Skip to content

chore(deps): bump the npm-minor-patch group across 1 directory with 11 updates - #996

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-9a36d442e5
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-9a36d442e5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown

Bumps the npm-minor-patch group with 11 updates in the / directory:

Package From To
@base-ui/react 1.8.0 1.9.0
@tanstack/react-virtual 3.14.13 3.14.15
@walletconnect/sign-client 2.25.0 2.26.0
lucide-react 1.52.0 1.55.0
next 16.3.8 16.4.0
@axe-core/playwright 4.10.2 4.13.0
@next/eslint-plugin-next 16.3.8 16.4.0
@playwright/test 1.63.0 1.64.0
postcss 8.5.28 8.5.29
prettier 3.9.9 3.9.10
shadcn 4.21.1 4.21.4

Updates @base-ui/react from 1.8.0 to 1.9.0

Release notes

Sourced from @​base-ui/react's releases.

v1.9.0

General changes

Accordion

  • Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @​cpruijsen
  • Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @​atomiks
  • Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Alert Dialog

  • Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @​michaldudak

Autocomplete

  • Fix autoHighlight for asynchronous results (#5818) by @​atomiks
  • Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
  • Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak

Checkbox

Collapsible

Combobox

Dialog

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.9.0

Oct 9, 2026

General changes

Accordion

  • Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @​cpruijsen
  • Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @​atomiks
  • Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Alert Dialog

  • Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @​michaldudak

Autocomplete

  • Fix autoHighlight for asynchronous results (#5818) by @​atomiks
  • Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
  • Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak

Checkbox

Collapsible

Combobox

  • Fix stale chip focus after returning to the input (#5879) by @​mdm317
  • Fix autoHighlight for asynchronous results (#5818) by @​atomiks
  • Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak
  • Fix label focus in Shadow DOM (#5871) by @​lyzno1
  • Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
  • Reset typeahead state when closing without moving focus (#5816) by @​mdm317
  • Accept readonly arrays for multiple values (#5710) by @​MonstraG

... (truncated)

Commits
  • ad7ecda [release] v1.9.0 (#5906)
  • 3296de3 [drawer] Avoid retaining unmounted drawers in DrawerProvider (#5921)
  • 69c33b4 [drawer] Fix deferred touch swipes leaving the popup (#5922)
  • 51b70db [menu] Strip internal filter components from public types (#5923)
  • 8d8b98c [menu] Ignore filter input edits while the menu animates out (#5911)
  • aeba3eb [combobox][menu][select] Revert highlightItem imperative action (#5910)
  • ec6bf32 [field][select][combobox][slider] Fall back to the owner document when lookin...
  • 1f112a5 [popups] Avoid re-rendering inactive triggers on open and close (#5865)
  • bc53db6 [fieldset] Await render in Legend disabled-state test (#5909)
  • 147092e [test] Strengthen tests, add test lint rules and share copied suites (#5892)
  • Additional commits viewable in compare view

Updates @tanstack/react-virtual from 3.14.13 to 3.14.15

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.15

Patch Changes

@​tanstack/react-virtual@​3.14.14

Patch Changes

  • #1301 ce57b78 - fix(react-virtual): position directDomUpdates rows that mount without the owner re-rendering

    Rows were only positioned by the owner's layout effect or the next onChange. A row mounted by a child that re-renders on its own (local state, context, a resolved Suspense boundary) skipped both when it was fixed-size, and stayed unpositioned until the range changed. Rows are now positioned as they register through measureElement, and containerRef positions the rows that mounted together with the container.

  • Updated dependencies [43675bc, 9df47a3, c644f10, 2a631f4]:

    • @​tanstack/virtual-core@​3.18.0
Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.15

Patch Changes

3.14.14

Patch Changes

  • #1301 ce57b78 - fix(react-virtual): position directDomUpdates rows that mount without the owner re-rendering

    Rows were only positioned by the owner's layout effect or the next onChange. A row mounted by a child that re-renders on its own (local state, context, a resolved Suspense boundary) skipped both when it was fixed-size, and stayed unpositioned until the range changed. Rows are now positioned as they register through measureElement, and containerRef positions the rows that mounted together with the container.

  • Updated dependencies [43675bc, 9df47a3, c644f10, 2a631f4]:

    • @​tanstack/virtual-core@​3.18.0
Commits
  • 84c1502 ci: Version Packages (#1303)
  • 92c697f fix(virtual-core): keep lanes aligned after changing lanes with measureElemen...
  • 259fc1a ci: Version Packages (#1299)
  • 2a631f4 fix(virtual-core): reconcile index scrolls after pending measurements (#1294)
  • ce57b78 fix(react-virtual): position directDomUpdates rows that mount without the own...
  • See full diff in compare view

Updates @walletconnect/sign-client from 2.25.0 to 2.26.0

Release notes

Sourced from @​walletconnect/sign-client's releases.

@​walletconnect/sign-client@​2.26.0

Patch Changes

Changelog

Sourced from @​walletconnect/sign-client's changelog.

2.26.0

Patch Changes

Commits

Updates lucide-react from 1.52.0 to 1.55.0

Release notes

Sourced from lucide-react's releases.

Version 1.55.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.54.0...1.55.0

Version 1.54.0

What's Changed

Full Changelog: lucide-icons/lucide@1.53.0...1.54.0

Version 1.53.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.52.0...1.53.0

Commits
  • 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
  • See full diff in compare view

Updates next from 16.3.8 to 16.4.0

Release notes

Sourced from next's releases.

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

  • Show compiler plugin warning in more situations: #75682
  • fix(scripts): correct typo in rm.mjs error message: #87015
  • docs: improve clarity and punctuation in README: #86096
  • Fix debug build paths Pages Router support entries: #93529
  • bundle-analyzer: record historical snapshots on each analyze run: #93520
  • fix: detect proxy.ts correctly with compound pageExtensions: #93246
  • feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

  • docs: correction to dynamicParams migration: #96624
  • docs: proxy event argument: #96435
  • docs: remove experimental note from runtime prefetching: #96615
  • Preserve per-segment prefetching after dynamic navigation: #96583
  • Rename static generation stream option to waitForAllReady: #96564
  • Remove obsolete static generation plumbing: #96563
  • [turbopack] Drop dead writes to exports: #96381
  • [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
  • [turbopack] Add test for sideEffects with optimizePackageImports: #96549
  • [turbopack] Strip leading BOM before parsing CSS: #96678
  • Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
  • docs: use relative doc links in instant-navigation error pages: #96672
  • Turbopack: terminate failed plugin worker threads: #96592
  • Fix HTML-limited bot matching in prerender bypass rules: #96584
  • [ci] Fix create_release_branch for new repo permissions: #96641
  • test: skip action module instance deploy test: #96629
  • docs: quote the dynamicParams build error in a blockquote: #96633
  • [react-sync] Open pull requests as the bot that authors the commits: #96682
  • [Bench] Fixes for pure Fizz bench: #96771
  • Derive foreground cache revalidation from the consumer: #96731
  • Fix race when navigating Back before hydration: #96252
  • docs: present each Skill as steps in the AI agents guide: #96751
  • Reuse completed cache entries for the rest of a request: #96727
  • Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
  • Remove WorkStore execution mode: #96674
  • Remove cache revalidation execution mode reads: #96670
  • Separate App Route render and prerender pipelines: #96662
  • Remove App Page execution mode reads: #96660
  • test: fix missing await in css-chunking test: #96725
  • docs (Skills): stop assuming app/ at the root and port 3000: #96696
  • Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808
  • Use Tailwind Turbopack loader in create-next-app: #96606
  • docs: instant navigation quick start with an adoption prompt: #96663
  • Separate App Page render and prerender pipelines: #96659
  • Move App Router execution intent to entrypoints: #96640

... (truncated)

Commits
  • e273d5b v16.4.0
  • fdf41d6 [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...
  • c3e76ad v16.4.0-canary.63
  • 47c6cc8 Document next analyze export in the package bundling guide (#99735)
  • 5b10604 Revert stabilization of forbidden() and unauthorized() (#99734)
  • f3a6f97 Preserve configured output directories during static export (#99507)
  • b22e5a2 Rename skill to next-bundle-optimizer and document its usage (#99731)
  • 74dc549 [turbo-tasks-backend] Clean up task state before publishing execution complet...
  • ccf8c15 v16.4.0-canary.62
  • b8c7c7f Improve static route error guidance (#99724)
  • Additional commits viewable in compare view

Updates @axe-core/playwright from 4.10.2 to 4.13.0

Release notes

Sourced from @​axe-core/playwright's releases.

Release 4.13.0

What's Changed

Full Changelog: dequelabs/axe-core-npm@v4.11.3...v4.13.0

v4.11.3

... (truncated)

Changelog

Sourced from @​axe-core/playwright's changelog.

4.13.0 (2026-08-10)

Features

4.12.1 (2026-06-22)

Features

4.11.3 (2026-04-29)

Bug Fixes

4.11.2 (2026-04-14)

Bug Fixes

4.11.1 (2026-01-09)

Bug Fixes

4.11.0 (2025-10-14)

Bug Fixes

Features

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​axe-core/playwright since your current version.


Updates @next/eslint-plugin-next from 16.3.8 to 16.4.0

Release notes

Sourced from @​next/eslint-plugin-next's releases.

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

  • Show compiler plugin warning in more situations: #75682
  • fix(scripts): correct typo in rm.mjs error message: #87015
  • docs: improve clarity and punctuation in README: #86096
  • Fix debug build paths Pages Router support entries: #93529
  • bundle-analyzer: record historical snapshots on each analyze run: #93520
  • fix: detect proxy.ts correctly with compound pageExtensions: #93246
  • feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

  • docs: correction to dynamicParams migration: #96624
  • docs: proxy event argument: #96435
  • docs: remove experimental note from runtime prefetching: #96615
  • Preserve per-segment prefetching after dynamic navigation: #96583
  • Rename static generation stream option to waitForAllReady: #96564
  • Remove obsolete static generation plumbing: #96563
  • [turbopack] Drop dead writes to exports: #96381
  • [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
  • [turbopack] Add test for sideEffects with optimizePackageImports: #96549
  • [turbopack] Strip leading BOM before parsing CSS: #96678
  • Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
  • docs: use relative doc links in instant-navigation error pages: #96672
  • Description has been truncated

…1 updates

Bumps the npm-minor-patch group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.8.0` | `1.9.0` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.13` | `3.14.15` |
| [@walletconnect/sign-client](https://github.com/WalletConnect/walletconnect-monorepo/tree/HEAD/packages/sign-client) | `2.25.0` | `2.26.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.52.0` | `1.55.0` |
| [next](https://github.com/vercel/next.js) | `16.3.8` | `16.4.0` |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.10.2` | `4.13.0` |
| [@next/eslint-plugin-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-plugin-next) | `16.3.8` | `16.4.0` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.28` | `8.5.29` |
| [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.21.1` | `4.21.4` |



Updates `@base-ui/react` from 1.8.0 to 1.9.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.9.0/packages/react)

Updates `@tanstack/react-virtual` from 3.14.13 to 3.14.15
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.15/packages/react-virtual)

Updates `@walletconnect/sign-client` from 2.25.0 to 2.26.0
- [Release notes](https://github.com/WalletConnect/walletconnect-monorepo/releases)
- [Changelog](https://github.com/WalletConnect/walletconnect-monorepo/blob/v2.0/packages/sign-client/CHANGELOG.md)
- [Commits](https://github.com/WalletConnect/walletconnect-monorepo/commits/@walletconnect/sign-client@2.26.0/packages/sign-client)

Updates `lucide-react` from 1.52.0 to 1.55.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.55.0/packages/lucide-react)

Updates `next` from 16.3.8 to 16.4.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.8...v16.4.0)

Updates `@axe-core/playwright` from 4.10.2 to 4.13.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core-npm@v4.10.2...v4.13.0)

Updates `@next/eslint-plugin-next` from 16.3.8 to 16.4.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.0/packages/eslint-plugin-next)

Updates `@playwright/test` from 1.63.0 to 1.64.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.0)

Updates `postcss` from 8.5.28 to 8.5.29
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.28...8.5.29)

Updates `prettier` from 3.9.9 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.9...3.9.10)

Updates `shadcn` from 4.21.1 to 4.21.4
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.21.4/packages/shadcn)

---
updated-dependencies:
- dependency-name: "@base-ui/react"
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@walletconnect/sign-client"
  dependency-version: 2.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: next
  dependency-version: 16.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@next/eslint-plugin-next"
  dependency-version: 16.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: postcss
  dependency-version: 8.5.29
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: shadcn
  dependency-version: 4.21.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

Copy link
Copy Markdown

🛡️ Frontend Security Scan

npm audit
# npm audit report

fflate  0.7.0 - 0.7.4
Severity: moderate
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives - https://github.com/advisories/GHSA-px8p-9vwx-vf98
fix available via `npm audit fix --force`
Will install @vercel/og@1.0.1, which is a breaking change
node_modules/fflate
  satori  >=0.33.0
  Depends on vulnerable versions of fflate
  node_modules/satori
    @vercel/og  >=1.0.2
    Depends on vulnerable versions of satori
    node_modules/@vercel/og

3 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force
# npm audit report

@vitest/mocker  2.1.0 - 4.1.10
Severity: moderate
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock - https://github.com/advisories/GHSA-82fw-gwwq-j7x9
fix available via `npm audit fix --force`
Will install storybook@10.6.2, which is a breaking change
node_modules/@vitest/mocker
  storybook  9.1.0-alpha.0 - 10.1.0-beta.6
  Depends on vulnerable versions of @vitest/mocker
  node_modules/storybook
    @storybook/addon-docs  <=0.0.0-pr-35259-sha-153697da || 9.1.0-alpha.0 - 9.2.0-alpha.3
    Depends on vulnerable versions of @storybook/csf-plugin
    Depends on vulnerable versions of @storybook/react-dom-shim
    Depends on vulnerable versions of storybook
    node_modules/@storybook/addon-docs
    @storybook/addon-links  9.1.0-alpha.0 - 9.2.0-alpha.3
    Depends on vulnerable versions of storybook
    node_modules/@storybook/addon-links
    @storybook/builder-webpack5  <=11.0.0-alpha.4
    Depends on vulnerable versions of @storybook/core-webpack
    Depends on vulnerable versions of fork-ts-checker-webpack-plugin
    Depends on vulnerable versions of storybook
    Depends on vulnerable versions of webpack-dev-middleware
    node_modules/@storybook/builder-webpack5
      @storybook/nextjs  <=11.0.0-alpha.4
      Depends on vulnerable versions of @storybook/builder-webpack5
      Depends on vulnerable versions of @storybook/preset-react-webpack
      Depends on vulnerable versions of @storybook/react
      Depends on vulnerable versions of node-polyfill-webpack-plugin
      Depends on vulnerable versions of storybook
      node_modules/@storybook/nextjs
    @storybook/core-webpack  9.1.0-alpha.0 - 9.2.0-alpha.3
    Depends on vulnerable versions of storybook
    node_modules/@storybook/core-webpack
    @storybook/csf-plugin  9.1.0-alpha.0 - 9.2.0-alpha.3
    Depends on vulnerable versions of storybook
    node_modules/@storybook/csf-plugin
    @storybook/preset-react-webpack  *
    Depends on vulnerable versions of @storybook/core-webpack
    Depends on vulnerable versions of @storybook/react-docgen-typescript-plugin
    Depends on vulnerable versions of storybook
    node_modules/@storybook/preset-react-webpack
    @storybook/react  9.1.0-alpha.0 - 9.2.0-alpha.3
    Depends on vulnerable versions of @storybook/react-dom-shim
    Depends on vulnerable versions of storybook
    node_modules/@storybook/react
    @storybook/react-dom-shim  9.1.0-alpha.0 - 9.2.0-alpha.3
    Depends on vulnerable versions of storybook
    node_modules/@storybook/react-dom-shim

braces  *
Severity: high
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns - https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
fix available via `npm audit fix --force`
Will install @storybook/nextjs@10.6.2, which is a breaking change
node_modules/braces
  chokidar  2.0.0 - 3.6.0
  Depends on vulnerable versions of braces
  node_modules/chokidar
    fork-ts-checker-webpack-plugin  0.4.7 - 4.0.0-beta.5 || 6.0.0-alpha.1 - 9.0.3
    Depends on vulnerable versions of chokidar
    node_modules/fork-ts-checker-webpack-plugin
  micromatch  >=0.2.0
  Depends on vulnerable versions of braces
  node_modules/micromatch
    @storybook/react-docgen-typescript-plugin  *
    Depends on vulnerable versions of micromatch
    node_modules/@storybook/react-docgen-typescript-plugin
    fast-glob  *
    Depends on vulnerable versions of micromatch
    node_modules/@shadcn/registry/node_modules/fast-glob
    node_modules/@ts-morph/common/node_modules/fast-glob
    node_modules/fast-glob
    node_modules/shadcn/node_modules/fast-glob
      @next/eslint-plugin-next  >=14.3.0-canary.0
      Depends on vulnerable versions of fast-glob
      node_modules/@next/eslint-plugin-next
      @shadcn/registry  <=0.0.0-rc-20261007105214 || >=0.1.0
      Depends on vulnerable versions of fast-glob
      node_modules/@shadcn/registry
        shadcn  <=0.0.0-rc-20261007105214 || >=2.0.0
        Depends on vulnerable versions of @shadcn/registry
        Depends on vulnerable versions of fast-glob
        Depends on vulnerable versions of ts-morph
        node_modules/shadcn
      @ts-morph/common  0.2.0 - 0.24.0 || 0.26.0 - 0.27.0
      Depends on vulnerable versions of fast-glob
      node_modules/@ts-morph/common
        ts-morph  6.0.1 - 23.0.0 || 25.0.0 - 26.0.0
        Depends on vulnerable versions of @ts-morph/common
        node_modules/ts-morph

elliptic  *
Elliptic Uses a Cryptographic Primitive with a Risky Implementation - https://github.com/advisories/GHSA-848j-6mx2-7j84
fix available via `npm audit fix --force`
Will install @storybook/nextjs@10.6.2, which is a breaking change
node_modules/elliptic
  browserify-sign  >=2.4.0
  Depends on vulnerable versions of elliptic
  node_modules/browserify-sign
    crypto-browserify  >=3.4.0
    Depends on vulnerable versions of browserify-sign
    Depends on vulnerable versions of create-ecdh
    node_modules/crypto-browserify
      node-polyfill-webpack-plugin  <=4.0.0
      Depends on vulnerable versions of crypto-browserify
      node_modules/node-polyfill-webpack-plugin
  create-ecdh  *
  Depends on vulnerable versions of elliptic
  node_modules/create-ecdh

fflate  0.7.0 - 0.7.4
Severity: moderate
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives - https://github.com/advisories/GHSA-px8p-9vwx-vf98
fix available via `npm audit fix --force`
Will install @vercel/og@1.0.1, which is a breaking change
node_modules/fflate
  satori  >=0.33.0
  Depends on vulnerable versions of fflate
  node_modules/satori
    @vercel/og  >=1.0.2
    Depends on vulnerable versions of satori
    node_modules/@vercel/og

webpack-dev-middleware  <7.4.5
Severity: high
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath - https://github.com/advisories/GHSA-g84c-rxfj-3j2c
fix available via `npm audit fix --force`
Will install @storybook/nextjs@10.6.2, which is a breaking change
node_modules/webpack-dev-middleware

31 vulnerabilities (5 low, 11 moderate, 15 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force
ESLint
> flowstar@0.1.0 lint
> eslint .


/home/runner/work/FlowStar/FlowStar/next.config.mjs
  15:5  warning  Unexpected console statement  no-console

/home/runner/work/FlowStar/FlowStar/scripts/check-secrets.mjs
  28:23  warning  Found readdirSync from package "fs" with non literal argument at index 0   security/detect-non-literal-fs-filename
  31:16  warning  Found statSync from package "fs" with non literal argument at index 0      security/detect-non-literal-fs-filename
  47:15  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  52:9   warning  Unexpected console statement                                               no-console
  60:3   warning  Unexpected console statement                                               no-console
  63:3   warning  Unexpected console statement                                               no-console

/home/runner/work/FlowStar/FlowStar/scripts/soroban-security-check.mjs
   14:23  warning  Found readdirSync from package "fs" with non literal argument at index 0   security/detect-non-literal-fs-filename
   16:9   warning  Found statSync from package "fs" with non literal argument at index 0      security/detect-non-literal-fs-filename
  135:15  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  142:7   warning  Unexpected console statement                                               no-console
  150:3   warning  Unexpected console statement                                               no-console
  154:3   warning  Unexpected console statement                                               no-console
  159:3   warning  Unexpected console statement                                               no-console

✖ 14 problems (0 errors, 14 warnings)
Hardcoded secrets check
✅ No hardcoded secrets found.

@github-actions

Copy link
Copy Markdown

🔐 Contract Security Scan

cargo audit
�[0m�[0m�[1m�[32m    Fetching�[0m advisory database from `https://github.com/RustSec/advisory-db.git`
�[0m�[0m�[1m�[32m      Loaded�[0m 1329 security advisories (from /home/runner/.cargo/advisory-db)
�[0m�[0m�[1m�[32m    Updating�[0m crates.io index
�[0m�[0m�[1m�[32m    Scanning�[0m Cargo.lock for vulnerabilities (193 crate dependencies)
�[0m�[0m�[1m�[33mCrate:    �[0m paste
�[0m�[0m�[1m�[33mVersion:  �[0m 1.0.15
�[0m�[0m�[1m�[33mWarning:  �[0m unmaintained
�[0m�[0m�[1m�[33mTitle:    �[0m paste - no longer maintained
�[0m�[0m�[1m�[33mDate:     �[0m 2024-10-07
�[0m�[0m�[1m�[33mID:       �[0m RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mURL:      �[0m https://rustsec.org/advisories/RUSTSEC-2024-0436

�[0m�[0m�[1m�[33mCrate:    �[0m spin
�[0m�[0m�[1m�[33mVersion:  �[0m 0.9.8
�[0m�[0m�[1m�[33mWarning:  �[0m yanked

�[0m�[0m�[1m�[33mwarning:�[0m 2 allowed warnings found
Soroban pattern check
❌ HIGH [SOROBAN-002] contracts/streaming/src/lib.rs:407 — pub fn pause performs writes but has no require_auth()
❌ HIGH [SOROBAN-002] contracts/streaming/src/lib.rs:423 — pub fn unpause performs writes but has no require_auth()

2 HIGH severity issue(s) found. Fix before merging.

This branch was successfully deployed

1 active deployment
staging — 7ae2355d Deployed Oct 15, 2026 by dependabot[bot] via deploy-staging #312
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants