Skip to content

chore(deps): bump the npm_and_yarn group across 4 directories with 15 updates#12

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-3684adf8e5
Closed

chore(deps): bump the npm_and_yarn group across 4 directories with 15 updates#12
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-3684adf8e5

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Apr 7, 2026

Bumps the npm_and_yarn group with 13 updates in the / directory:

Package From To
ajv 8.17.1 8.18.0
axios 1.12.2 1.13.5
undici 6.21.2 6.24.0
lodash 4.17.21 4.18.1
@sentry/node 10.19.0 10.27.0
fastify 4.28.1 5.8.3
nodemailer 7.0.13 8.0.4
dompurify 3.3.0 3.3.2
next 15.4.11 15.5.14
@hono/node-server 1.13.7 1.19.10
hono 4.10.6 4.12.7
vite 5.4.21 6.4.2
handlebars 4.7.8 4.7.9

Bumps the npm_and_yarn group with 2 updates in the /cli directory: ajv and undici.
Bumps the npm_and_yarn group with 4 updates in the /controlplane directory: lodash, @sentry/node, fastify and nodemailer.
Bumps the npm_and_yarn group with 4 updates in the /studio directory: axios, lodash, dompurify and next.

Updates ajv from 8.17.1 to 8.18.0

Release notes

Sourced from ajv's releases.

v8.18.0

What's Changed

New Contributors

Full Changelog: ajv-validator/ajv@v8.17.1...v8.18.0

Commits
  • 142ce84 8.18.0
  • 720a23f fix(pattern): use configured RegExp engine with $data keyword to mitigate ReD...
  • 82735a1 fix: typos in schema-language.md (#2507)
  • b17ec32 fix: small grammatical error in managing-schemas.md (#2508)
  • 69568d0 fix: #2482 Infinity and NaN serialise to null (#2487)
  • f06766f feat: allow tree-shaking by adding ``"sideEffects": falsetopackage.json` ...
  • See full diff in compare view

Updates axios from 1.12.2 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

  • Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
  • Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

  • Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

  • Fix/5657. (PR #7313)
  • Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

  • Add input validation to isAbsoluteURL. (PR #7326)
  • Refactor: bump minor package versions. (PR #7356)

Documentation

  • Clarify object-check comment. (PR #7323)
  • Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

  • Chore: fix issues with YAML. (PR #7355)
  • CI: update workflow YAMLs. (PR #7372)
  • CI: fix run condition. (PR #7373)
  • Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
  • Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

  • fix: issues with version 1.13.3 (#7352) (ee90dfc)
    • Fixed issues discovered in v1.13.3 release

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

  • http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
  • interceptor: handle the error in the same interceptor (#6269) (5945e40)
  • main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
  • package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
  • silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
  • turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
  • types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
  • types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
  • unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

Reverts

  • Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
  • deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

... (truncated)

Commits
  • 29f7542 chore(release): prepare release 1.13.5 (#7379)
  • 431c3a3 ci: fix run condition (#7373)
  • 9ff3a78 ci: update ymls (#7372)
  • 265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
  • 475e75a feat: add input validation to isAbsoluteURL (#7326)
  • 28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
  • 04cf019 docs: clarify object check comment (#7323)
  • 696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
  • 569f028 fix: added a option to choose between legacy and the new request/response int...
  • 44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.


Updates undici from 6.21.2 to 6.24.0

Release notes

Sourced from undici's releases.

v6.24.0

Undici v6.24.0 Security Release Notes (LTS)

This release backports fixes for security vulnerabilities affecting the v6 line.

Upgrade guidance

All users on v6 should upgrade to v6.24.0 or later.

Fixed advisories

Not applicable to v6

Affected and patched ranges (v6)

References

v6.23.0

⚠️ Security Release

... (truncated)

Commits
  • 8873c94 Bumped v6.24.0
  • 411bd01 test(websocket): use node:assert for Node 18 compatibility
  • 844bf59 test: fix http2 lint regressions in backport
  • a444e4f test: stabilize h2 and tls-cert-leak under current test runner
  • dc032a1 fix: h2 CI (#4395)
  • 4cd3f4b test: increase bitness in test/fixtures/*.pem (#3659)
  • 7df6442 fix: adapt websocket frame-limit handling for v6 parser
  • 4e0179a fix: reject duplicate content-length and host headers
  • 5a97f08 Fix websocket 64-bit length overflow
  • e43e898 fix: validate upgrade header to prevent CRLF injection
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.


Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates @sentry/node from 10.19.0 to 10.27.0

Release notes

Sourced from @​sentry/node's releases.

10.27.0

Important Changes

  • feat(deps): Bump OpenTelemetry (#18239)

    • Bump @​opentelemetry/context-async-hooks from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/core from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/resources from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/sdk-trace-base from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/sdk-trace-node from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/instrumentation from 0.204.0 to 0.208.0
    • Bump @​opentelemetry/instrumentation-amqplib from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-aws-sdk from 0.59.0 to 0.64.0
    • Bump @​opentelemetry/instrumentation-connect from 0.48.0 to 0.52.0
    • Bump @​opentelemetry/instrumentation-dataloader from 0.22.0 to 0.26.0
    • Bump @​opentelemetry/instrumentation-express from 0.53.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-fs from 0.24.0 to 0.28.0
    • Bump @​opentelemetry/instrumentation-generic-pool from 0.48.0 to 0.52.0
    • Bump @​opentelemetry/instrumentation-graphql from 0.52.0 to 0.56.0
    • Bump @​opentelemetry/instrumentation-hapi from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-http from 0.204.0 to 0.208.0
    • Bump @​opentelemetry/instrumentation-ioredis from 0.52.0 to 0.56.0
    • Bump @​opentelemetry/instrumentation-kafkajs from 0.14.0 to 0.18.0
    • Bump @​opentelemetry/instrumentation-knex from 0.49.0 to 0.53.0
    • Bump @​opentelemetry/instrumentation-koa from 0.52.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-lru-memoizer from 0.49.0 to 0.53.0
    • Bump @​opentelemetry/instrumentation-mongodb from 0.57.0 to 0.61.0
    • Bump @​opentelemetry/instrumentation-mongoose from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-mysql from 0.50.0 to 0.54.0
    • Bump @​opentelemetry/instrumentation-mysql2 from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-nestjs-core from 0.50.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-pg from 0.57.0 to 0.61.0
    • Bump @​opentelemetry/instrumentation-redis from 0.53.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-tedious from 0.23.0 to 0.27.0
    • Bump @​opentelemetry/instrumentation-undici from 0.15.0 to 0.19.0
    • Bump @​prisma/instrumentation from 6.15.0 to 6.19.0

  • feat(browserprofiling): Add manual mode and deprecate old profiling (#18189)

    Adds the manual lifecycle mode for UI profiling (the default mode), allowing profiles to be captured manually with Sentry.uiProfiler.startProfiler() and Sentry.uiProfiler.stopProfiler(). The previous transaction-based profiling is with profilesSampleRate is now deprecated in favor of the new UI Profiling with profileSessionSampleRate.

Other Changes

  • feat(core): Add gibibyte and pebibyte to InformationUnit type (#18241)
  • feat(core): Add scope attribute APIs (#18165)
  • feat(core): Re-add _experiments.enableLogs option (#18299)
  • feat(core): Use maxValueLength on error messages (#18301)
  • feat(deps): bump @​sentry/bundler-plugin-core from 4.3.0 to 4.6.1 (#18273)
  • feat(deps): bump @​sentry/cli from 2.56.0 to 2.58.2 (#18271)
  • feat(node): Add tracing support for AzureOpenAI (#18281)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.27.0

Important Changes

  • feat(deps): Bump OpenTelemetry (#18239)

    • Bump @​opentelemetry/context-async-hooks from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/core from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/resources from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/sdk-trace-base from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/sdk-trace-node from ^2.1.0 to ^2.2.0
    • Bump @​opentelemetry/instrumentation from 0.204.0 to 0.208.0
    • Bump @​opentelemetry/instrumentation-amqplib from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-aws-sdk from 0.59.0 to 0.64.0
    • Bump @​opentelemetry/instrumentation-connect from 0.48.0 to 0.52.0
    • Bump @​opentelemetry/instrumentation-dataloader from 0.22.0 to 0.26.0
    • Bump @​opentelemetry/instrumentation-express from 0.53.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-fs from 0.24.0 to 0.28.0
    • Bump @​opentelemetry/instrumentation-generic-pool from 0.48.0 to 0.52.0
    • Bump @​opentelemetry/instrumentation-graphql from 0.52.0 to 0.56.0
    • Bump @​opentelemetry/instrumentation-hapi from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-http from 0.204.0 to 0.208.0
    • Bump @​opentelemetry/instrumentation-ioredis from 0.52.0 to 0.56.0
    • Bump @​opentelemetry/instrumentation-kafkajs from 0.14.0 to 0.18.0
    • Bump @​opentelemetry/instrumentation-knex from 0.49.0 to 0.53.0
    • Bump @​opentelemetry/instrumentation-koa from 0.52.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-lru-memoizer from 0.49.0 to 0.53.0
    • Bump @​opentelemetry/instrumentation-mongodb from 0.57.0 to 0.61.0
    • Bump @​opentelemetry/instrumentation-mongoose from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-mysql from 0.50.0 to 0.54.0
    • Bump @​opentelemetry/instrumentation-mysql2 from 0.51.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-nestjs-core from 0.50.0 to 0.55.0
    • Bump @​opentelemetry/instrumentation-pg from 0.57.0 to 0.61.0
    • Bump @​opentelemetry/instrumentation-redis from 0.53.0 to 0.57.0
    • Bump @​opentelemetry/instrumentation-tedious from 0.23.0 to 0.27.0
    • Bump @​opentelemetry/instrumentation-undici from 0.15.0 to 0.19.0
    • Bump @​prisma/instrumentation from 6.15.0 to 6.19.0

  • feat(browserprofiling): Add manual mode and deprecate old profiling (#18189)

    Adds the manual lifecycle mode for UI profiling (the default mode), allowing profiles to be captured manually with Sentry.uiProfiler.startProfiler() and Sentry.uiProfiler.stopProfiler(). The previous transaction-based profiling is with profilesSampleRate is now deprecated in favor of the new UI Profiling with profileSessionSampleRate.

Other Changes

  • feat(core): Add gibibyte and pebibyte to InformationUnit type (#18241)
  • feat(core): Add scope attribute APIs (#18165)
  • feat(core): Re-add _experiments.enableLogs option (#18299)
  • feat(core): Use maxValueLength on error messages (#18301)
  • feat(deps): bump @​sentry/bundler-plugin-core from 4.3.0 to 4.6.1 (#18273)
  • feat(deps): bump @​sentry/cli from 2.56.0 to 2.58.2 (#18271)

... (truncated)

Commits
  • 0b0151d release: 10.27.0
  • 930863e Merge pull request #18312 from getsentry/prepare-release/10.27.0
  • 02aa2ea meta(changelog): Update changelog for 10.27.0
  • 6ce620e fix(core): Always redact content of sensitive headers regardless of `sendDefa...
  • 235c865 feat(core): Re-add _experiments.enableLogs option (#18299)
  • 4b92c64 fix(nextjs): universal random tunnel path support (#18257)
  • 6240191 feat(core): Use maxValueLength on error messages (#18301)
  • 1525603 feat(browserprofiling): Add manual mode and deprecate old profiling (#18189)
  • 3d48cc6 chore: Add external contributor to CHANGELOG.md (#18300)
  • b8127fb doc(sveltekit): Update documentation link for SvelteKit guide (#18298)
  • Additional commits viewable in compare view

Updates fastify from 4.28.1 to 5.8.3

Release notes

Sourced from fastify's releases.

v5.8.3

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.2...v5.8.3

v5.8.2

What's Changed

New Contributors

... (truncated)

Commits
  • a3e77ce Bumped v5.8.3
  • 4e1db5b fix: gate host and protocol getters on proxy trust function
  • a22217f ci(lock-threads): use shared lock-threads workflow (#6592)
  • 1851f20 docs: update links (#6593)
  • 9cc5187 types: Allow port to be null in request type definition (#6589)
  • 722d83b docs: replace redirected npm.im http-errors link (#6588)
  • a1413de docs: fix incorrect code examples in Reply and Request reference (#6582)
  • d7f01b6 docs: clarify content-type parser/schema mismatch is outside threat model (#6...
  • a0649e9 docs: update syntax markdown, absolute paths and links (#6569)
  • d477915 ci(link-checker): fix root-relative links resolution (#6535)
  • Additional commits viewable in compare view

Updates nodemailer from 7.0.13 to 8.0.4

Release notes

Sourced from nodemailer's releases.

v8.0.4

8.0.4 (2026-03-25)

Bug Fixes

  • sanitize envelope size to prevent SMTP command injection (2d7b971)

v8.0.3

8.0.3 (2026-03-18)

Bug Fixes

  • clean up addressparser and fix group name fallback producing undefined (9d55877)
  • fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)
  • refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)
  • remove familySupportCache that broke DNS resolution tests (c803d90)

v8.0.2

8.0.2 (2026-03-09)

Bug Fixes

  • merge fragmented display names with unquoted commas in addressparser (fe27f7f)

v8.0.1

8.0.1 (2026-02-07)

Bug Fixes

  • absorb TLS errors during socket teardown (7f8dde4)
  • absorb TLS errors during socket teardown (381f628)
  • Add Gmail Workspace service configuration (#1787) (dc97ede)

v8.0.0

8.0.0 (2026-02-04)

⚠ BREAKING CHANGES

  • Error code 'NoAuth' renamed to 'ENOAUTH'

Bug Fixes

  • add connection fallback to alternative DNS addresses (e726d6f)
  • centralize and standardize error codes (45062ce)
  • harden DNS fallback against race conditions and cleanup issues (4fa3c63)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

8.0.4 (2026-03-25)

Bug Fixes

  • sanitize envelope size to prevent SMTP command injection (2d7b971)

8.0.3 (2026-03-18)

Bug Fixes

  • clean up addressparser and fix group name fallback producing undefined (9d55877)
  • fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)
  • refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)
  • remove familySupportCache that broke DNS resolution tests (c803d90)

8.0.2 (2026-03-09)

Bug Fixes

  • merge fragmented display names with unquoted commas in addressparser (fe27f7f)

8.0.1 (2026-02-07)

Bug Fixes

  • absorb TLS errors during socket teardown (7f8dde4)
  • absorb TLS errors during socket teardown (381f628)
  • Add Gmail Workspace service configuration (#1787) (dc97ede)

8.0.0 (2026-02-04)

⚠ BREAKING CHANGES

  • Error code 'NoAuth' renamed to 'ENOAUTH'

Bug Fixes

  • add connection fallback to alternative DNS addresses (e726d6f)
  • centralize and standardize error codes (45062ce)
  • harden DNS fallback against race conditions and cleanup issues (4fa3c63)
  • improve socket cleanup to prevent potential memory leaks (6069fdc)
Commits
  • 2d31975 chore(master): release 8.0.4 (#1806)
  • 2d7b971 fix: sanitize envelope size to prevent SMTP command injection

@dependabot
chore(deps): bump the npm_and_yarn group across 4 directories with 15…
ba473a8 
… updates

Bumps the npm_and_yarn group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [ajv](https://github.com/ajv-validator/ajv) | `8.17.1` | `8.18.0` |
| [axios](https://github.com/axios/axios) | `1.12.2` | `1.13.5` |
| [undici](https://github.com/nodejs/undici) | `6.21.2` | `6.24.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.19.0` | `10.27.0` |
| [fastify](https://github.com/fastify/fastify) | `4.28.1` | `5.8.3` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `7.0.13` | `8.0.4` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.3.0` | `3.3.2` |
| [next](https://github.com/vercel/next.js) | `15.4.11` | `15.5.14` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.13.7` | `1.19.10` |
| [hono](https://github.com/honojs/hono) | `4.10.6` | `4.12.7` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.21` | `6.4.2` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` |

Bumps the npm_and_yarn group with 2 updates in the /cli directory: [ajv](https://github.com/ajv-validator/ajv) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 4 updates in the /controlplane directory: [lodash](https://github.com/lodash/lodash), [@sentry/node](https://github.com/getsentry/sentry-javascript), [fastify](https://github.com/fastify/fastify) and [nodemailer](https://github.com/nodemailer/nodemailer).
Bumps the npm_and_yarn group with 4 updates in the /studio directory: [axios](https://github.com/axios/axios), [lodash](https://github.com/lodash/lodash), [dompurify](https://github.com/cure53/DOMPurify) and [next](https://github.com/vercel/next.js).


Updates `ajv` from 8.17.1 to 8.18.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v8.17.1...v8.18.0)

Updates `axios` from 1.12.2 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.12.2...v1.13.5)

Updates `undici` from 6.21.2 to 6.24.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.2...v6.24.0)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `@sentry/node` from 10.19.0 to 10.27.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.19.0...10.27.0)

Updates `fastify` from 4.28.1 to 5.8.3
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v4.28.1...v5.8.3)

Updates `nodemailer` from 7.0.13 to 8.0.4
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v7.0.13...v8.0.4)

Updates `dompurify` from 3.3.0 to 3.3.2
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.0...3.3.2)

Updates `next` from 15.4.11 to 15.5.14
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.4.11...v15.5.14)

Updates `@hono/node-server` from 1.13.7 to 1.19.10
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.13.7...v1.19.10)

Updates `hono` from 4.10.6 to 4.12.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.10.6...v4.12.7)

Updates `vite` from 5.4.21 to 6.4.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite)

Updates `handlebars` from 4.7.8 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `yaml` from 1.10.2 to 1.10.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v1.10.2...v1.10.3)

Updates `ajv` from 8.17.1 to 8.18.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v8.17.1...v8.18.0)

Updates `undici` from 6.21.2 to 6.24.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.2...v6.24.0)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `@sentry/node` from 10.19.0 to 10.27.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.19.0...10.27.0)

Updates `fastify` from 4.28.1 to 5.8.3
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v4.28.1...v5.8.3)

Updates `nodemailer` from 7.0.13 to 8.0.4
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v7.0.13...v8.0.4)

Updates `axios` from 1.12.2 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.12.2...v1.13.5)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `dompurify` from 3.3.0 to 3.3.2
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.0...3.3.2)

Updates `next` from 15.4.11 to 15.5.14
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.4.11...v15.5.14)

---
updated-dependencies:
- dependency-name: ajv
  dependency-version: 8.18.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.24.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@sentry/node"
  dependency-version: 10.27.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.8.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 8.0.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.3.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.14
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 6.4.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: yaml
  dependency-version: 1.10.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ajv
  dependency-version: 8.18.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.24.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@sentry/node"
  dependency-version: 10.27.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.8.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 8.0.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.3.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.14
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 7, 2026
@dependabot dependabot bot mentioned this pull request Apr 7, 2026
Closed
@dependabot @github
Copy link
Copy Markdown
Author

dependabot bot commented on behalf of github Apr 8, 2026

Superseded by #13.

@dependabot dependabot bot closed this Apr 8, 2026
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-3684adf8e5 branch April 8, 2026 01:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants