build(deps): Bump the npm_and_yarn group across 1 directory with 4 updates by dependabot[bot] · Pull Request #8715 · thirdweb-dev/js

dependabot · 2026-03-17T21:25:17Z

Bumps the npm_and_yarn group with 3 updates in the / directory: storybook, next and fast-xml-parser.

Updates storybook from 9.0.15 to 9.1.19

Release notes

v9.1.19

9.1.19

Harden websocket connection

v9.1.18

9.1.18

No-op release. No changes.

v9.1.17

9.1.17

Core: Fix .env-file parsing, thanks @jreinhold!

Changelog

Sourced from storybook's changelog.

9.1.19

Harden websocket connection

9.1.18

No-op release. No changes.

9.1.16

CLI: Fix Nextjs project creation in empty directories - #32828, thanks @yannbf!

Core: Add experimental_devServer preset - #32862, thanks @yannbf!

Telemetry: Fix preview-first-load event - #32859, thanks @shilman!

9.1.15

Core: Add preview-first-load telemetry - #32770, thanks @shilman!

Dependencies: Update vite-plugin-storybook-nextjs - #32821, thanks @ndelangen!

9.1.14

NextJS: Add NextJS 16 support - #32791, thanks @yannbf and @ndelangen!

Addon-Vitest: Support Vitest 4 - #32819, thanks @yannbf and @ndelangen!

CSF: Fix play-fn tag for methods - #32695, thanks @shilman!

9.1.13

Nextjs: Fix config access for Vite - #32759, thanks @valentinpalkovic!

9.1.12

Maintenance: Hotfix for missing nextjs dts files, thanks @ndelangen!

9.1.11

Automigration: Improve the viewport/backgrounds automigration - #32619, thanks @valentinpalkovic!

Mocking: Fix sb.mock usage in Storybook's deployed in subpaths - #32678, thanks @valentinpalkovic!

NextJS-Vite: Automatically fix bad PostCSS configuration - #32691, thanks @ndelangen!

React Native Web: Fix REACT_NATIVE_AND_RNW should detect vite builder - #32718, thanks @dannyhw!

Telemetry: Add metadata for react routers - #32615, thanks @shilman!

9.1.10

Automigrations: Add automigration for viewport and backgrounds - #31614, thanks @valentinpalkovic!

Telemetry: Log userAgent in onboarding - #32566, thanks @shilman!

9.1.9

Angular: Enable experimental zoneless detection on Angular v21 - #32580, thanks @yannbf!

Svelte: Ignore inherited HTMLAttributes docgen when using utility types - #32173, thanks @steciuk!

... (truncated)

Commits

20887f1 Bump version from "9.1.18" to "9.1.19" [skip ci]
66b2d8e Fix test
31f16c4 fix linting
62dd25b Core: Require token for websocket connections
bbe61e3 Bump version from "9.1.17" to "9.1.18" [skip ci]
d0d5a3d Bump version from 9.1.16 to 9.1.17 MANUALLY
a06c257 filter env vars from .env files
a54a04c Bump version from "9.1.15" to "9.1.16" [skip ci]
ebd7ff5 Merge pull request #32859 from storybookjs/shilman/first-load-new-user
da2da6e Merge pull request #32862 from storybookjs/yann/patch-dev-server-preset
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for storybook since your current version.

Updates next from 15.3.8 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)

Apply server actions transform to node_modules in route handlers (#89380)

ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)

Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)

Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Upgrade to swc 54 (#88207)

implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)

tweak LRU sentinel key (#89123)

Credits

Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.0.11

Please see this changelog for more information about this security patch.

v15.6.0-canary.61

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

... (truncated)

Commits

bdf3e35 v16.1.7
dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
c68d62d Backport documentation fixes for 16.1.x (#90655)
5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
c95e357 Backport/docs fixes 16.1.x (#90125)
cba6144 [backport] Apply server actions transform to node_modules in route handlers...
3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
Additional commits viewable in compare view

Updates fast-xml-parser from 5.2.5 to 5.5.6

Release notes

Sourced from fast-xml-parser's releases.

fix entity expansion and incorrect replacement and performance

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.5...v5.5.6

support onDangerousProperty

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.3...v5.5.5

update dependecies to fix typings

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.1...v5.5.2

integrate path-expression-matcher

support path-expression-matcher

fix: stopNode should not be parsed

performance improvement for stopNode checking

Separate Builder

XML Builder was the part of fast-xml-parser for years. But considering that any bug in builder may false-alarm the users who are only using parser and vice-versa, we have decided to split it into a separate package.

Migration

To migrate to fast-xml-builder;

From
import { XMLBuilder } from "fast-xml-parser";
To
import  XMLBuilder  from "fast-xml-builder";
XMLBuilder will be removed from current package in any next major version of this library. So better to migrate.

support strictReservedNames

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.9...v5.3.9

handle non-array input for XML builder && support maxNestedTags

support maxNestedTags

handle non-array input for XML builder when preserveOrder is true (By Angelo Coetzee)

save use of js properies Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.7...v5.3.8

CJS typing fix

What's Changed

Unexport X2jOptions at declaration site by @Drarig29 in NaturalIntelligence/fast-xml-parser#787

New Contributors

@Drarig29 made their first contribution in NaturalIntelligence/fast-xml-parser#787

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.5.6 / 2026-03-16

update builder dependency

fix incorrect regex to replace . in entity name

fix check for entitiy expansion for lastEntities and html entities too

5.5.5 / 2026-03-13

sanitize dangerous tag or attribute name

error on critical property name

support onDangerousProperty option

5.5.4 / 2026-03-13

declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

5.5.3 / 2026-03-11

upgrade builder

5.5.2 / 2026-03-11

update dependency to fix typings

5.5.1 / 2026-03-10

fix dependency

5.5.0 / 2026-03-10

support path-expression-matcher

fix: stopNode should not be parsed

performance improvement for stopNode checking

5.4.2 / 2026-03-03

support maxEntityCount option

5.4.1 / 2026-02-25

fix (#785) unpairedTag node should not have tag content

5.4.0 / 2026-02-25

migrate to fast-xml-builder

5.3.9 / 2026-02-25

support strictReservedNames

5.3.8 / 2026-02-25

support maxNestedTags

handle non-array input for XML builder when preserveOrder is true (By Angelo Coetzee)

save use of js properies

5.3.7 / 2026-02-20

... (truncated)

Commits

870043e update release info
6df401e update builder dependency
bd26122 check for entitiy expansion for lastEntities and html entities too
7e70dd8 fix incorrect regex to replace . in entity name
e54155f update package info
3308fd7 handle critical properties
0500f6b refactor
ea07bb2 declare Matcher & Expression as unknown
0a4dc92 upgrade builder
e0a14f7 update dependency to fix typings
Additional commits viewable in compare view

Updates undici from 6.21.3 to 6.24.1

Release notes

Sourced from undici's releases.

v6.24.1

Full Changelog: nodejs/undici@v6.24.0...v6.24.1

v6.24.0

Undici v6.24.0 Security Release Notes (LTS)

This release backports fixes for security vulnerabilities affecting the v6 line.

Upgrade guidance

All users on v6 should upgrade to v6.24.0 or later.

Fixed advisories

GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
Malicious WebSocket 64-bit frame length handling could crash the client.

GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
CRLF injection via the upgrade option.

GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.

GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
Unbounded memory consumption in WebSocket permessage-deflate decompression.

Not applicable to v6

GHSA-phc3-fgpg-7m6h / CVE-2026-2581 affects >= 7.17.0 < 7.24.0 only.

Affected and patched ranges (v6)

CVE-2026-1525: affected < 6.24.0, patched 6.24.0

CVE-2026-1528: affected >= 6.0.0 < 6.24.0, patched 6.24.0

CVE-2026-1527: affected < 6.24.0, patched 6.24.0

CVE-2026-2229: affected < 6.24.0, patched 6.24.0

CVE-2026-1526: affected < 6.24.0, patched 6.24.0

References

GitHub Security Advisories: https://github.com/nodejs/undici/security/advisories

NVD CVE-2026-1525: https://nvd.nist.gov/vuln/detail/CVE-2026-1525

NVD CVE-2026-1528: https://nvd.nist.gov/vuln/detail/CVE-2026-1528

NVD CVE-2026-1527: https://nvd.nist.gov/vuln/detail/CVE-2026-1527

NVD CVE-2026-2229: https://nvd.nist.gov/vuln/detail/CVE-2026-2229

NVD CVE-2026-1526: https://nvd.nist.gov/vuln/detail/CVE-2026-1526

... (truncated)

Commits

c0cf656 Bumped v6.24.1
f5a9f0c Fix v6 release workflow branch targeting
af2cb8f wqremove maxDecompressedMessageSize (#4891)
8873c94 Bumped v6.24.0
411bd01 test(websocket): use node:assert for Node 18 compatibility
844bf59 test: fix http2 lint regressions in backport
a444e4f test: stabilize h2 and tls-cert-leak under current test runner
dc032a1 fix: h2 CI (#4395)
4cd3f4b test: increase bitness in test/fixtures/*.pem (#3659)
7df6442 fix: adapt websocket frame-limit handling for v6 parser
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

PR-Codex overview

This PR updates various package dependencies across multiple applications and libraries, primarily upgrading the next version from 15.3.8 to 16.1.7 and storybook from 9.0.15 to 9.1.19, along with some other minor version updates.

Detailed summary

Updated next from 15.3.8 to 16.1.7 in several package.json files.
Updated storybook from 9.0.15 to 9.1.19 in multiple package.json files.
Updated fast-xml-parser from ^5.2.5 to ^5.5.6 in apps/dashboard/package.json.
Updated zod from 3.25.75 to 4.1.12 in various dependencies.
Updated bufferutil from 4.0.9 to 4.1.0 in multiple dependencies.
Updated utf-8-validate from 5.0.10 to 5.0.11 in dependencies.

The following files were skipped due to too many changes: pnpm-lock.yaml

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

…dates Bumps the npm_and_yarn group with 3 updates in the / directory: [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core), [next](https://github.com/vercel/next.js) and [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser). Updates `storybook` from 9.0.15 to 9.1.19 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/v9.1.19/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v9.1.19/code/core) Updates `next` from 15.3.8 to 16.1.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.3.8...v16.1.7) Updates `fast-xml-parser` from 5.2.5 to 5.5.6 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.2.5...v5.5.6) Updates `undici` from 6.21.3 to 6.24.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.21.3...v6.24.1) --- updated-dependencies: - dependency-name: storybook dependency-version: 9.1.19 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.1.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-xml-parser dependency-version: 5.5.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.24.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-03-17T21:25:24Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Updated (UTC)
docs-v2	Error	Mar 17, 2026 9:29pm
nebula	Error	Mar 17, 2026 9:29pm
thirdweb_playground	Error	Mar 17, 2026 9:29pm
thirdweb-www	Error	Mar 17, 2026 9:29pm
wallet-ui	Error	Mar 17, 2026 9:29pm

changeset-bot · 2026-03-17T21:25:24Z

⚠️ No Changeset found

Latest commit: d936f73

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-03-17T21:26:42Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
next@15.3.8 ⏵ 16.1.7	^-6	⁺²²	⁺¹
@wagmi/cli@2.8.0 ⏵ 2.10.0	^-21		⁺¹	⁺³
storybook@9.0.15 ⏵ 9.1.19	⁺⁵	⁺²²	^-2	⁺¹
fast-xml-parser@5.2.5 ⏵ 5.5.6		⁺⁷⁵	⁺¹

View full report

dependabot bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 17, 2026

dependabot bot requested review from a team as code owners March 17, 2026 21:25

dependabot bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 17, 2026

vercel bot had a problem deploying to Preview – thirdweb-www March 17, 2026 21:28 Failure

vercel bot had a problem deploying to Preview – wallet-ui March 17, 2026 21:28 Failure

vercel bot had a problem deploying to Preview – docs-v2 March 17, 2026 21:28 Failure

vercel bot had a problem deploying to Preview – nebula March 17, 2026 21:28 Failure

vercel bot had a problem deploying to Preview – thirdweb_playground March 17, 2026 21:29 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): Bump the npm_and_yarn group across 1 directory with 4 updates#8715

build(deps): Bump the npm_and_yarn group across 1 directory with 4 updates#8715
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-b349177e59

dependabot bot commented on behalf of github Mar 17, 2026 •

edited by pr-codex bot

Loading

Uh oh!

vercel bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Mar 17, 2026

Uh oh!

socket-security bot commented Mar 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 17, 2026 • edited by pr-codex bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v9.1.19

9.1.19

v9.1.18

9.1.18

v9.1.17

9.1.17

9.1.19

9.1.18

9.1.16

9.1.15

9.1.14

9.1.13

9.1.12

9.1.11

9.1.10

9.1.9

v16.1.7

Core Changes

Credits

v16.1.6

Core Changes

Credits

v16.1.5

v16.0.11

v15.6.0-canary.61

v15.5.13

Core Changes

fix entity expansion and incorrect replacement and performance

support onDangerousProperty

update dependecies to fix typings

integrate path-expression-matcher

Separate Builder

Migration

support strictReservedNames

handle non-array input for XML builder && support maxNestedTags

CJS typing fix

What's Changed

New Contributors

v6.24.1

v6.24.0

Undici v6.24.0 Security Release Notes (LTS)

Upgrade guidance

Fixed advisories

Not applicable to v6

Affected and patched ranges (v6)

References

PR-Codex overview

Detailed summary

Uh oh!

vercel bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Mar 17, 2026

⚠️ No Changeset found

Uh oh!

socket-security bot commented Mar 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Mar 17, 2026 •

edited by pr-codex bot

Loading

vercel bot commented Mar 17, 2026 •

edited

Loading