chore(deps): bump the npm_and_yarn group across 2 directories with 5 updates by dependabot[bot] · Pull Request #183 · zeyu2001/eurekapad

dependabot · 2026-02-20T22:56:43Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
@clerk/nextjs	`6.9.6`	`6.23.3`
@trpc/server	`10.45.2`	`10.45.3`
ai	`4.2.8`	`5.0.52`
mathlive	`0.103.0`	`0.104.0`
next	`15.2.8`	`15.5.10`

Bumps the npm_and_yarn group with 5 updates in the /apps/eurekapad directory:

Package	From	To
@clerk/nextjs	`6.9.6`	`6.23.3`
@trpc/server	`10.45.2`	`10.45.3`
ai	`4.2.8`	`5.0.52`
mathlive	`0.103.0`	`0.104.0`
next	`15.2.8`	`15.5.10`

Updates @clerk/nextjs from 6.9.6 to 6.23.3

Changelog

Sourced from @clerk/nextjs's changelog.

6.23.3

Patch Changes

Updated dependencies [c2f24da, abd8446, 8387a39, feba23c, f2a6641, de9c01a, a8638b0, 3b4b3cb]:

@clerk/backend@2.4.0

@clerk/shared@3.10.2

@clerk/types@4.63.0

@clerk/clerk-react@5.32.4

6.23.2

Patch Changes

Updated dependencies [02a1f42, edc0bfd]:

@clerk/shared@3.10.1

@clerk/clerk-react@5.32.3

@clerk/types@4.62.1

@clerk/backend@2.3.1

6.23.1

Patch Changes

Updated dependencies [f1be1fe, 8bfdf94, bffb42a, 084e7cc]:

@clerk/types@4.62.0

@clerk/backend@2.3.0

@clerk/shared@3.10.0

@clerk/clerk-react@5.32.2

6.23.0

Minor Changes

Fix auth.protect() unauthorized error propagation within middleware (#6169) by @wobsoriano

Optimize auth() calls to avoid unnecessary verification calls when the provided token type is not in the acceptsToken array. (#6123) by @wobsoriano

Add handling for invalid token types when acceptsToken is an array in authenticateRequest(): now returns a clear unauthenticated state (tokenType: null) if the token is not in the accepted list.

Patch Changes

Updated dependencies [b495279, c3fa15d, 628583a, 52d5e57, 15a945c, 10f3dda, 72629b0, 2692124]:

@clerk/types@4.61.0

@clerk/backend@2.2.0

@clerk/shared@3.9.8

@clerk/clerk-react@5.32.1

6.22.0

... (truncated)

Commits

f48b883 ci(repo): Version packages (#6224)
6c11997 chore(nextjs): Update NextJS readme (#6237)
0c96827 ci(repo): Version packages (#6202)
1367d39 ci(repo): Version packages (#6184)
62ca696 ci(repo): Version packages (#6136)
2692124 chore(backend,nextjs): Introduce API keys methods and integration tests (#6169)
675011c fix(nextjs): Update dependency next to v14.2.30 [SECURITY] (#6122)
805c4a8 chore(vue,nuxt): Make initialState prop public and bump dependencies (#6132)
10f3dda chore(backend,nextjs): Improve token handling and optimize verification (#6123)
6e9bde8 ci(repo): Version packages (#6077)
Additional commits viewable in compare view

Updates @trpc/server from 10.45.2 to 10.45.3

Release notes

Sourced from @trpc/server's releases.

v10.45.3

fixes GHSA-43p4-m455-4f4j

Full Changelog: trpc/trpc@v10.45.2...v10.45.3

Commits

1117bb3 v10.45.3
See full diff in compare view

Updates ai from 4.2.8 to 5.0.52

Commits

63d5f66 Version Packages (#8895)
930399b Backport: fix(ai): download files when intermediate file cannot be downloaded...
7ca78f1 Backport: feat(provider/gateway): Add new Qwen models to Gateway model string...
1cfc209 Backport: feat(provider/openai): OpenAILanguageModelOptions type (#8858)
347b7ec ci: rename v5.0 branch to release-v*
85909a9 Backport: chore(ai): update test message (#8875)
c56822d Backport: fix(ai): update uiMessageChunkSchema to satisfy the `UIMessageChu...
1461adf Backport: chore(examples): remove redundant OpenAI reasoning examples (#8871)
6bd07df Version Packages (#8853)
a45d61a ci(release): remove incorrect changeset bump for @ai-sdk/baseten
Additional commits viewable in compare view

Updates mathlive from 0.103.0 to 0.104.0

Changelog

Sourced from mathlive's changelog.

0.104.0 2025-02-08

Security Advisories

As a reminder, if you are handling untrusted input, you should consider using the MathfieldElement.createHTML() method to sanitize content. The createHTML() method follows the recommendations from the Trusted Type specification.

For example, using the DOMPurify library (there are other HTML sanitizers available):
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.2.3/purify.min.js"></script>
MathfieldElement.createHTML = (html) => DOMPurify.sanitize(html);
security advisory Untrusted input could be used to inject arbitrary HTML or JavaScript code in a page using a mathfield or math content rendered by the library, if the content included an \htmlData{} command with maliciously crafted input and no DOM sanitizer was used.

The content of the \htmlData{} command is now sanitized and the 🚫 emoji is displayed instead in the mathfield if the content is unsafe. When using convertLatexToMarkup(), an exception is thrown.

The \href{}{} command now only allows URLs with the http or https protocol.

Issues Resolved

Generate only standard trigonometric functions, i.e. those available in the amsmath package. Use \operatorname{} for the others. The standard commands are:

\arccos

\arcsin

\arctan

\arg

\cos

\cosh

\cot

\coth

\csc

\sec

\sin

\sinh

... (truncated)

Commits

See full diff in compare view

Updates next from 15.2.8 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

Commits

60a2aa9 v15.5.10
e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
bf9f084 Sync DoS mitigations for React Flight
c5de33e v15.5.9
dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
7526cd6 v15.5.8
1e9ec41 Update React Version (#41)
16141e5 Update React Version (#30)
e01e589 Backport Next.js changes to v15.5.8 (#23)
Additional commits viewable in compare view

Updates @clerk/nextjs from 6.9.6 to 6.23.3

Changelog

Sourced from @clerk/nextjs's changelog.

6.23.3

Patch Changes

Updated dependencies [c2f24da, abd8446, 8387a39, feba23c, f2a6641, de9c01a, a8638b0, 3b4b3cb]:

@clerk/backend@2.4.0

@clerk/shared@3.10.2

@clerk/types@4.63.0

@clerk/clerk-react@5.32.4

6.23.2

Patch Changes

Updated dependencies [02a1f42, edc0bfd]:

@clerk/shared@3.10.1

@clerk/clerk-react@5.32.3

@clerk/types@4.62.1

@clerk/backend@2.3.1

6.23.1

Patch Changes

Updated dependencies [f1be1fe, 8bfdf94, bffb42a, 084e7cc]:

@clerk/types@4.62.0

@clerk/backend@2.3.0

@clerk/shared@3.10.0

@clerk/clerk-react@5.32.2

6.23.0

Minor Changes

Fix auth.protect() unauthorized error propagation within middleware (#6169) by @wobsoriano

Optimize auth() calls to avoid unnecessary verification calls when the provided token type is not in the acceptsToken array. (#6123) by @wobsoriano

Add handling for invalid token types when acceptsToken is an array in authenticateRequest(): now returns a clear unauthenticated state (tokenType: null) if the token is not in the accepted list.

Patch Changes

Updated dependencies [b495279, c3fa15d, 628583a, 52d5e57, 15a945c, 10f3dda, 72629b0, 2692124]:

@clerk/types@4.61.0

@clerk/backend@2.2.0

@clerk/shared@3.9.8

@clerk/clerk-react@5.32.1

6.22.0

... (truncated)

Commits

f48b883 ci(repo): Version packages (#6224)
6c11997 chore(nextjs): Update NextJS readme (#6237)
0c96827 ci(repo): Version packages (#6202)
1367d39 ci(repo): Version packages (#6184)
62ca696 ci(repo): Version packages (#6136)
2692124 chore(backend,nextjs): Introduce API keys methods and integration tests (#6169)
675011c fix(nextjs): Update dependency next to v14.2.30 [SECURITY] (#6122)
805c4a8 chore(vue,nuxt): Make initialState prop public and bump dependencies (#6132)
10f3dda chore(backend,nextjs): Improve token handling and optimize verification (#6123)
6e9bde8 ci(repo): Version packages (#6077)
Additional commits viewable in compare view

Updates @trpc/server from 10.45.2 to 10.45.3

Release notes

Sourced from @trpc/server's releases.

v10.45.3

fixes GHSA-43p4-m455-4f4j

Full Changelog: trpc/trpc@v10.45.2...v10.45.3

Commits

1117bb3 v10.45.3
See full diff in compare view

Updates ai from 4.2.8 to 5.0.52

Commits

63d5f66 Version Packages (#8895)
930399b Backport: fix(ai): download files when intermediate file cannot be downloaded...
7ca78f1 Backport: feat(provider/gateway): Add new Qwen models to Gateway model string...
1cfc209 Backport: feat(provider/openai): OpenAILanguageModelOptions type (#8858)
347b7ec ci: rename v5.0 branch to release-v*
85909a9 Backport: chore(ai): update test message (#8875)
c56822d Backport: fix(ai): update uiMessageChunkSchema to satisfy the `UIMessageChu...
1461adf Backport: chore(examples): remove redundant OpenAI reasoning examples (#8871)
6bd07df Version Packages (#8853)
a45d61a ci(release): remove incorrect changeset bump for @ai-sdk/baseten
Additional commits viewable in compare view

Updates mathlive from 0.103.0 to 0.104.0

Changelog

Sourced from mathlive's changelog.

0.104.0 2025-02-08

Security Advisories

As a reminder, if you are handling untrusted input, you should consider using the MathfieldElement.createHTML() method to sanitize content. The createHTML() method follows the recommendations from the Trusted Type specification.

For example, using the DOMPurify library (there are other HTML sanitizers available):
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.2.3/purify.min.js"></script>
MathfieldElement.createHTML = (html) => DOMPurify.sanitize(html);
security advisory Untrusted input could be used to inject arbitrary HTML or JavaScript code in a page using a mathfield or math content rendered by the library, if the content included an \htmlData{} command with maliciously crafted input and no DOM sanitizer was used.

The content of the \htmlData{} command is now sanitized and the 🚫 emoji is displayed instead in the mathfield if the content is unsafe. When using convertLatexToMarkup(), an exception is thrown.

The \href{}{} command now only allows URLs with the http or https protocol.

Issues Resolved

Generate only standard trigonometric functions, i.e. those available in the amsmath package. Use \operatorname{} for the others. The standard commands are:

\arccos

\arcsin

\arctan

\arg

\cos

\cosh

\cot

\coth

\csc

\sec

\sin

\sinh

... (truncated)

Commits

See full diff in compare view

Updates next from 15.2.8 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

Commits

60a2aa9 v15.5.10
e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
bf9f084 Sync DoS mitigations for React Flight
c5de33e v15.5.9
dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
7526cd6 v15.5.8
1e9ec41 Update React Version (#41)
16141e5 Update React Version (#30)
e01e589 Backport Next.js changes to v15.5.8 (#23)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs) | `6.9.6` | `6.23.3` | | [@trpc/server](https://github.com/trpc/trpc/tree/HEAD/packages/server) | `10.45.2` | `10.45.3` | | [ai](https://github.com/vercel/ai) | `4.2.8` | `5.0.52` | | [mathlive](https://github.com/arnog/mathlive) | `0.103.0` | `0.104.0` | | [next](https://github.com/vercel/next.js) | `15.2.8` | `15.5.10` | Bumps the npm_and_yarn group with 5 updates in the /apps/eurekapad directory: | Package | From | To | | --- | --- | --- | | [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs) | `6.9.6` | `6.23.3` | | [@trpc/server](https://github.com/trpc/trpc/tree/HEAD/packages/server) | `10.45.2` | `10.45.3` | | [ai](https://github.com/vercel/ai) | `4.2.8` | `5.0.52` | | [mathlive](https://github.com/arnog/mathlive) | `0.103.0` | `0.104.0` | | [next](https://github.com/vercel/next.js) | `15.2.8` | `15.5.10` | Updates `@clerk/nextjs` from 6.9.6 to 6.23.3 - [Release notes](https://github.com/clerk/javascript/releases) - [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md) - [Commits](https://github.com/clerk/javascript/commits/@clerk/[email protected]/packages/nextjs) Updates `@trpc/server` from 10.45.2 to 10.45.3 - [Release notes](https://github.com/trpc/trpc/releases) - [Commits](https://github.com/trpc/trpc/commits/v10.45.3/packages/server) Updates `ai` from 4.2.8 to 5.0.52 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/compare/[email protected]@5.0.52) Updates `mathlive` from 0.103.0 to 0.104.0 - [Release notes](https://github.com/arnog/mathlive/releases) - [Changelog](https://github.com/arnog/mathlive/blob/master/CHANGELOG.md) - [Commits](https://github.com/arnog/mathlive/commits) Updates `next` from 15.2.8 to 15.5.10 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.2.8...v15.5.10) Updates `@clerk/nextjs` from 6.9.6 to 6.23.3 - [Release notes](https://github.com/clerk/javascript/releases) - [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md) - [Commits](https://github.com/clerk/javascript/commits/@clerk/[email protected]/packages/nextjs) Updates `@trpc/server` from 10.45.2 to 10.45.3 - [Release notes](https://github.com/trpc/trpc/releases) - [Commits](https://github.com/trpc/trpc/commits/v10.45.3/packages/server) Updates `ai` from 4.2.8 to 5.0.52 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/compare/[email protected]@5.0.52) Updates `mathlive` from 0.103.0 to 0.104.0 - [Release notes](https://github.com/arnog/mathlive/releases) - [Changelog](https://github.com/arnog/mathlive/blob/master/CHANGELOG.md) - [Commits](https://github.com/arnog/mathlive/commits) Updates `next` from 15.2.8 to 15.5.10 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.2.8...v15.5.10) --- updated-dependencies: - dependency-name: "@clerk/nextjs" dependency-version: 6.23.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@trpc/server" dependency-version: 10.45.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ai dependency-version: 5.0.52 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mathlive dependency-version: 0.104.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@clerk/nextjs" dependency-version: 6.23.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@trpc/server" dependency-version: 10.45.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ai dependency-version: 5.0.52 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mathlive dependency-version: 0.104.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.10 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

vercel · 2026-02-20T22:56:47Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eurekapad	Error		Feb 20, 2026 10:58pm

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 20, 2026

dependabot bot mentioned this pull request Feb 20, 2026

chore(deps): bump mathlive from 0.103.0 to 0.104.0 in the npm_and_yarn group across 1 directory #145

Closed

dependabot bot had a problem deploying to Preview February 20, 2026 22:56 Failure

dependabot bot mentioned this pull request Feb 20, 2026

chore(deps): bump next from 15.2.3 to 15.2.4 in the npm_and_yarn group across 1 directory #146

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 2 directories with 5 updates#183

chore(deps): bump the npm_and_yarn group across 2 directories with 5 updates#183
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-4a3fd02cc1

dependabot bot commented on behalf of github Feb 20, 2026

Uh oh!

vercel bot commented Feb 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Feb 20, 2026

6.23.3

Patch Changes

6.23.2

Patch Changes

6.23.1

Patch Changes

6.23.0

Minor Changes

Patch Changes

6.22.0

v10.45.3

0.104.0 2025-02-08

Security Advisories

Issues Resolved

v15.5.10

v15.4.11

v15.3.9

v15.2.9

6.23.3

Patch Changes

6.23.2

Patch Changes

6.23.1

Patch Changes

6.23.0

Minor Changes

Patch Changes

6.22.0

v10.45.3

0.104.0 2025-02-08

Security Advisories

Issues Resolved

v15.5.10

v15.4.11

v15.3.9

v15.2.9

Uh oh!

vercel bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel bot commented Feb 20, 2026 •

edited

Loading