Bump the production group across 1 directory with 5 updates by dependabot[bot] · Pull Request #11 · bkoroglu1/draftledger

dependabot · 2026-09-17T18:14:49Z

Bumps the production group with 5 updates in the / directory:

Package	From	To
next	`16.3.1`	`16.3.5`
nodemailer	`9.0.5`	`10.0.10`
react	`19.2.8`	`19.3.0`
react-dom	`19.2.8`	`19.3.0`
zod	`4.4.3`	`4.6.5`

Updates next from 16.3.1 to 16.3.5

Release notes

Sourced from next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)

next/image: Reject empty images when reading/writing to the disk cache (#98186)

Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)

Add CSP nonce to script tags of loading and template files (#98403)

Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

testmode: Fix infinite recursion in testmode passthrough fetch (#97691)

Fix build error when aliasing typescript to @typescript/typescript6 (#97997)

Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @eps1lon, @mischnic, and @timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)

[backport] Fix catch-all index page being served for every other slug (#97416)

[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)

[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)

[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)

[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

Commits

ca2c75e v16.3.5
14fb290 [backport] Fix use cache prerender signal retention (#98448)
2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
4b56cee [16.3.x] Backport docs fixes (#98317)
5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
d9eac96 [16.3.x] next/image: skip 0-byte entries when initializing disk LRU cache (#9...
84b35fe [test] Fix 16.3 deploy test assertions (#98133)
14f9c1a [16.3.x][ci] Run flake detection and new deploy tests when merged and on back...
Additional commits viewable in compare view

Updates nodemailer from 9.0.5 to 10.0.10

Release notes

Sourced from nodemailer's releases.

v10.0.10

10.0.10 (2026-09-14)

Bug Fixes

derive the attachment filename from the basename of a Windows path (c7cc7ce)

dkim: unfold folded header lines in linear time (28a5909)

smtp-connection: reassemble multiline replies in linear time (f2d82fa)

v10.0.9

10.0.9 (2026-09-12)

Bug Fixes

addressparser: bound the '@' probe to the run being scanned (1465c3f)

addressparser: keep the text after a comment out of a quoted local part address (2f36eb1)

v10.0.8

10.0.8 (2026-09-11)

Bug Fixes

mime-node: clean the boundary where it is written, not only where it is built (e14278d)

mime-node: drop every control character from multipart boundary material (a82a355)

v10.0.7

10.0.7 (2026-09-11)

Bug Fixes

mime-funcs: do not double encode Buffer input when chunking base64 mime words (#1865) (4327a59)

mime-node: keep a boundary that is only line breaks from stripping to empty (ec46800)

mime-node: strip line breaks from multipart boundary material (#1867) (03c1a5c)

smtp-pool: release rate-limited connections on close (#1866) (7f5c7a4)

v10.0.6

10.0.6 (2026-09-11)

Bug Fixes

addressparser: scan free text for an address in linear time (437d7fc)

v10.0.5

10.0.5 (2026-09-11)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.0.10 (2026-09-14)

Bug Fixes

derive the attachment filename from the basename of a Windows path (c7cc7ce)

dkim: unfold folded header lines in linear time (28a5909)

smtp-connection: reassemble multiline replies in linear time (f2d82fa)

10.0.9 (2026-09-12)

Bug Fixes

addressparser: bound the '@' probe to the run being scanned (1465c3f)

addressparser: keep the text after a comment out of a quoted local part address (2f36eb1)

10.0.8 (2026-09-11)

Bug Fixes

mime-node: clean the boundary where it is written, not only where it is built (e14278d)

mime-node: drop every control character from multipart boundary material (a82a355)

10.0.7 (2026-09-11)

Bug Fixes

mime-funcs: do not double encode Buffer input when chunking base64 mime words (#1865) (4327a59)

mime-node: keep a boundary that is only line breaks from stripping to empty (ec46800)

mime-node: strip line breaks from multipart boundary material (#1867) (03c1a5c)

smtp-pool: release rate-limited connections on close (#1866) (7f5c7a4)

10.0.6 (2026-09-11)

Bug Fixes

addressparser: scan free text for an address in linear time (437d7fc)

10.0.5 (2026-09-11)

Bug Fixes

addressparser: parse comment-joined addresses in linear time (c07f175)

10.0.4 (2026-09-11)

... (truncated)

Commits

a67b182 chore(master): release 10.0.10 (#1873)
f2d82fa fix(smtp-connection): reassemble multiline replies in linear time
28a5909 fix(dkim): unfold folded header lines in linear time
c7cc7ce fix: derive the attachment filename from the basename of a Windows path
5a35d59 chore(master): release 10.0.9 (#1871)
2f36eb1 fix(addressparser): keep the text after a comment out of a quoted local part ...
1465c3f fix(addressparser): bound the '@' probe to the run being scanned
1732dc4 chore(deps): update dev dependencies
ec7eda6 chore(deps): update dev dependencies
618f912 chore(master): release 10.0.8 (#1870)
Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

Fix hang when updating a dehydrated boundary inside a hidden tree (@gaearon #37135)

Don't reacquire Host Singletons during dev effect validation (@gnoff #37113)

Only remove properties from Host Singletons on release (@gnoff #37112)

... (truncated)

Commits

2dc7da7 [test] Bump Jest to 30.4 (#37382)
4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
dbc3750 Update required references to GitHub repo (#36752)
900ae09 [flow] Bump flow to v0.317.0 (#36701)
fbb1370 [flow] Bump flow to v0.307.1 (#36199)
56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
74568e8 [Flight] Transport AggregateErrors.errors (#36156)
e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
3e1abcc [tests] Require exact error messages in assertConsole helpers (#35497)
Additional commits viewable in compare view

Updates react-dom from 19.2.8 to 19.3.0

Release notes

Sourced from react-dom's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637,

Bumps the production group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.5` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.5` | `10.0.10` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.5` | Updates `next` from 16.3.1 to 16.3.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.1...v16.3.5) Updates `nodemailer` from 9.0.5 to 10.0.10 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v9.0.5...v10.0.10) Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `zod` from 4.4.3 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.6.5) --- updated-dependencies: - dependency-name: next dependency-version: 16.3.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: nodemailer dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: zod dependency-version: 4.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-24T18:14:53Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 17, 2026

dependabot Bot closed this Sep 24, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-e1a7dc45b8 branch September 24, 2026 18:14

Navigation Menu

Bump the production group across 1 directory with 5 updates - #11

Bump the production group across 1 directory with 5 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-e1a7dc45b8

dependabot Bot commented on behalf of github Sep 17, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.3.5

v16.3.4

Credits

v16.3.3

v16.3.2

Core Changes

Credits

v10.0.10

10.0.10 (2026-09-14)

Bug Fixes

v10.0.9

10.0.9 (2026-09-12)

Bug Fixes

v10.0.8

10.0.8 (2026-09-11)

Bug Fixes

v10.0.7

10.0.7 (2026-09-11)

Bug Fixes

v10.0.6

10.0.6 (2026-09-11)

Bug Fixes

v10.0.5

10.0.5 (2026-09-11)

10.0.10 (2026-09-14)

Bug Fixes

10.0.9 (2026-09-12)

Bug Fixes

10.0.8 (2026-09-11)

Bug Fixes

10.0.7 (2026-09-11)

Bug Fixes

10.0.6 (2026-09-11)

Bug Fixes

10.0.5 (2026-09-11)

Bug Fixes

10.0.4 (2026-09-11)

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.0 (September 9, 2026)

New React Features

Uh oh!

dependabot Bot commented on behalf of github Sep 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 17, 2026 •

edited

Loading