Skip to content

fix: bump the npm_and_yarn group across 1 directory with 5 updates - #19

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-77cf1df54a
Closed

fix: bump the npm_and_yarn group across 1 directory with 5 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-77cf1df54a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 4 updates in the / directory: next, next-auth, fast-uri and hono.

Updates next from 16.2.7 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Moderate:

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

Commits
  • 2234717 v16.2.12
  • 957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
  • b56eb16 Backport/docs fixes 16.2 - July round (#96031)
  • 9beca08 v16.2.11
  • 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
  • ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
  • 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
  • b512063 [16.x] Set correct origin for internal redirects in custom server
  • d303326 [16.x] Ensure exotic rewrite param values are properly encoded
  • 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
  • Additional commits viewable in compare view

Updates next-auth from 5.0.0-beta.30 to 5.0.0-beta.32

Release notes

Sourced from next-auth's releases.

next-auth@5.0.0-beta.32

Beta release for the v5 line.

Picks up the @​auth/core@​0.41.3 security fixes (malformed Bearer token handling in getToken, provider-bound OAuth check cookies, and NFKC email normalization).

Fixes auth checks failing open on provider configuration errors: a non-OK session response now yields no session instead of an error object, so checks like !!auth fail closed.

next-auth@5.0.0-beta.31

Bugfixes (via @​auth/core@​0.41.2)

  • providers: add issuer to GitHub provider for RFC 9207 compliance (#13410).
    • Supports both github.com and GitHub Enterprise Server (dynamic ${baseUrl}/login/oauth).
  • signin/send-token: stricter email address validation (rejects quoted, multi-@, and empty-domain inputs).

Dependency bump

  • @auth/core: 0.41.0 → 0.41.2. Resolves a peer-dep inconsistency in 5.0.0-beta.30 where next-auth declared nodemailer: ^7.0.7 while pinning @auth/core@0.41.0 (which wanted ^6.8.0). Both now align at ^7.0.7.

No changes to next-auth's own source.

Commits
  • e293b37 chore(release): next-auth@5.0.0-beta.32 [skip ci]
  • b690d91 chore: add npm bugs metadata and fix repository field format (#13452)
  • 5af7357 chore(release): bump package version(s) [skip ci]
  • 8a933f9 fix(core): document that getToken returns null for malformed authorization he...
  • 5b1aa47 chore(ci): pin surrealdb test server to the v2 image for the 1.3 client (#13468)
  • 1116034 Chore/nodemailer 8 peer deps (#13434)
  • 7b35fc3 fix(docs): repair docs build broken by floating TypeScript resolution (#13450)
  • b24abfa fix(proxy): override Vercel build command so it doesn't run turbo (#13448)
  • a99514b chore(deps): resolve remaining Dependabot alerts via cross-major dependency u...
  • d008b9b Merge commit from fork
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.


Updates @auth/core from 0.41.0 to 0.41.3

Release notes

Sourced from @​auth/core's releases.

@​auth/core@​0.41.3

Bugfixes

  • core: getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value
  • core: OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback
  • core: email addresses are Unicode-normalized (NFKC) before validation in the default email normalizer, closing a homoglyph @ bypass

Other

  • deps: resolve Dependabot alerts via cross-major dependency upgrades (#13449)
  • deps: resolve Dependabot security advisories via pnpm overrides (#13441)
  • deps: allow nodemailer 8 in peer dependency ranges (#13434)
  • CI formatting and proxy deploy repairs (#13444)

@​auth/core@​0.41.2

Bugfixes

  • providers: add issuer to GitHub provider for RFC 9207 compliance (#13410)

Other

  • sync package versions with npm registry (#13414)

@​auth/core@​0.41.1

Bugfixes

  • security issue from nodemailer (#13305)

Other

  • update links for Credentials-based Authentication (#13258)
Commits
  • 5af7357 chore(release): bump package version(s) [skip ci]
  • 8a933f9 fix(core): document that getToken returns null for malformed authorization he...
  • 5b1aa47 chore(ci): pin surrealdb test server to the v2 image for the 1.3 client (#13468)
  • 1116034 Chore/nodemailer 8 peer deps (#13434)
  • 7b35fc3 fix(docs): repair docs build broken by floating TypeScript resolution (#13450)
  • b24abfa fix(proxy): override Vercel build command so it doesn't run turbo (#13448)
  • a99514b chore(deps): resolve remaining Dependabot alerts via cross-major dependency u...
  • d008b9b Merge commit from fork
  • af42d8f chore: lint (#13446)
  • e707770 Merge commit from fork
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for @​auth/core since your current version.


Updates fast-uri from 3.1.2 to 3.1.4

Release notes

Sourced from fast-uri's releases.

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

Updates hono from 4.12.26 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

  • ci: enable reports for type & bundle size check in honojs/hono#5148
  • fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
  • fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
  • test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
  • fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
  • fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

New Contributors

... (truncated)

Commits
  • 26d8e42 4.12.32
  • 402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
  • c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
  • a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
  • 44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
  • e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
  • bf8608c ci: enable reports for type & bundle size check (#5148)
  • cadff88 4.12.31
  • 64c613a test(validator): fix misspelled identifier in transform type test (#5136)
  • aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
fix: bump the npm_and_yarn group across 1 directory with 5 updates
a036c4e 
Bumps the npm_and_yarn group with 4 updates in the / directory: [next](https://github.com/vercel/next.js), [next-auth](https://github.com/nextauthjs/next-auth), [fast-uri](https://github.com/fastify/fast-uri) and [hono](https://github.com/honojs/hono).


Updates `next` from 16.2.7 to 16.2.12
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.7...v16.2.12)

Updates `next-auth` from 5.0.0-beta.30 to 5.0.0-beta.32
- [Release notes](https://github.com/nextauthjs/next-auth/releases)
- [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.30...next-auth@5.0.0-beta.32)

Updates `@auth/core` from 0.41.0 to 0.41.3
- [Release notes](https://github.com/nextauthjs/next-auth/releases)
- [Commits](https://github.com/nextauthjs/next-auth/compare/@auth/core@0.41.0...@auth/core@0.41.3)

Updates `fast-uri` from 3.1.2 to 3.1.4
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.4)

Updates `hono` from 4.12.26 to 4.12.32
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.26...v4.12.32)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.2.12
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next-auth
  dependency-version: 5.0.0-beta.32
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@auth/core"
  dependency-version: 0.41.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.32
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@independabot-soc2
independabot-soc2 Bot requested a review from dannyneira July 29, 2026 13:09
dannyneira
dannyneira reviewed Jul 29, 2026
View reviewed changes

@dannyneira dannyneira left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not approving yet: this PR is currently in a merge-conflict state with the base branch (). Please rebase/merge main and I can re-review.

@dannyneira

dannyneira commented Jul 29, 2026

Copy link
Copy Markdown
Member

Follow-up clarity: not approving yet because this PR is currently merge-conflicting with base. Please rebase/merge main and I can re-review.

@dependabot @github

dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 29, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-77cf1df54a branch July 29, 2026 16:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dannyneira dannyneira dannyneira left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dannyneira