chore(deps): bump the npm_and_yarn group across 5 directories with 5 updates by dependabot[bot] · Pull Request #3966 · FuelLabs/fuels-ts

dependabot · 2026-03-26T23:42:34Z

Bumps the npm_and_yarn group with 4 updates in the / directory: glob, next, markdown-it and bn.js.
Bumps the npm_and_yarn group with 1 update in the /apps/demo-nextjs directory: next.
Bumps the npm_and_yarn group with 1 update in the /apps/demo-wallet-sdk-react directory: next.
Bumps the npm_and_yarn group with 1 update in the /packages/math directory: bn.js.
Bumps the npm_and_yarn group with 1 update in the /templates/nextjs directory: next.

Updates glob from 10.4.5 to 12.0.0

Changelog

Sourced from glob's changelog.

changeglob

13

Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)

Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.

Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

Drop support for node before v20

10.4

Add includeChildMatches: false option

Export the Ignore class

10.3

Add --default -p flag to provide a default pattern

exclude symbolic links to directories when follow and nodir are both set

10.2

Add glob cli

10.1

Return '.' instead of the empty string '' when the current working directory is returned as a match.

Add posix: true option to return / delimited paths, even on

... (truncated)

Commits

2b03cca 12.0.0
d56203d prettier config
bb521e5 Remove --shell option where unsafe to use
2551fb5 11.1.0
47473c0 bin: Do not expose filenames to shell expansion
bc33fe1 skip tilde test on systems that lack tilde expansion
59bf9ca fix notes
dde4fa6 docs(README): add #anchor and improve notes
0559b0e docs: add better links to path-scurry docs
c9773c2 fix: correct typos in README.md
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for glob since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates next from 15.2.4 to 15.5.14

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)

Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @styfle and @lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

Commits

d7b012d v15.5.14
2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
cfd5f53 v15.5.13
15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
d23f41c v15.5.12
8e75765 fix unlock in publish-native
6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
7a94645 Apply needs for publishRelease
bbfd4e3 v15.5.11
Additional commits viewable in compare view

Updates markdown-it from 14.1.0 to 14.1.1

Changelog

Sourced from markdown-it's changelog.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

Commits

b4a9b65 14.1.1 released
4b4bbca Fixed perf regression in linkify-it wrapper
d2782d8 Add supplementary example-driven documentation (#1092)
See full diff in compare view

Updates bn.js from 5.2.1 to 5.2.3

Changelog

Sourced from bn.js's changelog.

5.2.3 / 2026-02-19

fix: imaskn state (#317)

5.2.2 / 2025-04-25

fix: imuln/muln with zero (#313)

Commits

ea6c072 5.2.3
33df26b fix imaskn state (#317)
6db7c38 5.2.2
c7e1a53 Fix imuln/muln with zero (#313)
4cc0bfa docs: mention the max plain JS number argument value (#307)
5df40f8 Document length unit in toBuffer(...) input (#299)
See full diff in compare view

Updates fast-xml-parser from 4.5.3 to 4.5.5

Release notes

Sourced from fast-xml-parser's releases.

Summary update on all the previous releases from v4.2.4

Multiple minor fixes provided in the validator and parser

v6 is added for experimental use.

ignoreAttributes support function, and array of string or regex

Add support for parsing HTML numeric entities

v5 of the application is ESM module now. However, JS is also supported

Note: Release section in not updated frequently. Please check CHANGELOG or Tags for latest release information.

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.5.9 / 2026-03-23

combine typing files

4.5.5 / 2026-03-22

apply fixes from v5 (legacy maintenance branch v4-maintenance)

support maxEntityCount

support onDangerousProperty

support maxNestedTags

handle prototype pollution

fix incorrect entity name replacement

fix incorrect condition for entity expansion

5.5.8 / 2026-03-20

pass read only matcher in callback

5.5.7 / 2026-03-19

fix: entity expansion limits

update strnum package to 2.2.0

5.5.6 / 2026-03-16

update builder dependency

fix incorrect regex to replace . in entity name

fix check for entitiy expansion for lastEntities and html entities too

5.5.5 / 2026-03-13

sanitize dangerous tag or attribute name

error on critical property name

support onDangerousProperty option

5.5.4 / 2026-03-13

declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

5.5.3 / 2026-03-11

upgrade builder

5.5.2 / 2026-03-11

update dependency to fix typings

5.5.1 / 2026-03-10

fix dependency

... (truncated)

Commits

88d0936 apply all fixes from v5
d4eb6b4 update release version
See full diff in compare view

Updates next from 15.2.4 to 15.5.14

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)

Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @styfle and @lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

Commits

d7b012d v15.5.14
2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
cfd5f53 v15.5.13
15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
d23f41c v15.5.12
8e75765 fix unlock in publish-native
6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
7a94645 Apply needs for publishRelease
bbfd4e3 v15.5.11
Additional commits viewable in compare view

Updates next from 15.2.4 to 15.5.14

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)

Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @styfle and @lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

Commits

d7b012d v15.5.14
2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
cfd5f53 v15.5.13
15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
d23f41c v15.5.12
8e75765 fix unlock in publish-native
6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
7a94645 Apply needs for publishRelease
bbfd4e3 v15.5.11
Additional commits viewable in compare view

Updates bn.js from 5.2.1 to 5.2.3

Changelog

Sourced from bn.js's changelog.

5.2.3 / 2026-02-19

fix: imaskn state (#317)

5.2.2 / 2025-04-25

fix: imuln/muln with zero (#313)

Commits

ea6c072 5.2.3
33df26b fix imaskn state (#317)
6db7c38 5.2.2
c7e1a53 Fix imuln/muln with zero (#313)
4cc0bfa docs: mention the max plain JS number argument value (#307)
5df40f8 Document length unit in toBuffer(...) input (#299)
See full diff in compare view

Updates next from 15.2.4 to 15.5.14

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)

Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @styfle and @lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

Commits

d7b012d v15.5.14
2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
cfd5f53 v15.5.13
15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
d23f41c v15.5.12
8e75765 fix unlock in publish-native
6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
7a94645 Apply needs for publishRelease
bbfd4e3 v15.5.11
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 4 updates in the / directory: [glob](https://github.com/isaacs/node-glob), [next](https://github.com/vercel/next.js), [markdown-it](https://github.com/markdown-it/markdown-it) and [bn.js](https://github.com/indutny/bn.js). Bumps the npm_and_yarn group with 1 update in the /apps/demo-nextjs directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /apps/demo-wallet-sdk-react directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/math directory: [bn.js](https://github.com/indutny/bn.js). Bumps the npm_and_yarn group with 1 update in the /templates/nextjs directory: [next](https://github.com/vercel/next.js). Updates `glob` from 10.4.5 to 12.0.0 - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v10.4.5...v12.0.0) Updates `next` from 15.2.4 to 15.5.14 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.2.4...v15.5.14) Updates `markdown-it` from 14.1.0 to 14.1.1 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.0...14.1.1) Updates `bn.js` from 5.2.1 to 5.2.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v5.2.1...v5.2.3) Updates `fast-xml-parser` from 4.5.3 to 4.5.5 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v4.5.3...v4.5.5) Updates `next` from 15.2.4 to 15.5.14 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.2.4...v15.5.14) Updates `next` from 15.2.4 to 15.5.14 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.2.4...v15.5.14) Updates `bn.js` from 5.2.1 to 5.2.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v5.2.1...v5.2.3) Updates `next` from 15.2.4 to 15.5.14 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.2.4...v15.5.14) --- updated-dependencies: - dependency-name: glob dependency-version: 12.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.14 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.1.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 5.2.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-xml-parser dependency-version: 4.5.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.14 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.14 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 5.2.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.14 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

cursor · 2026-03-26T23:42:40Z

PR Summary

Medium Risk
Primarily dependency version bumps, but glob has a major-version jump and Next.js upgrades can introduce build/runtime regressions across the demo apps/template.

Overview
Updates dependency versions across the monorepo: Next.js is bumped to 15.5.14 in apps/demo-nextjs, apps/demo-wallet-sdk-react, and the templates/nextjs template.

Also bumps glob to 12.0.0 (root + apps/docs + several packages), updates markdown-it to 14.1.1 in docs, and bumps bn.js to 5.2.3 in @fuel-ts/math.

^{Written by Cursor Bugbot for commit c4926c0. This will update automatically on new commits. Configure here.}

github-actions · 2026-03-26T23:47:53Z

Temporary PR

This PR is published in AWS CodeArtifact with version: pr-3966

Install using the below commands — create-fuels variations are commented out.

PNPM

pnpm config set registry https://npm-packages.fuel.network/ --global
pnpm install fuels@pr-3966
# pnpm create fuels@pr-3966

NPM

npm --registry=https://npm-packages.fuel.network/ install fuels@pr-3966
# npm --registry=https://npm-packages.fuel.network/ create fuels@pr-3966

Bun

npm_config_registry=https://npm-packages.fuel.network/ bun install fuels@pr-3966
# npm_config_registry=https://npm-packages.fuel.network/ bun create fuels@pr-3966

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 26, 2026

dependabot bot requested review from helciofranco and nelitow as code owners March 26, 2026 23:42

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 26, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 5 directories with 5 updates#3966

chore(deps): bump the npm_and_yarn group across 5 directories with 5 updates#3966
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-3944b7f439

dependabot bot commented on behalf of github Mar 26, 2026

Uh oh!

cursor bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 26, 2026

changeglob

13

12

11.1

11.0

10.4

10.3

10.2

10.1

v15.5.14

Core Changes

Credits

v15.5.13

Core Changes

Credits

v15.5.12

[14.1.1] - 2026-01-11

Security

5.2.3 / 2026-02-19

5.2.2 / 2025-04-25

Summary update on all the previous releases from v4.2.4

v15.5.14

Core Changes

Credits

v15.5.13

Core Changes

Credits

v15.5.12

v15.5.14

Core Changes

Credits

v15.5.13

Core Changes

Credits

v15.5.12

5.2.3 / 2026-02-19

5.2.2 / 2025-04-25

v15.5.14

Core Changes

Credits

v15.5.13

Core Changes

Credits

v15.5.12

Uh oh!

cursor bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

github-actions bot commented Mar 26, 2026

Temporary PR

PNPM

NPM

Bun

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

cursor bot commented Mar 26, 2026 •

edited

Loading