Skip to content

chore(deps): bump the npm_and_yarn group across 3 directories with 5 updates - #4966

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8fadd58b63
Closed

chore(deps): bump the npm_and_yarn group across 3 directories with 5 updates#4966
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8fadd58b63

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 4 updates in the / directory: @excalidraw/excalidraw, lodash, next and glob.
Bumps the npm_and_yarn group with 4 updates in the /apps/www directory: @excalidraw/excalidraw, lodash, next and glob.
Bumps the npm_and_yarn group with 1 update in the /packages/excalidraw directory: @excalidraw/excalidraw.

Updates @excalidraw/excalidraw from 0.18.0 to 0.18.1

Release notes

Sourced from @​excalidraw/excalidraw's releases.

v0.18.1

Security patch release for @excalidraw/excalidraw@0.18.x, addressing upstream Mermaid XSS vulnerability CVE-2025-54881 / GHSA-7rqq-prvp-x9jh.

  • Backports Mermaid XSS mitigation by updating @excalidraw/mermaid-to-excalidraw to 2.2.2
  • Pins @types/d3-dispatch for compatibility with the 0.18.x TypeScript version
Commits

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates next from 16.2.1 to 16.2.6

Release notes

Sourced from next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

Moderate:

Low:

Core Changes

  • fix: preserve HTTP access fallbacks during prerender recovery (#92231)
  • Fix fallback route params case in app-page handler (#91737)
  • Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
  • Patch setHeader for direct route handlers (#93101)
  • Include deployment id in cacheHandlers keys (#93453)
  • Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

... (truncated)

Commits
  • ee6e79b v16.2.6
  • afa053d Turbopack: Match proxy matchers with webpack implementation (#93594)
  • 97a154e Turbopack: Fix middleware matcher suffix (#93590)
  • 83899bc [backport] Disable build caches for production/staging/force-preview deploys ...
  • 7b222b9 [backport][test] Pin package manager to patch versions (#93595)
  • a8dc24f [backport] Turbopack: more strict vergen setup (#93587)
  • 766148f v16.2.5
  • 0dd9483 fix: add explicit checks for RSC header (#83) (#98)
  • d166096 fix proxy matching for segment prefetch URLs (#89) (#96)
  • 9d50c0b Strip next-resume header from incoming requests (#92)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates glob from 11.0.2 to 12.0.0

Changelog

Sourced from glob's changelog.

changeglob

13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

  • Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
  • Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
  • Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

  • Drop support for node before v20

10.4

  • Add includeChildMatches: false option
  • Export the Ignore class

10.3

  • Add --default -p flag to provide a default pattern
  • exclude symbolic links to directories when follow and nodir are both set

10.2

  • Add glob cli

10.1

  • Return '.' instead of the empty string '' when the current working directory is returned as a match.
  • Add posix: true option to return / delimited paths, even on

... (truncated)

Commits
  • 2b03cca 12.0.0
  • d56203d prettier config
  • bb521e5 Remove --shell option where unsafe to use
  • 2551fb5 11.1.0
  • 47473c0 bin: Do not expose filenames to shell expansion
  • bc33fe1 skip tilde test on systems that lack tilde expansion
  • 59bf9ca fix notes
  • dde4fa6 docs(README): add #anchor and improve notes
  • 0559b0e docs: add better links to path-scurry docs
  • c9773c2 fix: correct typos in README.md
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for glob since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates dompurify from 3.1.6 to 3.3.2

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.2

  • Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
  • Fixed a prototype pollution issue when working with custom elements, thanks @​christos-eth
  • Fixed a lenient config parsing in _isValidAttribute, thanks @​christos-eth
  • Bumped and removed several dependencies, thanks @​Rotzbua
  • Fixed the test suite after bumping dependencies, thanks @​Rotzbua

DOMPurify 3.3.1

  • Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @​MariusRumpf
  • Updated the ESM import syntax to be more correct, thanks @​binhpv

DOMPurify 3.3.0

  • Added the SVG mask-type attribute to default allow-list, thanks @​prasadrajandran
  • Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @​nelstrom
  • Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @​Wim-Valgaeren

DOMPurify 3.2.7

  • Added new attributes and elements to default allow-list, thanks @​elrion018
  • Added tagName parameter to custom element attributeNameCheck, thanks @​nelstrom
  • Added better check for animated href attributes, thanks @​llamakko
  • Updated and improved the bundled types, thanks @​ssi02014
  • Updated several tests to better align with new browser encoding behaviors
  • Improved the handling of potentially risky content inside CDATA elements, thanks @​securityMB & @​terjanq
  • Improved the regular expression for raw-text elements to cover textareas, thanks @​securityMB & @​terjanq

DOMPurify 3.2.6

DOMPurify 3.2.5

  • Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
  • Added ESM type imports in source, removes patch function, thanks @​donmccurdy
  • Added script to verify various TypeScript configurations, thanks @​reduckted
  • Added more modern browsers to the Karma launchers list
  • Added Node 23.x to tested runtimes, removed Node 17.x
  • Fixed the generation of source maps, thanks @​reduckted
  • Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
  • Fixed a few typos in the README file

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot

... (truncated)

Commits
  • 5e56114 Getting 3.x branch ready for 3.3.2 release (#1208)
  • e8c95f4 fix: Fixed the broken package-lock.json
  • 9636037 Update package-lock.json
  • 5cad4ce Getting 3.x branch ready for 3.3.2 releas (#1205)
  • 6fc446a Merge pull request #1175 from cure53/main
  • 3b3bf91 Merge branch 'main' of github.com:cure53/DOMPurify
  • 9863f41 chore: Preparing 3.3.1 release
  • b4e0295 chore: Preparing 3.3.0 release
  • 077746b build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1170)
  • 4de68bb build(deps): bump actions/checkout from 5 to 6 (#1171)
  • Additional commits viewable in compare view

Updates @excalidraw/excalidraw from 0.18.0 to 0.18.1

Release notes

Sourced from @​excalidraw/excalidraw's releases.

v0.18.1

Security patch release for @excalidraw/excalidraw@0.18.x, addressing upstream Mermaid XSS vulnerability CVE-2025-54881 / GHSA-7rqq-prvp-x9jh.

  • Backports Mermaid XSS mitigation by updating @excalidraw/mermaid-to-excalidraw to 2.2.2
  • Pins @types/d3-dispatch for compatibility with the 0.18.x TypeScript version
Commits

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates next from 16.2.1 to 16.2.6

Release notes

Sourced from next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

Moderate:

Low:

Core Changes

  • fix: preserve HTTP access fallbacks during prerender recovery (#92231)
  • Fix fallback route params case in app-page handler (#91737)
  • Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
  • Patch setHeader for direct route handlers (#93101)
  • Include deployment id in cacheHandlers keys (#93453)
  • Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

... (truncated)

Commits
  • ee6e79b v16.2.6
  • afa053d Turbopack: Match proxy matchers with webpack implementation (#93594)
  • 97a154e Turbopack: Fix middleware matcher suffix (#93590)
  • 83899bc [backport] Disable build caches for production/staging/force-preview deploys ...
  • 7b222b9 [backport][test] Pin package manager to patch versions (#93595)
  • a8dc24f [backport] Turbopack: more strict vergen setup (#93587)
  • 766148f v16.2.5
  • 0dd9483 fix: add explicit checks for RSC header (#83) (#98)
  • d166096 fix proxy matching for segment prefetch URLs (#89) (#96)
  • 9d50c0b Strip next-resume header from incoming requests (#92)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates glob from 11.0.2 to 12.0.0

Changelog

Sourced from glob's changelog.

changeglob

13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

  • Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
  • Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
  • Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

  • Drop support for node before v20

10.4

  • Add includeChildMatches: false option
  • Export the Ignore class

10.3

  • Add --default -p flag to provide a default pattern
  • exclude symbolic links to directories when follow and nodir are both set

10.2

  • Add glob cli

10.1

  • Return '.' instead of the empty string '' when the current working directory is returned as a match.
  • Add posix: true option to return / delimited paths, even on

... (truncated)

Commits
  • 2b03cca 12.0.0
  • d56203d prettier config
  • bb521e5 Remove --shell option where unsafe to use
  • 2551fb5 11.1.0
  • 47473c0 bin: Do not expose filenames to shell expansion
  • bc33fe1 skip tilde test on systems that lack tilde expansion
  • 59bf9ca fix notes
  • dde4fa6 docs(README): add #anchor and improve notes
  • 0559b0e docs: add better links to path-scurry docs
  • c9773c2 fix: correct typos in README.md
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for glob since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates dompurify from 3.1.6 to 3.3.2

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.2

  • Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
  • Fixed a prototype pollution issue when working with custom elements, thanks @​christos-eth
  • Fixed a lenient config parsing in _isValidAttribute, thanks @​christos-eth
  • Bumped and removed several dependencies, thanks @​Rotzbua
  • Fixed the test suite after bumping dependencies, thanks @​Rotzbua

DOMPurify 3.3.1

  • Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @​MariusRumpf
  • Updated the ESM import syntax to be more correct, thanks @​binhpv

DOMPurify 3.3.0

  • Added the SVG mask-type attribute to default allow-list, thanks @​prasadrajandran
  • Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @​nelstrom
  • Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @​Wim-Valgaeren

DOMPurify 3.2.7

  • Added new attributes and elements to default allow-list, thanks @​elrion018
  • Added tagName parameter to custom element attributeNameCheck, thanks @​nelstrom
  • Added better check for animated href attributes, thanks @​llamakko
  • Updated and improved the bundled types, thanks @​ssi02014
  • Updated several tests to better align with new browser encoding behaviors
  • Improved the handling of potentially risky content inside CDATA elements, thanks @​securityMB & @​terjanq
  • Improved the regular expression for raw-text elements to cover textareas, thanks @​securityMB & @​terjanq

DOMPurify 3.2.6

DOMPurify 3.2.5

  • Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
  • Added ESM type imports in source, removes patch function, thanks @​donmccurdy
  • Added script to verify various TypeScript configurations, thanks @​reduckted
  • Added more modern browsers to the Karma launchers list
  • Added Node 23.x to tested runtimes, removed Node 17.x
  • Fixed the generation of source maps, thanks @​reduckted
  • Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
  • Fixed a few typos in the README file

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot

... (truncated)

Commits
  • 5e56114 Getting 3.x branch ready for 3.3.2 release (#1208)
  • e8c95f4 fix: Fixed the broken package-lock.json
  • 9636037 Update package-lock.json
  • 5cad4ce Getting 3.x branch ready for 3.3.2 releas (#1205)
  • 6fc446a Merge pull request #1175 from cure53/main
  • 3b3bf91 Merge branch 'main' of github.com:cure53/DOMPurify
  • 9863f41 chore: Preparing 3.3.1 release
  • b4e0295 chore: Preparing 3.3.0 release
  • 077746b build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1170)
  • 4de68bb build(deps): bump actions/checkout from 5 to 6 (#1171)
  • Additional commits viewable in compare view

Updates @excalidraw/excalidraw from 0.18.0 to 0.18.1

Release notes

Sourced from @​excalidraw/excalidraw's releases.

v0.18.1

Security patch release for @excalidraw/excalidraw@0.18.x, addressing upstream Mermaid XSS vulnerability CVE-2025-54881 / GHSA-7rqq-prvp-x9jh.

  • Backports Mermaid XSS mitigation by updating @excalidraw/mermaid-to-excalidraw to 2.2.2
  • Pins @types/d3-dispatch for compatibility with the 0.18.x TypeScript version
Commits

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main t...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 25, 2026
@dependabot
dependabot Bot requested a review from a team April 25, 2026 20:55
@vercel

vercel Bot commented Apr 25, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
plate Ready Ready Preview, Comment Apr 25, 2026 9:01pm

Request Review

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 25, 2026
@dependabot dependabot Bot mentioned this pull request Apr 25, 2026
Closed
@codesandbox

codesandbox Bot commented Apr 25, 2026

Copy link
Copy Markdown

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

@changeset-bot

changeset-bot Bot commented Apr 25, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 5d49d4c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@dosubot dosubot Bot added size:XS This PR changes 0-9 lines, ignoring generated files. security Pull requests that address a security vulnerability labels Apr 25, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-8fadd58b63 branch from f431074 to cc1490e Compare April 29, 2026 07:18
@dependabot
chore(deps): bump the npm_and_yarn group across 3 directories with 5 …
5d49d4c 
…updates

Bumps the npm_and_yarn group with 4 updates in the / directory: [@excalidraw/excalidraw](https://github.com/excalidraw/excalidraw), [lodash](https://github.com/lodash/lodash), [next](https://github.com/vercel/next.js) and [glob](https://github.com/isaacs/node-glob).
Bumps the npm_and_yarn group with 4 updates in the /apps/www directory: [@excalidraw/excalidraw](https://github.com/excalidraw/excalidraw), [lodash](https://github.com/lodash/lodash), [next](https://github.com/vercel/next.js) and [glob](https://github.com/isaacs/node-glob).
Bumps the npm_and_yarn group with 1 update in the /packages/excalidraw directory: [@excalidraw/excalidraw](https://github.com/excalidraw/excalidraw).


Updates `@excalidraw/excalidraw` from 0.18.0 to 0.18.1
- [Release notes](https://github.com/excalidraw/excalidraw/releases)
- [Commits](excalidraw/excalidraw@v0.18.0...v0.18.1)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `next` from 16.2.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.1...v16.2.6)

Updates `glob` from 11.0.2 to 12.0.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v11.0.2...v12.0.0)

Updates `dompurify` from 3.1.6 to 3.3.2
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.1.6...3.3.2)

Updates `@excalidraw/excalidraw` from 0.18.0 to 0.18.1
- [Release notes](https://github.com/excalidraw/excalidraw/releases)
- [Commits](excalidraw/excalidraw@v0.18.0...v0.18.1)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `next` from 16.2.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.1...v16.2.6)

Updates `glob` from 11.0.2 to 12.0.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v11.0.2...v12.0.0)

Updates `dompurify` from 3.1.6 to 3.3.2
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.1.6...3.3.2)

Updates `@excalidraw/excalidraw` from 0.18.0 to 0.18.1
- [Release notes](https://github.com/excalidraw/excalidraw/releases)
- [Commits](excalidraw/excalidraw@v0.18.0...v0.18.1)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `glob` from 11.0.2 to 12.0.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v11.0.2...v12.0.0)

Updates `next` from 16.2.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.1...v16.2.6)

Updates `dompurify` from 3.1.6 to 3.3.2
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.1.6...3.3.2)

Updates `@excalidraw/excalidraw` from 0.18.0 to 0.18.1
- [Release notes](https://github.com/excalidraw/excalidraw/releases)
- [Commits](excalidraw/excalidraw@v0.18.0...v0.18.1)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `next` from 16.2.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.1...v16.2.6)

Updates `glob` from 11.0.2 to 12.0.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v11.0.2...v12.0.0)

Updates `@excalidraw/excalidraw` from 0.18.0 to 0.18.1
- [Release notes](https://github.com/excalidraw/excalidraw/releases)
- [Commits](excalidraw/excalidraw@v0.18.0...v0.18.1)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `next` from 16.2.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.1...v16.2.6)

Updates `glob` from 11.0.2 to 12.0.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v11.0.2...v12.0.0)

Updates `@excalidraw/excalidraw` from 0.18.0 to 0.18.1
- [Release notes](https://github.com/excalidraw/excalidraw/releases)
- [Commits](excalidraw/excalidraw@v0.18.0...v0.18.1)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `glob` from 11.0.2 to 12.0.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v11.0.2...v12.0.0)

Updates `next` from 16.2.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.1...v16.2.6)

Updates `@excalidraw/excalidraw` from 0.18.0 to 0.18.1
- [Release notes](https://github.com/excalidraw/excalidraw/releases)
- [Commits](excalidraw/excalidraw@v0.18.0...v0.18.1)

Updates `@excalidraw/excalidraw` from 0.18.0 to 0.18.1
- [Release notes](https://github.com/excalidraw/excalidraw/releases)
- [Commits](excalidraw/excalidraw@v0.18.0...v0.18.1)

Updates `@excalidraw/excalidraw` from 0.18.0 to 0.18.1
- [Release notes](https://github.com/excalidraw/excalidraw/releases)
- [Commits](excalidraw/excalidraw@v0.18.0...v0.18.1)

---
updated-dependencies:
- dependency-name: "@excalidraw/excalidraw"
  dependency-version: 0.18.1
  dependency-type: direct:production
- dependency-name: "@excalidraw/excalidraw"
  dependency-version: 0.18.1
  dependency-type: direct:production
- dependency-name: "@excalidraw/excalidraw"
  dependency-version: 0.18.1
  dependency-type: direct:production
- dependency-name: "@excalidraw/excalidraw"
  dependency-version: 0.18.1
  dependency-type: direct:production
- dependency-name: "@excalidraw/excalidraw"
  dependency-version: 0.18.1
  dependency-type: direct:production
- dependency-name: "@excalidraw/excalidraw"
  dependency-version: 0.18.1
  dependency-type: direct:production
- dependency-name: "@excalidraw/excalidraw"
  dependency-version: 0.18.1
  dependency-type: direct:production
- dependency-name: "@excalidraw/excalidraw"
  dependency-version: 0.18.1
  dependency-type: direct:production
- dependency-name: "@excalidraw/excalidraw"
  dependency-version: 0.18.1
  dependency-type: direct:production
- dependency-name: dompurify
  dependency-version: 3.3.2
  dependency-type: indirect
- dependency-name: dompurify
  dependency-version: 3.3.2
  dependency-type: indirect
- dependency-name: dompurify
  dependency-version: 3.3.2
  dependency-type: indirect
- dependency-name: glob
  dependency-version: 12.0.0
  dependency-type: direct:development
- dependency-name: glob
  dependency-version: 12.0.0
  dependency-type: direct:development
- dependency-name: glob
  dependency-version: 12.0.0
  dependency-type: direct:development
- dependency-name: glob
  dependency-version: 12.0.0
  dependency-type: direct:development
- dependency-name: glob
  dependency-version: 12.0.0
  dependency-type: direct:development
- dependency-name: glob
  dependency-version: 12.0.0
  dependency-type: direct:development
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-8fadd58b63 branch from cc1490e to 5d49d4c Compare May 12, 2026 16:10
@zbeyens zbeyens closed this Jun 13, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 13, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-8fadd58b63 branch June 13, 2026 22:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code security Pull requests that address a security vulnerability size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zbeyens