build(deps): Bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #8884 · thirdweb-dev/js

dependabot · 2026-08-11T17:32:39Z

Bumps the npm_and_yarn group with 3 updates in the / directory: sharp, next and postcss.

Updates sharp from 0.34.2 to 0.35.0

Release notes

v0.35.0

Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.

Breaking: Remove install script from package.json file. Compiling from source is now opt-in via the build script.

Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.

Breaking: Add limitInputChannels with a default value of 5.

Breaking: Remove deprecated failOnError constructor property.

Breaking: Remove deprecated paletteBitDepth from metadata response.

Breaking: Remove deprecated properties from sharpen operation.

Breaking: Rename format.jp2k as format.jp2 for API consistency.

Upgrade to libvips v8.18.3 for upstream bug fixes.

Remove experimental status from WebAssembly binaries.

Add prebuilt binaries for FreeBSD (WebAssembly).

Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.

Ensure TIFF output bitdepth option is limited to 1, 2 or 4.

Add AVIF/HEIF tune option for control over quality metrics. #4227

Add keepGainMap and withGainMap to process HDR JPEG images with embedded gain maps. #4314

Add toUint8Array for output image as a TypedArray backed by a transferable ArrayBuffer. #4355

Require prebuilt binaries using static paths to aid code bundling. #4380

TypeScript: Ensure FormatEnum keys match reality. #4475

Add margin option to trim operation. #4480 @eddienubes

Ensure HEIF primary item is used as default page/frame. #4487

... (truncated)

Commits

2ed5af4 Release v0.35.0
4475cf1 Tests: update locator hash for sharp-libvips v1.3.0
deb22dd Upgrade to sharp-libvips v1.3.0
07f1be9 Prerelease v0.35.0-rc.8
df1109b Prerelease v0.35.0-rc.7
aca49b3 Upgrade to libvips v8.18.3
e9e86f5 Type-check density option before range validation (#4536)
2f0bcf0 Docs: update supported image formats
98e03b8 Revert "Guard heif bitdepth property for prebuilt binaries"
e4ea2f3 CI: Ignore package minimum age in smoke tests
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sharp since your current version.

Updates next from 15.3.8 to 15.5.21

Release notes

Sourced from next's releases.

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

15.5.19

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[15.5.x] Don't drop FormData entries (#94244)

Other

[15.5.x] Fix CI (#94281)

Credits

Huge thanks to @eps1lon for helping!

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates postcss from 8.5.6 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

... (truncated)

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates nanoid from 3.3.11 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Changelog

Sourced from nanoid's changelog.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Commits

9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
96dd086 Update CI action
ba0bc3b Do not create latest release for v3
6819724 Release 3.3.15 version
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates undici from 6.21.3 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.

GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.

GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.
Action required: Upgrade to undici 6.27.0 or later.
npm install undici@^6.27.0
Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did

... (truncated)

Commits

01a912e Bumped v6.28.0 (#5591)
481ecfc Use Node 22 and npm 11 to release
740a0b7 fix: validate blob body content type
2698e49 fix: validate coerced header values for CRLF (#5579)
4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
cba3a52 fix(retry): reject partial content length mismatch
af74840 fix: harden cookie domain, path, and unparsed attribute validation
551138c Bumped v6.27.0 (#5431)
b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
25efa44 fix(cookies): preserve values and parse SameSite strictly
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

PR-Codex overview

This PR primarily focuses on updating various package dependencies across multiple projects to their latest versions, ensuring compatibility and potentially improving performance and security.

Detailed summary

Updated sharp from ^0.34.2 to ^0.35.0 in packages/thirdweb/package.json.
Updated next from 15.3.8 to 15.5.21 in multiple package.json files.
Updated postcss from 8.5.6 to 8.5.23 in several package.json files.
Updated autoprefixer to use postcss@8.5.23 in various package.json files.
Updated bufferutil from 4.0.9 to 4.1.0 in multiple package.json files.
Updated utf-8-validate from 5.0.10 to 5.0.11 in several package.json files.
Updated zod from 3.25.75 to 4.1.12 in various package.json files.
Updated @babel/core to 7.29.7 in multiple locations.
Updated @babel/plugin-* packages to their respective 7.29.x versions in various locations.

The following files were skipped due to too many changes: pnpm-lock.yaml

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

…dates Bumps the npm_and_yarn group with 3 updates in the / directory: [sharp](https://github.com/lovell/sharp), [next](https://github.com/vercel/next.js) and [postcss](https://github.com/postcss/postcss). Updates `sharp` from 0.34.2 to 0.35.0 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.2...v0.35.0) Updates `next` from 15.3.8 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.3.8...v15.5.21) Updates `postcss` from 8.5.6 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.23) Updates `nanoid` from 3.3.11 to 3.3.18 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.18) Updates `undici` from 6.21.3 to 6.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.21.3...v6.28.0) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.28.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-08-11T17:32:45Z

⚠️ No Changeset found

Latest commit: 12858fb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2026-08-11T17:32:48Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-v2	Error		Aug 11, 2026 5:39pm
nebula	Ready	Preview	Aug 11, 2026 5:39pm
thirdweb_playground	Error		Aug 11, 2026 5:39pm
thirdweb-www	Error		Aug 11, 2026 5:39pm
wallet-ui	Ready	Preview	Aug 11, 2026 5:39pm

socket-security · 2026-08-11T17:35:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@wagmi/cli@2.8.0 ⏵ 2.10.0
	postcss@8.5.6 ⏵ 8.5.23	⁺¹	⁺²⁴	^-1

View full report

socket-security · 2026-08-11T17:35:12Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@walletconnect/sign-client` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@walletconnect/sign-client@2.23.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@walletconnect/sign-client@2.23.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `yargs` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/vitest@3.2.4` → `npm/yargs@17.7.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/yargs@17.7.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 11, 2026

dependabot Bot requested review from a team as code owners August 11, 2026 17:32

vercel Bot had a problem deploying to Preview – docs-v2 August 11, 2026 17:35 Failure

vercel Bot deployed to Preview – wallet-ui August 11, 2026 17:36 View deployment

vercel Bot deployed to Preview – nebula August 11, 2026 17:36 View deployment

vercel Bot had a problem deploying to Preview – thirdweb-www August 11, 2026 17:37 Failure

vercel Bot had a problem deploying to Preview – thirdweb_playground August 11, 2026 17:39 Failure

Navigation Menu

Uh oh!

build(deps): Bump the npm_and_yarn group across 1 directory with 5 updates - #8884

build(deps): Bump the npm_and_yarn group across 1 directory with 5 updates#8884
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-f8ccf79b3f

dependabot Bot commented on behalf of github Aug 11, 2026 •

edited by pr-codex Bot

Loading

Uh oh!

changeset-bot Bot commented Aug 11, 2026

Uh oh!

vercel Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 11, 2026

Uh oh!

socket-security Bot commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	6.27.0	`b7f252e7`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	6.27.0	`25efa447`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	6.27.0	`25efa447`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	6.27.0	`f4c31d60`

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 11, 2026 • edited by pr-codex Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.35.0

v15.5.21

v15.5.20

15.5.19

Core Changes

Other

Credits

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

v6.28.0

⚠️ Security fixes

v6.27.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

PR-Codex overview

Detailed summary

Uh oh!

changeset-bot Bot commented Aug 11, 2026

⚠️ No Changeset found

Uh oh!

vercel Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 11, 2026

Uh oh!

socket-security Bot commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 11, 2026 •

edited by pr-codex Bot

Loading

vercel Bot commented Aug 11, 2026 •

edited

Loading