Skip to content

Chore(deps): bump the dependencies group in /with-next-page-router with 5 updates - #153

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/with-next-page-router/dependencies-22f312fbb5
Closed

Chore(deps): bump the dependencies group in /with-next-page-router with 5 updates#153
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/with-next-page-router/dependencies-22f312fbb5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 11, 2026 •
edited by cubic-dev-ai Bot
Loading

Copy link
Copy Markdown

Bumps the dependencies group in /with-next-page-router with 5 updates:

Package From To
@rainbow-me/rainbowkit 2.1.7 2.2.11
@rainbow-me/rainbowkit-siwe-next-auth 0.4.1 0.6.0
next-themes 0.3.0 0.4.6
viem 2.21.7 2.55.10
postcss 8.5.23 8.5.25

Updates @rainbow-me/rainbowkit from 2.1.7 to 2.2.11

Release notes

Sourced from @​rainbow-me/rainbowkit's releases.

@​rainbow-me/rainbowkit@​2.2.11

Patch Changes

  • a40b1f4: Migrate the Base connector to canonical base naming, while preserving backwards-compatible aliases baseAccount and coinbaseWallet.

  • 3672dc6: Added Anchorage Digital wallet support with the anchorageDigitalWallet wallet connector.

  • 1043d88: Added MeCo Wallet support with mecoWallet wallet connector.

  • f52657f: Exposed RainbowKitProviderProps and WalletButtonRendererProps as public type exports to support Custom Wallet Button scenarios.

  • 4f2de17: Fixed a crash that could occur when selecting a wallet while multiple browser wallet extensions were installed and the specific injected wallet was missing. Wallet-specific injected connectors now bind only to their matching provider instead of falling back to available defaults.

  • bc4625c: Fix recent transaction tracking so failed transactions no longer prevent an app's own transaction receipt wait from settling.

  • 25c4c2b: Improved SSR safety to prevent WalletConnect initialization warnings and mitigate localStorage API availability changes in Node.js v25 and above.

  • f52657f: Fixed useWindowSize triggering a state update after unmount, which could surface as a React warning.

  • eb4251d: The AuthenticationAdapter.createMessage API can now return a promise, so dApps can fetch or construct a custom SIWE message asynchronously. This enables server-side SIWE message creation before prompting the wallet, while preserving existing synchronous behavior.

    See the server-side message creation docs for guidance.

  • b0f6d52: fix: harden useCoolMode against malicious wallet icon URLs

    The cool mode particle animation built image elements via innerHTML, which parses its input as HTML. A malicious EIP-6963 wallet could supply a crafted icon URL containing injected attributes (e.g. onerror) that would execute in the dApp's origin when a user interacts with the wallet button.

    Switched to document.createElement('img') with property assignment so the icon value is always treated as a plain URL rather than markup.

  • f2523a9: Updated MetaMask wallet icon

@​rainbow-me/rainbowkit@​2.2.10

Patch Changes

  • e74f604: Improve UI on the mobile connect flow to hint to users that they can horizontally scroll to see additional wallet connectors

  • eb72c37: Fix Gemini wallet connector to use icon instead of icons in appMetadata

  • e58367e: Fix mobile visibility for Coin98, CLV, SafePal, Frontier, and BeraSig wallets.

  • b7b7b43: Rename the Argent wallet connector to readyWallet

  • 507f583: Add additional wallet flags to isMetaMask() to detect impersonating providers.

  • 16963de: Add ctrlWallet wallet connector to replace xdefiWallet. XDEFI Wallet has been rebranded to CTRL Wallet.

  • 6c745a5: Disable third-party connector telemetry by default for user privacy. h/t @​TimDaub

    To opt-in to WalletConnect analytics:

    With getDefaultConfig:

    const config = getDefaultConfig({
  /** ... **/
  walletConnectParameters: {
    telemetryEnabled: true,
  },
});

... (truncated)

Changelog

Sourced from @​rainbow-me/rainbowkit's changelog.

2.2.11

Patch Changes

  • a40b1f4: Migrate the Base connector to canonical base naming, while preserving backwards-compatible aliases baseAccount and coinbaseWallet.

  • 3672dc6: Added Anchorage Digital wallet support with the anchorageDigitalWallet wallet connector.

  • 1043d88: Added MeCo Wallet support with mecoWallet wallet connector.

  • f52657f: Exposed RainbowKitProviderProps and WalletButtonRendererProps as public type exports to support Custom Wallet Button scenarios.

  • 4f2de17: Fixed a crash that could occur when selecting a wallet while multiple browser wallet extensions were installed and the specific injected wallet was missing. Wallet-specific injected connectors now bind only to their matching provider instead of falling back to available defaults.

  • bc4625c: Fix recent transaction tracking so failed transactions no longer prevent an app's own transaction receipt wait from settling.

  • 25c4c2b: Improved SSR safety to prevent WalletConnect initialization warnings and mitigate localStorage API availability changes in Node.js v25 and above.

  • f52657f: Fixed useWindowSize triggering a state update after unmount, which could surface as a React warning.

  • eb4251d: The AuthenticationAdapter.createMessage API can now return a promise, so dApps can fetch or construct a custom SIWE message asynchronously. This enables server-side SIWE message creation before prompting the wallet, while preserving existing synchronous behavior.

    See the server-side message creation docs for guidance.

  • b0f6d52: fix: harden useCoolMode against malicious wallet icon URLs

    The cool mode particle animation built image elements via innerHTML, which parses its input as HTML. A malicious EIP-6963 wallet could supply a crafted icon URL containing injected attributes (e.g. onerror) that would execute in the dApp's origin when a user interacts with the wallet button.

    Switched to document.createElement('img') with property assignment so the icon value is always treated as a plain URL rather than markup.

  • f2523a9: Updated MetaMask wallet icon

2.2.10

Patch Changes

  • e74f604: Improve UI on the mobile connect flow to hint to users that they can horizontally scroll to see additional wallet connectors

  • eb72c37: Fix Gemini wallet connector to use icon instead of icons in appMetadata

  • e58367e: Fix mobile visibility for Coin98, CLV, SafePal, Frontier, and BeraSig wallets.

  • b7b7b43: Rename the Argent wallet connector to readyWallet

  • 507f583: Add additional wallet flags to isMetaMask() to detect impersonating providers.

  • 16963de: Add ctrlWallet wallet connector to replace xdefiWallet. XDEFI Wallet has been rebranded to CTRL Wallet.

  • 6c745a5: Disable third-party connector telemetry by default for user privacy. h/t @​TimDaub

    To opt-in to WalletConnect analytics:

    With getDefaultConfig:

    const config = getDefaultConfig({
  /** ... **/
  walletConnectParameters: {
    telemetryEnabled: true,
  },

... (truncated)

Commits

Updates @rainbow-me/rainbowkit-siwe-next-auth from 0.4.1 to 0.6.0

Release notes

Sourced from @​rainbow-me/rainbowkit-siwe-next-auth's releases.

@​rainbow-me/rainbowkit-siwe-next-auth@​0.6.0

Minor Changes

  • e90c2dd: Upgraded to NextAuth v5. This is a breaking change.

    Key changes:

    • Requires NextAuth v5 (next-auth >=5.0.0-0 <6); NextAuth v4 apps must migrate before upgrading.
    • NextAuth server configuration now uses v5 APIs like NextAuthConfig, Credentials, and the exported auth helper.
    • Pages Router server calls must pass req and res separately to auth; passing the full GetServerSidePropsContext is no longer valid.
    • NextAuth v5 internal cookies use authjs names, including authjs.csrf-token or __Host-authjs.csrf-token for CSRF depending on secure-cookie settings.
    • CSRF nonce validation now compares the SIWE nonce against the csrfToken value that NextAuth v5 posts to the Credentials provider, instead of parsing CSRF cookies from request headers.

    Migration guide:

    1. Upgrade next-auth to v5 and upgrade @rainbow-me/rainbowkit-siwe-next-auth.
    - npm install next-auth@^4 @rainbow-me/rainbowkit-siwe-next-auth
+ npm install next-auth@5.0.0-beta.31 @rainbow-me/rainbowkit-siwe-next-auth
    1. Update your NextAuth server configuration to the v5 API.
    - import type { NextAuthOptions } from 'next-auth';
- import CredentialsProvider from 'next-auth/providers/credentials';
+ import NextAuth from 'next-auth';
+ import type { NextAuthConfig } from 'next-auth';
+ import Credentials from 'next-auth/providers/credentials';

export const authOptions: NextAuthOptions = {


export const authOptions: NextAuthConfig = {
providers: [



CredentialsProvider({





Credentials({
  async authorize(credentials) {
    /* your SIWE validation */
  },
}),

],
};

export const { handlers, auth, signIn, signOut } = NextAuth(authOptions);
  1. Update Pages Router server-side session lookups to use the exported auth helper. Pass req and res separately; passing the full GetServerSidePropsContext is not supported by the v5 overloads.
- import { getServerSession } from 'next-auth';

... (truncated)

Changelog

Sourced from @​rainbow-me/rainbowkit-siwe-next-auth's changelog.

0.6.0

Minor Changes

  • e90c2dd: Upgraded to NextAuth v5. This is a breaking change.

    Key changes:

    • Requires NextAuth v5 (next-auth >=5.0.0-0 <6); NextAuth v4 apps must migrate before upgrading.
    • NextAuth server configuration now uses v5 APIs like NextAuthConfig, Credentials, and the exported auth helper.
    • Pages Router server calls must pass req and res separately to auth; passing the full GetServerSidePropsContext is no longer valid.
    • NextAuth v5 internal cookies use authjs names, including authjs.csrf-token or __Host-authjs.csrf-token for CSRF depending on secure-cookie settings.
    • CSRF nonce validation now compares the SIWE nonce against the csrfToken value that NextAuth v5 posts to the Credentials provider, instead of parsing CSRF cookies from request headers.

    Migration guide:

    1. Upgrade next-auth to v5 and upgrade @rainbow-me/rainbowkit-siwe-next-auth.
    - npm install next-auth@^4 @rainbow-me/rainbowkit-siwe-next-auth
+ npm install next-auth@5.0.0-beta.31 @rainbow-me/rainbowkit-siwe-next-auth
    1. Update your NextAuth server configuration to the v5 API.
    - import type { NextAuthOptions } from 'next-auth';
- import CredentialsProvider from 'next-auth/providers/credentials';
+ import NextAuth from 'next-auth';
+ import type { NextAuthConfig } from 'next-auth';
+ import Credentials from 'next-auth/providers/credentials';

export const authOptions: NextAuthOptions = {


export const authOptions: NextAuthConfig = {
providers: [



CredentialsProvider({





Credentials({
  async authorize(credentials) {
    /* your SIWE validation */
  },
}),

],
};

export const { handlers, auth, signIn, signOut } = NextAuth(authOptions);
  1. Update Pages Router server-side session lookups to use the exported auth helper. Pass req and res separately; passing the full GetServerSidePropsContext is not supported by the v5 overloads.







... (truncated)





Commits






Updates next-themes from 0.3.0 to 0.4.6



Release notes

Sourced from next-themes's releases.




v0.4.6


What's Changed



New Contributors



Full Changelog: pacocoursey/next-themes@v0.4.5...v0.4.6


v0.4.5


What's Changed



New Contributors



Full Changelog: pacocoursey/next-themes@v0.4.4...v0.4.5


v0.4.4


What's Changed



New Contributors



Full Changelog: pacocoursey/next-themes@v0.4.3...v0.4.4


v0.4.3


What's Changed


    

  • Pass nonce to inline style tag when using disableTransitionOnChange
    • 



Full Changelog: pacocoursey/next-themes@v0.4.2...v0.4.3


v0.4.2


What's Changed



New Contributors



Full Changelog: pacocoursey/next-themes@v0.4.1...v0.4.2





... (truncated)





Commits

    

  • 3a43743 v0.4.6
    • 

  • f5be1b2 fix: add null check for value in updateDOM function to prevent runtime errors...
    • 

  • c178917 v0.4.5
    • 

  • d12996b chore: Fix corepack errors in CI (#342)
    • 

  • b77db23 Bump the npm_and_yarn group across 1 directory with 7 updates (#341)
    • 

  • d3fa4ee Bump next from 14.2.10 to 14.2.15 in the npm_and_yarn group across 1 director...
    • 

  • ad83567 Reduce number of renders by pre-setting resolvedTheme (#338)
    • 

  • 1b51044 fix: map theme to class using ValueObject in injected script (#330)
    • 

  • 57c0561 v0.4.4
    • 

  • ae2ab9b fix: infinite loop theme flicker (#329)
    • 

  • Additional commits viewable in compare view
    • 







Updates viem from 2.21.7 to 2.55.10



Release notes

Sourced from viem's releases.




viem@2.55.10


Patch Changes



viem@2.55.8


Patch Changes



viem@2.55.7


Patch Changes



viem@2.55.5


Patch Changes






... (truncated)





Commits





Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for viem since your current version.






Updates postcss from 8.5.23 to 8.5.25



Release notes

Sourced from postcss's releases.




8.5.25


    

  • Fixed 8.5.17 visitor regression.
    • 

  • Fixed list.split() for non-string values (by @​amir-rezaei).
    • 



8.5.24


    

  • Preserve the BOM after the processing (by @​hdimer).
    • 








Changelog

Sourced from postcss's changelog.




8.5.25


    

  • Fixed 8.5.17 visitor regression.
    • 

  • Fixed list.split() for non-string values (by @​amir-rezaei).
    • 



8.5.24


    

  • Preserve the BOM after the processing (by @​hdimer).
    • 








Commits






Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • 

  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • 

  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    • 








View with [code]smith Autofix with [code]smith

Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.





Review in cubic


    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          Chore(deps): bump the dependencies group
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          74d79c5
        
      

    

  

    

      
Bumps the dependencies group in /with-next-page-router with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [@rainbow-me/rainbowkit](https://github.com/rainbow-me/rainbowkit/tree/HEAD/packages/rainbowkit) | `2.1.7` | `2.2.11` |
| [@rainbow-me/rainbowkit-siwe-next-auth](https://github.com/rainbow-me/rainbowkit/tree/HEAD/packages/rainbowkit-siwe-next-auth) | `0.4.1` | `0.6.0` |
| [next-themes](https://github.com/pacocoursey/next-themes) | `0.3.0` | `0.4.6` |
| [viem](https://github.com/wevm/viem) | `2.21.7` | `2.55.10` |
| [postcss](https://github.com/postcss/postcss) | `8.5.23` | `8.5.25` |


Updates `@rainbow-me/rainbowkit` from 2.1.7 to 2.2.11
- [Release notes](https://github.com/rainbow-me/rainbowkit/releases)
- [Changelog](https://github.com/rainbow-me/rainbowkit/blob/main/packages/rainbowkit/CHANGELOG.md)
- [Commits](https://github.com/rainbow-me/rainbowkit/commits/@rainbow-me/rainbowkit@2.2.11/packages/rainbowkit)

Updates `@rainbow-me/rainbowkit-siwe-next-auth` from 0.4.1 to 0.6.0
- [Release notes](https://github.com/rainbow-me/rainbowkit/releases)
- [Changelog](https://github.com/rainbow-me/rainbowkit/blob/main/packages/rainbowkit-siwe-next-auth/CHANGELOG.md)
- [Commits](https://github.com/rainbow-me/rainbowkit/commits/@rainbow-me/rainbowkit-siwe-next-auth@0.6.0/packages/rainbowkit-siwe-next-auth)

Updates `next-themes` from 0.3.0 to 0.4.6
- [Release notes](https://github.com/pacocoursey/next-themes/releases)
- [Commits](pacocoursey/next-themes@v0.3.0...v0.4.6)

Updates `viem` from 2.21.7 to 2.55.10
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.21.7...viem@2.55.10)

Updates `postcss` from 8.5.23 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.23...8.5.25)

---
updated-dependencies:
- dependency-name: "@rainbow-me/rainbowkit"
  dependency-version: 2.2.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@rainbow-me/rainbowkit-siwe-next-auth"
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: next-themes
  dependency-version: 0.4.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: viem
  dependency-version: 2.55.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  javascript

  Pull requests that update javascript code

  labels


      Aug 11, 2026

    

  








      

  
      



  

  @socket-security






  



    

      

  

    

      
          
      

      
            socket-security
    Bot

      

      

      commented


        Aug 11, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          
Dependency limit exceeded — report not shown.


This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.


Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.


Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.



      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
            

    

      
    

    


      


          @yosriady
yosriady




          closed this


      Aug 11, 2026

    

  


    







      

  
      



  

  @dependabot


    @github




  



    

      

  

    

      
          
      

      
            dependabot
    Bot

      

      

      commented

        on behalf of github

        Aug 11, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

  Author


    

  





      


        



  
    

      
          
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.


To ignore these dependencies, configure ignore rules in dependabot.yml


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
          

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

        
    deleted the
    
      
        dependabot/npm_and_yarn/with-next-page-router/dependencies-22f312fbb5
    
    branch

        August 11, 2026 10:46        
        
      

    










      

  
      



  

  @yosriady


    
      ChatGPT Codex Connector
    




  



    

      

  

    

      
          
      

      
            yosriady
    

      

      

      commented


        Aug 11, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        

  
    Contributor


        

    

  





      


        



  
    

      
          
Superseded by #208, which consolidates, security-reviews, and locally validates the dependency updates. Incompatible major versions are intentionally held on supported combinations and documented in the replacement PR.


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    
















  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    

    No reviews







  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    javascript

  Pull requests that update javascript code








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      1 participant
    

    

        
          @yosriady