Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 15, 2026

Bumps next to 14.2.35 and updates ancestor dependency @asyncapi/cli. These dependencies need to be updated together.

Updates next from 14.2.26 to 14.2.35

Release notes

Sourced from next's releases.

v14.2.35

Please see the Next.js Security Update for information about this security patch.

Commits

Updates @asyncapi/cli from 3.1.1 to 5.0.5

Release notes

Sourced from @​asyncapi/cli's releases.

v5.0.5

Patch Changes

  • be7c41d: chore: bump Node.js version to 24 in remaining Dockerfiles

v5.0.4

Patch Changes

  • cacf566: Update server-api image to use Node 24.

v5.0.3

Patch Changes

  • 125e907: Update dependencies to the latest feasible ones thus eliminating vulnerabilities.

v5.0.2

Patch Changes

  • 4073175: - Alpine Releases have been fixed now.
    • Smaller docker image sizes and pruned dependencies.

v5.0.1

Major Changes

  • dac7bb4: Removed support for AsyncAPI Generator v1 and v2. The CLI now exclusively uses Generator v3. The --use-new-generator flag has been removed from the generate fromTemplate command.

  • b90a9b7: ## Major release with important security updates

    • Keeping in mind the recent Shai-Hulud attack, we have adopted trusted publishing with NPM.
    • This requires us to use node >= 24 and npm >= 11
    • Next.js version is in sync with Studio, and is currently 14.2.35 deemed safe by CVE. For more details

    Breaking Changes

    • Node.js version 24 or higher is now required.
    • NPM version 11 or higher is now required.
    • Next.js version is now 14.2.35 or higher.
    • The CLI now exclusively uses Generator v3 only.
    • The --use-new-generator flag has been removed from the generate fromTemplate command.
    • Default template in action has been upgraded to @asyncapi/[email protected]

    Please make sure to update your environment accordingly before upgrading to this version.

Minor Changes

Patch Changes

  • 394967f: fix: remove unnecessary await from startPreview call

    The startPreview function returns void, not a Promise, so awaiting it

... (truncated)

Changelog

Sourced from @​asyncapi/cli's changelog.

5.0.5

Patch Changes

  • be7c41d: chore: bump Node.js version to 24 in remaining Dockerfiles

5.0.4

Patch Changes

  • cacf566: Update server-api image to use Node 24.

5.0.3

Patch Changes

  • 125e907: Update dependencies to the latest feasible ones thus eliminating vulnerabilities.

5.0.2

Patch Changes

  • 4073175: - Alpine Releases have been fixed now.
    • Smaller docker image sizes and pruned dependencies.

5.0.1

Patch Changes

  • 394967f: fix: remove unnecessary await from startPreview call

    The startPreview function returns void, not a Promise, so awaiting it was incorrect and triggered a linter error. This matches the pattern used in the studio command.

5.0.0

Major Changes

  • dac7bb4: Removed support for AsyncAPI Generator v1 and v2. The CLI now exclusively uses Generator v3. The --use-new-generator flag has been removed from the generate fromTemplate command.

  • b90a9b7: ## Major release with important security updates

    • Keeping in mind the recent Shai-Hulud attack, we have adopted trusted publishing with NPM.
    • This requires us to use node >= 24 and npm >= 11
    • Next.js version is in sync with Studio, and is currently 14.2.35 deemed safe by CVE. For more details

    Breaking Changes

    • Node.js version 24 or higher is now required.
    • NPM version 11 or higher is now required.
    • Next.js version is now 14.2.35 or higher.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​asyncapi/cli since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [next](https://github.com/vercel/next.js) to 14.2.35 and updates ancestor dependency [@asyncapi/cli](https://github.com/asyncapi/cli). These dependencies need to be updated together.


Updates `next` from 14.2.26 to 14.2.35
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v14.2.26...v14.2.35)

Updates `@asyncapi/cli` from 3.1.1 to 5.0.5
- [Release notes](https://github.com/asyncapi/cli/releases)
- [Changelog](https://github.com/asyncapi/cli/blob/master/CHANGELOG.md)
- [Commits](asyncapi/cli@v3.1.1...v5.0.5)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 14.2.35
  dependency-type: indirect
- dependency-name: "@asyncapi/cli"
  dependency-version: 5.0.5
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jan 15, 2026
@dependabot dependabot bot requested a review from fmvilas as a code owner January 15, 2026 08:35
@dependabot dependabot bot added the javascript Pull requests that update javascript code label Jan 15, 2026
@sonarqubecloud
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

autoapproved autoupdate dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants