[BenDaSpur]

Combines the Dependabot updates that can land together. Node 26 stays on the current release until it is LTS.

Included

Package	From	To	Source
nodemailer	9.1.1	10.0.16	#113 (10.0.13; lockfile resolved the latest 10.x patch)
stripe	22.6.2	23.0.0	#112
dotenv	17.4.2	18.0.6	#109 (18.0.5; lockfile resolved the latest 18.x patch)

Stripe 23 pins API version 2026-09-30.endive and drops payment_method_types on Checkout Sessions. Subscription checkout now sets allowed_payment_method_types: ['card'], which keeps the session card-only by filtering the dynamic payment-method list.

Left open

Update	Why it is not in this PR
Node 24-alpine → 26-alpine (#62)	Node 26 is not LTS yet
@types/node 24 → 26 (#108)	Tracks Node 26; typecheck also fails on current code
@sveltejs/kit 2 → 3 (#110)	sveltekit-api@0.6.1 only peers Kit 1 or 2, and Kit 3 must move with the Vercel adapter
@sveltejs/adapter-vercel 6 → 7 (#111)	Requires @sveltejs/kit@^3. Alone, npm ci fails peer resolution
typescript 6 → 7 (#69)	@sveltejs/kit and svelte-check only peer TypeScript 5 or 6

Testing

• npm run check: 0 errors (35 pre-existing warnings)
• npm run test:unit -- --run: 46 files, 733 passed, 5 todo
• Smoke: dotenv.parse, nodemailer streamTransport send, and a Stripe client constructed with apiVersion: '2026-09-30.endive'

  

Summary by CodeRabbit

Payments

• Checkout now filters dynamically offered payment methods to card payments, so customers see card options during the checkout flow.
• The checkout integration has also been updated to use a newer payment-service API version. The changes described do not indicate other updates to the checkout experience or payment options.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
qa-studio	Ready	Preview	Oct 7, 2026 3:04pm UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: QAStudio-Dev/studio/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c69cd95d-d877-4255-9897-0dc386b40a95

📥 Commits

Reviewing files that changed from the base of the PR and between 1153187 and aaae2bb.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (2)

• package.json
• src/lib/server/stripe.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• QAStudio-Dev/mcp-server (manual)
• QAStudio-Dev/playwright-reporter (manual)
• QAStudio-Dev/playwright-reporter-python (manual)

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The dependency ranges for dotenv, nodemailer, and stripe are updated. The Stripe client API version changes, and checkout session creation uses allowed_payment_method_types for card payments.

Changes

Stripe SDK Update

Layer / File(s)	Summary
Dependency and checkout update package.json, src/lib/server/stripe.ts	The dotenv, nodemailer, and stripe dependency ranges are updated. The Stripe client API version changes to 2026-09-30.endive. Checkout session creation uses allowed_payment_method_types: ['card'] instead of payment_method_types: ['card'].

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: cursoragent

Merge Risk: ⚪ Minimal · up to aaae2

This change updates nodemailer, Stripe, and dotenv, and moves subscription checkout to Stripe's new card-only payment-method setting. Checkout stays card-only, and the other billing calls do not use the removed parameter. No known merge-blocking problems remain.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the combined updates to nodemailer, Stripe, and dotenv, which are the primary changes in the pull request.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A newer Stripe version takes the stage
Card payments follow the updated setting
Three dependency ranges shift
One API version moves ahead
Checkout keeps its card-only path}

_{Comment @coderabbitai help to get the list of available commands.}