chore(deps): bump the safe-patches group across 1 directory with 63 updates

[dependabot]

Bumps the safe-patches group with 56 updates in the / directory:

Package	From	To
@eslint/js	9.39.4	9.39.5
@typescript-eslint/eslint-plugin	8.61.1	8.64.0
@typescript-eslint/parser	8.61.1	8.64.0
eslint	9.39.4	9.39.5
prettier	3.8.4	3.9.5
typescript-eslint	8.61.1	8.64.0
vitest	3.2.6	3.2.7
@trpc/client	11.16.0	11.18.0
@types/node	20.19.37	20.19.43
@floating-ui/react	0.27.19	0.27.20
next	15.5.14	15.5.20
next-intl	4.9.0	4.13.2
use-intl	4.9.0	4.13.2
hono	4.12.10	4.12.30
@tanstack/react-router	1.149.3	1.170.18
react	19.2.5	19.2.7
@types/react	19.2.14	19.2.17
vite	7.1.12	7.3.6
fumadocs-core	16.8.1	16.11.4
fumadocs-mdx	14.2.5	14.3.2
fumadocs-ui	16.4.7	16.11.4
lucide-react	0.562.0	0.577.0
react-dom	19.2.5	19.2.7
tailwind-merge	3.5.0	3.6.0
@tailwindcss/postcss	4.2.2	4.3.2
@types/mdx	2.0.13	2.0.14
wrangler	4.83.0	4.110.0
@central-icons-react/round-outlined-radius-2-stroke-2	1.1.178	1.1.294
@tailwindcss/vite	4.2.2	4.3.2
@tanstack/react-query	5.96.1	5.101.2
@tanstack/react-start	1.149.4	1.168.28
@tanstack/router-plugin	1.149.3	1.168.20
@tailwindcss/typography	0.5.19	0.5.20
esbuild	0.27.7	0.28.1
react-scan	0.5.3	0.5.7
@scalar/hono-api-reference	0.9.48	0.11.9
@shopify/hydrogen	2026.1.3	2026.4.4
@shopify/remix-oxygen	3.0.2	3.0.4
graphql	16.13.2	16.14.2
graphql-tag	2.12.6	2.12.7
isbot	5.1.37	5.2.0
react-router	7.14.2	7.18.1
@react-router/dev	7.12.0	7.18.1
@react-router/fs-routes	7.12.0	7.18.1
@shopify/cli	3.93.0	3.94.3
@shopify/cli-hydrogen	11.1.12	11.1.16
@shopify/mini-oxygen	4.0.2	4.2.0
@helpway/react	0.13.1	0.13.3
@radix-ui/react-hover-card	1.1.15	1.1.19
@remotion/player	4.0.450	4.0.489
@tanstack/react-devtools	0.7.11	0.10.8
@tanstack/react-router-devtools	1.166.13	1.167.0
@tanstack/devtools-vite	0.3.12	0.8.1
web-vitals	5.2.0	5.3.0
@react-navigation/bottom-tabs	7.15.9	7.18.8
@react-navigation/native	7.2.2	7.3.8

Updates @eslint/js from 9.39.4 to 9.39.5

Release notes

Sourced from @​eslint/js's releases.

v9.39.5

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#20619) (Copilot)

Commits

• 202117b chore: package.json update for @​eslint/js release
• See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.61.1 to 8.64.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

• support parsing import defer (#12513)
• eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
• typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

• eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

8.63.0 (2026-07-06)

🚀 Features

• eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

• eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)
• eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)
• eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)
• scope-manager: export ClassStaticBlockScope (#12460)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kristjan @​KristjanTammekivi
• Michael Naumov @​mnaoumov
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

8.62.1 (2026-06-29)

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.64.0 (2026-07-13)

🚀 Features

• eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
• typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

• eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

🚀 Features

• eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

• eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)
• eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)
• eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kristjan @​KristjanTammekivi
• Michael Naumov @​mnaoumov
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

🩹 Fixes

• eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#12443, #12418)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#12365)

... (truncated)

Commits

• 414d9ab chore(release): publish 8.64.0
• bcfe16f feat(eslint-plugin): [no-loop-func] support using / await using declarati...
• 5b5bfde fix(eslint-plugin): [require-array-sort-compare] handle constrained arrays (#...
• 321856c chore: cleanup cspell config (#12526)
• b418cf5 feat(typescript-estree): throw for invalid definite assignment in class prope...
• 737de2b docs: align unified-signatures correct example parameter (#12506)
• a63c17a docs: fix shadowed parameter name in unified-signatures example (#12502)
• 290cf6c chore(release): publish 8.63.0
• 8d8fda6 feat(eslint-plugin): [no-misused-promises] detect async usage of a sync dispo...
• fec4f4f fix(eslint-plugin): [no-base-to-string] don't flag a shadowed String() call (...
• Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.61.1 to 8.64.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

• support parsing import defer (#12513)
• eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
• typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

• eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

8.63.0 (2026-07-06)

🚀 Features

• eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

• eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)
• eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)
• eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)
• scope-manager: export ClassStaticBlockScope (#12460)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kristjan @​KristjanTammekivi
• Michael Naumov @​mnaoumov
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

8.62.1 (2026-06-29)

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.64.0 (2026-07-13)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.0 (2026-06-22)

🚀 Features

• remove redundant package.json "files" (#12444)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 414d9ab chore(release): publish 8.64.0
• 290cf6c chore(release): publish 8.63.0
• 3ea32f4 chore(release): publish 8.62.1
• 54e2857 chore(release): publish 8.62.0
• 81e4c26 feat: remove redundant package.json "files" (#12444)
• See full diff in compare view

Updates eslint from 9.39.4 to 9.39.5

Release notes

Sourced from eslint's releases.

v9.39.5

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#20619) (Copilot)

Commits

• 4a24e8c 9.39.5
• 1fba874 Build: changelog update for 9.39.5
• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#21077)
• 202117b chore: package.json update for @​eslint/js release
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#21...
• 253be16 fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#21068)
• 74930ed docs: switch build to Node.js 24 (#20894)
• daf7791 chore: pin fflate@0.8.2 (#20895)
• eaec8bb docs: Add ESLint v9.x EOL notice (#20828)
• Additional commits viewable in compare view

Updates prettier from 3.8.4 to 3.9.5

Release notes

Sourced from prettier's releases.

3.9.5

🔗 Changelog

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.5

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @​tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text
<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text
<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @​andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](https://github.com/prettier/prettier/blob/main/<> "title")
<!-- Prettier 3.9.4 -->
[link](https://github.com/prettier/prettier/blob/main/ "title")
<!-- Prettier 3.9.5 -->
</tr></table>

... (truncated)

Commits

• b6c7d18 Release 3.9.5
• cd54ccc Avoid corrupting empty Markdown link with title (#19487)
• 2bb67ce Preserving comments' placement property (#19567)
• 91bcac8 Add more tests for comment-only object type (#19587)
• cbee737 Remove space in empty object type (#19583)
• 6394c73 Align empty module declaration with TS (#19568)
• a4e6f7a Prevent the addition of space in type() with + (#19516)
• 3d063b5 Ignore dangling comments when checking type parameter comments (#19572)
• 908503e Handle dangling comments in SwitchStatement (#19581)
• 943a475 Angular: Support expression for exhaustive typechecking (#19571)
• Additional commits viewable in compare view

Updates typescript-eslint from 8.61.1 to 8.64.0

Release notes

Sourced from typescript-eslint's releases.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

• support parsing import defer (#12513)
• eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
• typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

• eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

8.63.0 (2026-07-06)

🚀 Features

• eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

• eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)
• eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)
• eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)
• scope-manager: export ClassStaticBlockScope (#12460)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kristjan @​KristjanTammekivi
• Michael Naumov @​mnaoumov
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

8.62.1 (2026-06-29)

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.64.0 (2026-07-13)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.0 (2026-06-22)

🚀 Features

• remove redundant package.json "files" (#12444)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 414d9ab chore(release): publish 8.64.0
• 290cf6c chore(release): publish 8.63.0
• 3ea32f4 chore(release): publish 8.62.1
• 54e2857 chore(release): publish 8.62.0
• 81e4c26 feat: remove redundant package.json "files" (#12444)
• See full diff in compare view

Updates vitest from 3.2.6 to 3.2.7

Release notes

Sourced from vitest's releases.

v3.2.7

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v3]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10679 (b795e)

    View changes on GitHub

Commits

• c0c203d chore: release v3.2.7 (#10719)
• See full diff in compare view

Updates @trpc/client from 11.16.0 to 11.18.0

Release notes

Sourced from @​trpc/client's releases.

v11.18.0

What's Changed

• fix(ci): restore tests package version and pin Bun by @​KATT in trpc/trpc#7393
• fix(tanstack-react-query): add prefix support for mutation options by @​tmkx in trpc/trpc#7370
• chore: fix duplicate "the" in unstable-core JSDoc comment by @​dfedoryshchev in trpc/trpc#7366
• feat(openapi): Add server url support by @​Nick-Lucas in trpc/trpc#7411

New Contributors

• @​dfedoryshchev made their first contribution in trpc/trpc#7366

Full Changelog: trpc/trpc@v11.17.0...v11.18.0

v11.17.0

What's Changed

• chore(deps): bump next from 15.5.10 to 15.5.14 by @​dependabot[bot] in trpc/trpc#7268
• chore: Review stale skills (v11.16.0) by @​github-actions[bot] in trpc/trpc#7295
• fix(server): unwrap error from cause for streaming onError by @​zirkelc in trpc/trpc#7286
• chore: Add cache checks for openapi router fixtures by @​Nick-Lucas in trpc/trpc#7296
• chore: Update Hey API for new type imports by @​Nick-Lucas in trpc/trpc#7298
• docs: Add oasdiff docs to openapi by @​Nick-Lucas in trpc/trpc#7299
• feat: Add subscription inferrence helpers by @​Nick-Lucas in trpc/trpc#7303
• fix(www): Add accessible text to links without discernible text by @​cyphercodes in trpc/trpc#7302
• fix(deps): update dependency @​tanstack/intent to ^0.0.27 by @​renovate[bot] in trpc/trpc#7309
• fix(deps): update dependency srvx to v0.11.14 by @​renovate[bot] in trpc/trpc#7310
• chore(deps): update dependency @​oxc-project/runtime to v0.123.0 by @​renovate[bot] in trpc/trpc#7311
• fix(deps): update dependency @​clack/prompts to v1.2.0 by @​renovate[bot] in trpc/trpc#7312
• chore(deps): bump fastify from 5.8.1 to 5.8.3 by @​dependabot[bot] in trpc/trpc#7288
• chore(deps): update codecov/codecov-action action to v6 by @​renovate[bot] in trpc/trpc#7313
• fix(deps): update dependency eslint-plugin-unicorn to v64 by @​renovate[bot] in trpc/trpc#7314
• fix(deps): update dependency undici to v8 by @​renovate[bot] in trpc/trpc#7316
• chore(monorepo): remove versions from private workspaces by @​KATT in trpc/trpc#7306
• fix(server): handle React 19 proxy coercion in createInnerProxy by @​DORI2001 in trpc/trpc#7336
• docs: add trpc-studio to awesome-trpc extensions by @​sayefdeen in trpc/trpc#7340
• chore: upgrade pnpm to 10.33.1 by @​KATT in trpc/trpc#7350
• build: upgrade drizzle in next-sse-chat example by @​KATT in trpc/trpc#7351
• chore(www): Add Legora to website logos by @​KATT in trpc/trpc#7358

New Contributors

• @​cyphercodes made their first contribution in trpc/trpc#7302
• @​DORI2001 made their first contribution in trpc/trpc#7336
• @​sayefdeen made their first contribution in trpc/trpc#7340

Full Changelog: trpc/trpc@v11.16.0...v11.17.0

Commits

• 6aec157 v11.18.0
• 23c723c v11.17.0
• cb17317 fix(deps): update dependency undici to v8 (#7316)
• 48c5158 fix(deps): update dependency @​tanstack/intent to ^0.0.27 (#7309)
• 59f2cdb chore: Review stale skills (v11.16.0) (#7295)
• See full diff in compare view

Updates @types/node from 20.19.37 to 20.19.43

Commits

• See full diff in compare view

Updates @floating-ui/react from 0.27.19 to 0.27.20

Release notes

Sourced from @​floating-ui/react's releases.

@​floating-ui/react@​0.27.20

Patch Changes

• fix: remove redundant passive options from scroll listeners
• fix: support explicit undefined for optional properties with exactOptionalPropertyTypes
• Update dependencies: @floating-ui/react-dom@2.1.9, @floating-ui/utils@0.2.12

Changelog

Sourced from @​floating-ui/react's changelog.

0.27.20

Patch Changes

• fix: remove redundant passive options from scroll listeners
• fix: support explicit undefined for optional properties with exactOptionalPropertyTypes
• Update dependencies: @floating-ui/react-dom@2.1.9, @floating-ui/utils@0.2.12

Commits

• 12d9473 chore: version packages (#3480)
• 9887c96 fix(types): restore bivariant parameters for optional callbacks
• 73c1f76 fix(types): support exactOptionalPropertyTypes (#3456)
• 8999976 chore: upgrade vulnerable direct dependencies (#3484)
• fa63ca6 chore: remove unnecessary passive flag from scroll events (#3470)
• fabb80b breaking(vue): drop vue-demi and require Vue >=3.3.0 (#3452)
• See full diff in compare view

Updates next from 15.5.14 to 15.5.20

Release notes

Sourced from next's releases.

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

15.5.19

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [15.5.x] Don't drop FormData entries (#94244)

Other

• [15.5.x] Fix CI (#94281)

Credits

Huge thanks to @​eps1lon for helping!

v15.5.18

This release contains security fixes for the following advisories:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.16

This release contains security fixes for the following advisories:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

... (truncated)

Comm...

Description has been truncated

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[aliosmandev]

@dependabot rebase

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.