build(deps): Bump the npm_and_yarn group across 7 directories with 2 updates by dependabot[bot] · Pull Request #8714 · thirdweb-dev/js

dependabot · 2026-03-17T21:14:56Z

Bumps the npm_and_yarn group with 2 updates in the /apps/dashboard directory: next and storybook.
Bumps the npm_and_yarn group with 2 updates in the /apps/nebula directory: next and storybook.
Bumps the npm_and_yarn group with 1 update in the /apps/playground-web directory: next.
Bumps the npm_and_yarn group with 1 update in the /apps/portal directory: next.
Bumps the npm_and_yarn group with 1 update in the /apps/wallet-ui directory: next.
Bumps the npm_and_yarn group with 1 update in the /packages/thirdweb directory: storybook.
Bumps the npm_and_yarn group with 2 updates in the /packages/ui directory: next and storybook.

Updates next from 15.3.8 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)

Apply server actions transform to node_modules in route handlers (#89380)

ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)

Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)

Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Upgrade to swc 54 (#88207)

implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)

tweak LRU sentinel key (#89123)

Credits

Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.0.11

Please see this changelog for more information about this security patch.

v15.6.0-canary.61

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

... (truncated)

Commits

bdf3e35 v16.1.7
dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
c68d62d Backport documentation fixes for 16.1.x (#90655)
5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
c95e357 Backport/docs fixes 16.1.x (#90125)
cba6144 [backport] Apply server actions transform to node_modules in route handlers...
3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
Additional commits viewable in compare view

Updates storybook from 9.0.15 to 9.1.19

Release notes

Sourced from storybook's releases.

v9.1.19

9.1.19

Harden websocket connection

v9.1.18

9.1.18

No-op release. No changes.

v9.1.17

9.1.17

Core: Fix .env-file parsing, thanks @jreinhold!

Changelog

Sourced from storybook's changelog.

9.1.19

Harden websocket connection

9.1.18

No-op release. No changes.

9.1.16

CLI: Fix Nextjs project creation in empty directories - #32828, thanks @yannbf!

Core: Add experimental_devServer preset - #32862, thanks @yannbf!

Telemetry: Fix preview-first-load event - #32859, thanks @shilman!

9.1.15

Core: Add preview-first-load telemetry - #32770, thanks @shilman!

Dependencies: Update vite-plugin-storybook-nextjs - #32821, thanks @ndelangen!

9.1.14

NextJS: Add NextJS 16 support - #32791, thanks @yannbf and @ndelangen!

Addon-Vitest: Support Vitest 4 - #32819, thanks @yannbf and @ndelangen!

CSF: Fix play-fn tag for methods - #32695, thanks @shilman!

9.1.13

Nextjs: Fix config access for Vite - #32759, thanks @valentinpalkovic!

9.1.12

Maintenance: Hotfix for missing nextjs dts files, thanks @ndelangen!

9.1.11

Automigration: Improve the viewport/backgrounds automigration - #32619, thanks @valentinpalkovic!

Mocking: Fix sb.mock usage in Storybook's deployed in subpaths - #32678, thanks @valentinpalkovic!

NextJS-Vite: Automatically fix bad PostCSS configuration - #32691, thanks @ndelangen!

React Native Web: Fix REACT_NATIVE_AND_RNW should detect vite builder - #32718, thanks @dannyhw!

Telemetry: Add metadata for react routers - #32615, thanks @shilman!

9.1.10

Automigrations: Add automigration for viewport and backgrounds - #31614, thanks @valentinpalkovic!

Telemetry: Log userAgent in onboarding - #32566, thanks @shilman!

9.1.9

Angular: Enable experimental zoneless detection on Angular v21 - #32580, thanks @yannbf!

Svelte: Ignore inherited HTMLAttributes docgen when using utility types - #32173, thanks @steciuk!

... (truncated)

Commits

20887f1 Bump version from "9.1.18" to "9.1.19" [skip ci]
66b2d8e Fix test
31f16c4 fix linting
62dd25b Core: Require token for websocket connections
bbe61e3 Bump version from "9.1.17" to "9.1.18" [skip ci]
d0d5a3d Bump version from 9.1.16 to 9.1.17 MANUALLY
a06c257 filter env vars from .env files
a54a04c Bump version from "9.1.15" to "9.1.16" [skip ci]
ebd7ff5 Merge pull request #32859 from storybookjs/shilman/first-load-new-user
da2da6e Merge pull request #32862 from storybookjs/yann/patch-dev-server-preset
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for storybook since your current version.

Updates next from 15.3.8 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)

Apply server actions transform to node_modules in route handlers (#89380)

ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)

Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)

Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Upgrade to swc 54 (#88207)

implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)

tweak LRU sentinel key (#89123)

Credits

Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.0.11

Please see this changelog for more information about this security patch.

v15.6.0-canary.61

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

... (truncated)

Commits

bdf3e35 v16.1.7
dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
c68d62d Backport documentation fixes for 16.1.x (#90655)
5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
c95e357 Backport/docs fixes 16.1.x (#90125)
cba6144 [backport] Apply server actions transform to node_modules in route handlers...
3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
Additional commits viewable in compare view

Updates storybook from 9.0.15 to 9.1.19

Release notes

Sourced from storybook's releases.

v9.1.19

9.1.19

Harden websocket connection

v9.1.18

9.1.18

No-op release. No changes.

v9.1.17

9.1.17

Core: Fix .env-file parsing, thanks @jreinhold!

Changelog

Sourced from storybook's changelog.

9.1.19

Harden websocket connection

9.1.18

No-op release. No changes.

9.1.16

CLI: Fix Nextjs project creation in empty directories - #32828, thanks @yannbf!

Core: Add experimental_devServer preset - #32862, thanks @yannbf!

Telemetry: Fix preview-first-load event - #32859, thanks @shilman!

9.1.15

Core: Add preview-first-load telemetry - #32770, thanks @shilman!

Dependencies: Update vite-plugin-storybook-nextjs - #32821, thanks @ndelangen!

9.1.14

NextJS: Add NextJS 16 support - #32791, thanks @yannbf and @ndelangen!

Addon-Vitest: Support Vitest 4 - #32819, thanks @yannbf and @ndelangen!

CSF: Fix play-fn tag for methods - #32695, thanks @shilman!

9.1.13

Nextjs: Fix config access for Vite - #32759, thanks @valentinpalkovic!

9.1.12

Maintenance: Hotfix for missing nextjs dts files, thanks @ndelangen!

9.1.11

Automigration: Improve the viewport/backgrounds automigration - #32619, thanks @valentinpalkovic!

Mocking: Fix sb.mock usage in Storybook's deployed in subpaths - #32678, thanks @valentinpalkovic!

NextJS-Vite: Automatically fix bad PostCSS configuration - #32691, thanks @ndelangen!

React Native Web: Fix REACT_NATIVE_AND_RNW should detect vite builder - #32718, thanks @dannyhw!

Telemetry: Add metadata for react routers - #32615, thanks @shilman!

9.1.10

Automigrations: Add automigration for viewport and backgrounds - #31614, thanks @valentinpalkovic!

Telemetry: Log userAgent in onboarding - #32566, thanks @shilman!

9.1.9

Angular: Enable experimental zoneless detection on Angular v21 - #32580, thanks @yannbf!

Svelte: Ignore inherited HTMLAttributes docgen when using utility types - #32173, thanks @steciuk!

... (truncated)

Commits

20887f1 Bump version from "9.1.18" to "9.1.19" [skip ci]
66b2d8e Fix test
31f16c4 fix linting
62dd25b Core: Require token for websocket connections
bbe61e3 Bump version from "9.1.17" to "9.1.18" [skip ci]
d0d5a3d Bump version from 9.1.16 to 9.1.17 MANUALLY
a06c257 filter env vars from .env files
a54a04c Bump version from "9.1.15" to "9.1.16" [skip ci]
ebd7ff5 Merge pull request #32859 from storybookjs/shilman/first-load-new-user
da2da6e Merge pull request #32862 from storybookjs/yann/patch-dev-server-preset
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for storybook since your current version.

Updates next from 15.3.8 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)

Apply server actions transform to node_modules in route handlers (#89380)

ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)

Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)

Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Upgrade to swc 54 (#88207)

implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)

tweak LRU sentinel key (#89123)

Credits

Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.0.11

Please see this changelog for more information about this security patch.

v15.6.0-canary.61

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

... (truncated)

Commits

bdf3e35 v16.1.7
dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
c68d62d Backport documentation fixes for 16.1.x (#90655)
5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
c95e357 Backport/docs fixes 16.1.x (#90125)
cba6144 [backport] Apply server actions transform to node_modules in route handlers...
3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
Additional commits viewable in compare view

Updates next from 15.3.8 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)

Apply server actions transform to node_modules in route handlers (#89380)

ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)

Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)

Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Upgrade to swc 54 (#88207)

implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)

tweak LRU sentinel key (#89123)

Credits

Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.0.11

Please see this changelog for more information about this security patch.

v15.6.0-canary.61

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

... (truncated)

Commits

bdf3e35 v16.1.7
dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
c68d62d Backport documentation fixes for 16.1.x (#90655)
5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
c95e357 Backport/docs fixes 16.1.x (#90125)
cba6144 [backport] Apply server actions transform to node_modules in route handlers...
3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
Additional commits viewable in compare view

Updates next from 15.3.8 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)

Apply server actions transform to node_modules in route handlers (#89380)

ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)

Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)

Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Upgrade to swc 54 (#88207)

implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)

tweak LRU sentinel key (#89123)

Credits

Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.0.11

Please see this changelog for more information about this security patch.

v15.6.0-canary.61

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

... (truncated)

Commits

bdf3e35 v16.1.7
dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
c68d62d Backport documentation fixes for 16.1.x (#90655)
5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
c95e357 Backport/docs fixes 16.1.x (#90125)
cba6144 [backport] Apply server actions transform to node_modules in route handlers...
3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
Additional commits viewable in compare view

Updates storybook from 9.0.15 to 9.1.19

Release notes

Sourced from storybook's releases.

v9.1.19

9.1.19

Harden websocket connection

v9.1.18

9.1.18

No-op release. No changes.

v9.1.17

9.1.17

Core: Fix .env-file parsing, thanks @jreinhold!

Changelog

Sourced from storybook's changelog.

9.1.19

Harden websocket connection

9.1.18

No-op release. No changes.

9.1.16

CLI: Fix Nextjs project creation in empty directories - #32828, thanks @yannbf!

Core: Add experimental_devServer preset - #32862, thanks @yannbf!

Telemetry: Fix preview-first-load event - #32859, thanks @shilman!

9.1.15

Core: Add preview-first-load telemetry - #32770, thanks @shilman!

Dependencies: Update vite-plugin-storybook-nextjs - #32821, thanks @ndelangen!

9.1.14

NextJS: Add NextJS 16 support - #32791, thanks @yannbf and @ndelangen!

Addon-Vitest: Support Vitest 4 - #32819, thanks @yannbf and @ndelangen!

CSF: Fix play-fn tag for methods - #32695, thanks @shilman!

9.1.13

Nextjs: Fix config access for Vite - #32759, thanks @valentinpalkovic!

9.1.12

Maintenance: Hotfix for missing nextjs dts files, thanks @ndelangen!

9.1.11

Automigration: Improve the viewport/backgrounds automigration - #32619, thanks @valentinpalkovic!

Mocking: Fix sb.mock usage in Storybook's deployed in subpaths - #32678, thanks @valentinpalkovic!

NextJS-Vite: Automatically fix bad PostCSS configuration - #32691, thanks @ndelangen!

React Native Web: Fix REACT_NATIVE_AND_RNW should detect vite builder - #32718, thanks @dannyhw!

Telemetry: Add metadata for react routers - #32615, thanks @shilman!

9.1.10

Automigrations: Add automigration for viewport and backgrounds - #31614, thanks @valentinpalkovic!

Telemetry: Log userAgent in onboarding - #32566, thanks @shilman!

9.1.9

Angular: Enable experimental zoneless detection on Angular v21 - #32580, thanks @yannbf!

Svelte: Ignore inherited HTMLAttributes docgen when using utility types - #32173, thanks @steciuk!

... (truncated)

Commits

20887f1 Bump version from "9.1.18" to "9.1.19" [skip ci]
66b2d8e Fix test
31f16c4 fix linting
62dd25b Core: Require token for websocket connections
bbe61e3 Bump version from "9.1.17" to "9.1.18" [skip ci]
d0d5a3d Bump version from 9.1.16 to 9.1.17 MANUALLY
a06c257 filter env vars from .env files
a54a04c Bump version from "9.1.15" to "9.1.16" [skip ci]
ebd7ff5 Merge pull request #32859 from storybookjs/shilman/first-load-new-user
da2da6e Merge pull request #32862 from storybookjs/yann/patch-dev-server-preset
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for storybook since your current version.

Updates next from 15.3.8 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)

Apply server actions transform to node_modules in route handlers (#89380)

ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)

Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)

Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Upgrade to swc 54 (#88207)

implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)

tweak LRU sentinel key (#89123)

Credits

Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.0.11

Please see this changelog for more information about this security patch.

v15.6.0-canary.61

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

... (truncated)

Commits

bdf3e35 v16.1.7
dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
c68d62d Backport documentation fixes for 16.1.x (#90655)
5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
c95e357 Backport/docs fixes 16.1.x (#90125)
cba6144 [backport] Apply server actions transform to node_modules in route handlers...
3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
Additional commits viewable in compare view

Updates storybook from 9.0.15 to 9.1.19

Release notes

Sourced from storybook's releases.

v9.1.19

9.1...
Description has been truncated

PR-Codex overview

This PR primarily focuses on updating the version of the next package and the storybook package across multiple projects.

Detailed summary

Updated next from 15.3.8 to 16.1.7 in:

apps/wallet-ui/package.json

apps/portal/package.json

apps/playground-web/package.json

apps/nebula/package.json

apps/dashboard/package.json

packages/ui/package.json

Updated storybook from 9.0.15 to 9.1.19 in:

packages/thirdweb/package.json

apps/nebula/package.json

apps/dashboard/package.json

packages/ui/package.json

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

…updates Bumps the npm_and_yarn group with 2 updates in the /apps/dashboard directory: [next](https://github.com/vercel/next.js) and [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core). Bumps the npm_and_yarn group with 2 updates in the /apps/nebula directory: [next](https://github.com/vercel/next.js) and [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core). Bumps the npm_and_yarn group with 1 update in the /apps/playground-web directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /apps/portal directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /apps/wallet-ui directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/thirdweb directory: [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core). Bumps the npm_and_yarn group with 2 updates in the /packages/ui directory: [next](https://github.com/vercel/next.js) and [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core). Updates `next` from 15.3.8 to 16.1.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.3.8...v16.1.7) Updates `storybook` from 9.0.15 to 9.1.19 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/v9.1.19/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v9.1.19/code/core) Updates `next` from 15.3.8 to 16.1.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.3.8...v16.1.7) Updates `storybook` from 9.0.15 to 9.1.19 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/v9.1.19/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v9.1.19/code/core) Updates `next` from 15.3.8 to 16.1.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.3.8...v16.1.7) Updates `next` from 15.3.8 to 16.1.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.3.8...v16.1.7) Updates `next` from 15.3.8 to 16.1.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.3.8...v16.1.7) Updates `storybook` from 9.0.15 to 9.1.19 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/v9.1.19/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v9.1.19/code/core) Updates `next` from 15.3.8 to 16.1.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.3.8...v16.1.7) Updates `storybook` from 9.0.15 to 9.1.19 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/v9.1.19/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v9.1.19/code/core) --- updated-dependencies: - dependency-name: next dependency-version: 16.1.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: storybook dependency-version: 9.1.19 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.1.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: storybook dependency-version: 9.1.19 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.1.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.1.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.1.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: storybook dependency-version: 9.1.19 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.1.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: storybook dependency-version: 9.1.19 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-03-17T21:15:03Z

⚠️ No Changeset found

Latest commit: 88cb7d9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2026-03-17T21:15:04Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Updated (UTC)
docs-v2	Error	Mar 17, 2026 9:15pm
nebula	Error	Mar 17, 2026 9:15pm
thirdweb_playground	Error	Mar 17, 2026 9:15pm
thirdweb-www	Error	Mar 17, 2026 9:15pm
wallet-ui	Error	Mar 17, 2026 9:15pm

dependabot bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 17, 2026

dependabot bot requested review from a team as code owners March 17, 2026 21:14

vercel bot had a problem deploying to Preview – thirdweb-www March 17, 2026 21:15 Failure

vercel bot had a problem deploying to Preview – wallet-ui March 17, 2026 21:15 Failure

vercel bot had a problem deploying to Preview – thirdweb_playground March 17, 2026 21:15 Failure

vercel bot had a problem deploying to Preview – docs-v2 March 17, 2026 21:15 Failure

vercel bot had a problem deploying to Preview – nebula March 17, 2026 21:15 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): Bump the npm_and_yarn group across 7 directories with 2 updates#8714

build(deps): Bump the npm_and_yarn group across 7 directories with 2 updates#8714
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/apps/dashboard/npm_and_yarn-8c1c2ea4c2

dependabot bot commented on behalf of github Mar 17, 2026 •

edited by pr-codex bot

Loading

Uh oh!

changeset-bot bot commented Mar 17, 2026

Uh oh!

vercel bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 17, 2026 • edited by pr-codex bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.1.7

Core Changes

Credits

v16.1.6

Core Changes

Credits

v16.1.5

v16.0.11

v15.6.0-canary.61

v15.5.13

Core Changes

v9.1.19

9.1.19

v9.1.18

9.1.18

v9.1.17

9.1.17

9.1.19

9.1.18

9.1.16

9.1.15

9.1.14

9.1.13

9.1.12

9.1.11

9.1.10

9.1.9

v16.1.7

Core Changes

Credits

v16.1.6

Core Changes

Credits

v16.1.5

v16.0.11

v15.6.0-canary.61

v15.5.13

Core Changes

v9.1.19

9.1.19

v9.1.18

9.1.18

v9.1.17

9.1.17

9.1.19

9.1.18

9.1.16

9.1.15

9.1.14

9.1.13

9.1.12

9.1.11

9.1.10

9.1.9

v16.1.7

Core Changes

Credits

v16.1.6

Core Changes

Credits

v16.1.5

v16.0.11

v15.6.0-canary.61

v15.5.13

Core Changes

v16.1.7

Core Changes

Credits

v16.1.6

Core Changes

Credits

v16.1.5

v16.0.11

v15.6.0-canary.61

v15.5.13

Core Changes

v16.1.7

dependabot bot commented on behalf of github Mar 17, 2026 •

edited by pr-codex bot

Loading

9.1...
Description has been truncated

vercel bot commented Mar 17, 2026 •

edited

Loading