pnpm dependency update 2026-09-10

[commercelayer-ci]

Dependency update tracking

Date: 2026-09-10
Branch: chore/deps-update-202609101012
Prerelease tag: skipped
Node.js: 24.x
pnpm: 10.x

This issue tracks the automated dependency update. It will be closed automatically when the linked PR is merged.

Dependency update results

• Check: success
• Build: success
• Test: success

Semver bump log

No semver updates found.

Audit log

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ uuid: Missing buffer bounds check in v3/v5/v6 when buf │
│                     │ is provided                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ uuid                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <11.1.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=11.1.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>contentful-import>contentful-batch-libs>uuid         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-w5hq-g745-h8pq      │
└─────────────────────┴────────────────────────────────────────────────────────┘
1 vulnerabilities found
Severity: 1 moderate

Major updates log not updated

authentication/nextjs-auth0-sso/package.json
  @babel/core                         ^7.29.7  →   ^8.0.1
  @commercelayer/js-auth               ^7.4.2  →   ^8.0.1
  @commercelayer/react-components     ^4.29.7  →   ^5.0.1
  @commercelayer/sdk                  ^6.58.0  →  ^7.12.1
  @fortawesome/fontawesome-svg-core    ^6.7.2  →   ^7.3.1
  @fortawesome/free-solid-svg-icons    ^6.7.2  →   ^7.3.1
  @fortawesome/react-fontawesome       ^0.2.6  →   ^3.5.0
  @testing-library/jest-dom           ^6.10.0  →   ^7.0.1
  @vitejs/plugin-react                 ^4.7.0  →   ^6.1.1
  auth0                               ^5.14.1  →   ^7.0.0
  babel-jest                          ^29.7.0  →  ^30.5.1
  concurrently                         ^8.2.2  →  ^10.0.5
  dotenv                              ^16.6.1  →  ^17.4.2
  eslint-config-next                   15.5.4  →   16.3.4
  express                             ^4.22.2  →   ^5.2.1
  helmet                               ^7.2.0  →   ^8.3.0
  jest                                ^29.7.0  →  ^30.5.1
  jest-environment-jsdom              ^29.7.0  →  ^30.5.1
  jwks-rsa                             ^3.2.2  →   ^4.1.0
  next                               ^15.5.25  →  ^16.3.4
  react                               ^18.3.1  →  ^19.3.0
  react-dom                           ^18.3.1  →  ^19.3.0
  start-server-and-test                ^2.1.5  →  ^3.0.12
  vitest                               ^3.2.7  →   ^5.0.0

cms/nextjs-contentful-store/package.json
  @types/react      ^19.2.18  →  ^19.3.0
  @types/react-dom   ^19.2.7  →  ^19.3.0
  react              ^19.2.8  →  ^19.3.0
  react-dom          ^19.2.8  →  ^19.3.0
  eslint      ^9.39.5  →  ^10.10.0
  typescript   ^5.9.3  →    ^7.0.2

solutions/commercelayer-slackbot/package.json
  @commercelayer/js-auth    ^4.3.0  →    ^8.0.1
  @commercelayer/sdk       ^4.57.0  →   ^7.12.1
  @slack/bolt              ^3.22.0  →    ^5.1.0
  dotenv                   ^16.6.1  →   ^17.4.2
  jwt-decode                ^3.1.2  →    ^4.0.0
  nodemon                  ^2.0.22  →   ^3.1.14
  supabase                ^1.226.4  →  ^2.117.0
  typescript                ^4.9.5  →    ^7.0.2
  @flydotio/dockerfile  ^0.2.16  →  ^0.7.10

solutions/external-payment-gateway/package.json
  typescript  ^6.0.3  →  ^7.0.2

solutions/giftcard-tutorial/package.json
  @commercelayer/js-auth            ^6.7.2  →   ^8.0.1
  @commercelayer/react-components  ^4.29.7  →   ^5.0.1
  @commercelayer/sdk               ^6.58.0  →  ^7.12.1
  @types/node                          ^20  →      ^22
  eslint                                ^9  →      ^10
  typescript                            ^5  →       ^7

solutions/js-sdk-sandbox/package.json
  js-cookie  3.0.5  →  3.0.8
  @babel/core         7.25.2  →   8.0.1
  @commercelayer/sdk  6.11.0  →  7.12.1
  typescript           5.5.4  →   7.0.2

solutions/pay-with-tweet/package.json
  @types/node  ^22.20.1  →  ^22.20.2
  @types/express  ^4.17.25  →   ^5.0.6
  dotenv           ^16.6.1  →  ^17.4.2
  express          ^4.22.2  →   ^5.2.1
  tsc-watch         ^6.3.1  →   ^7.2.1

webhooks/expressjs-signature-verification/package.json
  express  ^4.22.2  →  ^5.2.1

webhooks/nextjs-signature-verification/package.json
  @types/react      ^19.2.18  →  ^19.3.0
  @types/react-dom   ^19.2.7  →  ^19.3.0
  react              ^19.2.8  →  ^19.3.0
  react-dom          ^19.2.8  →  ^19.3.0
  eslint      ^9.39.5  →  ^10.10.0
  typescript   ^5.9.3  →    ^7.0.2

webhooks/sendgrid-templated-emails/package.json
  dotenv   ^16.6.1  →  ^17.4.2
  express  ^4.22.2  →   ^5.2.1

webhooks/twilio-sms-notification/package.json
  dotenv   ^16.6.1  →  ^17.4.2
  express  ^4.22.2  →   ^5.2.1
  twilio   ^5.13.1  →   ^6.1.1

solutions/external-payment-gateway/packages/app/package.json
  @types/react      ^19.2.18  →  ^19.3.0
  @types/react-dom   ^19.2.7  →  ^19.3.0
  react              ^19.2.8  →  ^19.3.0
  react-dom          ^19.2.8  →  ^19.3.0
  @commercelayer/js-auth  ^7.4.2  →  ^8.0.1
  typescript              ^6.0.3  →  ^7.0.2

solutions/external-payment-gateway/packages/mollie-gateway/package.json
  @commercelayer/js-auth  ^7.4.2  →  ^8.0.1
  typescript              ^6.0.3  →  ^7.0.2