Skip to content

chore(deps): bump the npm-production group across 1 directory with 20 updates - #911

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-production-378570e9c1
Open

chore(deps): bump the npm-production group across 1 directory with 20 updates#911
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-production-378570e9c1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-production group with 20 updates in the / directory:

Package From To
@stripe/stripe-js 9.13.0 9.16.0
eventsource-parser 3.1.1 4.1.0
structured-headers 2.0.3 2.1.0
zod 4.4.3 4.6.5
@hono/node-server 2.1.0 2.1.1
@x402/core 2.22.0 2.25.0
@x402/evm 2.22.0 2.25.0
@x402/express 2.22.0 2.25.0
viem 2.55.13 2.56.5
vite 8.2.1 8.3.0
@remix-run/node-fetch-server 0.14.0 0.14.1
bun 1.3.14 1.4.2
@tanstack/react-query 5.101.4 5.102.8
react 19.2.8 19.3.0
react-dom 19.2.8 19.3.0
wagmi 3.7.6 3.7.7
stripe 17.7.0 22.6.2
accounts 0.16.0 0.18.4
file-type 22.0.1 22.1.0
ox 0.14.33 1.7.4

Updates @stripe/stripe-js from 9.13.0 to 9.16.0

Release notes

Sourced from @​stripe/stripe-js's releases.

v9.16.0

  • Add Link Signup Element types (#969)
  • Add Custom Checkout tiered and package pricing types (#966)

New features

Fixes

Changed

v9.15.0

New features

  • Add types for stripe.createConfirmationToken params.metadata (#963)
  • Add buttonBoxShadow appearance variable type (#964)

v9.14.0

  • CPM in ECE - Update API types (#959)
  • Add types for new walletOptions top-level parameter for PE create/update (#952)
  • Add deprecation tag to onShippingDetailsChange for Embedded Checkout (#960)
  • Bump js-yaml from 3.15.0 to 3.15.1 (#958)

New features

Fixes

Changed

Commits
  • e03ec56 v9.16.0
  • 128ad21 Add Link Signup Element types (#969)
  • c83bfc1 Add Custom Checkout tiered and package pricing types (#966)
  • 9c83132 v9.15.0
  • ad774c5 Add types for stripe.createConfirmationToken params.metadata (#963)
  • 07adacf Add buttonBoxShadow appearance variable type (#964)
  • 8daa6fa v9.14.0
  • 16f79ed CPM in ECE - Update API types (#959)
  • 5ab3ba1 Add types for new walletOptions top-level parameter for PE create/update (#952)
  • bdd9b4b Add deprecation tag to onShippingDetailsChange for Embedded Checkout (#960)
  • Additional commits viewable in compare view

Updates eventsource-parser from 3.1.1 to 4.1.0

Release notes

Sourced from eventsource-parser's releases.

v4.1.0

Minor Changes

  • #39 0482048 Thanks @​rexxars! - Added an onId callback that reports ID fields when an event block ends, including blocks without data.

v4.0.0

Major Changes

  • #33 39cf365 Thanks @​rexxars! - Require Node.js 22.12 or higher, drop the CommonJS build, and discard invalid lines instead of buffering them

    Breaking changes

    • Node.js 18 and 20 are no longer supported. engines now requires >=22.12, and the browserslist target moved from node >= 18 to node >= 22.12. Older versions may keep working, but they are no longer tested or guaranteed.
    • The CommonJS build has been removed. The main field and the require export conditions are gone, so the package resolves to ./dist/index.js and ./dist/stream.js only. Node 22.12 and above supports require(esm) transparently, so require('eventsource-parser') continues to work there.
    • The root stream.js file has been removed. It re-exported ./dist/stream.cjs for React Native and other bundlers without package exports support. Import eventsource-parser/stream instead, and make sure your bundler resolves the exports field.
    • Invalid lines are now discarded as soon as the parser can tell they cannot become a valid SSE field, rather than being buffered until the line terminator arrives. onError is not called for these, and no line, field, or value is retained. Only lines that are complete when found to be invalid still produce a ParseError with type: 'unknown-field'. This also means reset({consume: true}) no longer reports pending data that was already discarded.
    • Partial comment lines (starting with :) are only buffered when an onComment callback is configured. Without one, they are discarded like any other line the parser has no use for.

    Other changes

    • A leading byte order mark is now stripped whether it arrives as a decoded U+FEFF (for example from a TextDecoder created with ignoreBOM) or as the raw three byte 0xEF 0xBB 0xBF sequence. Previously only the raw form was handled.
    • The README documented an invalid-field error type that the parser never emitted. The ErrorType union is unchanged; the documentation now correctly refers to unknown-field.
Changelog

Sourced from eventsource-parser's changelog.

4.1.0

Minor Changes

  • #39 0482048 Thanks @​rexxars! - Added an onId callback that reports ID fields when an event block ends, including blocks without data.

4.0.0

Major Changes

  • #33 39cf365 Thanks @​rexxars! - Require Node.js 22.12 or higher, drop the CommonJS build, and discard invalid lines instead of buffering them

    Breaking changes

    • Node.js 18 and 20 are no longer supported. engines now requires >=22.12, and the browserslist target moved from node >= 18 to node >= 22.12. Older versions may keep working, but they are no longer tested or guaranteed.
    • The CommonJS build has been removed. The main field and the require export conditions are gone, so the package resolves to ./dist/index.js and ./dist/stream.js only. Node 22.12 and above supports require(esm) transparently, so require('eventsource-parser') continues to work there.
    • The root stream.js file has been removed. It re-exported ./dist/stream.cjs for React Native and other bundlers without package exports support. Import eventsource-parser/stream instead, and make sure your bundler resolves the exports field.
    • Invalid lines are now discarded as soon as the parser can tell they cannot become a valid SSE field, rather than being buffered until the line terminator arrives. onError is not called for these, and no line, field, or value is retained. Only lines that are complete when found to be invalid still produce a ParseError with type: 'unknown-field'. This also means reset({consume: true}) no longer reports pending data that was already discarded.
    • Partial comment lines (starting with :) are only buffered when an onComment callback is configured. Without one, they are discarded like any other line the parser has no use for.

    Other changes

    • A leading byte order mark is now stripped whether it arrives as a decoded U+FEFF (for example from a TextDecoder created with ignoreBOM) or as the raw three byte 0xEF 0xBB 0xBF sequence. Previously only the raw form was handled.
    • The README documented an invalid-field error type that the parser never emitted. The ErrorType union is unchanged; the documentation now correctly refers to unknown-field.
Commits
  • 6519a0f chore: version packages (#40)
  • f54bf65 docs: clarify eventsource being cross-runtime, not node.js exclusive
  • 0482048 feat: add an onId callback (#39)
  • 202c19e chore: version packages (#36)
  • fde4ca2 ci: use a conventional commit subject for the version pull request (#38)
  • f32fda2 ci: generate changesets from conventional commit PR titles (#37)
  • c8cd582 chore: add changeset for #33
  • 39cf365 feat!: require node 22.12 or higher, drop commonjs, reduce memory usage (#33)
  • 0e767c4 docs: prepare CHANGELOG.md for changesets
  • f56f2d2 ci: replace semantic-release with changesets (#35)
  • See full diff in compare view

Updates structured-headers from 2.0.3 to 2.1.0

Release notes

Sourced from structured-headers's releases.

v2.1.0

  • Byte Sequences can now be serialized from any BufferSource such as a Uint8Array, a Node Buffer or a DataView.
Changelog

Sourced from structured-headers's changelog.

2.1.0 (2026-09-11)

  • Byte Sequences can now be serialized from any BufferSource such as a Uint8Array, a Node Buffer or a DataView.
Commits

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

  • d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
  • ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
  • cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
  • 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
  • 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

v4.6.1

A patch on top of 4.6.0.

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits
  • 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
  • 0f3f5ee 4.6.5
  • cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
  • ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
  • 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
  • de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
  • 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • 743aedb 4.6.4
  • Additional commits viewable in compare view

Updates @hono/node-server from 2.1.0 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

Commits

Updates @x402/core from 2.22.0 to 2.25.0

Commits

Updates @x402/evm from 2.22.0 to 2.25.0

Commits

Updates @x402/express from 2.22.0 to 2.25.0

Commits

Updates viem from 2.55.13 to 2.56.5

Release notes

Sourced from viem's releases.

viem@2.56.5

Patch Changes

viem@2.56.3

Patch Changes

viem@2.56.2

Patch Changes

viem@2.56.1

Patch Changes

viem@2.56.0

Minor Changes

... (truncated)

Commits

Updates vite from 8.2.1 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

Bug Fixes

  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

v8.3.0-beta.0

Features

  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
  • devtools: enable dev server integration (#23333) (68aeb8a)
  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
  • worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)
  • config: close bundles when generation fails (#23256) (6bacc95)
  • css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
  • deps: update all non-major dependencies (#23337) (d550815)
  • deps: update all non-major dependencies (#23404) (238ad81)
  • deps: update rolldown-related dependencies (#23338) (76e8082)
  • deps: update rolldown-related dependencies (#23405) (b882566)
  • dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
  • hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
  • utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
  • utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

... (truncated)

Commits

Updates @remix-run/node-fetch-server from 0.14.0 to 0.14.1

Release notes

Sourced from @​remix-run/node-fetch-server's releases.

node-fetch-server v0.14.1

Patch Changes

  • Request handlers now receive native Request instances instead of lazy request objects that emulated native requests. This fixes compatibility with standard APIs like new Request(request, init) that rely on native Request internals.
Changelog

Sourced from @​remix-run/node-fetch-server's changelog.

v0.14.1

Patch Changes

  • Request handlers now receive native Request instances instead of lazy request objects that emulated native requests. This fixes compatibility with standard APIs like new Request(request, init) that rely on native Request internals.
Commits

Updates bun from 1.3.14 to 1.4.2

Release notes

Sourced from bun's releases.

Bun v1.4.2

To install Bun v1.4.2

curl -fsSL https://bun.sh/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.2:

bun upgrade

Read Bun v1.4.2's release notes on Bun's blog

Thanks to 3 contributors!

Bun v1.4.1

To install Bun v1.4.1

curl -fsSL https://bun.sh/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.1:

bun upgrade

Read Bun v1.4.1's release notes on Bun's blog

Thanks to 7 contributors!

Description has been truncated

@dependabot
chore(deps): bump the npm-production group across 1 directory with 20…
1d678b0 
… updates

Bumps the npm-production group with 20 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@stripe/stripe-js](https://github.com/stripe/stripe-js) | `9.13.0` | `9.16.0` |
| [eventsource-parser](https://github.com/rexxars/eventsource-parser) | `3.1.1` | `4.1.0` |
| [structured-headers](https://github.com/evert/structured-header) | `2.0.3` | `2.1.0` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.5` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.0` | `2.1.1` |
| [@x402/core](https://github.com/x402-foundation/x402) | `2.22.0` | `2.25.0` |
| [@x402/evm](https://github.com/x402-foundation/x402) | `2.22.0` | `2.25.0` |
| [@x402/express](https://github.com/x402-foundation/x402) | `2.22.0` | `2.25.0` |
| [viem](https://github.com/wevm/viem) | `2.55.13` | `2.56.5` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.3.0` |
| [@remix-run/node-fetch-server](https://github.com/remix-run/remix/tree/HEAD/packages/node-fetch-server) | `0.14.0` | `0.14.1` |
| [bun](https://github.com/oven-sh/bun) | `1.3.14` | `1.4.2` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.102.8` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [wagmi](https://github.com/wevm/wagmi/tree/HEAD/packages/react) | `3.7.6` | `3.7.7` |
| [stripe](https://github.com/stripe/stripe-node) | `17.7.0` | `22.6.2` |
| [accounts](https://github.com/tempoxyz/accounts) | `0.16.0` | `0.18.4` |
| [file-type](https://github.com/sindresorhus/file-type) | `22.0.1` | `22.1.0` |
| [ox](https://github.com/wevm/ox) | `0.14.33` | `1.7.4` |



Updates `@stripe/stripe-js` from 9.13.0 to 9.16.0
- [Release notes](https://github.com/stripe/stripe-js/releases)
- [Commits](stripe/stripe-js@v9.13.0...v9.16.0)

Updates `eventsource-parser` from 3.1.1 to 4.1.0
- [Release notes](https://github.com/rexxars/eventsource-parser/releases)
- [Changelog](https://github.com/rexxars/eventsource-parser/blob/main/CHANGELOG.md)
- [Commits](rexxars/eventsource-parser@v3.1.1...v4.1.0)

Updates `structured-headers` from 2.0.3 to 2.1.0
- [Release notes](https://github.com/evert/structured-header/releases)
- [Changelog](https://github.com/evert/structured-headers/blob/main/changelog.md)
- [Commits](evert/structured-headers@v2.0.3...v2.1.0)

Updates `zod` from 4.4.3 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.5)

Updates `@hono/node-server` from 2.1.0 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.0...v2.1.1)

Updates `@x402/core` from 2.22.0 to 2.25.0
- [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/core@v2.22.0...npm-@x402/core@v2.25.0)

Updates `@x402/evm` from 2.22.0 to 2.25.0
- [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/evm@v2.22.0...npm-@x402/evm@v2.25.0)

Updates `@x402/express` from 2.22.0 to 2.25.0
- [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/express@v2.22.0...npm-@x402/express@v2.25.0)

Updates `viem` from 2.55.13 to 2.56.5
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.55.13...viem@2.56.5)

Updates `vite` from 8.2.1 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

Updates `@remix-run/node-fetch-server` from 0.14.0 to 0.14.1
- [Release notes](https://github.com/remix-run/remix/releases)
- [Changelog](https://github.com/remix-run/remix/blob/main/packages/node-fetch-server/CHANGELOG.md)
- [Commits](https://github.com/remix-run/remix/commits/v0.14.1/packages/node-fetch-server)

Updates `bun` from 1.3.14 to 1.4.2
- [Release notes](https://github.com/oven-sh/bun/releases)
- [Commits](oven-sh/bun@bun-v1.3.14...bun-v1.4.2)

Updates `@tanstack/react-query` from 5.101.4 to 5.102.8
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.8/packages/react-query)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `wagmi` from 3.7.6 to 3.7.7
- [Release notes](https://github.com/wevm/wagmi/releases)
- [Changelog](https://github.com/wevm/wagmi/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/wevm/wagmi/commits/wagmi@3.7.7/packages/react)

Updates `stripe` from 17.7.0 to 22.6.2
- [Release notes](https://github.com/stripe/stripe-node/releases)
- [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-node@v17.7.0...v22.6.2)

Updates `accounts` from 0.16.0 to 0.18.4
- [Release notes](https://github.com/tempoxyz/accounts/releases)
- [Changelog](https://github.com/tempoxyz/accounts/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tempoxyz/accounts/compare/accounts@0.16.0...accounts@0.18.4)

Updates `file-type` from 22.0.1 to 22.1.0
- [Release notes](https://github.com/sindresorhus/file-type/releases)
- [Commits](sindresorhus/file-type@v22.0.1...v22.1.0)

Updates `ox` from 0.14.33 to 1.7.4
- [Release notes](https://github.com/wevm/ox/releases)
- [Changelog](https://github.com/wevm/ox/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/ox/compare/ox@0.14.33...ox@1.7.4)

---
updated-dependencies:
- dependency-name: "@stripe/stripe-js"
  dependency-version: 9.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: eventsource-parser
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-production
- dependency-name: structured-headers
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: "@x402/core"
  dependency-version: 2.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: "@x402/evm"
  dependency-version: 2.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: "@x402/express"
  dependency-version: 2.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: viem
  dependency-version: 2.56.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: "@remix-run/node-fetch-server"
  dependency-version: 0.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: bun
  dependency-version: 1.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.102.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: wagmi
  dependency-version: 3.7.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: stripe
  dependency-version: 22.6.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-production
- dependency-name: accounts
  dependency-version: 0.18.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: file-type
  dependency-version: 22.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: ox
  dependency-version: 1.7.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 21, 2026
@socket-security

socket-security Bot commented Sep 21, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​types/​react-dom@​19.2.4 ⏵ 19.3.0100 +110075 +192100
Updated@​types/​react@​19.2.18 ⏵ 19.3.01001007993100
Updatedbun@​1.3.14 ⏵ 1.4.292 +11007997 +8100
Updatedwagmi@​3.7.6 ⏵ 3.7.71001007995100
Added@​types/​node@​26.6.21001008196100
Addedtsx@​4.23.131001008193100
Updatedvite@​8.2.1 ⏵ 8.3.09910082 +196 +1100
Updatedreact@​19.2.8 ⏵ 19.3.0100 +110084 +197100
Updatedstructured-headers@​2.0.3 ⏵ 2.1.0100 +110010088 +3100
Addedeventsource-parser@​4.1.010010010090100
Updated@​tanstack/​react-query@​5.101.4 ⏵ 5.102.89910091 +498100
Updated@​hono/​node-server@​2.1.0 ⏵ 2.1.1100 +110010092100
Updatedreact-dom@​19.2.8 ⏵ 19.3.010010092 +198100
Updatedfile-type@​22.0.1 ⏵ 22.1.0100 +1100100 +193100
Updatedzod@​4.4.3 ⏵ 4.6.510010010095 -1100
Updated@​x402/​express@​2.22.0 ⏵ 2.25.098 +1100100 +195 -1100
Updated@​x402/​evm@​2.22.0 ⏵ 2.25.0100100100 +195 -1100
Updatedox@​0.14.33 ⏵ 1.7.4100 +110099 +196 -1100
Updatedstripe@​17.7.0 ⏵ 22.6.29910010096100
Updatedaccounts@​0.16.0 ⏵ 0.18.497 +19100100 +198100
Added@​x402/​core@​2.25.010010010097100
Updated@​stripe/​stripe-js@​9.13.0 ⏵ 9.16.0100 +1100100100 +2100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants