Skip to content

pnpm dependency update 2026-06-22 - #628

Closed
commercelayer-ci wants to merge 1 commit into
mainfrom
chore/deps-update-202606221118
Closed

pnpm dependency update 2026-06-22#628
commercelayer-ci wants to merge 1 commit into
mainfrom
chore/deps-update-202606221118

Conversation

@commercelayer-ci

Copy link
Copy Markdown
Collaborator

Dependency update

Closes #625
Branch: chore/deps-update-202606221118
Based on stable: v6.5.3
Prerelease tag: v6.5.4-auto-deps-202606221119.0
Node.js: 20.x
pnpm: 10.x

Automated dependency update via pnpm. Review the dependency diff and validation output before merging.

Dependency update results

  • Check: success
  • Build: success
  • Test: skipped

Semver bump log

package.json
  cron-parser  ^5.5.0  →  ^5.6.0

Audit log

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ PostCSS has XSS via Unescaped </style> in its CSS      │
│                     │ Stringify Output                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ postcss                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <8.5.10                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.10                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>next>postcss                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-qx2v-qp2m-jg93      │
└─────────────────────┴────────────────────────────────────────────────────────┘
1 vulnerabilities found
Severity: 1 moderate

Major updates log not updated

package.json
  @adyen/adyen-web      6.28.0  →    6.40.0
  @commercelayer/sdk   ^6.57.0  →   ^7.11.0
  @types/async-retry     1.4.8  →     1.4.9
  @types/node         ^24.13.2  →   ^26.0.0
  @types/react        ^18.3.31  →  ^19.2.17
  npm-check-updates    ^19.6.6  →   ^22.2.7
  react                ^18.3.1  →   ^19.2.7
  react-dom            ^18.3.1  →   ^19.2.7
  react-i18next        ^16.6.6  →   ^17.0.8
  react-router-dom     ^6.30.4  →   ^7.18.0
  typescript            ^5.9.3  →    ^6.0.3

@commercelayer-ci commercelayer-ci added the dependencies Pull requests that update a dependency file label Jun 22, 2026
@commercelayer-ci commercelayer-ci self-assigned this Jun 22, 2026
@malessani malessani closed this Jun 23, 2026
@commercelayer-ci
commercelayer-ci deleted the chore/deps-update-202606221118 branch July 8, 2026 09:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[VANTA] [VULNERABILITY] <MEDIUM> CVE-2026-41305, fix before 2026-06-24

2 participants