From aaae2bbb14993980a3fdc35b1e8bb2a07f38c3aa Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 7 Oct 2026 15:01:01 +0000 Subject: [PATCH] chore(deps): bump nodemailer, stripe, and dotenv Land the Dependabot majors that install cleanly: nodemailer 10, stripe 23, and dotenv 18. Stripe checkout now pins API version 2026-09-30.endive and keeps card-only sessions via allowed_payment_method_types. Node 26, SvelteKit 3, adapter-vercel 7, and TypeScript 7 stay on their current versions. Node 26 is not LTS yet, and the others fail peer resolution against sveltekit-api and svelte-check. Co-authored-by: ben --- package-lock.json | 46 +++++++++++++++++++++++++++------------- package.json | 6 +++--- src/lib/server/stripe.ts | 6 ++++-- 3 files changed, 38 insertions(+), 20 deletions(-) diff --git a/package-lock.json b/package-lock.json index 8322e6f..757c9fc 100644 --- a/package-lock.json +++ b/package-lock.json @@ -18,19 +18,19 @@ "@vercel/functions": "^3.9.11", "adm-zip": "^0.6.1", "bcrypt": "^6.0.0", - "dotenv": "^17.4.2", + "dotenv": "^18.0.6", "gray-matter": "^4.0.3", "html5-qrcode": "^2.3.8", "marked": "^18.0.14", "marked-highlight": "^2.2.4", "nanoid": "^6.0.1", - "nodemailer": "^9.0.4", + "nodemailer": "^10.0.16", "openai": "^7.27.0", "otpauth": "^9.5.2", "pg": "^8.23.0", "shiki": "^4.4.3", "simple-oauth2": "^5.1.0", - "stripe": "^22.6.2", + "stripe": "^23.0.0", "sveltekit-api": "^0.6.1", "swagger-ui-dist": "^5.33.1", "zod": "^4.4.3" @@ -5130,6 +5130,19 @@ } } }, + "node_modules/c12/node_modules/dotenv": { + "version": "17.4.2", + "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz", + "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==", + "dev": true, + "license": "BSD-2-Clause", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://dotenvx.com" + } + }, "node_modules/cacheable": { "version": "2.5.0", "resolved": "https://registry.npmjs.org/cacheable/-/cacheable-2.5.0.tgz", @@ -5656,10 +5669,13 @@ } }, "node_modules/dotenv": { - "version": "17.4.2", - "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz", - "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==", + "version": "18.0.6", + "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-18.0.6.tgz", + "integrity": "sha512-ZMVmohV6CvAJtj++pZNyggluUt6hbRdQAxc2+Z635RL6/AG/ruXv5lHnybUFoxMPL/yrTL/tsF4paZu2l7RA6Q==", "license": "BSD-2-Clause", + "bin": { + "dotenv": "dist/index.cjs" + }, "engines": { "node": ">=12" }, @@ -7662,12 +7678,12 @@ } }, "node_modules/nodemailer": { - "version": "9.1.1", - "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.1.1.tgz", - "integrity": "sha512-izw9mVKFix6YSnC9eLgV6g1opl9DUlRio9ZNcq+Wu9Ujn2UwF+8Nl0B8nz22kEC+CTZCvinkxwJ0DeFbb6NwcQ==", + "version": "10.0.16", + "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-10.0.16.tgz", + "integrity": "sha512-VL9xKErxN+el77o8eBOuYKUPMyEx7F9hfnDCuiUKJRp9v3wnWMOudYgP/SWbwSHy8rUL4cylobuXtki1LpQS7A==", "license": "MIT-0", "engines": { - "node": ">=6.0.0" + "node": ">=20.0.0" } }, "node_modules/nopt": { @@ -9148,15 +9164,15 @@ } }, "node_modules/stripe": { - "version": "22.6.2", - "resolved": "https://registry.npmjs.org/stripe/-/stripe-22.6.2.tgz", - "integrity": "sha512-PwRE2scocvXqDKPiskMa5vRJEAEkq46W69XyUYmAwrNSLr675lQnfqLwnsndAWizwgihOWw/irLmoFRo3ez7ew==", + "version": "23.0.0", + "resolved": "https://registry.npmjs.org/stripe/-/stripe-23.0.0.tgz", + "integrity": "sha512-MDE2A5ZVVluYURORaZEVghSmnLJc3w6aHAlZSxDQMsOjOb3V0O6ro/CiaeFlJS4N7uIVmsg98ocRsPmUK6YfyA==", "license": "MIT", "engines": { - "node": ">=18" + "node": ">=20" }, "peerDependencies": { - "@types/node": ">=18" + "@types/node": ">=20" }, "peerDependenciesMeta": { "@types/node": { diff --git a/package.json b/package.json index 82e7a69..efc8fa8 100644 --- a/package.json +++ b/package.json @@ -94,19 +94,19 @@ "@vercel/functions": "^3.9.11", "adm-zip": "^0.6.1", "bcrypt": "^6.0.0", - "dotenv": "^17.4.2", + "dotenv": "^18.0.6", "gray-matter": "^4.0.3", "html5-qrcode": "^2.3.8", "marked": "^18.0.14", "marked-highlight": "^2.2.4", "nanoid": "^6.0.1", - "nodemailer": "^9.0.4", + "nodemailer": "^10.0.16", "openai": "^7.27.0", "otpauth": "^9.5.2", "pg": "^8.23.0", "shiki": "^4.4.3", "simple-oauth2": "^5.1.0", - "stripe": "^22.6.2", + "stripe": "^23.0.0", "sveltekit-api": "^0.6.1", "swagger-ui-dist": "^5.33.1", "zod": "^4.4.3" diff --git a/src/lib/server/stripe.ts b/src/lib/server/stripe.ts index 8c34381..b2f722d 100644 --- a/src/lib/server/stripe.ts +++ b/src/lib/server/stripe.ts @@ -6,7 +6,7 @@ if (!STRIPE_SECRET_KEY) { } export const stripe = new Stripe(STRIPE_SECRET_KEY, { - apiVersion: '2026-08-26.dahlia', + apiVersion: '2026-09-30.endive', typescript: true }); @@ -28,7 +28,9 @@ export async function createCheckoutSession(params: CheckoutSessionParams) { const session = await stripe.checkout.sessions.create({ mode: 'subscription', - payment_method_types: ['card'], + // Stripe API 2026-09-30.endive removed payment_method_types. This filters + // the dynamic method list down to cards, matching the previous card-only checkout. + allowed_payment_method_types: ['card'], customer_email: customerEmail, line_items: [ {