Skip to content

chore(deps): update app dependencies#1765

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/app-dependencies
Open

chore(deps): update app dependencies#1765
renovate[bot] wants to merge 1 commit intomainfrom
renovate/app-dependencies

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Sep 9, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@next/bundle-analyzer (source) 15.5.215.5.15 age confidence
@remix-run/dev (source) 2.17.02.17.4 age confidence
@remix-run/eslint-config (source) 2.17.02.17.4 age confidence
@remix-run/react (source) 2.17.32.17.4 age confidence
@remix-run/serve (source) 2.17.02.17.4 age confidence
@sanity/client (source) ^7.11.0^7.22.0 age confidence
@sanity/pkg-utils (source) 8.1.68.1.29 age confidence
@sanity/ui (source) 3.0.143.1.14 age confidence
@sanity/vercel-protection-bypass (source) 2.0.12.1.1 age confidence
@sanity/vision (source) 4.6.14.22.0 age confidence
@sanity/visual-editing (source) 3.0.43.2.4 age confidence
@types/node (source) ^24.3.1^24.12.2 age confidence
@types/react (source) ^19.1.12^19.2.14 age confidence
@types/react-dom (source) ^19.1.9^19.2.3 age confidence
@typescript-eslint/eslint-plugin (source) ^8.43.0^8.59.0 age confidence
@typescript-eslint/parser (source) ^8.43.0^8.59.0 age confidence
esbuild ^0.25.9^0.28.0 age confidence
eslint-config-next (source) 15.5.215.5.15 age confidence
eslint-plugin-prettier ^5.5.4^5.5.5 age confidence
groq (source) 4.6.14.22.0 age confidence
next-sanity (source) 10.1.110.1.4 age confidence
react (source) 19.1.119.2.5 age confidence
react-dom (source) 19.1.119.2.5 age confidence
sanity (source) 4.6.14.22.0 age confidence
sanity-plugin-iframe-pane (source) 4.0.04.0.1 age confidence
styled-components (source) 6.1.196.4.1 age confidence
typescript (source) 5.9.25.9.3 age confidence
typescript (source) ^5.9.2^5.9.3 age confidence

Release Notes

vercel/next.js (@​next/bundle-analyzer)

v15.5.15

Compare Source

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#​91660)
  • Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#​90304)
Credits

Huge thanks to @​styfle and @​lllomh for helping!

v15.5.13

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)
Credits

Huge thanks to @​ztanner for helping!

v15.5.12

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

  • fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

v15.5.11

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • Tracing: Fix memory leak in span map (#​85529)
  • fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
  • Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
  • Turbopack: support pattern into exports field (#​82757)
  • NFT tracing fixes (#​84155 and #​85323)
  • Turbopack: validate CSS without computing all paths (#​83810)
  • feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)
Credits

Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!

v15.5.10

Compare Source

Please refer the following changelogs for more information about this security release:

v15.5.9

Compare Source

Please see the Next.js Security Update for information about this security patch.

v15.5.8

Compare Source

v15.5.7

Compare Source

Please see CVE-2025-66478 for additional details about this release.

v15.5.6

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • Turbopack: don't define process.cwd() in node_modules #​83452
Credits

Huge thanks to @​mischnic for helping!

v15.5.5

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • Split code-frame into separate compiled package (#​84238)
  • Add deprecation warning to Runtime config (#​84650)
  • fix: unstable_cache should perform blocking revalidation during ISR revalidation (#​84716)
  • feat: experimental.middlewareClientMaxBodySize body cloning limit (#​84722)
  • fix: missing next/link types with typedRoutes (#​84779)
Misc Changes
  • docs: early October improvements and fixes (#​84334)
Credits

Huge thanks to @​devjiwonchoi, @​ztanner, and @​icyJoseph for helping!

v15.5.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • fix: ensure onRequestError is invoked when otel enabled (#​83343)
  • fix: devtools initial position should be from next config (#​83571)
  • [devtool] fix overlay styles are missing (#​83721)
  • Turbopack: don't match dynamic pattern for node_modules packages (#​83176)
  • Turbopack: don't treat metadata routes as RSC (#​82911)
  • [turbopack] Improve handling of symlink resolution errors in track_glob and read_glob (#​83357)
  • Turbopack: throw large static metadata error earlier (#​82939)
  • fix: error overlay not closing when backdrop clicked (#​83981)
  • Turbopack: flush Node.js worker IPC on error (#​84077)
Misc Changes
  • [CNA] use linter preference (#​83194)
  • CI: use KV for test timing data (#​83745)
  • docs: september improvements and fixes (#​83997)
Credits

Huge thanks to @​yiminghe, @​huozhi, @​devjiwonchoi, @​mischnic, @​lukesandberg, @​ztanner, @​icyJoseph, @​leerob, @​fufuShih, @​dwrth, @​aymericzip, @​obendev, @​molebox, @​OoMNoO, @​pontasan, @​styfle, @​HondaYt, @​ryuapp, @​lpalmes, and @​ijjk for helping!

v15.5.3

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • fix: validation return types of pages API routes (#​83069)
  • fix: relative paths in dev in validator.ts (#​83073)
  • fix: remove satisfies keyword from type validation to preserve old TS compatibility (#​83071)
Credits

Huge thanks to @​bgub for helping!

sanity-io/client (@​sanity/client)

v7.22.0

Compare Source

Features

v7.21.0

Compare Source

Features
  • live: add waitFor option to defer events until Sanity Function processing (#​1209) (3251113)
  • support intercepting requests via internal requestHandler config (#​1208) (4d794f6)
Bug Fixes

v7.20.0

Compare Source

Features

v7.19.0

Compare Source

Features

v7.18.0

Compare Source

Features
  • types: add VideoRenditionInfo types with typed resolution (#​1186) (6d9e85e)
Bug Fixes

v7.17.0

Compare Source

Features
  • projects: add onlyExplicitMembership option to projects.list() (#​1200) (96619c5)

v7.16.0

Compare Source

Features
  • dataset: added embeddings configuration options (d4cca13)

v7.15.0

Compare Source

Features

v7.14.1

Compare Source

Bug Fixes

v7.14.0

Compare Source

Features
  • media-library: add thumbhash support to AssetMetadataType (223fdbc)
  • media-library: improve Media Library API support (#​1171) (df82583)
Bug Fixes
  • types: thumbhash -> thumbHash (223fdbc)

v7.13.2

Compare Source

Bug Fixes

v7.13.1

Compare Source

Bug Fixes

v7.13.0

Compare Source

Features

v7.12.1

Compare Source

Bug Fixes

v7.12.0

Compare Source

Features

v7.11.2

Compare Source

Bug Fixes

v7.11.1

Compare Source

Bug Fixes
  • move extra options check after first connect attempt (#​1136) (fa8a040)
sanity-io/pkg-utils (@​sanity/pkg-utils)

v8.1.29

Compare Source

Bug Fixes

v8.1.28

Compare Source

Bug Fixes

v8.1.27

Compare Source

Bug Fixes

v8.1.26

Compare Source

Bug Fixes

v8.1.25

Compare Source

Bug Fixes

v8.1.24

Compare Source

Bug Fixes

v8.1.23

Compare Source

Bug Fixes

v8.1.22

Compare Source

Bug Fixes

v8.1.21

Compare Source

Bug Fixes

v8.1.20

Compare Source

Bug Fixes
  • add minimumReleaseAge 3 days policy (f71fa0c)

v8.1.19

Compare Source

Bug Fixes

v8.1.17

Compare Source

Bug Fixes

v8.1.16

Compare Source

Bug Fixes

v8.1.15

Compare Source

Bug Fixes

v8.1.14

Compare Source

Bug Fixes

v8.1.13

Compare Source

Bug Fixes

v8.1.12

Compare Source

Bug Fixes

v8.1.11

Compare Source

Bug Fixes

v8.1.10

Compare Source

Bug Fixes

v8.1.9

Compare Source

Bug Fixes

v8.1.8

Compare Source

Bug Fixes
  • deps: Update dependency rolldown-plugin-dts to v0.16.2 (#​1920) (b056cf8)

v8.1.7

Compare Source

Bug Fixes
sanity-io/ui (@​sanity/ui)

v3.1.14

Compare Source

Bug Fixes

v3.1.13

Compare Source

Bug Fixes

v3.1.12

Compare Source

Bug Fixes

v3.1.11

Compare Source

Bug Fixes
  • deps: replace framer-motion with motion/react (cc49ab6)

v3.1.10

Compare Source

Bug Fixes

v3.1.9

Compare Source

Bug Fixes
  • deps: update dependency framer-motion to ^12.23.24 (main) (#​2128) (4ac4680)

v3.1.8

Compare Source

Bug Fixes
  • deps: update dependency framer-motion to ^12.23.22 (main) (#​2109) (2d605cf)

v3.1.7

Compare Source

Bug Fixes
  • deps: update dependency framer-motion to ^12.23.21 (main) (#​2101) (0ee41d2)

v3.1.6

Compare Source

Bug Fixes
  • deps: update dependency framer-motion to ^12.23.19 (main) (#​2097) (43a8ee2)

[v3.1.5](https://redirect.github.com/sani


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 3am on the first day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate using a curated preset maintained by Sanity. View repository job log here

@renovate renovate Bot requested a review from a team as a code owner September 9, 2025 13:56
@vercel
Copy link
Copy Markdown

vercel Bot commented Sep 9, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
preview-kit-next-app-router Error Error Apr 24, 2026 5:41pm
preview-kit-next-pages-router Ready Ready Preview, Comment Apr 24, 2026 5:41pm
preview-kit-remix Ready Ready Preview, Comment Apr 24, 2026 5:41pm
preview-kit-test-studio Ready Ready Preview, Comment Apr 24, 2026 5:41pm

Request Review

@renovate renovate Bot added the 🤖 bot label Sep 9, 2025
@renovate renovate Bot force-pushed the renovate/app-dependencies branch from 571d5c8 to 2b5cc46 Compare September 9, 2025 19:11
@renovate renovate Bot force-pushed the renovate/app-dependencies branch from 2b5cc46 to 2742571 Compare September 10, 2025 15:43
@renovate renovate Bot force-pushed the renovate/app-dependencies branch from 2742571 to 41a84c8 Compare September 10, 2025 19:12
@renovate renovate Bot force-pushed the renovate/app-dependencies branch from 41a84c8 to 1eb554b Compare September 10, 2025 23:04
@renovate renovate Bot force-pushed the renovate/app-dependencies branch from 5eb522f to 178032a Compare September 16, 2025 16:09
@renovate renovate Bot force-pushed the renovate/app-dependencies branch from 178032a to 96fb273 Compare September 16, 2025 19:39
@renovate renovate Bot force-pushed the renovate/app-dependencies branch from 96fb273 to 2ac5ab2 Compare September 16, 2025 23:06
@renovate renovate Bot force-pushed the renovate/app-dependencies branch from 2ac5ab2 to 0b7365c Compare September 17, 2025 19:31
@renovate renovate Bot force-pushed the renovate/app-dependencies branch from 0b7365c to b8e8e94 Compare September 17, 2025 23:13
@renovate renovate Bot force-pushed the renovate/app-dependencies branch from b8e8e94 to f304646 Compare September 18, 2025 03:35
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Oct 1, 2025

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm markdown-it is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: pnpm-lock.yamlnpm/sanity@4.22.0npm/markdown-it@14.1.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/markdown-it@14.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm typescript

License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt)

From: apps/next-app-router/package.jsonnpm/typescript@5.9.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@5.9.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 16, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants