chore(deps): bump the minor-and-patch group with 8 updates by dependabot[bot] · Pull Request #66 · RahilBhavan/Ondo

dependabot · 2026-11-11T10:55:22Z

Bumps the minor-and-patch group with 8 updates:

Package	From	To
next	`16.4.3`	`16.4.5`
viem	`2.57.11`	`2.57.16`
@tailwindcss/postcss	`4.3.3`	`4.3.5`
@types/node	`26.6.5`	`26.6.6`
eslint	`10.13.0`	`10.14.0`
eslint-config-next	`16.4.3`	`16.4.5`
postcss	`8.5.31`	`8.5.32`
tailwindcss	`4.3.3`	`4.3.5`

Updates next from 16.4.3 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache

Cache leak across root param values in nested 'use cache' functions (follow-up)

Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params

Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments

Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses

SVG rejection bypass in Next.js image optimization

HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

[lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)

[lts-active] Reload on missed Turbopack startup CSS updates (#100619)

[lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)

[lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)

[lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)

[lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)

[lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @icyJoseph, @mischnic, @wbinnssmith, @lukesandberg, and @eps1lon for helping!

Commits

4e5335a v16.4.5
809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
b175f52 v16.4.4
ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
Additional commits viewable in compare view

Updates viem from 2.57.11 to 2.57.16

Release notes

Sourced from viem's releases.

viem@2.57.16

Patch Changes

#5395 c60ca26e030706610bcf61689331008a30a3db2a Thanks @jxom! - viem/tempo: gatewayActions paid in the Gateway currency the Client account held most of, threw Gateway.InsufficientFundsError (with the account's balances) when it couldn't pay, and explained how to pay in Gateway.PaymentRequiredError.

#5392 9348d386a9f62fd6713124e25360d6040e4a34cf Thanks @gakonst! - Stopped retrying JSON-RPC method-not-found (-32601) and method-not-supported (-32004) errors from non-2xx HTTP responses, since a retry gets the same refusal.

#5392 9348d386a9f62fd6713124e25360d6040e4a34cf Thanks @gakonst! - Reduced per-request overhead of the http, webSocket and ipc transports by building the onFetchRequest Request only when the hook is set and the TimeoutError only when a request times out, and fetched the withdrawal receipt once in the ZKsync finalizeWithdrawal and isWithdrawalFinalized actions.

#5392 9348d386a9f62fd6713124e25360d6040e4a34cf Thanks @gakonst! - Cached signature hashes in toSignatureHash, so selector lookups in decodeFunctionData, decodeEventLog, decodeErrorResult and encodeFunctionData no longer hash every ABI item on each call.

#5391 721d6824516514195c0a98971731c6d81b2f9032 Thanks @jxom! - viem/tempo: Added experimental Gateway and gatewayActions (client.ai, client.bucket, client.compute, client.kv), with standalone Actions.ai, Actions.bucket, Actions.compute, and Actions.kv, with client.gateway.getCapabilities, Actions.gateway.getCapabilities and defaults for every option (gatewayActions()), for wallet-paid inference (including streamed text), object storage, metered and streamed CPU and GPU compute, and key-value state on a Tempo Gateway paid with a local Client account through the optional mppx peer dependency, with Tempo Wallet through the Accounts SDK, or with an app-supplied payment-aware fetch.

viem@2.57.15

Patch Changes

#5339 a864b864b8b9031d970910fb8247471924d09280 Thanks @mortezashojaei! - Fixed getAbiItem to throw AbiItemAmbiguityError for overloads that JavaScript cannot distinguish, such as bytes vs bytes32, uint256 vs int256, and uint256[] vs uint256[2], while resolving distinguishable values by byte length and integer range.

#5321 af062571382ec3631cf1901aeda9b58a87c8fad5 Thanks @evanaronson! - Removed a trailing slash to the ZKsync explorer URL.

#5358 179a53682d9bf2ac2b7a65a86ec312fca0c7c9a8 Thanks @Turkchain1919! - Added Turkchain Mainnet (Chain ID: 1919) to the supported chains.

#5375 bb12b94649962cd7f03c339c226399c614b49805 Thanks @jxom! - Fixed decodeEventLog and parseEventLogs to decode anonymous event logs when eventName names the event or every event in abi is anonymous, as with getLogs and watchEvent given a single anonymous event.

#5364 8f2a79ba8b4d235a24c4c101f4ef04a824c3e429 Thanks @jxom! - ccip: Applied the HTTP transport timeout (including its override) and 10 MiB response cap to CCIP-Read gateway requests, refused non-HTTP(S) gateway URLs (including data: URLs, which previously worked), and limited one lookup to 4 nested callbacks, 4 nested local batches, 256 gateway requests and 16 concurrent requests.

#5372 f32ef6c41e623683b99989422eac7ac6cea5c107 Thanks @jxom! - Fixed estimateGas and estimateContractGas returning a gas limit filled by eth_fillTransaction that ignored blockNumber, blockTag, and stateOverride.

#5360 41801d827e339b96d1b4dd775f4dd379f17cc610 Thanks @jxom! - Raised the default expiring nonce validBefore from 25 to 270 seconds, capped Relay.feePayer expiring nonce windows at 300 seconds, added Transaction.expiringNonceMaxExpiry, and replaced the random expiring nonce validAfter with a random nonce discriminator.

#5360 41801d827e339b96d1b4dd775f4dd379f17cc610 Thanks @jxom! - Fixed sponsored prepareTransactionRequest fills keeping a requested feeToken that the fee payer did not sign, which made the fee payer signature invalid.

#5378 cbdd61078378012368464c9b0e4a76804a5ea987 Thanks @mmv08! - Fixed fillTransaction and prepareTransactionRequest returning gasPrice next to EIP-1559 fees on Anvil, which made estimateGas and sendTransaction fail on Anvil 1.8.5 and later with "both gasPrice and (maxFeePerGas or maxPriorityFeePerGas) specified".

#5346 7156f80f77c47c0a3f9df479b0a6e856029edb3b Thanks @KieranAltman! - Updated HashKey Chain and HashKey Chain Testnet display names, native currency name, and block explorer URLs.

#5373 ddc2d365d093793f9d8f5818743f169c98eed8d7 Thanks @jxom! - Added an optional nonce to NonceManager reset parameters, which sendTransaction and sendTransactionSync now set to the consumed nonce when a send fails after consume returned.

#5371 035c519b6b6b3f179fa741953751a501f05132a2 Thanks @jxom! - Fixed parseTransaction to accept an EIP-7702 authorization yParity from 2 to 255 so a serialized transaction parses back, and made recoverAuthorizationAddress throw InvalidYParityError (and verifyAuthorization return false) for a yParity other than 0 or 1, which EIP-7702 treats as having no authority.

#5318 57db085e896dfee3a3387fb7573bf7f7ebc6170d Thanks @jxom! - Fixed parseTransaction not raising TipAboveFeeCapError when the encoded maxFeePerGas is zero.

#5377 42c41ca3c42792e56a2e1f64d3007c28adc9fbba Thanks @mmv08! - Fixed sendTransactionSync and writeContractSync failing at once and freeing the nonce when the node had accepted the transaction but stopped waiting for its receipt (eth_sendRawTransactionSync error code 4), even if the error had no transaction hash, and stopped fallback from sending that transaction to the next node.

#5388 141f8c0ed7f5fdeafbfc514131781638e9340bd9 Thanks @jxom! - Added Account.serialize and Account.deserialize to viem/tempo, which store a configurable account (TIP-1107) as JSON and rebuild it with passkey owners that sign, and Account.AddressMismatchError for a version-zero config that does not derive the stored address. Added a keyAuthorization option to access key accounts, which attaches a signed key authorization to the account's transactions until the chain registers the access key.

#5318 57db085e896dfee3a3387fb7573bf7f7ebc6170d Thanks @jxom! - Fixed maxPriorityFeePerGas above a maxFeePerGas of 0n not raising TipAboveFeeCapError or MaxFeePerGasTooLowError (including in actions that validate requests before calling the node, such as call and estimateGas), and fixed fee error messages dropping 0n values.

#5370 18b6b9041ef9d19421d182e6b0ca4b1caf5be09e Thanks @jxom! - Fixed validateTypedData (and so hashTypedData and signTypedData) accepting field types that are not EIP-712 types, such as uint7, uint264, uint08, int0 or bytes0, and field types that reference a struct missing from types, including in structs only referenced as array elements; it now throws InvalidTypedDataTypeError.

... (truncated)

Commits

98aa491 chore: raise viem/ens size limit (#5398)
71241b2 chore: version package (#5393)
e1329c9 fix(tempo): check Gateway chain and refresh balances before payment errors (#...
c60ca26 feat(tempo): fund-aware Gateway payments and InsufficientFundsError (#5395)
264ab41 docs(tempo): use code groups with viem.config in Gateway guides (#5394)
721d682 feat(tempo): add experimental Gateway actions (#5391)
9348d38 perf: skip retries for method refusals and trim per-request overhead (#5392)
5711b7e chore: version package (#5363)
dbf8ae6 test: stabilize sendTransactionSync timeout and watchBlocks catch-up test...
141f8c0 feat(tempo): add Account.serialize, Account.deserialize and keyAuthorization ...
Additional commits viewable in compare view

Updates @tailwindcss/postcss from 4.3.3 to 4.3.5

Release notes

Sourced from @tailwindcss/postcss's releases.

v4.3.5

Fixed

Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)

Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)

Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)

Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)

Ignore  between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)

Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)

Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

v4.3.4

Added

Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)

Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)

Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)

Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)

Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)

Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)

Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)

Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)

Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)

Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)

Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)

Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)

Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)

Drop invalid UTF-8 candidates during class detection (#20389)

Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)

Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)

Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)

Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)

Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)

Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)

Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)

Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)

Improve style invalidation performance of group-* and peer-* variants (#20513)

Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)

Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)

Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)

Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)

Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)

Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)

Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)

Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)

Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)

... (truncated)

Changelog

Sourced from @tailwindcss/postcss's changelog.

[4.3.5] - 2026-11-06

Fixed

Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)

Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)

Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)

Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)

Ignore  between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)

Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)

Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

[4.3.4] - 2026-11-02

Added

Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)

Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)

Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)

Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)

Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)

Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)

Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)

Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)

Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)

Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)

Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)

Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)

Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)

Drop invalid UTF-8 candidates during class detection (#20389)

Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)

Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)

Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)

Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)

Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)

Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)

Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)

Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)

Improve style invalidation performance of group-* and peer-* variants (#20513)

Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)

Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)

Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)

Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)

Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)

Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)

Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)

... (truncated)

Commits

9b2c925 4.3.5 (#20672)
2626ae6 4.3.4 (#20447)
e8f8b19 Rewrite url(…)s of stylesheets inlined before @tailwindcss/postcss in opt...
931db16 Use margin-trim: block in the @property fallback detection (#20569)
05c3a87 Bump dependencies (#20381)
See full diff in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

See full diff in compare view

Updates eslint from 10.13.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)

827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)

161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)

6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)

9155e14 fix: Update @humanfs/node dependency version (#21434) (Nicholas C. Zakas)

cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)

5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)

dab466e docs: Update README (GitHub Actions Bot)

97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)

7697550 docs: Update README (GitHub Actions Bot)

0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)

0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)

e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)

6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])

a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)

67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)

276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])

449724e chore: update ecosystem plugins (#21420) (ESLint Bot)

8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

Commits

12cbff4 10.14.0
6b696e7 Build: changelog update for 10.14.0
0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
0f94f47 docs: remove zh-hans from docs language switcher (#21437)
dab466e docs: Update README
827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
161558a fix: handle LS, PS and empty hashbang comments (#21419)
Additional commits viewable in compare view

Updates eslint-config-next from 16.4.3 to 16.4.5

Release notes

Sourced from eslint-config-next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache

Cache leak across root param values in nested 'use cache' functions (follow-up)

Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params

Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments

Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses

SVG rejection bypass in Next.js image optimization

HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

[lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)

[lts-active] Reload on missed Turbopack startup CSS updates (#100619)

[lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)

[lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)

[lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)

[lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)

[lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @icyJoseph, @mischnic, @wbinnssmith, @lukesandberg, and @eps1lon for helping!

Commits

4e5335a v16.4.5
b175f52 v16.4.4
See full diff in compare view

Updates postcss from 8.5.31 to 8.5.32

Release notes

Sourced from postcss's releases.

8.5.32

Fixed Input#origin() without opts.from (by @wleeaf).

Fixed final-word lookup without source offsets (by @Don-Yin).

Fixed explicit start in Warning#toString() (by @Don-Yin).

Fixed Promise semantics in LazyResult#finally() (by @Don-Yin).

Changelog

Sourced from postcss's changelog.

8.5.32

Fixed Input#origin() without opts.from (by @wleeaf).

Fixed final-word lookup without source offsets (by @Don-Yin).

Fixed explicit start in Warning#toString() (by @Don-Yin).

Fixed Promise semantics in LazyResult#finally() (by @Don-Yin).

Commits

2455ac8 Release 8.5.32 version
e367106 Update dependencies
f70f586 Fix Input#origin() without from or with relative sourceRoot (#2179)
eb28619 Fix final-word lookup without source offsets (#2178)
095654b Preserve explicit start in Warning#toString() (#2177)
9b3d8b8 Preserve Promise semantics in result finally() (#2176)
See full diff in compare view

Updates tailwindcss from 4.3.3 to 4.3.5

Release notes

Sourced from tailwindcss's releases.

v4.3.5

Fixed

Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)

Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)

Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)

Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)

Ignore  between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)

Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)

Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

v4.3.4

Added

Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)

Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)

Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)

Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)

Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )Description has been truncated

Bumps the minor-and-patch group with 8 updates: | Package | From | To | | --- | --- | --- | | [next](https://github.com/vercel/next.js) | `16.4.3` | `16.4.5` | | [viem](https://github.com/wevm/viem) | `2.57.11` | `2.57.16` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.3.3` | `4.3.5` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` | | [eslint](https://github.com/eslint/eslint) | `10.13.0` | `10.14.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.3` | `16.4.5` | | [postcss](https://github.com/postcss/postcss) | `8.5.31` | `8.5.32` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.5` | Updates `next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.3...v16.4.5) Updates `viem` from 2.57.11 to 2.57.16 - [Release notes](https://github.com/wevm/viem/releases) - [Commits](https://github.com/wevm/viem/compare/viem@2.57.11...viem@2.57.16) Updates `@tailwindcss/postcss` from 4.3.3 to 4.3.5 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/@tailwindcss-postcss) Updates `@types/node` from 26.6.5 to 26.6.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.13.0 to 10.14.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.13.0...v10.14.0) Updates `eslint-config-next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/eslint-config-next) Updates `postcss` from 8.5.31 to 8.5.32 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.31...8.5.32) Updates `tailwindcss` from 4.3.3 to 4.3.5 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/tailwindcss) --- updated-dependencies: - dependency-name: next dependency-version: 16.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: viem dependency-version: 2.57.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@tailwindcss/postcss" dependency-version: 4.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 26.6.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: eslint dependency-version: 10.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: eslint-config-next dependency-version: 16.4.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: postcss dependency-version: 8.5.32 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tailwindcss dependency-version: 4.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-11-11T10:55:24Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ondo-nexus	Ready	Preview	Nov 11, 2026 10:56am UTC

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 11, 2026

vercel Bot deployed to Preview November 11, 2026 10:56

View deployment

Navigation Menu

Repository navigation

chore(deps): bump the minor-and-patch group with 8 updates - #66

chore(deps): bump the minor-and-patch group with 8 updates#66
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-dd816f7597

dependabot Bot commented on behalf of github Nov 11, 2026

Uh oh!

vercel Bot commented Nov 11, 2026 •

edited

Loading

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 11, 2026

v16.4.5

Moderate

v16.4.4

Core Changes

Credits

viem@2.57.16

Patch Changes

viem@2.57.15

Patch Changes

v4.3.5

Fixed

v4.3.4

Added

Fixed

[4.3.5] - 2026-11-06

Fixed

[4.3.4] - 2026-11-02

Added

Fixed

v10.14.0

Features

Bug Fixes

Documentation

Chores

v16.4.5

Moderate

v16.4.4

Core Changes

Credits

8.5.32

8.5.32

v4.3.5

Fixed

v4.3.4

Added

Fixed

Uh oh!

vercel Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented Nov 11, 2026 •

edited

Loading