Skip to content

deps(deps): bump the minor-and-patch group with 21 updates - #213

Merged
ralyodio merged 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-b17503dfed
Sep 8, 2026
Merged

deps(deps): bump the minor-and-patch group with 21 updates#213
ralyodio merged 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-b17503dfed

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 21 updates:

Package From To
@alpacahq/alpaca-trade-api 4.0.1 4.0.2
@profullstack/player 0.3.1 0.6.0
@supabase/supabase-js 2.112.4 2.115.0
framer-motion 13.1.1 13.2.0
hls.js 1.7.1 1.7.2
imapflow 1.7.6 1.7.8
lucide-react 1.37.0 1.41.0
mailparser 3.9.17 3.9.20
next 16.3.3 16.3.4
node-datachannel 0.33.1 0.33.2
openai 7.8.0 7.10.0
posthog-js 1.422.5 1.427.1
puppeteer 25.9.0 25.10.0
resend 6.25.0 6.26.0
undici 8.10.0 8.10.2
@testing-library/user-event 14.6.6 14.6.7
@types/node 26.4.0 26.4.1
@types/react-dom 19.2.5 19.2.7
eslint-config-next 16.3.3 16.3.4
postcss 8.5.26 8.5.28
tsx 4.23.12 4.23.13

Updates @alpacahq/alpaca-trade-api from 4.0.1 to 4.0.2

Release notes

Sourced from @​alpacahq/alpaca-trade-api's releases.

v4.0.2

Patch Changes

  • #310 23057a0 Thanks @​jaketrimble! - Surface the crypto trade taker side on stream trades: mapTrade now maps the wire's tks field to StreamTrade.takerSide ("B"/"S", crypto only). Previously the field was dropped by the stream mapper even though the v1beta3 crypto stream delivers it and the REST CryptoTrade path already exposed it.
Changelog

Sourced from @​alpacahq/alpaca-trade-api's changelog.

4.0.2

Patch Changes

  • #310 23057a0 Thanks @​jaketrimble! - Surface the crypto trade taker side on stream trades: mapTrade now maps the wire's tks field to StreamTrade.takerSide ("B"/"S", crypto only). Previously the field was dropped by the stream mapper even though the v1beta3 crypto stream delivers it and the REST CryptoTrade path already exposed it.
Commits
  • d13357a chore: version packages (#317)
  • 21ede97 fix: ci for new releases (#319)
  • 600c8d2 chore: move release tooling to Node 24 (#316)
  • 23057a0 fix: map the crypto trade taker side (tks) to StreamTrade.takerSide (#310)
  • ee8c24f Bump brace-expansion from 5.0.6 to 5.0.7 in /tooling (#300)
  • f354caa Bump shell-quote and @​openapitools/openapi-generator-cli in /tooling (#303)
  • 8d23ef6 Bump webpack-dev-server from 5.2.5 to 5.2.6 in /docs (#304)
  • c68ab0d Bump body-parser from 1.20.5 to 1.20.6 in /docs (#305)
  • 831ea00 Bump postcss from 8.5.15 to 8.5.25 in /tooling (#306)
  • 571ff34 Bump svgo from 3.3.3 to 3.3.4 in /docs (#301)
  • Additional commits viewable in compare view

Updates @profullstack/player from 0.3.1 to 0.6.0

Release notes

Sourced from @​profullstack/player's releases.

v0.6.0 — an audio option, for a station that is HLS but has no picture

The audio shape was inferred from the source alone: an .mp3 got the compact bar and everything else got a 16:9 stage. A SiriusXM channel is an .m3u8 whose playlist carries nothing but AAC, and it was drawn as a black stage with a LIVE badge over a picture that never arrives.

Now: createPlayer takes audio: true, and infers it when the element passed as media is an <audio>. A caller that passes neither sees no change.

Full detail in #7. pnpm test: 119 pass, 0 fail.

Commits

Updates @supabase/supabase-js from 2.112.4 to 2.115.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.115.0

2.115.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

v2.115.0-canary.0

2.115.0-canary.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

v2.114.0

2.114.0 (2026-09-02)

🚀 Features

  • storage: object versioning updates (#2644)

🩹 Fixes

  • auth: unenroll the unverified factor after a failed registration (#2641)
  • deps: override browserslist to patch high-severity advisories (#2652)

❤️ Thank You

v2.114.0-canary.0

2.114.0-canary.0 (2026-09-02)

🚀 Features

  • storage: object versioning updates (#2644)

🩹 Fixes

  • auth: unenroll the unverified factor after a failed registration (#2641)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.115.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

2.114.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.113.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

Commits

Updates framer-motion from 13.1.1 to 13.2.0

Changelog

Sourced from framer-motion's changelog.

[13.2.0] 2026-unreleased

Added

  • animate.addEffect() for registering effects that lets animate drive non-DOM subjects alongside DOM elements.
  • threeEffect (motion/three) supporting Three.js objects, materials, shader uniforms, TSL uniform nodes and more.
  • vgpuEffect (motion/vgpu) supporting shared uniforms, Effect/Draw/Compute bindings ("params.time"), scene nodes, cameras, lights, materials, orbit controls, CSS colors and vector components.
  • createEffect now accepts test, read and step options and exposes bound motion values via effect.get().

Changed

  • Reduced filesize and improved performance of spring.
Commits
  • 0f1c119 v13.2.0
  • f73cbd7 Latest
  • d743b79 Latest
  • ce2719d Add WebGPURenderer TSL demo
  • b800e58 Add TSL uniform node support to Three.js animate
  • d60a956 Merge pull request #3800 from motiondivision/add-uniform-effect
  • a2d3227 Merge pull request #3799 from motiondivision/generator-filesize-optimisations
  • 55c8f8e Remove redundant comment from inertia bounds check
  • 84c2599 Add GPU adapter preview examples
  • 7b0ac88 Create adapter MotionValues lazily
  • Additional commits viewable in compare view

Updates hls.js from 1.7.1 to 1.7.2

Release notes

Sourced from hls.js's releases.

v1.7.2

Summary

HLS.js v1.7.2 includes bug fixes and improvements over the last release.

Changes Since The Last Release

video-dev/hls.js@v1.7.1...v1.7.2

  • Bundle externals in TypeScript type definitions (#8019) @​robwalch
  • Fix capLevelToPlayerSize with stable player size (#8011)
  • Prevent duration collapse on seek to gap at end-of-stream (#8027)
  • Fix blocking reload for MSN 0 (#8013) @​darfink
  • Process empty WebVTT parts with MAP segments (#8012)
  • Fix IMSC1 millisecond parsing (#8003) @​luantaraschi
  • Fix default the TTML tick rate for IMSC1 subtitles (#8024)
  • Fix HLS Variable Substitution after a Media Playlist parsing error (#7992) @​luantaraschi
  • Docs: add inspect.software health badge (#7989) @​Nayjest

Demo Page

https://e06ac3e1.hls-js-dev.pages.dev/demo/

Feedback

Please provide feedback via Issues in GitHub. For more details on how to contribute to HLS.js, see our CONTRIBUTING guide.

Commits
  • dd669ec Do not mark end-of-stream on empty or GAP segments
  • 28aad06 fix(subtitles): process empty WebVTT parts
  • ded4e78 Default the TTML tick rate instead of dividing by zero
  • 971ffee Convert IMSC1 milliseconds to seconds instead of multiplying
  • f0b8f96 fix: enable blocking reload for MSN 0
  • d12d447 Bundle externals in type definitions (#8019)
  • bc96ed9 Fix capLevelToPlayerSize with stable player size
  • d80bc2f Merge pull request #8017 from video-dev/renovate/wrangler-4.x
  • dd8d2be Update dependency wrangler to v4.124.0
  • f9c3eb7 Merge pull request #8016 from video-dev/renovate/microsoft-api-extractor-7.x
  • Additional commits viewable in compare view

Updates imapflow from 1.7.6 to 1.7.8

Changelog

Sourced from imapflow's changelog.

1.7.8 (2026-09-01)

Bug Fixes

  • download: keep the pipeline error forwarder across a backpressure wait (c6b2ed7)

1.7.7 (2026-08-31)

Bug Fixes

  • deps: update encoding-japanese to 2.3.0 for the CP932 extended areas (8ae7ea4)
Commits
  • 52df440 chore(master): release 1.7.8 [skip-ci] (#390)
  • c6b2ed7 fix(download): keep the pipeline error forwarder across a backpressure wait
  • 763875e chore(master): release 1.7.7 [skip-ci] (#389)
  • 8ae7ea4 fix(deps): update encoding-japanese to 2.3.0 for the CP932 extended areas
  • See full diff in compare view

Updates lucide-react from 1.37.0 to 1.41.0

Release notes

Sourced from lucide-react's releases.

Version 1.41.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.40.0...1.41.0

Version 1.40.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.39.0...1.40.0

Version 1.39.0

What's Changed

Full Changelog: lucide-icons/lucide@1.38.0...1.39.0

... (truncated)

Commits

Updates mailparser from 3.9.17 to 3.9.20

Changelog

Sourced from mailparser's changelog.

3.9.20 (2026-09-01)

Bug Fixes

  • deps: update nodemailer to 9.1.1 (36233e6)

3.9.19 (2026-08-31)

Bug Fixes

  • deps: update libmime and mailsplit for the CP932 extended areas (0bbe7a3)

3.9.18 (2026-08-31)

Bug Fixes

  • deps: update nodemailer to 9.1.0 (b812c54)
Commits
  • c5390ac chore(master): release 3.9.20 [skip-ci] (#437)
  • 36233e6 fix(deps): update nodemailer to 9.1.1
  • c3583f4 chore(master): release 3.9.19 [skip-ci] (#436)
  • 0bbe7a3 fix(deps): update libmime and mailsplit for the CP932 extended areas
  • c79c47a chore(master): release 3.9.18 [skip-ci] (#435)
  • b812c54 fix(deps): update nodemailer to 9.1.0
  • See full diff in compare view

Updates next from 16.3.3 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

Commits
  • 299180d v16.3.4
  • 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
  • 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
  • d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
  • 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
  • See full diff in compare view

Updates node-datachannel from 0.33.1 to 0.33.2

Commits

Updates openai from 7.8.0 to 7.10.0

Release notes

Sourced from openai's releases.

v7.10.0

7.10.0 (2026-09-03)

Features

  • api: add gpt-6-astra and related features (#2582) (94ecdc4)

Documentation

v7.9.0

7.9.0 (2026-09-02)

Features

  • api: update usage APIs and documentation (#2565) (4908505)

Bug Fixes

  • api: prevent Responses WebSockets from following redirects (#2513) (0a4fb1b)
  • load CommonJS under browser export conditions (#2507) (222f3d7)
  • restore monthly Node version review (#2553) (15dc890)
  • support Jest 28 CommonJS package imports (#2511) (eea2292)

Chores

  • deps-dev: bump browserslist to 4.28.7 across ecosystem tests (#2554) (a408e0b)
  • raise custom-code budget to 4,000 lines (#2562) (82c5b2d)
Changelog

Sourced from openai's changelog.

7.10.0 (2026-09-03)

Features

  • api: add gpt-6-astra and related features (#2582) (94ecdc4)

Documentation

7.9.0 (2026-09-02)

Features

  • api: update usage APIs and documentation (#2565) (4908505)

Bug Fixes

  • api: prevent Responses WebSockets from following redirects (#2513) (0a4fb1b)
  • load CommonJS under browser export conditions (#2507) (222f3d7)
  • restore monthly Node version review (#2553) (15dc890)
  • support Jest 28 CommonJS package imports (#2511) (eea2292)

Chores

  • deps-dev: bump browserslist to 4.28.7 across ecosystem tests (#2554) (a408e0b)
  • raise custom-code budget to 4,000 lines (#2562) (82c5b2d)
Commits

Updates posthog-js from 1.422.5 to 1.427.1

Release notes

Sourced from posthog-js's releases.

posthog-js@1.427.1

1.427.1

Patch Changes

  • #4786 a04c333 Thanks @​marandaneto! - Prevent automatic and manual exception capture from recursively recapturing stack overflows raised while sending an exception. (2026-09-04)

posthog-js@1.427.0

1.427.0

Minor Changes

Patch Changes

  • #4782 b64b113 Thanks @​posthog! - Stop counting stack frames that have no filename (in-app browser bridge scripts and other code the runtime reports without a script URL) as in-app code. (2026-09-04)

  • #4758 dd74222 Thanks @​marandaneto! - Keep relaying session recording events when a cross-origin iframe redirects through the parent page's origin. (2026-09-04)

  • Updated dependencies [b64b113, 426e1fd]:

    • @​posthog/core@​1.50.5
    • @​posthog/types@​1.409.0

posthog-js@1.426.4

1.426.4

Patch Changes

  • #4764 fa2924d Thanks @​marandaneto! - Preserve previously persisted feature flags as an offline fallback when bootstrap flags are provided. (2026-09-04)

posthog-js@1.426.3

1.426.3

Patch Changes

  • #4761 ebf7318 Thanks @​marandaneto! - Prevent session replay network capture from replacing a downstream fetch wrapper's response with an instrumentation error when the response has no headers. (2026-09-04)

posthog-js@1.426.2

1.426.2

Patch Changes

  • #4763 7b30da7 Thanks @​marandaneto! - Ship the package ESM entrypoint with an .mjs extension so Node recognizes its module format, while retaining the existing .js bundle for backwards compatibility. (2026-09-03)

... (truncated)

Commits
  • efc772f chore: update versions and lockfile [version bump]
  • a04c333 fix(browser): prevent recursive exception capture after stack overflows (#4786)
  • 135b7c7 chore: replace ESLint directives with Oxlint annotations (#4784)
  • 365ad87 chore: update versions and lockfile [version bump]
  • 3ded241 chore(rrweb): upgrade builds to Vite 8 (#4748)
  • dd74222 fix: keep cross-origin iframe recording after redirects (#4758)
  • 426e1fd feat(browser): support reuseAnonymousId during identify (#4774)
  • 7a21bc6 test(core): make retry timing checks deterministic (#4781)
  • b64b113 fix(error-tracking): stop counting frames without a filename as in_app (#4782)
  • f5d3ad5 ci(nuxt): wait for npm packages before consumer test (#4780)
  • Additional commits viewable in compare view

Updates puppeteer from 25.9.0 to 25.10.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.10.0

25.10.0 (2026-09-03)

🎉 Features

🛠️ Fixes

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.2.1 to 3.2.2

puppeteer: v25.10.0

25.10.0 (2026-09-03)

♻️ Chores

  • puppeteer: Synchronize puppeteer versions

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.2.1 to 3.2.2
      • puppeteer-core bumped from 25.9.0 to 25.10.0
Commits
  • 88b517a chore: release main (#15396)
  • a84b032 fix: revert launch browsers in detached mode on Windows to fix flakiness (#15...
  • 7a17a9a chore(deps): bump the all group across 1 directory with 2 updates (#15368)
  • 4ff495d test: explain the CDP-only mouse expectations (#15380)
  • c3ca313 test: update webmcp-types dep and simplify execute handler signatures (#15414)
  • 8ca9ab4 chore(deps-dev): bump browserslist from 4.28.4 to 4.28.8 (#15413)
  • 3744bad chore(deps-dev): bump @​humanfs/node from 0.16.7 to 0.16.8 (#15412)
  • 051c195 chore(deps): bump fast-uri from 3.1.5 to 3.1.7 in /website (#15411)
  • 89f3f18 fix: roll to Chrome 152.0.7977.75 (#15409)
  • ed544f7 feat: roll to Firefox 155.0 (#15408)
  • Additional commits viewable in compare view

Updates resend from 6.25.0 to 6.26.0

Release notes

Sourced from resend's releases.

v6.26.0

What's Changed

Full Changelog: resend/resend-node@v6.25.0...v6.26.0

Commits

Updates undici from 8.10.0 to 8.10.2

Release notes

Sourced from undici's releases.

v8.10.2

⚠️ Security fixes

High severity

  • GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.
  • GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by 8f5868fb.
  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 4411a238.
  • GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.
  • GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.
  • GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 7aac7f12.
  • GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by e905b5b8.

Low severity

  • GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by 2be07bf9.
  • GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 6d583124.
  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by 0160a719.

What's Changed

  • build(deps-dev): bump undici from 6.27.0 to 6.28.0 by @​dependabot[bot] in

@dependabot
deps(deps): bump the minor-and-patch group with 21 updates
a2d4c21 
Bumps the minor-and-patch group with 21 updates:

| Package | From | To |
| --- | --- | --- |
| [@alpacahq/alpaca-trade-api](https://github.com/alpacahq/alpaca-trade-api-js) | `4.0.1` | `4.0.2` |
| [@profullstack/player](https://github.com/profullstack/player) | `0.3.1` | `0.6.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.4` | `2.115.0` |
| [framer-motion](https://github.com/motiondivision/motion) | `13.1.1` | `13.2.0` |
| [hls.js](https://github.com/video-dev/hls.js) | `1.7.1` | `1.7.2` |
| [imapflow](https://github.com/postalsys/imapflow) | `1.7.6` | `1.7.8` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.37.0` | `1.41.0` |
| [mailparser](https://github.com/nodemailer/mailparser) | `3.9.17` | `3.9.20` |
| [next](https://github.com/vercel/next.js) | `16.3.3` | `16.3.4` |
| [node-datachannel](https://github.com/murat-dogan/node-datachannel) | `0.33.1` | `0.33.2` |
| [openai](https://github.com/openai/openai-node) | `7.8.0` | `7.10.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.422.5` | `1.427.1` |
| [puppeteer](https://github.com/puppeteer/puppeteer) | `25.9.0` | `25.10.0` |
| [resend](https://github.com/resend/resend-node) | `6.25.0` | `6.26.0` |
| [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.10.2` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.6` | `14.6.7` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.0` | `26.4.1` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.2.7` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.3` | `16.3.4` |
| [postcss](https://github.com/postcss/postcss) | `8.5.26` | `8.5.28` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.13` |


Updates `@alpacahq/alpaca-trade-api` from 4.0.1 to 4.0.2
- [Release notes](https://github.com/alpacahq/alpaca-trade-api-js/releases)
- [Changelog](https://github.com/alpacahq/alpaca-trade-api-js/blob/master/CHANGELOG.md)
- [Commits](alpacahq/alpaca-trade-api-js@v4.0.1...v4.0.2)

Updates `@profullstack/player` from 0.3.1 to 0.6.0
- [Release notes](https://github.com/profullstack/player/releases)
- [Commits](https://github.com/profullstack/player/commits/v0.6.0)

Updates `@supabase/supabase-js` from 2.112.4 to 2.115.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.115.0/packages/core/supabase-js)

Updates `framer-motion` from 13.1.1 to 13.2.0
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v13.1.1...v13.2.0)

Updates `hls.js` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/video-dev/hls.js/releases)
- [Changelog](https://github.com/video-dev/hls.js/blob/master/docs/release-process.md)
- [Commits](video-dev/hls.js@v1.7.1...v1.7.2)

Updates `imapflow` from 1.7.6 to 1.7.8
- [Release notes](https://github.com/postalsys/imapflow/releases)
- [Changelog](https://github.com/postalsys/imapflow/blob/master/CHANGELOG.md)
- [Commits](postalsys/imapflow@v1.7.6...v1.7.8)

Updates `lucide-react` from 1.37.0 to 1.41.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.41.0/packages/lucide-react)

Updates `mailparser` from 3.9.17 to 3.9.20
- [Release notes](https://github.com/nodemailer/mailparser/releases)
- [Changelog](https://github.com/nodemailer/mailparser/blob/master/CHANGELOG.md)
- [Commits](nodemailer/mailparser@v3.9.17...v3.9.20)

Updates `next` from 16.3.3 to 16.3.4
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.3...v16.3.4)

Updates `node-datachannel` from 0.33.1 to 0.33.2
- [Release notes](https://github.com/murat-dogan/node-datachannel/releases)
- [Commits](https://github.com/murat-dogan/node-datachannel/commits)

Updates `openai` from 7.8.0 to 7.10.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.8.0...v7.10.0)

Updates `posthog-js` from 1.422.5 to 1.427.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.422.5...posthog-js@1.427.1)

Updates `puppeteer` from 25.9.0 to 25.10.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-v25.9.0...puppeteer-v25.10.0)

Updates `resend` from 6.25.0 to 6.26.0
- [Release notes](https://github.com/resend/resend-node/releases)
- [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md)
- [Commits](resend/resend-node@v6.25.0...v6.26.0)

Updates `undici` from 8.10.0 to 8.10.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.10.0...v8.10.2)

Updates `@testing-library/user-event` from 14.6.6 to 14.6.7
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.6...v14.6.7)

Updates `@types/node` from 26.4.0 to 26.4.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react-dom` from 19.2.5 to 19.2.7
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `eslint-config-next` from 16.3.3 to 16.3.4
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.4/packages/eslint-config-next)

Updates `postcss` from 8.5.26 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.26...8.5.28)

Updates `tsx` from 4.23.12 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.12...v4.23.13)

---
updated-dependencies:
- dependency-name: "@alpacahq/alpaca-trade-api"
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@profullstack/player"
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.115.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: framer-motion
  dependency-version: 13.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: hls.js
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: imapflow
  dependency-version: 1.7.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mailparser
  dependency-version: 3.9.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: node-datachannel
  dependency-version: 0.33.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: openai
  dependency-version: 7.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: posthog-js
  dependency-version: 1.427.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: puppeteer
  dependency-version: 25.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: resend
  dependency-version: 6.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: undici
  dependency-version: 8.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint-config-next
  dependency-version: 16.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security

socket-security Bot commented Sep 7, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednext@​16.3.3 ⏵ 16.3.461100909970
Updatedeslint-config-next@​16.3.3 ⏵ 16.3.4991006798100
Updatednode-datachannel@​0.33.1 ⏵ 0.33.29910010090 -170
Updated@​types/​react-dom@​19.2.5 ⏵ 19.2.7100 +110075 +193100
Updatedopenai@​7.8.0 ⏵ 7.10.075 +1100100 +1100100
Updated@​profullstack/​player@​0.3.1 ⏵ 0.6.078 +210010093 +6100
Updatedmailparser@​3.9.17 ⏵ 3.9.2099 +11008095 +2100
Updatedhls.js@​1.7.1 ⏵ 1.7.21001001009980
Updatedlucide-react@​1.37.0 ⏵ 1.41.010010098 +19680
Updatedposthog-js@​1.422.5 ⏵ 1.427.19910081 +1100100
Updated@​types/​node@​26.4.0 ⏵ 26.4.11001008196100
Updatedtsx@​4.23.12 ⏵ 4.23.131001008194100
Updatedpostcss@​8.5.26 ⏵ 8.5.28100 +110082 +195100
Updated@​supabase/​supabase-js@​2.112.4 ⏵ 2.115.089 +110010098 +1100
Updated@​alpacahq/​alpaca-trade-api@​4.0.1 ⏵ 4.0.296 +610010092100
Updatedpuppeteer@​25.9.0 ⏵ 25.10.0921009397 +2100
Updatedundici@​8.10.0 ⏵ 8.10.293100100 +197100
Updatedimapflow@​1.7.6 ⏵ 1.7.899 +110098 +196 +1100
Updated@​testing-library/​user-event@​14.6.6 ⏵ 14.6.7100 +1100100 +196 +1100
Updatedframer-motion@​13.1.1 ⏵ 13.2.099 +1100100 +197 +2100
Updatedresend@​6.25.0 ⏵ 6.26.098 +1100100100100

View full report

@socket-security

socket-security Bot commented Sep 7, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
License policy violation: npm @zone-eu/mailsplit under EUPL-1.2

License: EUPL-1.2 - The applicable license policy does not permit this license (5) (package/LICENSE.EUPL-1.2)

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.EUPL-1.2)

License: EUPL-1.1+ - This license classifier is not allowed by the applicable policy (package/package.json)

From: pnpm-lock.yaml → npm/imapflow@1.7.8 → npm/mailparser@3.9.20 → npm/@zone-eu/mailsplit@5.4.16

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@zone-eu/mailsplit@5.4.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @node-datachannel/android-arm64

Location: Package overview

From: pnpm-lock.yaml → npm/node-datachannel@0.33.2 → npm/@node-datachannel/android-arm64@0.33.2

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-datachannel/android-arm64@0.33.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @node-datachannel/win32-arm64-msvc

Location: Package overview

From: pnpm-lock.yaml → npm/node-datachannel@0.33.2 → npm/@node-datachannel/win32-arm64-msvc@0.33.2

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-datachannel/win32-arm64-msvc@0.33.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @profullstack/player

Location: Package overview

From: package.json → npm/@profullstack/player@0.6.0

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@profullstack/player@0.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@ralyodio
ralyodio merged commit 8f75df5 into master Sep 8, 2026
9 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-b17503dfed branch September 8, 2026 01:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ralyodio