Skip to content

Bump the npm_and_yarn group across 2 directories with 5 updates#20

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-f22d97da5e
Open

Bump the npm_and_yarn group across 2 directories with 5 updates#20
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-f22d97da5e

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 19, 2026

Bumps the npm_and_yarn group with 3 updates in the / directory: @tiptap/extension-link, next and pnpm.
Bumps the npm_and_yarn group with 3 updates in the /my-app directory: next, brace-expansion and js-yaml.

Updates @tiptap/extension-link from 2.0.0-beta.220 to 2.10.4

Changelog

Sourced from @​tiptap/extension-link's changelog.

2.10.4

Patch Changes

  • 1c2fefe: Added checks for allowed protocols in link commands & exported isValidUri helper for manual checks outside of the extension

2.10.3

2.10.2

2.10.1

2.10.0

Patch Changes

  • 7619215: The link extension's validate option now applies to both auto-linking and XSS mitigation. While, the new shouldAutoLink option is used to disable auto linking on an otherwise valid url.

2.9.1

2.9.0

2.8.0

Minor Changes

  • 6834a7f: Bundling of packages no longer includes tiptap dependency type definitions

2.7.4

2.7.3

2.7.2

2.7.1

2.7.0

2.7.0-pre.0

Patch Changes

  • Updated dependencies [97ea55f]
  • Updated dependencies [bd34793]
  • Updated dependencies [9e18d24]
  • Updated dependencies [f805333]
  • Updated dependencies [07fa49d]
  • Updated dependencies [7f24a66]
  • Updated dependencies [97ea55f]
  • Updated dependencies [a22767e]

... (truncated)

Commits
  • f2afde0 chore(release): release version 2.10.4 (#5947)
  • 1c2fefe Fixed Link extension's commands not respecting XSS prevention via unallowed p...
  • 7567ace chore(release): release version 2.10.3 (#5874)
  • ccd0147 fix(link): change type HTMLLinkElement to HTMLAnchorElement (#5858)
  • c5d87d6 chore(release): release version 2.10.2 (#5861)
  • 9d1c41e chore(release): publish a new release version (#5855)
  • 4b2de33 chore(release): release version 2.10.0 (#5843)
  • 7619215 revert: "chore(release): publish a new pre-release version (#5769)"
  • 177868a chore(release): publish a new pre-release version (#5769)
  • 62c6ddd fix(link): add backwards compat by deprecating validate and using isAllowedUr...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by nperez0111, a new releaser for @​tiptap/extension-link since your current version.


Updates next from 14.2.21 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

Updates pnpm from 9.15.9 to 10.30.0

Release notes

Sourced from pnpm's releases.

pnpm 10.30

Minor Changes

  • pnpm why now shows a reverse dependency tree. The searched package appears at the root with its dependents as branches, walking back to workspace roots. This replaces the previous forward-tree output which was noisy and hard to read for deeply nested dependencies.

Patch Changes

  • Revert pnpm why dependency pruning to prefer correctness over memory consumption. Reverted PR: #7122.
  • Optimize pnpm why and pnpm list performance in workspaces with many importers by sharing the dependency graph and materialization cache across all importers instead of rebuilding them independently for each one #10596.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.30.0

Minor Changes

  • pnpm why now shows a reverse dependency tree. The searched package appears at the root with its dependents as branches, walking back to workspace roots. This replaces the previous forward-tree output which was noisy and hard to read for deeply nested dependencies.

Patch Changes

  • Revert pnpm why dependency pruning to prefer correctness over memory consumption. Reverted PR: #7122.
  • Optimize pnpm why and pnpm list performance in workspaces with many importers by sharing the dependency graph and materialization cache across all importers instead of rebuilding them independently for each one #10596.

10.29.3

Patch Changes

  • Fixed an out-of-memory error in pnpm list (and pnpm why) on large dependency graphs by replacing the recursive tree builder with a two-phase approach: a BFS dependency graph followed by cached tree materialization. Duplicate subtrees are now deduplicated in the output, shown as "deduped (N deps hidden)" #10586.
  • Fixed allowBuilds not working when set via .pnpmfile.cjs #10516.
  • When the enableGlobalVirtualStore option is set, the pnpm deploy command would incorrectly create symlinks to the global virtual store. To keep the deploy directory self-contained, pnpm deploy now ignores this setting and always creates a localized virtual store within the deploy directory.
  • Fixed minimumReleaseAgeExclude not being respected by pnpm dlx #10338.

10.29.2

Patch Changes

  • Reverted a fix shipped in v10.29.1, which caused another issue #10571. Reverted fix: Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #10497.

10.29.1

Minor Changes

  • The pnpm dlx / pnpx command now supports the catalog: protocol. Example: pnpm dlx shx@catalog:.
  • Support configuring auditLevel in the pnpm-workspace.yaml file #10540.
  • Support bare workspace: protocol without version specifier. It is now treated as workspace:* and resolves to the concrete version during publish #10436.

Patch Changes

  • Fixed pnpm list --json returning incorrect paths when using global virtual store #10187.

  • Fix pnpm store path and pnpm store status using workspace root for path resolution when storeDir is relative #10290.

  • Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #10497.

  • Fixed a bug where catalogMode: strict would write the literal string "catalog:" to pnpm-workspace.yaml instead of the resolved version specifier when re-adding an existing catalog dependency #10176.

  • Fixed the documentation URL shown in pnpm completion --help to point to the correct page at https://pnpm.io/completion #10281.

  • Skip local file: protocol dependencies during pnpm fetch. This fixes an issue where pnpm fetch would fail in Docker builds when local directory dependencies were not available #10460.

  • Fixed pnpm audit --json to respect the --audit-level setting for both exit code and output filtering #10540.

  • update tar to version 7.5.7 to fix security issue

    Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: CVE-2026-24842

  • Fix pnpm audit --fix replacing reference overrides (e.g. $foo) with concrete versions #10325.

  • Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not being converted to publicHoistPattern #10271.

... (truncated)

Commits
  • d12c902 chore(release): 10.30.0
  • d203a71 feat: reverse pnpm why tree and improve list/why output (#10615)
  • f001ab7 chore(release): 10.29.3
  • 0d3798c fix(dlx): respect minimumReleaseAgeExclude (#10572)
  • 87d50fb docs: update sponsors
  • ea870c7 chore(release): 10.29.2
  • 595cd41 revert: "fix: allow pnpm run -r to work with empty pnpm-workspace.yaml (#10578)
  • 046c693 chore(release): 10.29.1
  • 607c2a6 fix: force isexe version that supports Node.js 18
  • 11202fc chore(release): 10.29.0
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for pnpm since your current version.


Updates next from 14.2.21 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

  • pkg: publish on tag 1.x c460dbd
  • fmt ccb8ac6
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 2 directories with 5 updates
578916b 
Bumps the npm_and_yarn group with 3 updates in the / directory: [@tiptap/extension-link](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-link), [next](https://github.com/vercel/next.js) and [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm).
Bumps the npm_and_yarn group with 3 updates in the /my-app directory: [next](https://github.com/vercel/next.js), [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml).


Updates `@tiptap/extension-link` from 2.0.0-beta.220 to 2.10.4
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/@tiptap/extension-link@2.10.4/packages/extension-link/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/@tiptap/extension-link@2.10.4/packages/extension-link)

Updates `next` from 14.2.21 to 15.5.10
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v14.2.21...v15.5.10)

Updates `pnpm` from 9.15.9 to 10.30.0
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/v10.30.0/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v10.30.0/pnpm)

Updates `next` from 14.2.21 to 15.5.10
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v14.2.21...v15.5.10)

Updates `brace-expansion` from 1.1.11 to 1.1.12
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

---
updated-dependencies:
- dependency-name: "@tiptap/extension-link"
  dependency-version: 2.10.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: pnpm
  dependency-version: 10.30.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 19, 2026
@vercel
Copy link

vercel bot commented Feb 19, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
zenithpaws.dev Error Error Feb 19, 2026 10:53am

@dependabot dependabot bot mentioned this pull request Feb 19, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants