Skip to content

Bump the all-dependencies group across 1 directory with 30 updates#1980

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/all-dependencies-a220e95ae0
Open

Bump the all-dependencies group across 1 directory with 30 updates#1980
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/all-dependencies-a220e95ae0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 25, 2026

Bumps the all-dependencies group with 30 updates in the / directory:

Package From To
@amplitude/analytics-browser 2.23.7 2.37.2
@creit.tech/stellar-wallets-kit 1.9.5 2.0.1
@ledgerhq/hw-app-str 7.2.9 7.6.0
@ledgerhq/hw-transport-webhid 6.30.9 6.33.0
@next/third-parties 15.5.7 16.2.1
@sentry/nextjs 10.29.0 10.46.0
@stellar/stellar-sdk 14.3.3 14.6.1
@tanstack/react-query 5.87.4 5.95.2
@tanstack/react-query-devtools 5.87.4 5.95.2
@trezor/connect-web 9.6.4 9.7.2
bignumber.js 9.3.1 10.0.2
dompurify 3.2.6 3.3.3
immer 10.1.3 11.1.4
lossless-json 4.2.0 4.3.0
next 15.5.14 16.2.1
uuid 11.1.0 13.0.0
zustand-querystring 0.0.19 0.6.1
@next/eslint-plugin-next 15.5.3 16.2.1
@playwright/test 1.57.0 1.58.2
@types/node 24.3.1 25.5.0
@types/papaparse 5.3.16 5.5.2
@typescript-eslint/eslint-plugin 8.43.0 8.57.2
eslint 9.35.0 10.1.0
eslint-config-next 15.4.4 16.2.1
eslint-plugin-react-hooks 5.2.0 7.0.1
jest 30.2.0 30.3.0
lint-staged 16.1.6 16.4.0
prettier 3.6.2 3.8.1
sass 1.92.1 1.98.0
typescript 5.9.2 6.0.2

Updates @amplitude/analytics-browser from 2.23.7 to 2.37.2

Release notes

Sourced from @​amplitude/analytics-browser's releases.

@​amplitude/analytics-browser@​2.37.2

2.37.2 (2026-03-24)

Note: Version bump only for package @​amplitude/analytics-browser

@​amplitude/analytics-browser@​2.37.1

2.37.1 (2026-03-23)

Note: Version bump only for package @​amplitude/analytics-browser

@​amplitude/analytics-browser@​2.37.0

2.37.0 (2026-03-20)

Features

  • plugin-custom-enrichment: add plugin based on remote config settings (#1586) (617ebfe)

@​amplitude/analytics-browser@​2.36.8

2.36.8 (2026-03-19)

Note: Version bump only for package @​amplitude/analytics-browser

@​amplitude/analytics-browser@​2.36.7

2.36.7 (2026-03-17)

Note: Version bump only for package @​amplitude/analytics-browser

Commits
  • c376048 chore(release): publish
  • 6c8066b fix: swallow session storage errors (#1618)
  • 206a32a chore(release): publish
  • e5417d0 chore: update background capture version (#1617)
  • e38844f chore(release): publish
  • d8b402d chore: revert publish so we can do-over (#1616)
  • e674bee chore(release): publish
  • 617ebfe feat(plugin-custom-enrichment): add plugin based on remote config settings (#...
  • 10d15eb chore: add first time publishing instructions (#1613)
  • b246563 chore: add a test iframe sandbox with e2e test (#1607)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​amplitude/analytics-browser since your current version.


Updates @creit.tech/stellar-wallets-kit from 1.9.5 to 2.0.1

Release notes

Sourced from @​creit.tech/stellar-wallets-kit's releases.

v2.0.1

2.0.1 (2026-03-11)

Changes

  • Update the recently included Bitget module
  • Include PRs 85 and 86

v2.0.0

2.0.0 (2026-02-11)

Changes

  • Full refactor of the whole repository (with breaking changes)
  • Migrate into a full Deno repository with NPM builds for compatibility
  • Separate the UI, the state, and the SDK
    • The UI (modal, buttons, etc) is now using Preact with HTM instead of Lit
    • The SDK (the class StellarWalletsKit) is now a regular Deno library
    • The state part of the SDK is being used by both the UI and the SDK
  • The UI now uses a series of CSS variables that can be defined by developers to personalize the complete UI (the SDK makes this process easier)
  • The SDK internal state is now using the small preact/signals library instead of RxJS (aiming to reduce the kit's size)
  • The SDK now exports the internal state so developers can update it directly if they need to (tho, still not recommended)
  • We included 3 simple examples using vite-preact, vite-react, and create-react-app so developers can see how to use the library
  • The components used in the library can now be created separately if needed (but like the internal state, not recommended)
  • The openModal method was removed, and we now have authModal. This new method works as a regular Promise, and it returns the address after the user has picked their selected wallet
  • A new profile page is added to the kit's modal, so in the future, we will allow having multiple accounts and wallets connected, so users can switch between accounts directly from the website instead of needing to check their wallets.
  • Include a new logic for events updates from the kit, developers can `subscribe ' to updates from the kit, like changes in the selected address, network, module, or disconnections.
  • The kit now separates the logic between getting the address and fetching the address. This means that if the user hasn't interacted with the AuthModal before, it will throw an error. This will prevent issues with modules that have different authorization logic (for example, Freighter)
  • The kit now keeps more information in the localstorage, for example, it will remember the last Wallet Connect topic it used, so when using Wallet Connect, the user doesn't need to connect again and again.
  • Freighter and Lobstr are now default wallets in the wallet connect modal, this way users will see them first instead of regular EVM wallets.
  • Fully remove both submit and submitUrl parameters
  • And many more.
Changelog

Sourced from @​creit.tech/stellar-wallets-kit's changelog.

2.0.1 (2026-03-11)

Changes

  • Update the recently included Bitget module
  • Include PRs 85 and 86

2.0.0 (2026-02-11)

Changes

  • Full refactor of the whole repository (with breaking changes)
  • Migrate into a full Deno repository with NPM builds for compatibility
  • Separate the UI, the state, and the SDK
    • The UI (modal, buttons, etc) is now using Preact with HTM instead of Lit
    • The SDK (the class StellarWalletsKit) is now a regular Deno library
    • The state part of the SDK is being used by both the UI and the SDK
  • The UI now uses a series of CSS variables that can be defined by developers to personalize the complete UI (the SDK makes this process easier)
  • The SDK internal state is now using the small preact/signals library instead of RxJS (aiming to reduce the kit's size)
  • The SDK now exports the internal state so developers can update it directly if they need to (tho, still not recommended)
  • We included 3 simple examples using vite-preact, vite-react, and create-react-app so developers can see how to use the library
  • The components used in the library can now be created separately if needed (but like the internal state, not recommended)
  • The openModal method was removed, and we now have authModal. This new method works as a regular Promise, and it returns the address after the user has picked their selected wallet
  • A new profile page is added to the kit's modal, so in the future, we will allow having multiple accounts and wallets connected, so users can switch between accounts directly from the website instead of needing to check their wallets.
  • Include a new logic for events updates from the kit, developers can `subscribe ' to updates from the kit, like changes in the selected address, network, module, or disconnections.
  • The kit now separates the logic between getting the address and fetching the address. This means that if the user hasn't interacted with the AuthModal before, it will throw an error. This will prevent issues with modules that have different authorization logic (for example, Freighter)
  • The kit now keeps more information in the localstorage, for example, it will remember the last Wallet Connect topic it used, so when using Wallet Connect, the user doesn't need to connect again and again.
  • Freighter and Lobstr are now default wallets in the wallet connect modal, this way users will see them first instead of regular EVM wallets.
  • Fully remove both submit and submitUrl parameters
  • And many more.

Fix

  • Update Freighter module signAuthEntry method so it ignores the freighter-api types and follow a similar logic to the signMessage method uses (handle both a string and buffer response)
Commits
  • 02f4bd1 Update changelog and include the README in the npm build
  • fc209e3 v2.0.1
  • e03d17d Update bitget module
  • b2e74b0 Merge branch 'main' of github.com:Creit-Tech/Stellar-Wallets-Kit
  • db4737a Merge pull request #86 from BitgetWalletTeam/feat-bitget-wallet
  • df56e6c feat: support bitget wallet
  • 355726e Merge pull request #85 from marcelosalloum/fix/missing-onekey-exports
  • 37850e9 Fix missing OneKey module exports and docs
  • cf76789 Add NPM deployment github action
  • b863d6c v2.0.0
  • Additional commits viewable in compare view

Updates @ledgerhq/hw-app-str from 7.2.9 to 7.6.0

Commits

Updates @ledgerhq/hw-transport-webhid from 6.30.9 to 6.33.0

Commits
  • 647c11d Merge release into main
  • f260074 chore(release): 🚀 prepare release [skip ci]
  • 80c3d0c Merge pull request #13733 from LedgerHQ/smartling-translations-20260116094320030
  • 42ac90e File apps/ledger-live-mobile/src/locales/en/common.json was translated to es-...
  • 2c03c83 File apps/ledger-live-desktop/static/i18n/en/app.json was translated to pt-BR...
  • c9d1d26 File apps/ledger-live-desktop/static/i18n/en/app.json was translated to es-ES...
  • 4772f20 File apps/ledger-live-mobile/src/locales/en/common.json was translated to zh-...
  • 3c18ff2 File apps/ledger-live-mobile/src/locales/en/common.json was translated to de-...
  • d6191c9 File apps/ledger-live-desktop/static/i18n/en/app.json was translated to ar-AE...
  • 83e994c File apps/ledger-live-mobile/src/locales/en/common.json was translated to ja-...
  • Additional commits viewable in compare view

Updates @next/third-parties from 15.5.7 to 16.2.1

Release notes

Sourced from @​next/third-parties's releases.

v16.2.1

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • docs: post release amends (#91715)
  • docs: fix broken Activity Patterns demo link in preserving UI state guide (#91698)
  • Fix adapter outputs for dynamic metadata routes (#91680)
  • Turbopack: fix webpack loader runner layer (#91727)
  • Fix server actions in standalone mode with cacheComponents (#91711)
  • turbo-persistence: remove Unmergeable mmap advice (#91713)
  • Fix layout segment optimization: move app-page imports to server-utility transition (#91701)
  • Turbopack: lazy require metadata and handle TLA (#91705)
  • [turbopack] Respect {eval:true} in worker_threads constructors (#91666)

Credits

Huge thanks to @​icyJoseph, @​abhishekmardiya, @​ijjk, @​mischnic, @​unstubbable, @​sokra, and @​lukesandberg for helping!

v16.2.1-canary.7

Core Changes

  • Avoid deprecated TS node10 moduleResolution defaults: #91847
  • [turbopack] Rebuild the docker build scripts: #91799
  • Fix TS6 baseUrl deprecation for extended tsconfig: #91855
  • Add next internal post-build CLI command for Turbopack database compaction: #91336

Example Changes

  • chore(examples): remove with-styletron example: #81842

Misc Changes

  • ci: upload adapter deploy test results: #91846
  • Turbopack: Define Effect as a trait instead of a closure: #89080
  • test: scope css data-url typing to fixture: #91877
  • Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133

Credits

Huge thanks to @​JamBalaya56562, @​ijjk, @​mmastrac, @​sokra, and @​bgw for helping!

v16.2.1-canary.6

Core Changes

  • [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
  • Upgrade React from 3f0b9e61-20260317 to 8b2e903a-20260320: #91731
  • [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438

Misc Changes

... (truncated)

Commits

Updates @sentry/nextjs from 10.29.0 to 10.46.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.46.0

Important Changes

  • feat(elysia): @sentry/elysia - Alpha Release (#19509)

    New Sentry SDK for the Elysia web framework, supporting both Bun and Node.js runtimes.

    Note: This is an alpha release. Please report any issues or feedback on GitHub.

    Features

    • Automatic error capturing — 5xx errors captured via global onError hook; 3xx/4xx ignored by default. Customizable with shouldHandleError.
    • Automatic tracing — Lifecycle spans for every Elysia phase (Request, Parse, Transform, BeforeHandle, Handle, AfterHandle, MapResponse, AfterResponse, Error) with parameterized route names (e.g. GET /users/:id).
    • Distributed tracing — sentry-trace and baggage headers propagated automatically on incoming/outgoing requests.

    Usage

    import * as Sentry from '@sentry/elysia';
import { Elysia } from 'elysia';
Sentry.init({ dsn: 'DSN', tracesSampleRate: 1.0 });
const app = Sentry.withElysia(new Elysia());
app.get('/', () => 'Hello World');
app.listen(3000);

Other Changes

  • feat(nuxt): Conditionally use plugins based on Nitro version (v2/v3) (#19955)
  • fix(cloudflare): Forward ctx argument to Workflow.do user callback (#19891)
  • fix(cloudflare): Send correct events in local development (#19900)
  • fix(core): Do not overwrite user provided conversation id in Vercel (#19903)
  • fix(core): Preserve .withResponse() on Anthropic instrumentation (#19935)
  • fix(core): Send internal_error as span status for Vercel error spans (#19921)
  • fix(core): Truncate content array format in Vercel (#19911)
  • fix(deps): bump fast-xml-parser to 5.5.8 in @​azure/core-xml chain (#19918)
  • fix(deps): bump socket.io-parser to 4.2.6 to fix CVE-2026-33151 (#19880)
  • fix(nestjs): Add node to nest metadata (#19875)
  • fix(serverless): Add node to metadata (#19878)
  • chore(ci): Fix "Gatbsy" typo in issue package label workflow (#19905)
  • chore(claude): Enable Claude Code Intelligence (LSP) (#19930)
  • chore(deps): bump mongodb-memory-server-global from 10.1.4 to 11.0.1 (#19888)
  • chore(deps-dev): bump @​react-router/node from 7.13.0 to 7.13.1 (#19544)
  • chore(deps-dev): bump effect from 3.19.19 to 3.20.0 (#19926)
  • chore(deps-dev): bump qunit-dom from 3.2.1 to 3.5.0 (#19546)

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.46.0

Important Changes

  • feat(elysia): @sentry/elysia - Alpha Release (#19509)

    New Sentry SDK for the Elysia web framework, supporting both Bun and Node.js runtimes.

    Note: This is an alpha release. Please report any issues or feedback on GitHub.

    Features

    • Automatic error capturing — 5xx errors captured via global onError hook; 3xx/4xx ignored by default. Customizable with shouldHandleError.
    • Automatic tracing — Lifecycle spans for every Elysia phase (Request, Parse, Transform, BeforeHandle, Handle, AfterHandle, MapResponse, AfterResponse, Error) with parameterized route names (e.g. GET /users/:id).
    • Distributed tracing — sentry-trace and baggage headers propagated automatically on incoming/outgoing requests.

    Usage

    import * as Sentry from '@sentry/elysia';
import { Elysia } from 'elysia';
Sentry.init({ dsn: 'DSN', tracesSampleRate: 1.0 });
const app = Sentry.withElysia(new Elysia());
app.get('/', () => 'Hello World');
app.listen(3000);

Other Changes

  • feat(nuxt): Conditionally use plugins based on Nitro version (v2/v3) (#19955)
  • fix(cloudflare): Forward ctx argument to Workflow.do user callback (#19891)
  • fix(cloudflare): Send correct events in local development (#19900)
  • fix(core): Do not overwrite user provided conversation id in Vercel (#19903)
  • fix(core): Preserve .withResponse() on Anthropic instrumentation (#19935)
  • fix(core): Send internal_error as span status for Vercel error spans (#19921)
  • fix(core): Truncate content array format in Vercel (#19911)
  • fix(deps): bump fast-xml-parser to 5.5.8 in @​azure/core-xml chain (#19918)
  • fix(deps): bump socket.io-parser to 4.2.6 to fix CVE-2026-33151 (#19880)
  • fix(nestjs): Add node to nest metadata (#19875)
  • fix(serverless): Add node to metadata (#19878)
  • chore(ci): Fix "Gatbsy" typo in issue package label workflow (#19905)
  • chore(claude): Enable Claude Code Intelligence (LSP) (#19930)
  • chore(deps): bump mongodb-memory-server-global from 10.1.4 to 11.0.1 (#19888)
  • chore(deps-dev): bump @​react-router/node from 7.13.0 to 7.13.1 (#19544)
  • chore(deps-dev): bump effect from 3.19.19 to 3.20.0 (#19926)

... (truncated)

Commits
  • e5fdc9d release: 10.46.0
  • c01fe86 release: 10.46.0
  • 0f1171b Merge pull request #19973 from getsentry/prepare-release/10.46.0
  • 6f48cc4 meta(changelog): Update changelog for 10.46.0
  • 54abb35 refactor(elysia): drop @​elysiajs/opentelemetry dependency (#19947)
  • a54de04 ref(core): Remove duplicate buildMethodPath utility from openai (#19969)
  • 0156846 feat(nuxt): Conditionally use plugins based on Nitro version (v2/v3) (#19955)
  • 18a624e feat(elysia): Elysia SDK (#19509)
  • c9812ae test(cloudflare): Enable multi-worker tests for CF integration tests (#19938)
  • 83cabf3 fix(core): Preserve .withResponse() on Anthropic instrumentation (#19935)
  • Additional commits viewable in compare view

Updates @stellar/stellar-sdk from 14.3.3 to 14.6.1

Release notes

Sourced from @​stellar/stellar-sdk's releases.

v14.6.1

v14.6.1

Fixed

  • Fix assembleTransaction double-counting the resource fee when the input transaction already has Soroban data attached (e.g. when re-assembling a previously simulated transaction) (#1343).
  • Removed adding resourceFee in rpc.assembleTransaction as it's now handled by TransactionBuilder.build() (#1343).

Full Changelog: stellar/js-stellar-sdk@v14.6.0...v14.6.1

v14.6.0

v14.6.0

Added

  • Upgraded underlying @stellar/stellar-base library to include its new features and fixes (release notes).

Full Changelog: stellar/js-stellar-sdk@v14.5.0...v14.6.0

v14.5.0

v14.5.0

Added

  • Introduced CLI functionality for generating smart contract bindings (#1287).
  • Added BindingGeneration class for parsing contract specs into fully typed TypeScript libraries for calling contract methods (#1287).
  • Introduced rpc.Server.fundAddress that supports funding contract and account addresses via Friendbot (#1314).
  • Updated the StellarToml interface with SEP 45 fields WEB_AUTH_FOR_CONTRACTS_ENDPOINT and WEB_AUTH_CONTRACT_ID (#1326).

Fixed

  • X-App-Name and X-App-Version headers are now included when using CallBuilder.stream() (#1317).
  • CallBuilder now correctly uses the configured server URL for all requests, including pagination and linked resources. Previously, URLs returned by Horizon in _links would bypass reverse proxies (#1318).

Deprecated

  • rpc.Server.requestAirdrop is deprecated in favor of rpc.Server.fundAddress (#1314).

Contributors

@​ElliotFriend, @​leighmcculloch, @​Ryang-21, @​wpalmeri made their first contribution in stellar/js-stellar-sdk#1321, and @​joaquinsoza made their first contribution in stellar/js-stellar-sdk#1314

Full Changelog: stellar/js-stellar-sdk@v14.4.3...v14.5.0

v14.4.3

v14.4.3

Fixed

  • Upgraded underlying @stellar/stellar-base library to include its fixes (release notes).

v14.4.2

v14.4.2

Fixed

... (truncated)

Changelog

Sourced from @​stellar/stellar-sdk's changelog.

v14.6.1

Fixed

  • Fix assembleTransaction double-counting the resource fee when the input transaction already has Soroban data attached (e.g. when re-assembling a previously simulated transaction) (#1343).
  • Removed adding resourceFee in assembleTransaction as it's now handled by TransactionBuilder.build() (#1343).

v14.6.0

Added

  • Upgraded underlying @stellar/stellar-base library to include its new features and fixes (release notes).

v14.5.0

Added

  • Introduced CLI functionality for generating smart contract bindings (#1287).
  • Added BindingGeneration class for parsing contract specs into fully typed TypeScript libraries for calling contract methods (#1287).
  • Introduced rpc.Server.fundAddress that supports funding contract and account addresses via Friendbot (#1314).
  • Updated the StellarToml interface with SEP 45 fields WEB_AUTH_FOR_CONTRACTS_ENDPOINT and WEB_AUTH_CONTRACT_ID (#1326).

Fixed

  • X-App-Name and X-App-Version headers are now included when using CallBuilder.stream() (#1317).
  • CallBuilder now correctly uses the configured server URL for all requests, including pagination and linked resources. Previously, URLs returned by Horizon in _links would bypass reverse proxies (#1318).

Deprecated

  • rpc.Server.requestAirdrop is deprecated in favor of rpc.Server.fundAddress (#1314).

v14.4.3

Fixed

  • Upgraded underlying @stellar/stellar-base library to include its fixes (release notes).

v14.4.2

Fixed

  • Fixed package installation for Windows environments (#1306)

v14.4.1

Fixed

  • Set Api.GetEventsRequest.endLedger to be optional to align with RPC behavior (#1304)
  • Added back Typepoint and marked it deprecated in favor of Timepoint (#1303)

v14.4.0

Added

  • Introduced an rpc.Server.getAssetBalance() helper to fetch asset balances both for contracts and accounts (#1286).
  • rpc.Api.BalanceResponse now can include a revocable field in its balanceEntry for when trustlines are fetched (#1286).
  • Added Timepoint and Duration support to Spec (#1288)
  • Api.GetHealthResponse interface now includes latestLedger, ledgerRetentionWindow, and oldestLedger fields (#1297).

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​stellar/stellar-sdk since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @tanstack/react-query from 5.87.4 to 5.95.2

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.95.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.95.2
    • @​tanstack/react-query@​5.95.2

@​tanstack/react-query-next-experimental@​5.95.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.95.2

@​tanstack/react-query-persist-client@​5.95.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.95.2
    • @​tanstack/react-query@​5.95.2

@​tanstack/react-query@​5.95.2

Patch Changes

  • Updated dependencies [cd5a35b]:
    • @​tanstack/query-core@​5.95.2

@​tanstack/react-query-devtools@​5.95.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.95.1
    • @​tanstack/react-query@​5.95.1

@​tanstack/react-query-next-experimental@​5.95.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.95.1

@​tanstack/react-query-persist-client@​5.95.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.95.1
    • @​tanstack/react-query@​5.95.1

@​tanstack/react-query@​5.95.1

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.95.2

Patch Changes

  • Updated dependencies [cd5a35b]:
    • @​tanstack/query-core@​5.95.2

5.95.1

Patch Changes

  • Updated dependencies [1f1775c]:
    • @​tanstack/query-core@​5.95.1

5.95.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.95.0

5.94.5

Patch Changes

  • fix(*): resolve issue about excluded build directory (#10312)

  • Updated dependencies [4b6536d]:

    • @​tanstack/query-core@​5.94.5

5.94.4

Patch Changes

  • chore: fixed version (#10064)

  • Updated dependencies [4c75210]:

    • @​tanstack/query-core@​5.94.4

5.91.3

Patch Changes

  • fix: stop node types from leaking into browser (#10302)

5.91.2

Patch Changes

  • fix(streamedQuery): maintain error state on reset refetch with initialData defined (#10287)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​tanstack/react-query since your current version.


Updates @tanstack/react-query-devtools from 5.87.4 to 5.95.2

Release notes

Sourced from @​tanstack/react-query-devtools's releases.

@​tanstack/react-query-devtools@​5.95.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.95.2
    • @​tanstack/react-query@​5.95.2

@​tanstack/react-query-devtools@​5.95.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.95.1
    • @​tanstack/react-query@​5.95.1

@​tanstack/react-query-devtools@​5.95.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.95.0
    • @​tanstack/react-query@​5.95.0
Changelog

Sourced from @​tanstack/react-query-devtools's changelog.

5.95.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.95.2
    • @​tanstack/react-query@​5.95.2

5.95.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.95.1
    • @​tanstack/react-query@​5.95.1

5.95.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.95.0
    • @​tanstack/react-query@​5.95.0

5.94.5

Patch Changes

  • fix(*): resolve issue about excluded build directory (#10312)

  • Updated dependencies [4b6536d]:

    • @​tanstack/query-devtools@​5.94.5
    • @​tanstack/react-query@​5.94.5

5.94.4

Patch Changes

  • chore: fixed version (#10064)

  • Updated dependencies [4c75210]:

    • @​tanstack/query-devtools@​5.94.4
    • @​tanstack/react-query@​5.94.4

5.91.3

Patch Changes

  • Updated dependencies [83366c4]:
    • @​tanstack/query-devtools@​5.93.0

... (truncated)

Commits

@dependabot
Bump the all-dependencies group across 1 directory with 30 updates
f46b588 
Bumps the all-dependencies group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@amplitude/analytics-browser](https://github.com/amplitude/Amplitude-TypeScript) | `2.23.7` | `2.37.2` |
| [@creit.tech/stellar-wallets-kit](https://github.com/Creit-Tech/Stellar-Wallets-Kit) | `1.9.5` | `2.0.1` |
| [@ledgerhq/hw-app-str](https://github.com/LedgerHQ/ledger-live) | `7.2.9` | `7.6.0` |
| [@ledgerhq/hw-transport-webhid](https://github.com/LedgerHQ/ledger-live) | `6.30.9` | `6.33.0` |
| [@next/third-parties](https://github.com/vercel/next.js/tree/HEAD/packages/third-parties) | `15.5.7` | `16.2.1` |
| [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.29.0` | `10.46.0` |
| [@stellar/stellar-sdk](https://github.com/stellar/js-stellar-sdk) | `14.3.3` | `14.6.1` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.87.4` | `5.95.2` |
| [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.87.4` | `5.95.2` |
| [@trezor/connect-web](https://github.com/trezor/trezor-suite) | `9.6.4` | `9.7.2` |
| [bignumber.js](https://github.com/MikeMcl/bignumber.js) | `9.3.1` | `10.0.2` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.2.6` | `3.3.3` |
| [immer](https://github.com/immerjs/immer) | `10.1.3` | `11.1.4` |
| [lossless-json](https://github.com/josdejong/lossless-json) | `4.2.0` | `4.3.0` |
| [next](https://github.com/vercel/next.js) | `15.5.14` | `16.2.1` |
| [uuid](https://github.com/uuidjs/uuid) | `11.1.0` | `13.0.0` |
| [zustand-querystring](https://github.com/nitedani/zustand-querystring) | `0.0.19` | `0.6.1` |
| [@next/eslint-plugin-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-plugin-next) | `15.5.3` | `16.2.1` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.57.0` | `1.58.2` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.3.1` | `25.5.0` |
| [@types/papaparse](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/papaparse) | `5.3.16` | `5.5.2` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.43.0` | `8.57.2` |
| [eslint](https://github.com/eslint/eslint) | `9.35.0` | `10.1.0` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `15.4.4` | `16.2.1` |
| [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) | `5.2.0` | `7.0.1` |
| [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.2.0` | `30.3.0` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `16.1.6` | `16.4.0` |
| [prettier](https://github.com/prettier/prettier) | `3.6.2` | `3.8.1` |
| [sass](https://github.com/sass/dart-sass) | `1.92.1` | `1.98.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.2` | `6.0.2` |



Updates `@amplitude/analytics-browser` from 2.23.7 to 2.37.2
- [Release notes](https://github.com/amplitude/Amplitude-TypeScript/releases)
- [Commits](https://github.com/amplitude/Amplitude-TypeScript/compare/@amplitude/analytics-browser@2.23.7...@amplitude/analytics-browser@2.37.2)

Updates `@creit.tech/stellar-wallets-kit` from 1.9.5 to 2.0.1
- [Release notes](https://github.com/Creit-Tech/Stellar-Wallets-Kit/releases)
- [Changelog](https://github.com/Creit-Tech/Stellar-Wallets-Kit/blob/main/CHANGELOG.md)
- [Commits](Creit-Tech/Stellar-Wallets-Kit@v1.9.5...v2.0.1)

Updates `@ledgerhq/hw-app-str` from 7.2.9 to 7.6.0
- [Release notes](https://github.com/LedgerHQ/ledger-live/releases)
- [Commits](https://github.com/LedgerHQ/ledger-live/commits/v7.6.0)

Updates `@ledgerhq/hw-transport-webhid` from 6.30.9 to 6.33.0
- [Release notes](https://github.com/LedgerHQ/ledger-live/releases)
- [Commits](https://github.com/LedgerHQ/ledger-live/compare/@ledgerhq/hw-transport-http@6.30.9...@ledgerhq/hw-bolos@6.33.0)

Updates `@next/third-parties` from 15.5.7 to 16.2.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.1/packages/third-parties)

Updates `@sentry/nextjs` from 10.29.0 to 10.46.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.29.0...10.46.0)

Updates `@stellar/stellar-sdk` from 14.3.3 to 14.6.1
- [Release notes](https://github.com/stellar/js-stellar-sdk/releases)
- [Changelog](https://github.com/stellar/js-stellar-sdk/blob/master/CHANGELOG.md)
- [Commits](stellar/js-stellar-sdk@v14.3.3...v14.6.1)

Updates `@tanstack/react-query` from 5.87.4 to 5.95.2
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.95.2/packages/react-query)

Updates `@tanstack/react-query-devtools` from 5.87.4 to 5.95.2
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.95.2/packages/react-query-devtools)

Updates `@trezor/connect-web` from 9.6.4 to 9.7.2
- [Release notes](https://github.com/trezor/trezor-suite/releases)
- [Commits](https://github.com/trezor/trezor-suite/commits)

Updates `bignumber.js` from 9.3.1 to 10.0.2
- [Release notes](https://github.com/MikeMcl/bignumber.js/releases)
- [Changelog](https://github.com/MikeMcl/bignumber.js/blob/main/CHANGELOG.md)
- [Commits](MikeMcl/bignumber.js@v9.3.1...v10.0.2)

Updates `dompurify` from 3.2.6 to 3.3.3
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.2.6...3.3.3)

Updates `immer` from 10.1.3 to 11.1.4
- [Release notes](https://github.com/immerjs/immer/releases)
- [Commits](immerjs/immer@v10.1.3...v11.1.4)

Updates `lossless-json` from 4.2.0 to 4.3.0
- [Changelog](https://github.com/josdejong/lossless-json/blob/main/CHANGELOG.md)
- [Commits](josdejong/lossless-json@v4.2.0...v4.3.0)

Updates `next` from 15.5.14 to 16.2.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.5.14...v16.2.1)

Updates `uuid` from 11.1.0 to 13.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v11.1.0...v13.0.0)

Updates `zustand-querystring` from 0.0.19 to 0.6.1
- [Release notes](https://github.com/nitedani/zustand-querystring/releases)
- [Commits](https://github.com/nitedani/zustand-querystring/commits)

Updates `@next/eslint-plugin-next` from 15.5.3 to 16.2.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.1/packages/eslint-plugin-next)

Updates `@playwright/test` from 1.57.0 to 1.58.2
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.57.0...v1.58.2)

Updates `@types/node` from 24.3.1 to 25.5.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/papaparse` from 5.3.16 to 5.5.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/papaparse)

Updates `@typescript-eslint/eslint-plugin` from 8.43.0 to 8.57.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/eslint-plugin)

Updates `eslint` from 9.35.0 to 10.1.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.35.0...v10.1.0)

Updates `eslint-config-next` from 15.4.4 to 16.2.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.1/packages/eslint-config-next)

Updates `eslint-plugin-react-hooks` from 5.2.0 to 7.0.1
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/HEAD/packages/eslint-plugin-react-hooks)

Updates `jest` from 30.2.0 to 30.3.0
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.3.0/packages/jest)

Updates `lint-staged` from 16.1.6 to 16.4.0
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v16.1.6...v16.4.0)

Updates `prettier` from 3.6.2 to 3.8.1
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.6.2...3.8.1)

Updates `sass` from 1.92.1 to 1.98.0
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.92.1...1.98.0)

Updates `typescript` from 5.9.2 to 6.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.2...v6.0.2)

---
updated-dependencies:
- dependency-name: "@amplitude/analytics-browser"
  dependency-version: 2.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@creit.tech/stellar-wallets-kit"
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@ledgerhq/hw-app-str"
  dependency-version: 7.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@ledgerhq/hw-transport-webhid"
  dependency-version: 6.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@next/third-parties"
  dependency-version: 16.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@sentry/nextjs"
  dependency-version: 10.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@stellar/stellar-sdk"
  dependency-version: 14.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.95.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@tanstack/react-query-devtools"
  dependency-version: 5.95.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@trezor/connect-web"
  dependency-version: 9.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: bignumber.js
  dependency-version: 10.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: dompurify
  dependency-version: 3.3.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: immer
  dependency-version: 11.1.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: lossless-json
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: next
  dependency-version: 16.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: uuid
  dependency-version: 13.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: zustand-querystring
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@next/eslint-plugin-next"
  dependency-version: 16.2.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@playwright/test"
  dependency-version: 1.58.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.5.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@types/papaparse"
  dependency-version: 5.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.57.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: eslint
  dependency-version: 10.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: eslint-config-next
  dependency-version: 16.2.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: eslint-plugin-react-hooks
  dependency-version: 7.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: jest
  dependency-version: 30.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: lint-staged
  dependency-version: 16.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: prettier
  dependency-version: 3.8.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: sass
  dependency-version: 1.98.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: typescript
  dependency-version: 6.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 25, 2026
Copilot AI review requested due to automatic review settings March 25, 2026 17:59
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 25, 2026
@dependabot dependabot bot review requested due to automatic review settings March 25, 2026 17:59
@github-project-automation github-project-automation bot moved this to Backlog (Not Ready) in DevX Mar 25, 2026
@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 25, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednext@​15.5.14 ⏵ 16.2.162100 +2919770
Updatedeslint-config-next@​15.4.4 ⏵ 16.2.199 +110067 +398 +1100
Updatedjest@​30.2.0 ⏵ 30.3.0100 +110070 +194100
Updated@​tanstack/​react-query-devtools@​5.87.4 ⏵ 5.95.2100 +110071 +1100 +3100
Updated@​amplitude/​analytics-browser@​2.23.7 ⏵ 2.37.272 -2710094 +1100100
Updated@​next/​eslint-plugin-next@​15.5.3 ⏵ 16.2.1100 +110074 +199 +1100
Updated@​types/​papaparse@​5.3.16 ⏵ 5.5.2100 +110074 +183 -3100
Updatedzustand-querystring@​0.0.19 ⏵ 0.6.180 +1100100 +1091 +13100
Updated@​typescript-eslint/​eslint-plugin@​8.43.0 ⏵ 8.57.299 +110080 +198100
Updated@​types/​node@​24.3.1 ⏵ 25.5.0100 +110081 +195100
Updated@​next/​third-parties@​15.5.7 ⏵ 16.2.1100 +110082 +199100
Updatedlossless-json@​4.2.0 ⏵ 4.3.0100 +1100100 +183100
Updated@​creit.tech/​stellar-wallets-kit@​1.9.5 ⏵ 2.0.183 +210098 -193 +7100
Addeduuid@​13.0.010010010083100
Updatedimmer@​10.1.3 ⏵ 11.1.499 +110083 +188100
Updated@​tanstack/​react-query@​5.87.4 ⏵ 5.95.299 +110088 +1100 +1100
Updatedeslint@​9.35.0 ⏵ 10.1.089 +110010097100
Updatedtypescript@​5.9.2 ⏵ 6.0.2100 +110090 +110090
Updatedprettier@​3.6.2 ⏵ 3.8.19010097 +190100
Addedbignumber.js@​10.0.29810010090100
Updateddompurify@​3.2.6 ⏵ 3.3.398 +1100 +31009190
Updated@​sentry/​nextjs@​10.29.0 ⏵ 10.46.093 -610091 +196100
Updated@​trezor/​connect-web@​9.6.2 ⏵ 9.7.2991009296 +190
Updatedsass@​1.92.1 ⏵ 1.98.0100 +110010092100
Updated@​ledgerhq/​hw-app-str@​7.2.9 ⏵ 7.6.095 -1100100100 +1100
Updatedlint-staged@​16.1.6 ⏵ 16.4.0100 +110010095100
Updatedeslint-plugin-react-hooks@​5.2.0 ⏵ 7.0.1100 +310010096100
Updated@​stellar/​stellar-sdk@​14.3.3 ⏵ 14.6.199 +510010097 +1100
Updated@​playwright/​test@​1.57.0 ⏵ 1.58.210010010099100
Updated@​ledgerhq/​hw-transport-webhid@​6.30.9 ⏵ 6.33.0100100100100 +1100

View full report

@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 25, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @amplitude/analytics-browser is 85.0% likely obfuscated

Confidence: 0.85

Location: Package overview

From: package.json → npm/@amplitude/analytics-browser@2.37.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@amplitude/analytics-browser@2.37.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @ethereumjs/rlp under MPL-2.0

Location: Package overview

From: pnpm-lock.yaml → npm/@trezor/connect-web@9.7.2 → npm/@creit.tech/stellar-wallets-kit@2.0.1 → npm/@trezor/connect-plugin-stellar@9.2.3 → npm/@ethereumjs/rlp@10.1.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@ethereumjs/rlp@10.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @ethereumjs/tx under MPL-2.0

Location: Package overview

From: pnpm-lock.yaml → npm/@trezor/connect-web@9.7.2 → npm/@creit.tech/stellar-wallets-kit@2.0.1 → npm/@trezor/connect-plugin-stellar@9.2.3 → npm/@ethereumjs/tx@10.1.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@ethereumjs/tx@10.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @ethereumjs/util under MPL-2.0

Location: Package overview

From: pnpm-lock.yaml → npm/@trezor/connect-web@9.7.2 → npm/@creit.tech/stellar-wallets-kit@2.0.1 → npm/@trezor/connect-plugin-stellar@9.2.3 → npm/@ethereumjs/util@10.1.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@ethereumjs/util@10.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @lobstrco/signer-extension-api under GPL-3.0

License: GPL-3.0 - the applicable license policy does not allow this license (4) (npm metadata)

License: GPL-3.0 - the applicable license policy does not allow this license (4) (package/package.json)

From: pnpm-lock.yaml → npm/@creit.tech/stellar-wallets-kit@2.0.1 → npm/@lobstrco/signer-extension-api@2.0.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@lobstrco/signer-extension-api@2.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @sentry/cli under LicenseRef-FSL-1.1-MIT

License: LicenseRef-FSL-1.1-MIT - the applicable license policy does not allow this license (4) (package/LICENSE)

From: pnpm-lock.yaml → npm/@sentry/cli@2.58.5

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/cli@2.58.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @trezor/blockchain-link under LicenseRef-T-RSL

License: LicenseRef-T-RSL - the applicable license policy does not allow this license (4) (package/LICENSE.md)

From: pnpm-lock.yaml → npm/@trezor/connect-web@9.7.2 → npm/@trezor/connect-plugin-stellar@9.2.3 → npm/@trezor/blockchain-link@2.6.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@trezor/blockchain-link@2.6.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @trezor/connect-common under LicenseRef-T-RSL

License: LicenseRef-T-RSL - the applicable license policy does not allow this license (4) (package/LICENSE.md)

From: pnpm-lock.yaml → npm/@trezor/connect-web@9.7.2 → npm/@trezor/connect-plugin-stellar@9.2.3 → npm/@trezor/connect-common@0.5.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@trezor/connect-common@0.5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @trezor/connect-web under LicenseRef-T-RSL

License: LicenseRef-T-RSL - the applicable license policy does not allow this license (4) (package/LICENSE.md)

From: package.json → npm/@trezor/connect-web@9.7.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@trezor/connect-web@9.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @trezor/connect under LicenseRef-T-RSL

License: LicenseRef-T-RSL - the applicable license policy does not allow this license (4) (package/LICENSE.md)

From: pnpm-lock.yaml → npm/@trezor/connect-web@9.7.2 → npm/@trezor/connect-plugin-stellar@9.2.3 → npm/@trezor/connect@9.7.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@trezor/connect@9.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @trezor/transport under LicenseRef-T-RSL

License: LicenseRef-T-RSL - the applicable license policy does not allow this license (4) (package/LICENSE.md)

From: pnpm-lock.yaml → npm/@trezor/connect-web@9.7.2 → npm/@trezor/connect-plugin-stellar@9.2.3 → npm/@trezor/transport@1.6.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@trezor/transport@1.6.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @trezor/utils under LicenseRef-T-RSL

License: LicenseRef-T-RSL - the applicable license policy does not allow this license (4) (package/LICENSE.md)

From: pnpm-lock.yaml → npm/@trezor/connect-web@9.7.2 → npm/@trezor/connect-plugin-stellar@9.2.3 → npm/@trezor/utils@9.5.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@trezor/utils@9.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @trezor/utxo-lib under LicenseRef-T-RSL

License: LicenseRef-T-RSL - the applicable license policy does not allow this license (4) (package/LICENSE.md)

From: pnpm-lock.yaml → npm/@trezor/connect-web@9.7.2 → npm/@trezor/connect-plugin-stellar@9.2.3 → npm/@trezor/utxo-lib@2.5.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@trezor/utxo-lib@2.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm axe-core under MIT AND MPL-2.0

Location: Package overview

From: pnpm-lock.yaml → npm/eslint-config-next@16.2.1 → npm/axe-core@4.11.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/axe-core@4.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm next under CC-BY-SA-4.0

License: CC-BY-SA-4.0 - the applicable license policy does not allow this license (4) (package/dist/compiled/glob/LICENSE)

From: package.json → npm/next@16.2.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm rpc-websockets under LGPL-3.0-only

Location: Package overview

From: pnpm-lock.yaml → npm/@creit.tech/stellar-wallets-kit@2.0.1 → npm/rpc-websockets@9.3.6

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rpc-websockets@9.3.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm typescript under MIT-Khronos-old

License: MIT-Khronos-old - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt)

License: LicenseRef-W3C-Community-Final-Specification-Agreement - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt)

From: package.json → npm/typescript@6.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@6.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm ua-parser-js under AGPL-3.0-or-later

License: AGPL-3.0-or-later - the applicable license policy does not allow this license (4) (npm metadata)

License: AGPL-3.0-or-later - the applicable license policy does not allow this license (4) (package/package.json)

License: AGPL-3.0-or-later - the applicable license policy does not allow this license (4) (package/LICENSE.md)

From: pnpm-lock.yaml → npm/@trezor/connect-web@9.7.2 → npm/@creit.tech/stellar-wallets-kit@2.0.1 → npm/@trezor/connect-plugin-stellar@9.2.3 → npm/ua-parser-js@2.0.9

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ua-parser-js@2.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm usb under GPL-1.0-only

License: GPL-1.0-only - the applicable license policy does not allow this license (4) (package/libusb/examples/ezusb.h)

License: GPL-1.0-only - the applicable license policy does not allow this license (4) (package/libusb/examples/ezusb.c)

License: GPL-1.0-only - the applicable license policy does not allow this license (4) (package/libusb/examples/fxload.c)

From: pnpm-lock.yaml → npm/@trezor/connect-web@9.7.2 → npm/@creit.tech/stellar-wallets-kit@2.0.1 → npm/@trezor/connect-plugin-stellar@9.2.3 → npm/usb@2.17.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/usb@2.17.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

DevX
Status: Backlog (Not Ready)

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants