chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates by dependabot[bot] · Pull Request #505 · vllnt/ui

dependabot · 2026-08-20T00:28:43Z

Bumps the npm_and_yarn group with 3 updates in the / directory: turbo, next and postcss.
Bumps the npm_and_yarn group with 2 updates in the /apps/registry directory: next and postcss.

Updates turbo from 2.8.3 to 2.9.14

Release notes

Sourced from turbo's releases.

Turborepo v2.9.14

[!NOTE] This release contains important security fixes.

High:

GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection

Low:

GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation

GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection

What's Changed

Changelog

release(turborepo): 2.9.12 by @github-actions[bot] in vercel/turborepo#12774

fix: Restore docs mobile menu by @anthonyshew in vercel/turborepo#12782

ci: Use pull_request for PR title linting by @anthonyshew in vercel/turborepo#12787

ci: Scope GitHub Actions caches by branch by @anthonyshew in vercel/turborepo#12788

test: Validate lockfiles without dependency downloads by @anthonyshew in vercel/turborepo#12789

Removed unneeded import form hash creation script in docs by @dancrumb in vercel/turborepo#12799

fix: Validate auth callback state by @anthonyshew in vercel/turborepo#12802

fix: Harden VS Code extension command execution by @anthonyshew in vercel/turborepo#12800

fix: Avoid project-local Yarn during detection by @anthonyshew in vercel/turborepo#12801

chore: Release 2.9.13 by @anthonyshew in vercel/turborepo#12803

New Contributors

@dancrumb made their first contribution in vercel/turborepo#12799

Full Changelog: vercel/turborepo@v2.9.12...v2.9.14

Turborepo v2.9.13-canary.1

What's Changed

Changelog

release(turborepo): 2.9.11-canary.7 by @github-actions[bot] in vercel/turborepo#12768

fix: Allow $TURBO_EXTENDS$ in LSP diagnostics by @anthonyshew in vercel/turborepo#12770

release(turborepo): 2.9.11 by @github-actions[bot] in vercel/turborepo#12771

fix: Allow transit nodes in LSP diagnostics by @anthonyshew in vercel/turborepo#12773

release(turborepo): 2.9.12 by @github-actions[bot] in vercel/turborepo#12774

fix: Restore docs mobile menu by @anthonyshew in vercel/turborepo#12782

ci: Use pull_request for PR title linting by @anthonyshew in vercel/turborepo#12787

ci: Scope GitHub Actions caches by branch by @anthonyshew in vercel/turborepo#12788

test: Validate lockfiles without dependency downloads by @anthonyshew in vercel/turborepo#12789

Removed unneeded import form hash creation script in docs by @dancrumb in vercel/turborepo#12799

fix: Validate auth callback state by @anthonyshew in vercel/turborepo#12802

fix: Harden VS Code extension command execution by @anthonyshew in vercel/turborepo#12800

fix: Avoid project-local Yarn during detection by @anthonyshew in vercel/turborepo#12801

... (truncated)

Commits

fc62fe0 publish 2.9.14 to registry
fb8c9ae chore: Release 2.9.13 (#12803)
e8e629d fix: Avoid project-local Yarn during detection (#12801)
91c90cb fix: Harden VS Code extension command execution (#12800)
84f4508 fix: Validate auth callback state (#12802)
1779ad7 Removed unneeded import form hash creation script in docs (#12799)
71f8c90 test: Validate lockfiles without dependency downloads (#12789)
5fcb960 ci: Scope GitHub Actions caches by branch (#12788)
4cf9fab ci: Use pull_request for PR title linting (#12787)
859c629 fix: Restore docs mobile menu (#12782)
Additional commits viewable in compare view

Updates next from 16.2.6 to 16.2.11

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

Commits

9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
fe28768 [16.x] fix(next/image): improve performance of detectContentType()
d8afb8d [16.x] Performance improvements when decoding React Server function payloads
Additional commits viewable in compare view

Updates postcss from 8.5.10 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

... (truncated)

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates nanoid from 3.3.12 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

Changelog

Sourced from nanoid's changelog.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

Commits

9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
96dd086 Update CI action
ba0bc3b Do not create latest release for v3
6819724 Release 3.3.15 version
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates next from 16.2.6 to 16.2.11

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

Commits

9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
fe28768 [16.x] fix(next/image): improve performance of detectContentType()
d8afb8d [16.x] Performance improvements when decoding React Server function payloads
Additional commits viewable in compare view

Updates postcss from 8.5.10 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

... (truncated)

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 3 updates in the / directory: [turbo](https://github.com/vercel/turborepo), [next](https://github.com/vercel/next.js) and [postcss](https://github.com/postcss/postcss). Bumps the npm_and_yarn group with 2 updates in the /apps/registry directory: [next](https://github.com/vercel/next.js) and [postcss](https://github.com/postcss/postcss). Updates `turbo` from 2.8.3 to 2.9.14 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.8.3...v2.9.14) Updates `next` from 16.2.6 to 16.2.11 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.6...v16.2.11) Updates `postcss` from 8.5.10 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.10...8.5.23) Updates `nanoid` from 3.3.12 to 3.3.18 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.12...3.3.18) Updates `next` from 16.2.6 to 16.2.11 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.6...v16.2.11) Updates `postcss` from 8.5.10 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.10...8.5.23) --- updated-dependencies: - dependency-name: turbo dependency-version: 2.9.14 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vllnt-pilot · 2026-08-20T00:44:16Z

ntk preview

App	Status	Preview
ui-registry	Failed: build ui-registry: build failed: exit status 1	—
storybook	Failed: build storybook: build failed: exit status 1	—

Built from 802c8139 · public + no-index (ADR-082) · torn down on close

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 20, 2026

Navigation Menu

Uh oh!

chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates - #505

chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates#505
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-abb6f8f550

dependabot Bot commented on behalf of github Aug 20, 2026

Uh oh!

vllnt-pilot Bot commented Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 20, 2026

Turborepo v2.9.14

High:

Low:

What's Changed

Changelog

New Contributors

Turborepo v2.9.13-canary.1

What's Changed

Changelog

v16.2.11

v16.2.10

v16.2.9

v16.2.8

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

v16.2.11

v16.2.10

v16.2.9

v16.2.8

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13