Skip to content

deps(deps): bump the minor-and-patch group with 19 updates#71

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-022bc93244
Open

deps(deps): bump the minor-and-patch group with 19 updates#71
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-022bc93244

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 25, 2026

Bumps the minor-and-patch group with 19 updates:

Package From To
@supabase/supabase-js 2.99.3 2.106.2
framer-motion 12.38.0 12.40.0
isomorphic-dompurify 3.12.0 3.14.0
lucide-react 1.14.0 1.16.0
next 16.2.4 16.2.6
openai 6.36.0 6.39.0
react 19.2.5 19.2.6
@types/react 19.2.14 19.2.15
react-dom 19.2.5 19.2.6
resend 6.12.2 6.12.4
tailwind-merge 3.5.0 3.6.0
undici 8.2.0 8.3.0
@tailwindcss/postcss 4.2.4 4.3.0
@types/jsdom 28.0.0 28.0.3
@types/node 25.6.0 25.9.1
eslint-config-next 16.2.4 16.2.6
postcss 8.5.14 8.5.15
tailwindcss 4.2.4 4.3.0
tsx 4.21.0 4.22.3

Updates @supabase/supabase-js from 2.99.3 to 2.106.2

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.106.2

2.106.2 (2026-05-25)

🩹 Fixes

  • auth: restore signup user response (#2391)
  • misc: add react-native export condition for Hermes-safe resolution (#2393)

❤️ Thank You

v2.106.2-canary.1

2.106.2-canary.1 (2026-05-22)

This was a version bump only, there were no code changes.

v2.106.2-canary.0

2.106.2-canary.0 (2026-05-22)

🩹 Fixes

  • auth: restore signup user response (#2391)
  • misc: add react-native export condition for Hermes-safe resolution (#2393)

❤️ Thank You

v2.106.2-beta.2

2.106.2-beta.2 (2026-05-22)

This was a version bump only, there were no code changes.

v2.106.2-beta.0

2.106.2-beta.0 (2026-05-21)

This was a version bump only, there were no code changes.

v2.106.1

2.106.1 (2026-05-20)

🩹 Fixes

  • auth: encode client-id in oauth requests (#2383)
  • misc: hide dynamic import from hermesc (#2381)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.106.2 (2026-05-25)

🩹 Fixes

  • misc: add react-native export condition for Hermes-safe resolution (#2393)

❤️ Thank You

2.106.1 (2026-05-20)

🩹 Fixes

  • misc: hide dynamic import from hermesc (#2381)

❤️ Thank You

2.106.0 (2026-05-18)

🚀 Features

  • supabase: W3C/OpenTelemetry trace context propagation (#2163)

🩹 Fixes

  • release: mark @​supabase/tracing private and snapshot it for JSR (#2370)

❤️ Thank You

  • Claude Sonnet 4.5
  • Guilherme Souza
  • Katerina Skroumpelou @​mandarini

2.105.4 (2026-05-08)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.105.2 (2026-05-04)

🩹 Fixes

  • auth: forward lockAcquireTimeout to SupabaseAuthClient (#2309)
  • misc: widen enum-like unions with (string & {}) for forward compat (#2303)

❤️ Thank You

... (truncated)

Commits
  • a5f09cf chore(repo): adopt pnpm catalog and clean up devDeps (#2389)
  • c72cc56 fix(misc): add react-native export condition for Hermes-safe resolution (#2393)
  • a7bdb23 docs(supabase): expand tracePropagation tsdoc with examples (#2388)
  • f4c149c chore(release): version 2.106.1 changelogs (#2384)
  • 3f9628a fix(misc): hide dynamic import from hermesc (#2381)
  • 1761a62 chore(release): version 2.106.0 changelogs (#2379)
  • 1c48755 chore(deps): cleanups and updates (#2371)
  • 9dfba1c chore(repo): migrate to pnpm (#2368)
  • 6731c4a fix(release): mark @​supabase/tracing private and snapshot it for JSR (#2370)
  • 2fe1801 feat(supabase): W3C/OpenTelemetry trace context propagation (#2163)
  • Additional commits viewable in compare view

Updates framer-motion from 12.38.0 to 12.40.0

Changelog

Sourced from framer-motion's changelog.

[12.40.0] 2026-05-21

Added

  • path option to transition.
  • arc() for motion along an arc.

[12.39.0] 2026-05-18

Added

  • Support for repeatType and repeatDelay in animation sequences.

Fixed

  • Variants: Re-run keyframe animations when switching between variant labels even when they share identical keyframe arrays.
  • Drag: Preserve in-flight motion value animations across React 19 reorder unmount/remount so dragSnapToOrigin no longer leaves the drag transform stranded after a layout swap.
  • LazyMotion: Share React contexts between the framer-motion and framer-motion/m (and therefore motion/react and motion/react-m) CJS bundles so that <m.div> from the /m subpath picks up features loaded by <LazyMotion> from the main entry point.
  • useScroll: Support hydrating target and container refs from anywhere in the tree.
  • Drag: Gesture no longer starts from incorrect start point when rendered inside <AnimatePresence initial={false} />.
  • Drag: dragConstraints, when set as viewport-relative ref, no longer break on scroll.§
  • Updated visualElement hydration order.
  • useAnimate: Now respects skipAnimations.
  • AnimatePresence: Fix object-form initial values not applied on re-entry after exit completes.
  • scroll: Fixed callback progress when tracking an element.
  • useScroll: Fix hardware acceleration when tracking an element.
Commits
  • 38ebb94 v12.40.0
  • b1f766c Latest
  • bca5544 Merge pull request #3699 from motiondivision/lochie/arcs-injectable
  • f1a96cf arc(): rename amp/rotate, expose MotionPath, fix explicit cw/ccw
  • b4aaba0 pathRotation: non-destructive orientToPath rotation channel
  • 8604ef3 Make arcs injectable via transition.path = arc()
  • f90fe29 add orientToPath
  • 9ebe999 fix: test
  • bc2107e Revert "no should"
  • 6eeb92d no should
  • Additional commits viewable in compare view

Updates isomorphic-dompurify from 3.12.0 to 3.14.0

Release notes

Sourced from isomorphic-dompurify's releases.

3.14.0: Updated dependencies

What's Changed

  • chore(deps): bump dompurify from 3.4.3 to 3.4.5 by @​dependabot[bot]
  • chore: Allowed esbuild and disallowed lefthook for ci.
  • chore: Added homepage URL to package.json.

Full Changelog: kkomelin/isomorphic-dompurify@3.13.0...3.14.0

3.13.0: Updated dependencies

What's Changed

Full Changelog: kkomelin/isomorphic-dompurify@3.12.0...3.13.0

Commits
  • fa11d1d chore: bump version to 3.14.0
  • 3706f30 chore(deps): bump dompurify from 3.4.3 to 3.4.5
  • 0f1d8b2 chore: Added homepage URL to package.json.
  • 0c05491 chore: Allowed esbuild and disallowed lefthook for ci.
  • c159087 chore: Updated deps and incremented project version.
  • e8b2f23 chore(deps): bump dompurify from 3.4.2 to 3.4.3
  • 64b1d7b chore(deps-dev): bump @​biomejs/biome from 2.4.14 to 2.4.15
  • 233ed4d chore(deps-dev): bump @​types/jsdom from 28.0.1 to 28.0.3
  • bf44524 chore(deps-dev): bump vitest from 4.1.5 to 4.1.6
  • See full diff in compare view

Updates lucide-react from 1.14.0 to 1.16.0

Release notes

Sourced from lucide-react's releases.

Version 1.16.0

What's Changed

Full Changelog: lucide-icons/lucide@1.15.0...1.16.0

Version 1.15.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.14.0...1.15.0

Commits

Updates next from 16.2.4 to 16.2.6

Release notes

Sourced from next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

Moderate:

Low:

Core Changes

  • fix: preserve HTTP access fallbacks during prerender recovery (#92231)
  • Fix fallback route params case in app-page handler (#91737)
  • Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
  • Patch setHeader for direct route handlers (#93101)
  • Include deployment id in cacheHandlers keys (#93453)
  • Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

... (truncated)

Commits
  • ee6e79b v16.2.6
  • afa053d Turbopack: Match proxy matchers with webpack implementation (#93594)
  • 97a154e Turbopack: Fix middleware matcher suffix (#93590)
  • 83899bc [backport] Disable build caches for production/staging/force-preview deploys ...
  • 7b222b9 [backport][test] Pin package manager to patch versions (#93595)
  • a8dc24f [backport] Turbopack: more strict vergen setup (#93587)
  • 766148f v16.2.5
  • 0dd9483 fix: add explicit checks for RSC header (#83) (#98)
  • d166096 fix proxy matching for segment prefetch URLs (#89) (#96)
  • 9d50c0b Strip next-resume header from incoming requests (#92)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates openai from 6.36.0 to 6.39.0

Release notes

Sourced from openai's releases.

v6.39.0

6.39.0 (2026-05-21)

Full Changelog: v6.38.0...v6.39.0

Features

  • api: api update (33ea11f)
  • api: manual updates (c210b09)
  • api: manual updates (92df9dc)
  • api: update OpenAPI spec or Stainless config (c7c0f52)

Bug Fixes

  • types: allow runtime fetch options (8f5003d)
  • typescript: upgrade tsc-multi so that it works with Node 26 (068f9c6)

Chores

  • api: docs updates (9d43adb)
  • tests: remove redundant File import (5465bbe)

v6.38.0

6.38.0 (2026-05-13)

Full Changelog: v6.37.0...v6.38.0

Features

  • api: add service_tier parameter to responses compact method (423e838)

v6.37.0

6.37.0 (2026-05-07)

Full Changelog: v6.36.0...v6.37.0

Features

  • api: add quantity field to admin organization usage responses (273a8f7)
  • api: add web_search_call.results output option to responses (91c75e0)
  • api: launch realtime translate + update image 2 (a296b66)
  • api: manual updates (794b905)
  • api: manual updates (6963729)
  • api: realtime 2 (f4b7177)

Bug Fixes

... (truncated)

Changelog

Sourced from openai's changelog.

6.39.0 (2026-05-21)

Full Changelog: v6.38.0...v6.39.0

Features

  • api: api update (33ea11f)
  • api: manual updates (c210b09)
  • api: manual updates (92df9dc)
  • api: update OpenAPI spec or Stainless config (c7c0f52)

Bug Fixes

  • types: allow runtime fetch options (8f5003d)
  • typescript: upgrade tsc-multi so that it works with Node 26 (068f9c6)

Chores

  • api: docs updates (9d43adb)
  • tests: remove redundant File import (5465bbe)

6.38.0 (2026-05-13)

Full Changelog: v6.37.0...v6.38.0

Features

  • api: add service_tier parameter to responses compact method (423e838)

6.37.0 (2026-05-07)

Full Changelog: v6.36.0...v6.37.0

Features

  • api: add quantity field to admin organization usage responses (273a8f7)
  • api: add web_search_call.results output option to responses (91c75e0)
  • api: launch realtime translate + update image 2 (a296b66)
  • api: manual updates (794b905)
  • api: manual updates (6963729)
  • api: realtime 2 (f4b7177)

Bug Fixes

  • api: fix imagegen size enum regression (4fe8469)

... (truncated)

Commits
  • 2002111 release: 6.39.0
  • d6dc9b7 feat(api): manual updates
  • 7444892 feat(api): api update
  • f5db3f1 fix(types): allow runtime fetch options
  • 33b391a chore(api): docs updates
  • bfe3016 fix(typescript): upgrade tsc-multi so that it works with Node 26
  • 3320b20 chore(tests): remove redundant File import
  • 3250890 feat(api): manual updates
  • d9fbf39 feat(api): update OpenAPI spec or Stainless config
  • 8a8436e codegen metadata
  • Additional commits viewable in compare view

Updates react from 19.2.5 to 19.2.6

Release notes

Sourced from react's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Updates @types/react from 19.2.14 to 19.2.15

Commits

Updates react-dom from 19.2.5 to 19.2.6

Release notes

Sourced from react-dom's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Updates resend from 6.12.2 to 6.12.4

Release notes

Sourced from resend's releases.

v6.12.4

What's Changed

Full Changelog: resend/resend-node@v6.12.3...v6.12.4

v6.12.3

What's Changed

New Contributors

Full Changelog: resend/resend-node@v6.12.2...v6.12.3

Commits
  • 58db880 chore: bump version to 6.12.4 (#971)
  • 63f5ddb fix: replace svix with standardwebhooks to reduce install size (#969) (#970)
  • 45dc73d fix: to support @​react-email/render exports across versions in templates (#863)
  • 24950d7 refactor: align delete method with other HTTP methods in Resend class (#904)
  • 2759316 chore: bump public-shared-workflows hash (#966)
  • fa04efc chore: bump public-shared-workflows hash (#965)
  • 77bbf2d feat: add optional baseUrl and userAgent to Resend constructor (#839)
  • ebdb2d3 fix: avoid mutating payloads in emails, broadcasts, and templates (#862)
  • 674ab1b fix: rename misnamed get-contact.interface.ts to get-topic.interface.ts i...
  • ac0c09f chore: add sync-prs-to-linear action (#961)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by dielduarte, a new releaser for resend since your current version.


Updates tailwind-merge from 3.5.0 to 3.6.0

Release notes

Sourced from tailwind-merge's releases.

v3.6.0

New Features

Documentation

Other

Full Changelog: dcastil/tailwind-merge@v3.5.0...v3.6.0

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​block, @​openclaw, @​sourcegraph, @​mike-healy and more via @​thnxdev for sponsoring tailwind-merge! ❤️

Commits
  • d54f7e5 v3.6.0
  • 638871a Update README to add info about Tailwind CSS v4.3 support
  • 39fc7b5 Revert "v3.6.0"
  • bd8390f v3.6.0
  • 802877c add v3.6.0 changelog
  • a35feda Merge pull request #665 from dcastil/renovate/rollup-plugin-babel-7.x
  • 940389c Merge pull request #667 from dcastil/renovate/release-drafter-release-drafter...
  • 005af6d pin to specific version
  • 5816ced implement breaking changes
  • 17041e1 Merge pull request #676 from dcastil/dependabot/npm_and_yarn/babel/plugin-tra...
  • Additional commits viewable in compare view

Updates undici from 8.2.0 to 8.3.0

Release notes

Sourced from undici's releases.

v8.3.0

What's Changed

@dependabot
deps(deps): bump the minor-and-patch group with 19 updates
10f0f9d 
Bumps the minor-and-patch group with 19 updates:

| Package | From | To |
| --- | --- | --- |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.99.3` | `2.106.2` |
| [framer-motion](https://github.com/motiondivision/motion) | `12.38.0` | `12.40.0` |
| [isomorphic-dompurify](https://github.com/kkomelin/isomorphic-dompurify) | `3.12.0` | `3.14.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.14.0` | `1.16.0` |
| [next](https://github.com/vercel/next.js) | `16.2.4` | `16.2.6` |
| [openai](https://github.com/openai/openai-node) | `6.36.0` | `6.39.0` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.5` | `19.2.6` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.14` | `19.2.15` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.6` |
| [resend](https://github.com/resend/resend-node) | `6.12.2` | `6.12.4` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.5.0` | `3.6.0` |
| [undici](https://github.com/nodejs/undici) | `8.2.0` | `8.3.0` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.4` | `4.3.0` |
| [@types/jsdom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jsdom) | `28.0.0` | `28.0.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `25.9.1` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.4` | `16.2.6` |
| [postcss](https://github.com/postcss/postcss) | `8.5.14` | `8.5.15` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.4` | `4.3.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.22.3` |


Updates `@supabase/supabase-js` from 2.99.3 to 2.106.2
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.106.2/packages/core/supabase-js)

Updates `framer-motion` from 12.38.0 to 12.40.0
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v12.38.0...v12.40.0)

Updates `isomorphic-dompurify` from 3.12.0 to 3.14.0
- [Release notes](https://github.com/kkomelin/isomorphic-dompurify/releases)
- [Commits](kkomelin/isomorphic-dompurify@3.12.0...3.14.0)

Updates `lucide-react` from 1.14.0 to 1.16.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.16.0/packages/lucide-react)

Updates `next` from 16.2.4 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.4...v16.2.6)

Updates `openai` from 6.36.0 to 6.39.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/master/CHANGELOG.md)
- [Commits](openai/openai-node@v6.36.0...v6.39.0)

Updates `react` from 19.2.5 to 19.2.6
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react)

Updates `@types/react` from 19.2.14 to 19.2.15
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.5 to 19.2.6
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom)

Updates `resend` from 6.12.2 to 6.12.4
- [Release notes](https://github.com/resend/resend-node/releases)
- [Commits](resend/resend-node@v6.12.2...v6.12.4)

Updates `tailwind-merge` from 3.5.0 to 3.6.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](dcastil/tailwind-merge@v3.5.0...v3.6.0)

Updates `undici` from 8.2.0 to 8.3.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.2.0...v8.3.0)

Updates `@tailwindcss/postcss` from 4.2.4 to 4.3.0
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/@tailwindcss-postcss)

Updates `@types/jsdom` from 28.0.0 to 28.0.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jsdom)

Updates `@types/node` from 25.6.0 to 25.9.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.14 to 19.2.15
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `eslint-config-next` from 16.2.4 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.6/packages/eslint-config-next)

Updates `postcss` from 8.5.14 to 8.5.15
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.14...8.5.15)

Updates `tailwindcss` from 4.2.4 to 4.3.0
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/tailwindcss)

Updates `tsx` from 4.21.0 to 4.22.3
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.21.0...v4.22.3)

---
updated-dependencies:
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.106.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: framer-motion
  dependency-version: 12.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: isomorphic-dompurify
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: openai
  dependency-version: 6.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: resend
  dependency-version: 6.12.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tailwind-merge
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: undici
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tailwindcss/postcss"
  dependency-version: 4.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/jsdom"
  dependency-version: 28.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 25.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.2.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tailwindcss
  dependency-version: 4.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.22.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 25, 2026

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 25, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednext@​16.2.632100919970
Addedopenai@​6.39.066100100100100
Addedundici@​8.3.06610010097100
Addedeslint-config-next@​16.2.6991006798100
Added@​types/​jsdom@​28.0.31001007489100
Added@​types/​react@​19.2.151001007996100
Addedlucide-react@​1.16.0100100989580
Added@​types/​node@​25.9.11001008196100
Addedpostcss@​8.5.15991008294100
Addedtailwindcss@​4.3.01001008498100
Addedreact@​19.2.61001008496100
Addedtailwind-merge@​3.6.01001008696100
Addedresend@​6.12.492100100100100
Addedreact-dom@​19.2.61001009296100
Addedisomorphic-dompurify@​3.14.010010010096100
Addedframer-motion@​12.40.09610010099100
Added@​tailwindcss/​postcss@​4.3.010010010098100

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 25, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/eslint-config-next@16.2.6 → npm/@typescript-eslint/eslint-plugin@8.60.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.60.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Publisher changed: npm resend is now published by dielduarte

Author: dielduarte

From: package.json → npm/resend@6.12.4

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/resend@6.12.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants