[Aikido] Fix 103 security issues in h3, lodash, lodash-es and 20 more

[aikido-autofix]

Description

Upgrade dependencies to fix critical RCE vulnerabilities in H3 (SSE injection), Lodash (code injection via template imports), Protobufjs (arbitrary code injection), Seroval (prototype pollution and type confusion RCE), and other packages. This update includes breaking changes that require manual migration.

Motivation

Security Impact — CVE vulnerabilities fixed by this PR:

✅ 95 CVEs resolved by this upgrade, including 10 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-33128	🚨 CRITICAL	[h3] createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization, allowing attackers who control SSE message fields to inject arbitrary events to connected clients.
GHSA-wr4h-v87w-p3r7	MEDIUM	[h3] Path traversal vulnerability in serveStatic() via percent-encoded dot segments (%2e%2e) allows unauthenticated attackers to read arbitrary files outside the static directory on Node.js deployments. The vulnerability stems from insufficient path normalization before passing user-controlled paths to filesystem callbacks.
CVE-2026-4800	🚨 CRITICAL	[lodash] A vulnerability in _.template allows arbitrary code execution through untrusted key names in options.imports or prototype pollution, as validation was incomplete after a prior CVE fix. An attacker can inject malicious code that executes during template compilation.
CVE-2025-13465	MEDIUM	[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical prototype methods.
CVE-2026-2950	MEDIUM	[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes by using array-wrapped path segments to delete properties from built-in prototypes, potentially causing application malfunction or denial of service.
CVE-2026-41242	🚨 CRITICAL	[protobufjs] Arbitrary code injection vulnerability in protobuf type fields allows attackers to execute malicious code during object decoding. This enables remote code execution (RCE) when processing untrusted protobuf definitions.
CVE-2026-44293	HIGH	[protobufjs] A vulnerability in protobuf schema compilation allows attackers to inject arbitrary code into generated JavaScript conversion functions through crafted bytes field default values. This enables remote code execution when processing malicious protobuf descriptors.
CVE-2026-44291	HIGH	[protobufjs] Prototype pollution vulnerability allows attackers to inject malicious strings into generated JavaScript code through polluted Object.prototype properties, enabling arbitrary code execution during protobuf encoding and decoding operations.
CVE-2026-44289	HIGH	[protobufjs] Unbounded recursion during protobuf decoding allows a crafted binary payload to exhaust the JavaScript call stack, causing a denial of service. The vulnerability affects both unknown group field skipping and nested message field decoding.
CVE-2026-44290	HIGH	[protobufjs] A prototype pollution vulnerability allows attackers to write to global JavaScript constructor properties through crafted protobuf schemas, corrupting built-in functionality and potentially enabling remote code execution. The flaw exists in schema option path handling that fails to properly restrict property traversal during option application.
CVE-2026-45740	HIGH	[protobufjs] Unbounded recursion in JSON descriptor parsing allows attackers to exhaust the JavaScript call stack by providing deeply nested namespace definitions, causing a denial of service during descriptor loading.
CVE-2026-48712	HIGH	[protobufjs] A depth limit vulnerability in protobuf message conversion allows attackers to exhaust the JavaScript call stack through deeply nested protobuf payloads, causing a denial of service during toObject() or JSON conversion operations.
AIKIDO-2026-10467	MEDIUM	[protobufjs] Prototype pollution vulnerability in message initialization allows attackers to inject malicious properties via the proto field, enabling prototype chain manipulation and unintended property injection across the application.
CVE-2026-44288	MEDIUM	[protobufjs] A UTF-8 decoder vulnerability allows attackers to bypass application-level checks by decoding overlong UTF-8 byte sequences into canonical characters, potentially enabling malicious strings to pass validation filters. This could lead to security bypasses in protobuf message processing.
CVE-2026-44292	MEDIUM	[protobufjs] Prototype pollution vulnerability in message constructors allows attackers to modify the prototype of message instances by providing a malicious proto property, potentially enabling arbitrary code execution or object manipulation.
CVE-2026-44294	MEDIUM	[protobufjs] Unescaped control characters in field names can be embedded into generated JavaScript functions, causing code injection that breaks encode, decode, verify, or conversion functions during compilation. An attacker can exploit this via a crafted protobuf schema or JSON descriptor to achieve denial of service.
CVE-2026-23736	🚨 CRITICAL	[seroval] Improper input validation in JSON deserialization allows malicious object keys to cause prototype pollution, enabling attackers to modify object prototypes and potentially execute arbitrary code or manipulate application behavior.
CVE-2026-23737	HIGH	[seroval] Improper input handling in JSON deserialization allows arbitrary JavaScript code execution through constant value and error deserialization overrides. Attackers can achieve RCE via multiple requests to fromJSON/fromCrossJSON functions with knowledge of runtime data usage.
CVE-2026-23957	HIGH	[seroval] A denial of service vulnerability exists where attackers can override encoded array lengths with excessively large values, causing the deserialization process to consume significant processing time and resources.
CVE-2026-24006	HIGH	[seroval] A stack overflow vulnerability occurs when serializing deeply nested objects, causing denial of service. The issue is mitigated by introducing a configurable depth limit parameter that throws an error when exceeded.
AIKIDO-2026-476182	🚨 CRITICAL	[seroval] Deserialization of attacker-controlled JSON fails to validate Promise resolver records, allowing type confusion that enables arbitrary side effects and potential remote code execution when plugins are enabled.
CVE-2026-59940	🚨 CRITICAL	[seroval] Improper validation of Promise control nodes in deserialization allows attackers to trigger unintended side effects and potentially achieve remote code execution through malicious JSON input when plugins are enabled.
CVE-2026-1525	🚨 CRITICAL	[undici] Duplicate HTTP Content-Length headers with case-variant names can be sent in requests, causing malformed HTTP/1.1 messages. This enables denial of service against strict parsers and potential HTTP request smuggling attacks for ACL bypass or cache poisoning.
CVE-2026-13697	🚨 CRITICAL	[undici] The cache interceptor mishandles malformed Cache-Control private directives, allowing private response bodies and headers to be stored in shared cache and served to different callers, causing information disclosure. Additionally, certain Cache-Control headers trigger an uncaught TypeError that can crash the process.
CVE-2026-1526	HIGH	[undici] A malicious WebSocket server can send compressed frames that expand to extremely large sizes in memory without limits, causing denial-of-service through memory exhaustion and process crashes. The vulnerability stems from unbounded decompression in the permessage-deflate extension without size validation.
CVE-2026-1528	HIGH	[undici] A server can send a WebSocket frame with an extremely large 64-bit length value, causing ByteParser integer overflow that results in a fatal TypeError and process termination (DoS).
CVE-2026-2229	HIGH	[undici] A malicious WebSocket server can crash the client process by sending an invalid server_max_window_bits parameter in the permessage-deflate extension, causing an uncaught RangeError when creating a zlib decompressor. This results in a denial-of-service vulnerability due to insufficient parameter validation and missing exception handling.
CVE-2026-22036	HIGH	[undici] An unbounded decompression chain vulnerability allows a malicious server to insert thousands of compression steps, causing excessive CPU usage and memory allocation. This results in denial of service through resource exhaustion.
CVE-2026-14643	HIGH	[undici] The cache interceptor fails to parse qualified no-cache/private directives with whitespace around the equals sign, causing authenticated responses to be incorrectly cached and served to other users in shared-cache mode, enabling information disclosure.
AIKIDO-2026-10939	MEDIUM	[undici] HTTP response validation weakness allows peers to close chunked responses prematurely, causing truncated data to be treated as complete. Additionally, deduplication header collisions can cause concurrent requests to share incorrect responses, potentially leading to information disclosure or integrity bypass.
CVE-2026-16728	MEDIUM	[undici] A retry interceptor vulnerability causes mismatched Content-Length headers when reassembling partial responses after retries, potentially leading to response desynchronization and corruption in proxies or gateways that forward upstream headers downstream.
CVE-2026-16729	MEDIUM	[undici] The setCookie function fails to sanitize cookie domain values and unparsed entries, allowing attackers to inject additional cookie attributes like SameSite, HttpOnly, and Secure. This can bypass CSRF protections or force/strip security attributes in applications using user-controlled input for cookie configuration.
AIKIDO-2026-48713	MEDIUM	[undici] The Set-Cookie parser incorrectly percent-decodes cookie values, allowing encoded sequences like %0D%0A to become literal bytes. This enables HTTP response header injection attacks (session fixation, open redirect, cache poisoning) when parsed values are forwarded to response headers.
CVE-2026-9678	MEDIUM	[undici] Cache interceptor incorrectly caches responses with whitespace-padded Cache-Control directives, allowing authenticated data to be served to subsequent users in shared-cache mode, causing information disclosure.
CVE-2026-9679	MEDIUM	[undici] The cookie parser incorrectly percent-decodes cookie values, allowing encoded sequences like %0D%0A to become literal bytes that can be injected into HTTP response headers. This enables attackers to inject arbitrary headers for session fixation, open redirect, or cache poisoning attacks in applications that forward parsed cookies into responses.
CVE-2026-15157	MEDIUM	[undici] A vulnerability allows attackers to inject CRLF sequences into HTTP headers by passing a hand-rolled blob-like request body with an untrusted type property, enabling HTTP request smuggling. This affects applications using undici's request, stream, pipeline, or dispatch methods with duck-typed blob objects derived from user input.
AIKIDO-2026-10022	MEDIUM	[undici] A malicious server can send HTTP responses with excessive layered Content-Encoding headers, forcing the client into recursive decompression that exhausts CPU and memory resources, causing denial-of-service. This was mitigated by limiting the encoding chain to a maximum of 5 layers.
CVE-2026-1527	MEDIUM	[undici] HTTP request smuggling vulnerability allowing CRLF injection through the upgrade option, enabling arbitrary header injection and premature request termination to smuggle data to non-HTTP services.
CVE-2026-11525	LOW	[undici] Set-Cookie header parsing accepts non-spec SameSite values containing substrings like "Strict" or "None" instead of exact matches, allowing malicious servers to downgrade cookie security policies. This enables attackers to weaken SameSite enforcement through substring matching exploitation.
CVE-2026-6733	LOW	[undici] HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets, allowing an attacker-controlled upstream server to inject unsolicited responses that get associated with subsequent requests, causing responses to be delivered to wrong requests.
AIKIDO-2026-10369	LOW	[undici] Prototype pollution vulnerability allows attackers to modify object prototypes through specially crafted input with keys like __proto__ or constructor, potentially influencing application behavior or enabling further attacks.
AIKIDO-2026-10385	LOW	[undici] A prototype pollution vulnerability allows attackers to inject special keys like __proto__, constructor, or prototype into internal objects, potentially modifying the prototype chain and influencing application behavior or enabling further attacks.
AIKIDO-2026-553733	🚨 CRITICAL	[next] A heap buffer overflow in libheif during AVIF image processing allows unauthenticated remote code execution in the Image Optimization API. Self-hosted deployments optimizing attacker-supplied or remotely fetched AVIF images are vulnerable.
CVE-2026-44578	HIGH	[next] A server-side request forgery vulnerability in self-hosted Next.js applications allows attackers to craft WebSocket upgrade requests that proxy arbitrary requests to internal or external destinations, potentially exposing internal services or cloud metadata. Vercel-hosted deployments are unaffected.
AIKIDO-2026-10758	HIGH	[next] A WebSocket upgrade proxying vulnerability allows attackers to craft requests that trigger outbound connections to arbitrary destinations, enabling server-side request forgery and potential exposure of internal services. This affects self-hosted deployments and can be exploited to reach internal or external targets.
AIKIDO-2026-573829	HIGH	[next] Dynamic hostname resolution in rewrites/redirects rules allows untrusted request values to redirect to arbitrary hosts, enabling Server-Side Request Forgery via rewrites or open redirects via redirects rules.
AIKIDO-2026-283297	HIGH	[next] Server Actions can be exploited via untrusted Host headers to perform Server-Side Request Forgery (SSRF) attacks and disclose internal values in deployments without host-pinning protections. The vulnerability allows attackers to redirect outbound requests to malicious hosts by manipulating request headers.
AIKIDO-2026-284523	HIGH	[next] A vulnerability in App Router Server Actions allows unauthenticated attackers to cause denial of service by sending crafted requests that trigger excessive iteration, consuming CPU resources and blocking the event loop from handling further requests.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
AIKIDO-2026-10762	HIGH	[next] A deserialization vulnerability in server function endpoints allows attackers to consume excessive CPU through crafted input, causing denial of service by exhausting request handling capacity and degrading application availability.
AIKIDO-2026-10757	HIGH	[next] Pages Router deployments with i18n can expose locale-less data routes that bypass middleware authorization checks, allowing attackers to access internal JSON data endpoints for protected pages through alternate paths. This vulnerability enables unauthorized information disclosure of protected page data.
CVE-2026-44573	HIGH	[next] A vulnerability allows unauthorized access to protected page data in applications using Pages Router with i18n configuration, as middleware authorization checks are bypassed for locale-less data route requests. An attacker can retrieve sensitive SSR JSON data without passing intended authorization checks.
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-64641	HIGH	[next] Crafted requests targeting Next.js applications with App Router and Server Actions can cause excessive CPU usage, leading to denial of service by blocking request processing. This vulnerability allows attackers to exhaust server resources and prevent legitimate requests from being handled.
CVE-2026-29057	MEDIUM	[next] HTTP request smuggling vulnerability in Next.js rewrites with chunked DELETE/OPTIONS requests allows attackers to bypass route restrictions and access unintended backend endpoints. An attacker could smuggle malicious requests to internal or admin routes through request boundary disagreement between proxy and backend.
CVE-2026-64649	MEDIUM	[next] Server Actions can be exploited to perform Server-Side Request Forgery (SSRF) attacks when Host headers are not properly validated, allowing attackers to redirect requests to malicious hosts or bypass authorization. This affects applications on custom servers or deployments without upstream host pinning.
AIKIDO-2026-467347	MEDIUM	[next] Server-side fetch cache keys are derived from lossy text decoding of request bodies, allowing distinct requests with different bodies to share cache entries and leak confidential response data between callers. The vulnerability affects the App Router and is fixed by keying the cache on raw body bytes instead.
AIKIDO-2026-339670	MEDIUM	[next] Server Action and cache endpoint identifiers are exposed in publicly served client artifacts, allowing unauthenticated users to enumerate internal endpoints and potentially exploit weak authorization controls.
AIKIDO-2026-165691	MEDIUM	[next] Unauthenticated attackers can send oversized requests to Server Actions on Edge runtime without size limits, causing excessive memory consumption and denial of service through memory exhaustion.
AIKIDO-2026-10755	MEDIUM	[next] Insufficient escaping of untrusted input in inline beforeInteractive script serialization allows attackers to break script boundaries and execute arbitrary JavaScript in the browser (RCE).
CVE-2026-44580	MEDIUM	[next] A cross-site scripting (XSS) vulnerability exists in applications using beforeInteractive scripts with untrusted content, where serialized script content is not properly escaped, allowing attackers to execute arbitrary JavaScript in visitors' browsers.
CVE-2026-64645	MEDIUM	[next] A vulnerability in rewrites() and redirects() rules allows attackers to manipulate request-controlled input to point to arbitrary hostnames, enabling Server-Side Request Forgery (SSRF) via rewrites or Open Redirect attacks via redirects().
AIKIDO-2026-206850	MEDIUM	[next] A cache key vulnerability in server-side fetch responses fails to account for request body differences, allowing unauthorized users to receive cached responses containing confidential data from other requests. This information disclosure vulnerability affects applications using the App Router.
AIKIDO-2026-10754	MEDIUM	[next] The Image Optimization API loads local image responses into memory without enforcing consistent size limits, allowing large assets to exhaust process memory and cause denial of service in self-hosted configurations.
CVE-2026-44577	MEDIUM	[next] A memory exhaustion vulnerability in the Image Optimization API allows attackers to trigger out-of-memory conditions by requesting large local assets through the /_next/image endpoint without size limits. This can cause denial of service by consuming excessive server memory.
CVE-2026-44572	MEDIUM	[next] A vulnerability allows attackers to send a crafted x-nextjs-data header on requests to middleware-handled paths, causing the redirect response to use an internal header instead of the standard Location header, which browsers cannot follow. If deployed behind a caching CDN or reverse proxy, this can poison the cache and cause denial of service for affected redirect paths.
AIKIDO-2026-10753	MEDIUM	[next] A cache poisoning vulnerability allows attackers to cause incorrect React Server Component payloads to be cached and served to users under shared-cache conditions, potentially returning malformed responses and compromising application functionality.
CVE-2026-44576	MEDIUM	[next] Applications using React Server Components are vulnerable to cache poisoning due to improper response variant partitioning in shared caches, allowing attackers to serve component payloads instead of HTML and poison cache entries for subsequent visitors. This enables unauthorized content injection and potential remote code execution through malicious component payloads.
CVE-2026-64647	MEDIUM	[next] A server-side fetch caching vulnerability allows responses from POST requests with non-UTF-8 charset bodies to be incorrectly returned to different requests with different bodies, potentially leaking confidential data. This affects requests to the same URL where different character encodings produce identical cache keys.
CVE-2026-64648	MEDIUM	[next] Server-side fetch requests with different body parameters may return cached responses from other requests to the same URL, causing confidential data leakage to unauthorized requests. This information disclosure vulnerability affects fetch calls where the request init differs from the passed init parameter.
CVE-2026-64643	MEDIUM	[next] Next.js applications using App Router and Server Actions can leak Server Action IDs to unauthenticated users through publicly served client artifacts, enabling reconnaissance that may facilitate attacks when combined with other vulnerabilities. This information disclosure bypasses authentication controls on affected endpoints.
CVE-2026-64646	MEDIUM	[next] A vulnerability in Next.js App Router with Server Actions using Edge runtime allows attackers to cause excessive memory consumption through specially crafted requests, leading to potential denial of service. This memory exhaustion attack can crash or severely degrade application performance.
AIKIDO-2026-10756	MEDIUM	[next] A vulnerability allows malformed CSP nonce values from request headers to be reflected into HTML responses, potentially poisoning cached content and enabling script execution for other users in shared-cache deployments.
CVE-2026-44581	MEDIUM	[next] App Router applications using CSP nonces are vulnerable to stored cross-site scripting when deployed behind shared caches, as malformed nonce values from request headers can be unsafely reflected into HTML, allowing attackers to poison cached responses and execute scripts for subsequent visitors.
AIKIDO-2026-10752	LOW	[next] RSC cache-busting values can collide in shared cache deployments, allowing attackers to poison cache variants and serve incorrect component responses to users. This vulnerability stems from insufficient collision resistance in response variant separation.
AIKIDO-2026-10751	LOW	[next] A vulnerability in middleware redirect handling allows attackers to manipulate redirect responses and poison caches by spoofing internal-data headers, causing subsequent users to receive broken cached redirects until expiry.
CVE-2026-44582	LOW	[next] React Server Component responses are vulnerable to cache poisoning due to insufficient response partitioning, allowing attackers to poison cache entries and serve wrong response variants to users. This can lead to information disclosure or serve malicious content through shared cache collisions.
GHSA-mwv6-3258-q52c	HIGH	[next] A malicious HTTP request to App Router endpoints can cause server deserialization to hang and consume CPU, resulting in denial of service (DoS).
CVE-2026-41248	🚨 CRITICAL	[@clerk/shared] A route matcher bypass vulnerability allows crafted requests to skip middleware gating and reach downstream handlers, potentially enabling unauthorized access to protected resources.
CVE-2026-42349	HIGH	[@clerk/shared] Authorization predicates can incorrectly return true for combined checks (reverification with role/permission/feature/plan, or billing with role/permission), allowing unauthorized access to gated actions. This is an authorization bypass vulnerability affecting multiple Clerk SDKs.
AIKIDO-2026-420462	HIGH	[@clerk/shared] Stored XSS vulnerability in Clerk auth state serialization where unescaped characters in session claims can break out of SSR script tags and execute arbitrary JavaScript. The vulnerability affects JSON serialization of user-controllable data embedded in HTML script elements.
CVE-2026-42047	HIGH	[inngest] Unauthenticated attackers can exfiltrate environment variables via PATCH, OPTIONS, or DELETE requests to the serve() HTTP handler, exposing secrets and credentials. This occurs because unhandled HTTP methods return diagnostic information containing process.env contents.
CVE-2025-66414	HIGH	[@modelcontextprotocol/sdk] DNS rebinding vulnerability in HTTP-based MCP servers allows malicious websites to bypass same-origin policy and invoke tools or access resources on unauthenticated localhost servers. The vulnerability affects StreamableHTTPServerTransport and SSEServerTransport when DNS rebinding protection is not explicitly enabled.
CVE-2026-25536	HIGH	[@modelcontextprotocol/sdk] A cross-client response data leak vulnerability occurs when a single MCP server and transport instance is reused across multiple client connections, allowing responses intended for one client to be exposed to others. This information disclosure vulnerability primarily affects stateless HTTP server transport deployments.
AIKIDO-2026-517140	HIGH	[@clerk/tanstack-react-start] Stored XSS vulnerability in SSR script tags where unescaped user-controllable session claims can break out and execute arbitrary JavaScript. The vulnerability is fixed by escaping special characters while maintaining JSON compatibility.
CVE-2026-35209	HIGH	[defu] Prototype pollution vulnerability in the defu function allows attackers to override default object properties through crafted __proto__ payloads in unsanitized user input, potentially leading to application logic bypass or information disclosure.
CVE-2026-41907	HIGH	[uuid] A buffer overflow vulnerability allows v3, v5, and v6 UUID functions to write beyond caller-provided buffer boundaries when given small buffers or large offsets, causing silent data corruption. This can lead to memory corruption and potential code execution or information disclosure.
AIKIDO-2026-10892	MEDIUM	[uuid] UUID functions v3(), v5(), and v6() can write past the end of a caller-provided buffer due to missing offset validation, enabling buffer overflow attacks. The fix adds bounds checks to prevent out-of-range writes.
CVE-2026-44902	HIGH	[@opentelemetry/auto-instrumentations-node] A malformed HTTP request to the Prometheus metrics endpoint causes an uncaught TypeError, crashing the Node.js process due to missing error handling in URL parsing. This results in a Denial of Service vulnerability.
CVE-2026-45736	HIGH	[ws] is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
CVE-2026-46625	HIGH	[js-cookie] A prototype pollution vulnerability in the assign() helper allows attackers to inject malicious cookie attributes (domain, secure, samesite, expires, path) when parsing JSON objects, potentially compromising cookie security. This enables attackers to manipulate cookie behavior despite developer-intended attribute restrictions.
CVE-2026-48068	HIGH	[@grpc/grpc-js] An invalid incoming HTTP/2 stream initiation can cause a gRPC server process to crash, resulting in a denial of service attack.
CVE-2026-48069	HIGH	[@grpc/grpc-js] An invalid incoming compressed message can cause a denial of service (DoS) by crashing the client or server process.
CVE-2026-12143	HIGH	[form-data] A CRLF injection vulnerability in field names and filenames allows attackers to inject headers or additional multipart parts into requests, potentially enabling form field manipulation or smuggling attacks when untrusted input is used.
CVE-2026-59892	HIGH	[@opentelemetry/propagator-jaeger] A malformed percent-encoded HTTP header value causes an uncaught URIError that crashes the Node.js process. An unauthenticated remote attacker can exploit this denial-of-service vulnerability by sending specially crafted uber-trace-id or uberctx-* headers.

Type of change (choose one)

• Chore (refactors, upgrades, etc.)
• Bug fix (non-breaking change that fixes an issue)
• Security fix (non-breaking change that fixes a potential vulnerability)
• Docs
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality not to work as expected)

Checklist

• I've linked any associated issues to this PR.
• I've tested my own changes.

Breaking Changes & Upgrade Impact — prefer Warnings / Cautions / ⚠️ sections over implementation sections (upgrade risks, breaking changes, manual migration steps):

⚠️ Incomplete breaking changes analysis (12/23 analyzed)

⚠️ Breaking changes analysis not available for: protobufjs, @clerk/shared, @modelcontextprotocol/sdk, @clerk/backend, @clerk/tanstack-react-start, defu, @opentelemetry/auto-instrumentations-node, @opentelemetry/exporter-prometheus, @opentelemetry/sdk-node, @grpc/grpc-js, @opentelemetry/propagator-jaeger

⚠️ ## Breaking Changes Affecting This Codebase

@clerk/tanstack-react-start (0.26.10 => 1.4.20)

Where your code is affected:

• ui/apps/dashboard/src/components/URQL/URQLProvider.tsx (lines 35, 40)

• ui/apps/dashboard/src/utils/useRestAPIRequest.ts (line 13)

• ui/apps/support/src/data/gqlApi.ts (line 5)

• ui/apps/support/src/data/clerk.ts (lines 7, 13)

• ui/apps/dashboard/src/queries/server/integrations/vercel.ts (line 10)

• ui/apps/dashboard/src/queries/graphqlAPI.ts (line 7)

• ui/apps/dashboard/src/lib/auth.ts (line 7)

Impact: getToken() now throws ClerkOfflineError instead of returning null when the client is offline. Code currently checks for null or falsy values but doesn't handle the new exception.

Remediation: Add try-catch blocks around getToken() calls to handle ClerkOfflineError exceptions, or update conditional checks to handle the thrown error appropriately.

---

Where your code is affected:

• ui/apps/dashboard/src/start.ts (line 6)

• ui/apps/support/src/start.ts (line 1)

Impact: clerkMiddleware function no longer accepts individual props as functions; must use options callback pattern.

Remediation: If passing configuration to clerkMiddleware(), migrate from prop function form to options callback pattern (e.g., clerkMiddleware(({ url }) => ({ domain: url.hostname }))).

---

@clerk/shared (3.36.0 => 4.25.5)

Where your code is affected:

• Node.js version requirement increased to 20.9.0

• ui/apps/dashboard/package.json specifies "node": "20.x" (compatible)

• ui/apps/support/package.json has no explicit engine requirement

Impact: Minimum Node.js version requirement increased from 18.17.0 to 20.9.0. The dashboard app already requires Node 20.x, but the support app doesn't specify a version.

Remediation: Add "engines": { "node": "20.x" } to ui/apps/support/package.json to ensure compatibility.

---

OpenTelemetry SDK (@opentelemetry/sdk-node 0.208.0 => 0.217.0)

Where your code is affected:

• pkg/telemetry/trace/tracer.go (lines 178, 195, 212, 229, 283, 323)

• pkg/tracing/tracer.go (line 85)

Impact: BatchSpanProcessor and SimpleSpanProcessor constructor call signatures changed. The code uses trace.NewBatchSpanProcessor(exp) and sdktrace.NewSimpleSpanProcessor(tp.exp) with the old signature where the exporter is passed as the first positional argument.

Remediation: Update all NewBatchSpanProcessor and NewSimpleSpanProcessor calls to use the new options object format: trace.NewBatchSpanProcessor(trace.BatchSpanProcessorOptions{Exporter: exp}) and sdktrace.NewSimpleSpanProcessor(sdktrace.SimpleSpanProcessorOptions{Exporter: tp.exp}).

---

uuid (9.0.1 => 11.1.1)

Where your code is affected:

• ui/apps/dashboard/package.json specifies "uuid": "^13.0.0" (already on v13, not affected by v9→v11 upgrade)

Impact: None - the dashboard is already using uuid v13, which is beyond the breaking changes in v10-v11.

Remediation: No action needed.

All breaking changes by upgrading lodash from version 4.17.21 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.

All breaking changes by upgrading lodash-es from version 4.17.21 to 4.18.1 (CHANGELOG)

Version	Description
4.18.0	_.unset / _.omit: constructor and prototype are now blocked unconditionally as non-terminal path keys. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0	_.template: imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template" error, where previously they were accepted.

All breaking changes by upgrading undici from version 7.16.0 to 7.29.0 (CHANGELOG)

Version	Description
7.22.0	The deduplicate interceptor now does not deduplicate non-safe HTTP methods by default, which changes the behavior for POST, PUT, DELETE, and other non-idempotent requests that were previously being deduplicated.

All breaking changes by upgrading next from version 14.2.35 to 15.5.24 (CHANGELOG)

Version	Description
15.0.0	Remove deprecated analyticsId from config, and the corresponding performance-relayer files and tests
15.0.0	Remove squoosh in favor of sharp as optional dependency for next/image
15.0.0	Change default Content-Disposition to attachment for next/image
15.0.0	Error when src has leading or trailing space in next/image
15.0.0	Set upstream timeout to 7 seconds for next/image
15.0.0	Add sharp timeout of 10 seconds
15.0.0	Pages router: Enable strict next/head children reconciler by default
15.0.0	Disable automatic static generation for route handlers
15.0.0	Disable client router cache for page segments
15.0.0	Disable automatic fetch caching
15.0.0	Remove geo and ip from NextRequest
15.0.0	Update Dynamic APIs to be async (cookies, headers, params, searchParams)
15.0.0	Support ESLint v9 in plugin, config and next lint
15.0.0	Bump minimum Node.js version to 18.18 (up from 18.17)
15.1.0	Error on navigation API usage in pages router and middleware: navigation API usage is now forbidden in pages router and middleware, which will cause errors for code that previously used these APIs in those contexts.
15.1.0	Disallow multiple server directives at the same level (file or function): code with multiple server directives (like "use server" and "use cache") at the same level will no longer be allowed.
15.1.0	Forbid this and arguments in server functions: server functions can no longer use this or arguments, which will break existing server functions that rely on these features.
15.1.0	Forbid super in static class methods with server function directives: static class methods with server function directives cannot use super, breaking code that previously did so.
15.1.0	Emit build error when "use cache" is used without dynamicIO enabled: builds will now fail if "use cache" is used without enabling the dynamicIO flag.
15.1.0	Emit build error for unknown cache kinds: builds will fail when encountering unknown cache kinds, which may break builds that previously succeeded with warnings or were silently ignored.
15.1.0	Increase max cache tags to 128: while this is an increase, it establishes a new hard limit that could break code attempting to use more than 128 cache tags.
15.2.0	Removed internal_disableSyncDynamicAPIWarnings flag
15.2.0	Disabled colormin feature from cssnano
15.2.0	Turbopack now uses new backend by default
15.2.0	Removed experimental.reactOwnerStack flag
15.2.0	rootParams() is now a plain Promise (not exotic)
15.2.0	Removed --no-mangling CLI option for next build
15.2.0	Deprecated devIndicators options appIsrStatus and buildActivity
15.2.0	Deprecated devIndicators.buildActivityPosition and renamed to position
15.2.0	Removed old Dev Overlay
15.2.0	Removed the experiment config for overlay (new dev overlay enabled by default)
15.2.0	Streaming metadata enabled by default
15.2.0	Promoted streaming metadata configs to stable
15.2.0	Warning about i18n configuration deprecation in app router
15.2.0	Disabled turbo daemon by default
15.2.0	Error when output: export is used with intercepting routes
15.2.0	Emit build error when useCache is enabled and Edge runtime is used
15.2.0	Disallowed rootParams() in cache scope
15.3.0	Development origin verification switched to be opt-in rather than opt-out
15.3.0	Direct IP/port bypass removed in dev origin check
15.3.0	forwardRef removed from Link in App Router
15.3.0	Deprecation warning added for legacyBehavior prop
15.3.0	Turbopack build now requires --turbopack flag with next start, otherwise throws error
15.3.0	Output server.mjs for standalone with type: module
15.5.0	useMDXComponents argument removed
15.5.0	experimental.strictNextHead removed
15.5.0	Disallow sync access of cookies & headers at runtime in Cache Components
15.5.0	experimental.dynamicIO renamed to experimental.cacheComponents
15.5.0	unstable_rootParams deprecated with warning
15.5.0	AMP deprecated with warning

All breaking changes by upgrading uuid from version 9.0.1 to 13.0.2 (CHANGELOG)

Version	Description
10.0.0	Dropped support for Node.js 12 and 14; only Node.js 16-20 are supported
11.0.0	Refactored v1 internal state and options logic
11.0.0	Refactored v7 internal state and options logic
11.0.0	Ported to TypeScript
11.0.0	Updated node support matrix to only support Node.js 16-20
12.0.0	Dropped support for Node.js 16
12.0.0	Removed CommonJS support
12.0.0	Updated to TypeScript 5.2
13.0.0	Made browser exports the default

All breaking changes by upgrading ws from version 8.18.0 to 8.21.3 (CHANGELOG)

Version	Description
8.21.0	Fixed a remote memory exhaustion DoS vulnerability by introducing maxBufferedChunks and maxFragments options that restrict the volume of tiny fragments and data chunks that can be sent by a peer

All breaking changes by upgrading js-cookie from version 3.0.5 to 3.0.7 (CHANGELOG)

Version	Description
3.0.7	Prevent cookie attribute injection: CVE-2026-46625 - this security fix may restrict previously working behavior that involved cookie attribute injection

All breaking changes by upgrading form-data from version 4.0.4 to 4.0.6 (CHANGELOG)

Version	Description
4.0.6	Field names and filenames now escape CR, LF, and " characters, which may change the behavior of code that previously relied on these characters being passed through unescaped.

Check our Pull Request Guidelines

---

Note

Medium Risk
Large indirect upgrades touch auth (Clerk major), TanStack SSR stack, Next 15 in shared components, and GraphQL codegen majors—regression risk is mostly build/runtime compatibility rather than new app logic.

Overview
Bumps UI workspace dependencies and pnpm overrides to address reported CVEs in transitive packages (notably h3, lodash, js-cookie, and related stacks), without application source changes in this diff.

Dashboard and support align on newer @clerk/tanstack-react-start (~1.4.x), TanStack Router/Start/React Query (~1.168 / 5.102), plus inngest and a uuid patch on dashboard. dev-server-ui upgrades @graphql-codegen tooling to v5/v6 and bumps @rtk-query/graphql-request-base-query and React Query. @inngest/components moves next from 14.x to ^15.5.24 and matches React Query versions.

The root ui/package.json adds overrides pinning h3@2.0.1-rc.5 to 2.0.1-rc.15 and forcing js-cookie v2/v3 consumers to 3.0.7.

^{Reviewed by Cursor Bugbot for commit c6c7b95. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c6c7b95. Configure here.}

[cursor]

h3 override misses other versions

High Severity

The new pnpm override remaps only exact h3@2.0.1-rc.5 to 2.0.1-rc.15. The lockfile still resolves h3@2.0.1-rc.11 and h3@1.15.11, so TanStack/Nitro or Inngest paths on those versions keep the SSE-injection and serveStatic issues this PR claims to close.

Additional Locations (1)

• ui/pnpm-lock.yaml#L9479-L9510

 

^{Reviewed by Cursor Bugbot for commit c6c7b95. Configure here.}

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #78