build(deps): Bump the npm_and_yarn group across 9 directories with 5 updates by dependabot[bot] · Pull Request #9069 · thirdweb-dev/js

dependabot · 2026-11-10T16:30:18Z

Bumps the npm_and_yarn group with 3 updates in the /apps/dashboard directory: @sentry/nextjs, next and zod.
Bumps the npm_and_yarn group with 2 updates in the /apps/nebula directory: next and zod.
Bumps the npm_and_yarn group with 2 updates in the /apps/playground-web directory: next and zod.
Bumps the npm_and_yarn group with 1 update in the /apps/portal directory: next.
Bumps the npm_and_yarn group with 2 updates in the /apps/wallet-ui directory: next and zod.
Bumps the npm_and_yarn group with 1 update in the /packages/nexus directory: zod.
Bumps the npm_and_yarn group with 1 update in the /packages/service-utils directory: zod.
Bumps the npm_and_yarn group with 3 updates in the /packages/thirdweb directory: zod, happy-dom and toml.
Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: next.

Updates @sentry/nextjs from 10.74.0 to 10.75.2

Release notes

Sourced from @sentry/nextjs's releases.

10.75.2

fix(v10/cloudflare): Enforce flush timeout across Workflow lifecycle (#24582)

fix(v10/core): Apply dataCollection.urlQueryParams to collected URLs and query strings (#24572)

fix(v10/nextjs): Align tunnel request matching in middleware with tunnel rewrite (#24565)

fix(v10/node): Stop leaking unhandled rejections on aborted Vercel AI streams (#24563)

Bundle size 📦

Path Size

@sentry/browser 27.56 KB

@sentry/browser - with treeshaking flags 26.04 KB

@sentry/browser (incl. Tracing) 46.02 KB

@sentry/browser (incl. Tracing + Span Streaming) 47.77 KB

@sentry/browser (incl. Tracing, Profiling) 50.67 KB

@sentry/browser (incl. Tracing, Replay) 84.38 KB

@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 74.28 KB

@sentry/browser (incl. Tracing, Replay with Canvas) 89 KB

@sentry/browser (incl. Tracing, Replay, Feedback) 101.33 KB

@sentry/browser (incl. Feedback) 44.33 KB

@sentry/browser (incl. sendFeedback) 32.25 KB

@sentry/browser (incl. FeedbackAsync) 37.27 KB

@sentry/browser (incl. Metrics) 28.63 KB

@sentry/browser (incl. Logs) 28.84 KB

@sentry/browser (incl. Metrics & Logs) 29.52 KB

@sentry/react 29.32 KB

@sentry/react (incl. Tracing) 48.28 KB

@sentry/vue 32.88 KB

@sentry/vue (incl. Tracing) 47.98 KB

@sentry/svelte 27.58 KB

CDN Bundle 29.87 KB

CDN Bundle (incl. Tracing) 47.92 KB

CDN Bundle (incl. Logs, Metrics) 31.41 KB

CDN Bundle (incl. Tracing, Logs, Metrics) 49.21 KB

CDN Bundle (incl. Replay, Logs, Metrics) 69.82 KB

CDN Bundle (incl. Tracing, Replay) 84.64 KB

CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 85.87 KB

CDN Bundle (incl. Tracing, Replay, Feedback) 90.31 KB

CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 91.55 KB

CDN Bundle - uncompressed 88.83 KB

CDN Bundle (incl. Tracing) - uncompressed 144.49 KB

CDN Bundle (incl. Logs, Metrics) - uncompressed 93.43 KB

CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 148.38 KB

CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 215.46 KB

CDN Bundle (incl. Tracing, Replay) - uncompressed 261.12 KB

CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 264.99 KB

CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 274.5 KB

CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 278.36 KB

@sentry/nextjs (client) 50.75 KB

@sentry/sveltekit (client) 46.46 KB

... (truncated)

Changelog

Sourced from @sentry/nextjs's changelog.

10.75.2

fix(v10/cloudflare): Enforce flush timeout across Workflow lifecycle (#24582)

fix(v10/core): Apply dataCollection.urlQueryParams to collected URLs and query strings (#24572)

fix(v10/nextjs): Align tunnel request matching in middleware with tunnel rewrite (#24565)

fix(v10/node): Stop leaking unhandled rejections on aborted Vercel AI streams (#24563)

10.75.1

fix(v10/cloudflare): Capture telemetry from untraced Durable Object RPC calls (#24512)

fix(v10/cloudflare): Instrument namespaces returned by jurisdiction() (#24513)

fix(v10/hono): Allow @cloudflare/workers-types v5 as peer dependency (#24500)

fix(v10/nextjs): Resolve Next.js version relative to the SDK when cwd differs (#24475)

10.75.0

Important Changes

feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24445)

On Effect v4, Sentry.effectLayer now registers a Sentry ErrorReporter. Failures that pass through Effect.withErrorReporting, ErrorReporter.report or the built-in HTTP and RPC reporting boundaries are captured automatically, with ErrorReporter.ignore, ErrorReporter.severity and ErrorReporter.attributes annotations respected. Nothing changes on Effect v3.

Other Changes

feat(v10/core): Accept a CollectBehavior shorthand for dataCollection.httpHeaders (#24339)

fix(v10/browser): Release the XHR virtualError once the request completed (#24307)

fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)

fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps when disable-upload is set (#24332)

fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)

fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcemap upload (#24295)

fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)

fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe (#24353)

fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)

fix(v10/replay): Don't rewrite already-emitted nodes when syncing mirror attributes (#23588)

Commits

faeac9a release: 10.75.2
7175b19 meta(changelog): Update changelog for 10.75.2 (#24585)
8f5dc60 fix(v10/cloudflare): Enforce flush timeout across Workflow lifecycle (#24582)
44506df fix(v10/node): Stop leaking unhandled rejections on aborted Vercel AI streams...
c0eb753 fix(v10/core): Apply dataCollection.urlQueryParams to collected URLs and qu...
d525a2f fix(v10/nextjs): Align tunnel request matching in middleware with tunnel rewr...
5b03e28 Merge remote-tracking branch 'remotes/origin/release/10.75.1' into v10
8025a92 release: 10.75.1
d1462b2 meta(changelog): Update changelog for 10.75.1 (#24561)
c8f750f fix(v10/cloudflare): Capture telemetry from untraced Durable Object RPC calls...
Additional commits viewable in compare view

Updates next from 15.5.27 to 15.5.28

Release notes

Sourced from next's releases.

v15.5.28

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

195cd6a v15.5.28
1b53604 [cd] Allow branch to get published
5e3b687 [lts-maintenance][next/image] Bump sharp (#232)
a2021b3 [lts-maintenance][react] Improve Server Component transport protocol (#194)
a836b53 [lts-maintenance] Fix google tag manager e2e test, assume GTM 200s instead of...
9c1c1b1 [lts-maintenance][ci] Wire preview builds variables consistently (#99325)
See full diff in compare view

Updates zod from 3.25.75 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585

0c483c58 docs: the Zod 4.6 announcement post (#6546)

... (truncated)

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.

Updates next from 15.5.27 to 15.5.28

Release notes

Sourced from next's releases.

v15.5.28

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

195cd6a v15.5.28
1b53604 [cd] Allow branch to get published
5e3b687 [lts-maintenance][next/image] Bump sharp (#232)
a2021b3 [lts-maintenance][react] Improve Server Component transport protocol (#194)
a836b53 [lts-maintenance] Fix google tag manager e2e test, assume GTM 200s instead of...
9c1c1b1 [lts-maintenance][ci] Wire preview builds variables consistently (#99325)
See full diff in compare view

Updates zod from 3.25.75 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585

0c483c58 docs: the Zod 4.6 announcement post (#6546)

... (truncated)

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.

Updates next from 15.5.27 to 15.5.28

Release notes

Sourced from next's releases.

v15.5.28

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

195cd6a v15.5.28
1b53604 [cd] Allow branch to get published
5e3b687 [lts-maintenance][next/image] Bump sharp (#232)
a2021b3 [lts-maintenance][react] Improve Server Component transport protocol (#194)
a836b53 [lts-maintenance] Fix google tag manager e2e test, assume GTM 200s instead of...
9c1c1b1 [lts-maintenance][ci] Wire preview builds variables consistently (#99325)
See full diff in compare view

Updates zod from 3.25.75 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585

0c483c58 docs: the Zod 4.6 announcement post (#6546)

... (truncated)

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.

Updates next from 15.5.27 to 15.5.28

Release notes

Sourced from next's releases.

v15.5.28

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

195cd6a v15.5.28
1b53604 [cd] Allow branch to get published
5e3b687 [lts-maintenance][next/image] Bump sharp (#232)
a2021b3 [lts-maintenance][react] Improve Server Component transport protocol (#194)
a836b53 [lts-maintenance] Fix google tag manager e2e test, assume GTM 200s instead of...
9c1c1b1 [lts-maintenance][ci] Wire preview builds variables consistently (#99325)
See full diff in compare view

Updates next from 15.5.27 to 15.5.28

Release notes

Sourced from next's releases.

v15.5.28

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

195cd6a v15.5.28
1b53604 [cd] Allow branch to get published
5e3b687 [lts-maintenance][next/image] Bump sharp (#232)
a2021b3 [lts-maintenance][react] Improve Server Component transport protocol (#194)
a836b53 [lts-maintenance] Fix google tag manager e2e test, assume GTM 200s instead of...
9c1c1b1 [lts-maintenance][ci] Wire preview builds variables consistently (#99325)
See full diff in compare view

Updates zod from 3.25.75 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585

0c483c58 docs: the Zod 4.6 announcement post (#6546)

... (truncated)

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.

Updates zod from 3.25.75 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585

0c483c58 docs: the Zod 4.6 announcement post (#6546)

... (truncated)

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before p...
Description has been truncated

…updates Bumps the npm_and_yarn group with 3 updates in the /apps/dashboard directory: [@sentry/nextjs](https://github.com/getsentry/sentry-javascript), [next](https://github.com/vercel/next.js) and [zod](https://github.com/colinhacks/zod). Bumps the npm_and_yarn group with 2 updates in the /apps/nebula directory: [next](https://github.com/vercel/next.js) and [zod](https://github.com/colinhacks/zod). Bumps the npm_and_yarn group with 2 updates in the /apps/playground-web directory: [next](https://github.com/vercel/next.js) and [zod](https://github.com/colinhacks/zod). Bumps the npm_and_yarn group with 1 update in the /apps/portal directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 2 updates in the /apps/wallet-ui directory: [next](https://github.com/vercel/next.js) and [zod](https://github.com/colinhacks/zod). Bumps the npm_and_yarn group with 1 update in the /packages/nexus directory: [zod](https://github.com/colinhacks/zod). Bumps the npm_and_yarn group with 1 update in the /packages/service-utils directory: [zod](https://github.com/colinhacks/zod). Bumps the npm_and_yarn group with 3 updates in the /packages/thirdweb directory: [zod](https://github.com/colinhacks/zod), [happy-dom](https://github.com/capricorn86/happy-dom) and [toml](https://github.com/BinaryMuse/toml-node). Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: [next](https://github.com/vercel/next.js). Updates `@sentry/nextjs` from 10.74.0 to 10.75.2 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.74.0...10.75.2) Updates `next` from 15.5.27 to 15.5.28 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.27...v15.5.28) Updates `zod` from 3.25.75 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.75...v4.6.6) Updates `next` from 15.5.27 to 15.5.28 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.27...v15.5.28) Updates `zod` from 3.25.75 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.75...v4.6.6) Updates `next` from 15.5.27 to 15.5.28 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.27...v15.5.28) Updates `zod` from 3.25.75 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.75...v4.6.6) Updates `next` from 15.5.27 to 15.5.28 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.27...v15.5.28) Updates `next` from 15.5.27 to 15.5.28 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.27...v15.5.28) Updates `zod` from 3.25.75 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.75...v4.6.6) Updates `zod` from 3.25.75 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.75...v4.6.6) Updates `zod` from 3.25.75 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.75...v4.6.6) Updates `zod` from 3.25.75 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.75...v4.6.6) Updates `happy-dom` from 20.14.3 to 21.0.4 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.14.3...v21.0.4) Updates `toml` from 4.2.0 to 5.0.1 - [Changelog](https://github.com/BinaryMuse/toml-node/blob/main/CHANGELOG.md) - [Commits](BinaryMuse/toml-node@v4.2.0...v5.0.1) Updates `next` from 15.5.27 to 15.5.28 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.27...v15.5.28) --- updated-dependencies: - dependency-name: "@sentry/nextjs" dependency-version: 10.75.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.28 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.28 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.28 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.28 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.28 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: happy-dom dependency-version: 21.0.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: toml dependency-version: 5.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.28 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

coderabbitai · 2026-11-10T16:30:30Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 3a6a4c28-d6d3-44d5-9e59-c172807f6ce3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

changeset-bot · 2026-11-10T16:30:33Z

⚠️ No Changeset found

Latest commit: 6075891

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2026-11-10T16:30:41Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Updated
docs-v2	Error	Nov 10, 2026 4:31pm UTC
nebula	Error	Nov 10, 2026 4:31pm UTC
thirdweb_playground	Error	Nov 10, 2026 4:31pm UTC
thirdweb-www	Error	Nov 10, 2026 4:31pm UTC
wallet-ui	Error	Nov 10, 2026 4:31pm UTC

dependabot Bot requested review from a team as code owners November 10, 2026 16:30

dependabot Bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 10, 2026

vercel Bot had a problem deploying to Preview – docs-v2 November 10, 2026 16:31 Failure

vercel Bot had a problem deploying to Preview – wallet-ui November 10, 2026 16:31 Failure

vercel Bot had a problem deploying to Preview – thirdweb_playground November 10, 2026 16:31 Failure

vercel Bot had a problem deploying to Preview – nebula November 10, 2026 16:31 Failure

vercel Bot had a problem deploying to Preview – thirdweb-www November 10, 2026 16:31 Failure

Navigation Menu

Repository navigation

build(deps): Bump the npm_and_yarn group across 9 directories with 5 updates - #9069

build(deps): Bump the npm_and_yarn group across 9 directories with 5 updates#9069
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/dashboard/npm_and_yarn-f92a1d69b2

dependabot Bot commented on behalf of github Nov 10, 2026

Uh oh!

coderabbitai Bot commented Nov 10, 2026

Review skipped

Uh oh!

changeset-bot Bot commented Nov 10, 2026

Uh oh!

vercel Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

This branch had an error being deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Path	Size
`@sentry/browser`	27.56 KB
`@sentry/browser` - with treeshaking flags	26.04 KB
`@sentry/browser` (incl. Tracing)	46.02 KB
`@sentry/browser` (incl. Tracing + Span Streaming)	47.77 KB
`@sentry/browser` (incl. Tracing, Profiling)	50.67 KB
`@sentry/browser` (incl. Tracing, Replay)	84.38 KB
`@sentry/browser` (incl. Tracing, Replay) - with treeshaking flags	74.28 KB
`@sentry/browser` (incl. Tracing, Replay with Canvas)	89 KB
`@sentry/browser` (incl. Tracing, Replay, Feedback)	101.33 KB
`@sentry/browser` (incl. Feedback)	44.33 KB
`@sentry/browser` (incl. sendFeedback)	32.25 KB
`@sentry/browser` (incl. FeedbackAsync)	37.27 KB
`@sentry/browser` (incl. Metrics)	28.63 KB
`@sentry/browser` (incl. Logs)	28.84 KB
`@sentry/browser` (incl. Metrics & Logs)	29.52 KB
`@sentry/react`	29.32 KB
`@sentry/react` (incl. Tracing)	48.28 KB
`@sentry/vue`	32.88 KB
`@sentry/vue` (incl. Tracing)	47.98 KB
`@sentry/svelte`	27.58 KB
CDN Bundle	29.87 KB
CDN Bundle (incl. Tracing)	47.92 KB
CDN Bundle (incl. Logs, Metrics)	31.41 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	49.21 KB
CDN Bundle (incl. Replay, Logs, Metrics)	69.82 KB
CDN Bundle (incl. Tracing, Replay)	84.64 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	85.87 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	90.31 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	91.55 KB
CDN Bundle - uncompressed	88.83 KB
CDN Bundle (incl. Tracing) - uncompressed	144.49 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed	93.43 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	148.38 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	215.46 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	261.12 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	264.99 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	274.5 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	278.36 KB
`@sentry/nextjs` (client)	50.75 KB
`@sentry/sveltekit` (client)	46.46 KB

Conversation

dependabot Bot commented on behalf of github Nov 10, 2026

10.75.2

Bundle size 📦

10.75.2

10.75.1

10.75.0

Important Changes

Other Changes

v15.5.28

v4.6.6

Commits:

v4.6.5

Commits:

v4.6.4

v4.6.3

v4.6.2

v15.5.28

v4.6.6

Commits:

v4.6.5

Commits:

v4.6.4

v4.6.3

v4.6.2

v15.5.28

v4.6.6

Commits:

v4.6.5

Commits:

v4.6.4

v4.6.3

v4.6.2

v15.5.28

v15.5.28

v4.6.6

Commits:

v4.6.5

Commits:

v4.6.4

v4.6.3

v4.6.2

v4.6.6

Commits:

v4.6.5

Commits:

v4.6.4

v4.6.3

v4.6.2

Uh oh!

coderabbitai Bot commented Nov 10, 2026

Review skipped

Uh oh!

changeset-bot Bot commented Nov 10, 2026

⚠️ No Changeset found

Uh oh!

vercel Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented Nov 10, 2026 •

edited

Loading