BinaryMuse/fix/utf8-bom-spec
5d62d38 fix: allow leading UTF-8 BOM
a6d7152 Update changelog
49759be 4.1.2
efec08a Merge commit from fork
def6ab5 fix: prevent prototype traversal during table resolution
Additional commits viewable in compare view

Updates vitest from 3.2.4 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

... (truncated)

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates next from 15.3.8 to 15.5.24

Release notes

Sourced from next's releases.

v15.5.24

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v15.5.23

What's Changed

[15.x] Port ReplyServer traversal guards to FlightClient @eps1lon in vercel/next.js#96405

Full Changelog: vercel/next.js@v15.5.22...v15.5.23

v15.5.22

What's Changed

[15.5] Reject TypeScript >= 7.0 with an actionable error by @lukesandberg in vercel/next.js#96110

Full Changelog: vercel/next.js@v15.5.21...v15.5.22

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

Commits

b6c45b4 v15.5.24
b0f3460 [15.5.x] Fix ISR misses with backslashes in segments when deployed on Windows
409772e [15.5.x] [next/image]: disable avif image optimization
9c44b88 [15.x] support sharp 0.34 and 0.35
144fa5d [15.5.x] Remove generated error codes (#97783)
ddd94f0 [15.5.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
1da7a0a [15.5] [ci] Use OIDC tokens to read private preview builds (#97259)
70ab0fe [15.x] Default deploy e2e tests to the repo next version (#96899)
e57d564 v15.5.23
c4914aa [15.x] Port ReplyServer traversal guards to FlightClient (#96405)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 1 update in the /apps/dashboard directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /apps/nebula directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /apps/playground-web directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /apps/portal directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /apps/wallet-ui directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/service-utils directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 2 updates in the /packages/thirdweb directory: [toml](https://github.com/BinaryMuse/toml-node) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: [next](https://github.com/vercel/next.js). Updates `next` from 15.3.8 to 15.5.24 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.3.8...v15.5.24) Updates `next` from 15.3.8 to 15.5.24 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.3.8...v15.5.24) Updates `next` from 15.3.8 to 15.5.24 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.3.8...v15.5.24) Updates `next` from 15.3.8 to 15.5.24 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.3.8...v15.5.24) Updates `next` from 15.3.8 to 15.5.24 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.3.8...v15.5.24) Updates `vitest` from 3.2.4 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) Updates `toml` from 3.0.0 to 4.2.0 - [Changelog](https://github.com/BinaryMuse/toml-node/blob/master/CHANGELOG.md) - [Commits](BinaryMuse/toml-node@v3.0.0...v4.2.0) Updates `vitest` from 3.2.4 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) Updates `next` from 15.3.8 to 15.5.24 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.3.8...v15.5.24) --- updated-dependencies: - dependency-name: next dependency-version: 15.5.24 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.24 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.24 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.24 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.24 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: toml dependency-version: 4.2.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.24 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-09-11T14:32:55Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Updated
docs-v2	Error	Sep 11, 2026 2:33pm UTC
nebula	Error	Sep 11, 2026 2:33pm UTC
thirdweb_playground	Error	Sep 11, 2026 2:33pm UTC
thirdweb-www	Error	Sep 11, 2026 2:33pm UTC
wallet-ui	Error	Sep 11, 2026 2:33pm UTC

changeset-bot · 2026-09-11T14:32:56Z

⚠️ No Changeset found

Latest commit: cdc92e9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-09-11T14:33:14Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f2a24861-69f7-431b-a75e-39eec8fb2f37

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

dependabot · 2026-09-11T15:40:44Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-09-11T17:35:03Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-09-11T18:55:31Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-09-11T21:46:02Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot Bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 11, 2026

dependabot Bot requested review from a team as code owners September 11, 2026 14:32

dependabot Bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 11, 2026

vercel Bot had a problem deploying to Preview – nebula September 11, 2026 14:33 Failure

vercel Bot had a problem deploying to Preview – thirdweb_playground September 11, 2026 14:33 Failure

vercel Bot had a problem deploying to Preview – thirdweb-www September 11, 2026 14:33 Failure

vercel Bot had a problem deploying to Preview – wallet-ui September 11, 2026 14:33 Failure

vercel Bot had a problem deploying to Preview – docs-v2 September 11, 2026 14:33 Failure

Navigation Menu

Uh oh!

build(deps): Bump the npm_and_yarn group across 8 directories with 3 updates - #8953

build(deps): Bump the npm_and_yarn group across 8 directories with 3 updates#8953
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/dashboard/npm_and_yarn-e844ebf50e

dependabot Bot commented on behalf of github Sep 11, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Sep 11, 2026

Uh oh!

coderabbitai Bot commented Sep 11, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v15.5.24

v15.5.23

What's Changed

v15.5.22

What's Changed

v15.5.21

v15.5.24

v15.5.23

What's Changed

v15.5.22

What's Changed

v15.5.21

v15.5.24

v15.5.23

What's Changed

v15.5.22

What's Changed

v15.5.21

v15.5.24

v15.5.23

What's Changed

v15.5.22

What's Changed

v15.5.21

v15.5.24

v15.5.23

What's Changed

v15.5.22

What's Changed

v15.5.21

v4.1.11

🐞 Bug Fixes

v4.1.10

🐞 Bug Fixes

v4.1.9

🐞 Bug Fixes

v4.1.8

🐞 Bug Fixes

v4.1.7

🐞 Bug Fixes

4.2.0 - July 13 2026

4.1.2 - June 30 2026

4.1.1 - March 31 2026

4.1.0 - March 31 2026

4.0.1 - March 31 2026

4.0.0 - March 31 2026

2.3.0 - July 13 2015

2.2.3 - June 8 2015

2.2.2 - April 3 2015

v4.1.11

🐞 Bug Fixes

v4.1.10

🐞 Bug Fixes

v4.1.9

🐞 Bug Fixes

v4.1.8

🐞 Bug Fixes

v4.1.7

🐞 Bug Fixes

v15.5.24

v15.5.23

What's Changed

v15.5.22

What's Changed

v15.5.21

Uh oh!

vercel Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Sep 11, 2026

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Sep 11, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 11, 2026

dependabot Bot commented on behalf of github Sep 11, 2026 •

edited

Loading

vercel Bot commented Sep 11, 2026 •

edited

Loading