chore(deps): bump the production-dependencies group across 1 directory with 6 updates by dependabot[bot] · Pull Request #79 · yuireidev/devpockit

dependabot · 2026-04-20T10:17:53Z

Bumps the production-dependencies group with 6 updates in the / directory:

Package	From	To
canvas	`3.2.1`	`3.2.3`
jose	`6.2.1`	`6.2.3`
next	`16.1.6`	`16.2.4`
react	`19.2.4`	`19.2.5`
react-dom	`19.2.4`	`19.2.5`
yaml	`2.8.2`	`2.8.3`

Updates canvas from 3.2.1 to 3.2.3

Release notes

Sourced from canvas's releases.

v3.2.3

Fixed

Fix building with gcc (#2559)

v3.2.2

Fixed

Fix dangling env pointer in image MIME data cleanup (#2550)

Fix ctx.direction not affected by ctx.save and ctx.restore

Preserve rest of PDF pages when changing width and height (#2538)

Several security fixes for untrusted inputs to getImageData and putImageData. Thanks to Ethan Kim for the report.

Changelog

Sourced from canvas's changelog.

3.2.3

Fixed

Fix building with gcc (#2559)

3.2.2

Fixed

Fix dangling env pointer in image MIME data cleanup (#2550)

Fix ctx.direction not affected by ctx.save and ctx.restore

Preserve rest of PDF pages when changing width and height (#2538)

Several security fixes for untrusted inputs to getImageData and putImageData. Thanks to Ethan Kim for the report.

Commits

f91598e v3.2.3
1541544 PAGE_SIZE shouldn't be unsigned
ac82fa7 v3.2.2
103a620 add the last flurry of commits to CHANGELOG
7304c7a avoid integer overflow in getImageData
f9fcc5f avoid integer overflow in putImageData
802a8ca avoid integer overflow in new ImageData
9d1b478 wrap negative values passed to createImageData
779483c bail early when setting zero-length image source
22ed2b7 make canvas types unsigned
Additional commits viewable in compare view

Updates jose from 6.2.1 to 6.2.3

Release notes

Sourced from jose's releases.

v6.2.3

Refactor

cleanly reject invalid PBES2 p2c (0cdb851)

v6.2.2

Fixes

reject failed decompression with JWEInvalid error (043b181)

Changelog

Sourced from jose's changelog.

6.2.3 (2026-04-27)

Refactor

cleanly reject invalid PBES2 p2c (0cdb851)

6.2.2 (2026-03-18)

Fixes

reject failed decompression with JWEInvalid error (043b181)

Commits

41ad7e9 chore(release): 6.2.3
988e90f chore: account for commit-and-tag-version instead of standard-version
4b24656 chore: update CHANGELOG.md header
0cdb851 refactor: cleanly reject invalid PBES2 p2c
a0b261e test: update Bun expectations
b39dc1a chore: use fs.globSync
0675be1 build: replace rollup umd build with a custom esbuild iife wrap
9b03323 chore: bump packages
914b73d chore(deps-dev): bump lodash
9dce817 chore: bump packages
Additional commits viewable in compare view

Updates next from 16.1.6 to 16.2.4

Release notes

Sourced from next's releases.

v16.2.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#92713)

Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#92631)

Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)

Compiler: Support boolean and number primtives in next.config defines (#92731)

turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#92725)

Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)

Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92828)

Adding more system info to the 'initialize project' trace (#92427)

Credits

Huge thanks to @Badbird5907, @lukesandberg, @andrewimm, @sokra, and @mischnic for helping!

v16.2.3

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)

Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)

Deduplicate output assets and detect content conflicts on emit (#92292)

Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)

turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @icyJoseph, @sokra, @wbinnssmith, @eps1lon and @ztanner for helping!

v16.2.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

backport: Move expanded adapters docs to API reference (#92115) (#92129)

Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#92130)

[create-next-app] Skip interactive prompts when CLI flags are provided (#91840)

next.config.js: Accept an option for serverFastRefresh (#91968)

Turbopack: enable server HMR for app route handlers (#91466)

Turbopack: exclude metadata routes from server HMR (#92034)

Fix CI for glibc linux builds

Backport: disable bmi2 in qfilter #92177

[backport] Fix CSS HMR on Safari (#92174)

... (truncated)

Commits

2275bd8 v16.2.4
e073983 Adding more system info to the 'initialize project' trace (#92427)
8a540b5 Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92...
2f5343f Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)
2ad9d3f turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during ...
6f3808e Compiler: Support boolean and number primtives in next.config defines (#92731)
fbc7684 Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)
805d758 Turbopack: fix filesystem watcher config not applying follow_symlinks(false) ...
1056fae chore: Bump reqwest to 0.13.2 (#92713)
d5f649b v16.2.3
Additional commits viewable in compare view

Updates react from 19.2.4 to 19.2.5

Release notes

Sourced from react's releases.

19.2.5 (April 8th, 2026)

React Server Components

Add more cycle protections (#36236 by @eps1lon and @unstubbable)

Commits

23f4f9f 19.2.5
See full diff in compare view

Updates react-dom from 19.2.4 to 19.2.5

Release notes

Sourced from react-dom's releases.

19.2.5 (April 8th, 2026)

React Server Components

Add more cycle protections (#36236 by @eps1lon and @unstubbable)

Commits

23f4f9f 19.2.5
See full diff in compare view

Updates yaml from 2.8.2 to 2.8.3

Release notes

Sourced from yaml's releases.

v2.8.3

Add trailingComma ToString option for multiline flow formatting (#670)

Catch stack overflow during node composition (1e84ebb)

Commits

ce14587 2.8.3
1e84ebb fix: Catch stack overflow during node composition
6b24090 ci: Include Prettier check in lint action
9424dee chore: Refresh lockfile
d1aca82 Add trailingComma ToString option for multiline flow formatting (#670)
4321509 ci: Drop the branch filter from GitHub PR actions
47207d0 chore: Update docs-slate
5212fae chore: Update docs-slate
See full diff in compare view

dependabot · 2026-04-20T10:17:54Z

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

…y with 6 updates Bumps the production-dependencies group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [canvas](https://github.com/Automattic/node-canvas) | `3.2.1` | `3.2.3` | | [jose](https://github.com/panva/jose) | `6.2.1` | `6.2.3` | | [next](https://github.com/vercel/next.js) | `16.1.6` | `16.2.4` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.5` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.5` | | [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.3` | Updates `canvas` from 3.2.1 to 3.2.3 - [Release notes](https://github.com/Automattic/node-canvas/releases) - [Changelog](https://github.com/Automattic/node-canvas/blob/master/CHANGELOG.md) - [Commits](Automattic/node-canvas@v3.2.1...v3.2.3) Updates `jose` from 6.2.1 to 6.2.3 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.1...v6.2.3) Updates `next` from 16.1.6 to 16.2.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v16.1.6...v16.2.4) Updates `react` from 19.2.4 to 19.2.5 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react) Updates `react-dom` from 19.2.4 to 19.2.5 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react-dom) Updates `yaml` from 2.8.2 to 2.8.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.2...v2.8.3) --- updated-dependencies: - dependency-name: canvas dependency-version: 3.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: jose dependency-version: 6.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: next dependency-version: 16.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: react dependency-version: 19.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react-dom dependency-version: 19.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: yaml dependency-version: 2.8.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-05-03T20:50:32Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-8be97b93cb branch from a2e7dae to 0535a63 Compare May 1, 2026 04:39

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-8be97b93cb branch from 0535a63 to 921c127 Compare May 1, 2026 04:52

dependabot Bot closed this May 3, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-8be97b93cb branch May 3, 2026 20:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the production-dependencies group across 1 directory with 6 updates#79

chore(deps): bump the production-dependencies group across 1 directory with 6 updates#79
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-8be97b93cb

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Apr 20, 2026

Uh oh!

dependabot Bot commented on behalf of github May 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.2.3

Fixed

v3.2.2

Fixed

3.2.3

Fixed

3.2.2

Fixed

v6.2.3

Refactor

v6.2.2

Fixes

6.2.3 (2026-04-27)

Refactor

6.2.2 (2026-03-18)

Fixes

v16.2.4

Core Changes

Credits

v16.2.3

Core Changes

Credits

v16.2.2

Core Changes

19.2.5 (April 8th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

v2.8.3

Uh oh!

dependabot Bot commented on behalf of github Apr 20, 2026

Labels

Uh oh!

dependabot Bot commented on behalf of github May 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading