Bump the npm_and_yarn group across 1 directory with 10 updates by dependabot[bot] · Pull Request #1559 · mdazfar2/HelpOps-Hub

dependabot · 2026-08-01T21:03:04Z

Bumps the npm_and_yarn group with 9 updates in the /website3.0 directory:

Package	From	To
axios	`1.7.4`	`1.18.0`
mongoose	`8.4.4`	`8.24.1`
next	`14.2.12`	`16.2.12`
next-auth	`4.24.7`	`4.24.15`
nodemailer	`6.9.14`	`9.0.1`
postcss	`8.4.39`	`8.5.18`
brace-expansion	`1.1.11`	`removed`
lodash	`4.17.21`	`4.18.1`
picomatch	`2.3.1`	`removed`

Updates axios from 1.7.4 to 1.18.0

Release notes

Sourced from axios's releases.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@drori12 (#10984)

@eyupcanakman (#10899)

@Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)

React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@drori12 (#10984)

@eyupcanakman (#10899)

@Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)

React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

... (truncated)

Commits

2d06f96 chore(release): prepare release 1.18.0 (#11003)
32fc489 fix: malformed http urls (#11000)
b40ce49 chore(deps-dev): bump the development_dependencies group with 10 updates (#10...
fe964f9 docs: mark proxy config as Node.js only (#10995)
5f229d2 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...
fae9d4e docs: clarify package update PR policy (#10992)
28ab2ce chore(deps-dev): bump the development_dependencies group with 2 updates (#10989)
a8e4f13 fix(core): keep default validateStatus when request passes undefined (#10899)
614f455 docs: publish v1.17.0 release notes (#10988)
6bb12c1 fix: custom auth headers not stripped on cross-origin redirects (#10892)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates mongoose from 8.4.4 to 8.24.1

Release notes

Sourced from mongoose's releases.

8.24.1

fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez

fix(document): avoid accessing special properties in Document.prototype.get()

fix(schema): avoid returning inherited properties from schema path lookups, including paths underneath maps of subdocuments

fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez

types: enable exactOptionalPropertyTypes in TypeScript tests #16287

8.24.0 / 2026-05-14

feat(aggregate): add pipelineForUnionWith() helper to allow reusing pipelines with $unionWith in TypeScript #16247 #16041 #16033

fix(connection): handle calling watch() on disconnected connection #16246 #16034

types: handle compiling with exactOptionalPropertyTypes #16286 #16273

8.23.1 / 2026-04-23

fix(model): support sort option in Model.bulkWrite() updateOne and replaceOne operations #16091 #16079

fix(setDefaultsOnInsert): check child filter paths before applying defaults (backport #16031 to 8.x) #16219 marklai1998

fix(schema): always pass raw string value to error validators, only trim to 30 chars for maxlength validator #16238 #16236 #15550 #15571

8.23.0 / 2026-02-09

feat(document): add flattenUUIDs option to toObject() and toJSON() (backport #15021 to 8.x)

8.22.1 / 2025-02-04

fix: handle other top-level query operators in sanitizeFilter

fix(document): when cloning a doc with subdocs, make sure the subdocs parent is the cloned doc #15904 #15901

types(models): support Mongoose query casting in AnyBulkWriteOperation filter property #15910

types: add toBSON() to documents #15927

8.22.0 / 2026-01-27

feat(model): allow passing strict option to hydrate() #15944 #15940

8.21.1

fix(clone): fix parent doc for map subdocuments and array subdocuments #15958 AbdelrahmanHafez

fix(document): when cloning a doc with subdocs, make sure the subdocs parent is the cloned doc #15904 #15901

fix: respect currentTime schema option in bulkWrite updates #15976 sderrow

types(models): support Mongoose query casting in AnyBulkWriteOperation filter property #15910

types: add toBSON() to documents #15927

8.21.0 / 2025-12-29

feat(document): add support for getAtomics() to allow custom container types to utilize atomics #15817

feat(document+model): pass options to pre('deleteOne') and update+options to pre('updateOne') hooks #15908 #15870

fix: add support for typescript style enums #15914 #15913 mjfwebb

8.20.4 / 2025-12-18

fix(model): ensure $isDeleted is set after calling doc.deleteOne() successfully #15898

... (truncated)

Changelog

Sourced from mongoose's changelog.

8.24.1 / 2026-06-22

fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez

fix(document): avoid accessing special properties in Document.prototype.get()

fix(schema): avoid returning inherited properties from schema path lookups, including paths underneath maps of subdocuments

fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez

types: enable exactOptionalPropertyTypes in TypeScript tests #16287

9.7.2 / 2026-06-22

fix(documentarray): reindex subdocs after array reordering and removal so subsequent nested changes save using the correct path #16282 AbdelrahmanHafez

fix(document): avoid accessing special properties in Document.prototype.get()

fix(schema): only return own properties in schematype lookups and disallow setting schema paths under special properties

docs: update homepage sponsor layout

9.7.1 / 2026-06-17

perf(document+model): improve save performance by avoiding unnecessary promise allocations and reducing path/default/dirty-state overhead #16331

fix(schema): include ObjectId regex pattern in toJSONSchema() output #16335 #16334 AbdelrahmanHafez

fix(populate): split populate into separate queries per document if the resulting $in filter has more than 50k elements to reduce risk of BSON size errors #16333 #5890

docs: add assistant sidebar with MongoDB Knowledge integration #16311 #16283

docs: update docs copy buttons, edit links, homepage alignment, and llms.txt generation #16326 #16327 #16329

9.7.0 / 2026-06-09

feat: add Node.js TracingChannel support for APM instrumentation #16275 #16105 logaretm

feat(model): add standard schema adapter for models #16308 #16280

fix(cursor): avoid waiting on buffering to run aggregation middleware #16289 #16284

fix(document): throw error if overwriting array selected with $slice #16313 #2432

fix(schema): remove validateSync() union fallback #16310 #16291 AbdelrahmanHafez

types: cast primitive types within unions when applying create casting #16320 #16316

docs: add llms.txt #16312 #15687

docs: rewrite documents docs #16298

docs(model): clarify some details on model.validate() casting #16308 #16280

docs(findOneAndUpdate): clarify update handling of undefined #16299

docs(model): fix link to be absolute #16321 hasezoey

9.6.3 / 2026-05-27

fix(clone): isolate cloned arrays from source documents #16281 AbdelrahmanHafez

fix(update): preserve user-provided $setOnInsert.createdAt with overwriteImmutable: true #16278 #15781 AbdelrahmanHafez

fix(schema): always pass raw string value to error validators, only trim to 30 chars for maxlength validator #16238 #16236 #15550 #15571

types: add $percentile to TypeScript aggregation expression types #16290 #16288

docs: update default pool sizes on createConnection() #16295 torbiak-samdesk

docs: improve code block copy button behavior and sidebar scrolling #16294 DraXx-Van

docs: remove broken link to deleted schema example #16297 kaseken

8.24.0 / 2026-05-14

feat(aggregate): add pipelineForUnionWith() helper to allow reusing pipelines with $unionWith in TypeScript #16247 #16041 #16033

... (truncated)

Commits

d5dd19e chore: release 8.24.1
0c346a4 fix(documentarray): reindex subdocs after reordering (#16282)
550b803 fix(document): additional defensive checks in Document.prototype.get()
953d085 fix(schema): only return own properties in schematype lookups
1e1679f types: use exactOptionalPropertyTypes in tests (#16287)
051b095 fix(clone): isolate cloned arrays from source documents (#16281)
89ca7f2 chore: release 8.24.0
6922aa4 Merge pull request #16286 from Automattic/vkarpov15/gh-16273-8x
4295eff types: handle compiling with exactOptionalPropertyTypes
f712fdb Merge pull request #16246 from Automattic/vkarpov15/gh-16034
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongoose since your current version.

Updates next from 14.2.12 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Backport/docs fixes 16.2 - July round by @icyJoseph in vercel/next.js#96031

[Backport] Fixes to support TypeScript 7 by @lukesandberg in vercel/next.js#95831

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Backport documentation fixes for v16.2 (#93804)

[backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)

[backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)

[backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)

[backport] Encode non-ASCII characters in cache tags at construction (#93918)

[backport] Fix server action forwarding loop with middleware rewrites (#93919)

[backport] Turbopack: switch from base40 to base38 hash encoding (#93932)

[ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)

... (truncated)

Commits

2234717 v16.2.12
957f5ed [Backport] Fixes to support TypeScript 7 (#95831)
b56eb16 Backport/docs fixes 16.2 - July round (#96031)
9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates next-auth from 4.24.7 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.

OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.

Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.

An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.

Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.

next-auth@4.24.14

Bugfixes

providers: add issuer to GitHub provider for RFC 9207 compliance (#13412)

GitHub now returns an iss parameter in OAuth callbacks. openid-client validates it unconditionally, which was breaking authentication for apps that didn't configure an issuer. This sets the default GitHub provider issuer to https://github.com/login/oauth.

Commits

d857eec chore(release): next-auth@4.24.15 [skip ci]
5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
fa85858 chore: update uuid to v14, remove deprecated types (#13422)
2a39465 Merge commit from fork
19d2feb Merge commit from fork
e9a892a chore(release): bump version [skip ci]
0497da4 fix(providers): add issuer to github (#13412)
1a70ee8 chore(release): bump version [skip ci]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Updates next-auth from 4.24.7 to 4.24.15

Release notes

Sourced from next-auth's releases.

next-auth@4.24.15

Security patch release for the 4.x line.

getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value.

OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.

Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph @ bypass.

An explicitly configured NEXTAUTH_URL now takes precedence over the auto-detected forwarded host in trusted-host mode.

Restores CommonJS compatibility by pinning uuid to ^11.1.1; the 14.x line is ESM-only and broke require() on Node versions below 20.19.

next-auth@4.24.14

Bugfixes

providers: add issuer to GitHub provider for RFC 9207 compliance (#13412)

GitHub now returns an iss parameter in OAuth callbacks. openid-client validates it unconditionally, which was breaking authentication for apps that didn't configure an issuer. This sets the default GitHub provider issuer to https://github.com/login/oauth.

Commits

d857eec chore(release): next-auth@4.24.15 [skip ci]
5bca239 fix(next-auth): harden getToken parsing and bind OAuth check cookies to provi...
db7e27d chore(deps): use uuid ^11.1.1 to keep CommonJS support (#13466)
32d874c fix(next-auth): repair red v4 CI (lint + pre-existing test drift) (#13447)
fa85858 chore: update uuid to v14, remove deprecated types (#13422)
2a39465 Merge commit from fork
19d2feb Merge commit from fork
e9a892a chore(release): bump version [skip ci]
0497da4 fix(providers): add issuer to github (#13412)
1a70ee8 chore(release): bump version [skip ci]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Updates nodemailer from 6.9.14 to 9.0.1

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

8.0.8 (2026-05-23)

Bug Fixes

... (truncated)

Commits

69cf625 chore(master): release 9.0.1 (#1828)
a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
4e58450 chore: update dev dependencies
541f5fd chore(master): release 9.0.0 (#1827)
0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
6a947ac fix!: validate TLS certificates by default when fetching remote content
e3b1bda chore(master): release 8.0.11 (#1826)
4358caf refactor: remove dead checks flagged by Code Quality analysis
cf5195c chore: harden workflow token permissions and update GitHub Actions
067aebe fix: parse Ethereal response props without polynomial regex backtracking
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nodemailer since your current version.

Updates postcss from 8.4.39 to 8.5.18

Release notes

Sourced from postcss's releases.

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

Description has been truncated

Bumps the npm_and_yarn group with 9 updates in the /website3.0 directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.7.4` | `1.18.0` | | [mongoose](https://github.com/Automattic/mongoose) | `8.4.4` | `8.24.1` | | [next](https://github.com/vercel/next.js) | `14.2.12` | `16.2.12` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.7` | `4.24.15` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.9.14` | `9.0.1` | | [postcss](https://github.com/postcss/postcss) | `8.4.39` | `8.5.18` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `removed` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `removed` | Updates `axios` from 1.7.4 to 1.18.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.4...v1.18.0) Updates `mongoose` from 8.4.4 to 8.24.1 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@8.4.4...8.24.1) Updates `next` from 14.2.12 to 16.2.12 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v14.2.12...v16.2.12) Updates `next-auth` from 4.24.7 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.7...next-auth@4.24.15) Updates `next-auth` from 4.24.7 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.7...next-auth@4.24.15) Updates `nodemailer` from 6.9.14 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.14...v9.0.1) Updates `postcss` from 8.4.39 to 8.5.18 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.39...8.5.18) Removes `brace-expansion` Updates `follow-redirects` from 1.15.6 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Removes `picomatch` --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mongoose dependency-version: 8.24.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.12 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.18 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-08-01T21:03:07Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
helpops-hub2	Error		Aug 1, 2026 9:03pm

github-actions

Thank you, dependabot[bot], for creating this pull request and contributing to HelpOps-Hub! 💗

The maintainers will review this Pull Request and provide feedback as soon as possible! 😇

We appreciate your patience and contribution, Keep up the great work! 😀

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 1, 2026

vercel Bot had a problem deploying to Preview August 1, 2026 21:03 Failure

github-actions Bot reviewed Aug 1, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 10 updates - #1559

Bump the npm_and_yarn group across 1 directory with 10 updates#1559
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/website3.0/npm_and_yarn-7c75028fc5

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

vercel Bot commented Aug 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

v1.18.0 — June 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.17.0 — June 1, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

v1.18.0 — June 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.17.0 — June 1, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

8.24.1

8.24.0 / 2026-05-14

8.23.1 / 2026-04-23

8.23.0 / 2026-02-09

8.22.1 / 2025-02-04

8.22.0 / 2026-01-27

8.21.1

8.21.0 / 2025-12-29

8.20.4 / 2025-12-18

8.24.1 / 2026-06-22

9.7.2 / 2026-06-22

9.7.1 / 2026-06-17

9.7.0 / 2026-06-09

9.6.3 / 2026-05-27

8.24.0 / 2026-05-14

v16.2.12

What's Changed

v16.2.11

v16.2.10

v16.2.9

v16.2.8

v16.2.7

Core Changes

next-auth@4.24.15

next-auth@4.24.14

Bugfixes

next-auth@4.24.15

next-auth@4.24.14

Bugfixes

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

9.0.1 (2026-06-17)

Bug Fixes

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

8.0.11 (2026-06-10)

Bug Fixes

8.0.10 (2026-05-29)

Bug Fixes

8.0.9 (2026-05-26)

Bug Fixes

8.0.8 (2026-05-23)

Bug Fixes

8.5.18

vercel Bot commented Aug 1, 2026 •

edited

Loading