build(deps): Bump @confluentinc/kafka-javascript from 1.4.0 to 1.10.0 by dependabot[bot] · Pull Request #8848 · thirdweb-dev/js

dependabot · 2026-07-20T20:35:41Z

Bumps @confluentinc/kafka-javascript from 1.4.0 to 1.10.0.

Release notes

Sourced from @confluentinc/kafka-javascript's releases.

v1.10.0 is a feature release. It is supported for all usage.

Enhancements

References librdkafka v2.15.0. Refer to the librdkafka v2.15.0 release notes for more information.

Support for union-of-pools/auto-pool mapping for schema registry (#500)

Fixes

Handle non-HTTP errors during retries (#499)

v1.10.0-rc1

v1.10.0 is a feature release candidate. It is not supported.

Enhancements

References librdkafka v2.15.0. Refer to the librdkafka v2.15.0 release notes for more information.

Support for union-of-pools/auto-pool mapping for schema registry (#500)

Fixes

Handle non-HTTP errors during retries (#499)

v1.9.1 is a maintenance release. It is supported for all usage.

Enhancements

References librdkafka v2.14.2. Refer to the librdkafka v2.14.2 release notes for more information.

Fixes

Handle anyOf/allOf in JSON transforms (#479)

Preserve custom subjectNameStrategy in serde constructors (#482)

Correct the TypeScript return type of admin.fetchTopicMetadata to Promise<Array<ITopicMetadata>> (#367)

Correct the TypeScript MemberDescription shape returned by admin.describeGroups so assignment/targetAssignment wrap a topicPartitions array and memberAssignment/memberMetadata are nullable (#487)

Correct the TypeScript FetchOffsetsPartition.error type returned by admin.fetchOffsets to LibrdKafkaError | null, matching the runtime which always populates the field. It never returnes undefined. (#489)

Correct broken "types" path so TS consumers get types (#484)

Resolve IHeaders import for installed clients (#492)

Fix error callback passing and object to the logger instead of a string (#483)

Fix security vulnerabilities in dependencies (#478)

Handle missing Protobuf message index bytes in ProtobufDeserializer (#481)

v1.9.1-rc1 is a maintenance release candidate. It is not supported.

Enhancements

References librdkafka v2.14.2-RC3. Refer to the librdkafka v2.14.2-RC3 release notes for more information.

Fixes

Handle anyOf/allOf in JSON transforms (#479)

Preserve custom subjectNameStrategy in serde constructors (#482)

Correct the TypeScript return type of admin.fetchTopicMetadata to Promise<Array<ITopicMetadata>> (#367)

Correct the TypeScript MemberDescription shape returned by admin.describeGroups so assignment/targetAssignment wrap a topicPartitions array and memberAssignment/memberMetadata are nullable (#487)

Correct the TypeScript FetchOffsetsPartition.error type returned by admin.fetchOffsets to LibrdKafkaError | null, matching the runtime which always populates the field. It never returns undefined. (#489)

Correct broken "types" path so TS consumers get types (#484)

Resolve IHeaders import for installed clients (#492)

Fix error callback passing and object to the logger instead of a string (#483)

... (truncated)

Changelog

Sourced from @confluentinc/kafka-javascript's changelog.

confluent-kafka-javascript 1.10.0

v1.10.0 is a feature release. It is supported for all usage.

Enhancements

References librdkafka v2.15.0. Refer to the librdkafka v2.15.0 release notes for more information.

Support for union-of-pools/auto-pool mapping for schema registry (#500)

Fixes

Handle non-HTTP errors during retries (#499)

confluent-kafka-javascript 1.9.1

v1.9.1 is a maintenance release. It is supported for all usage.

Enhancements

References librdkafka v2.14.2. Refer to the librdkafka v2.14.2 release notes for more information.

Fixes

Handle anyOf/allOf in JSON transforms (#479)

Preserve custom subjectNameStrategy in serde constructors (#482)

Correct the TypeScript return type of admin.fetchTopicMetadata to Promise<Array<ITopicMetadata>> (#367)

Correct the TypeScript MemberDescription shape returned by admin.describeGroups so assignment/targetAssignment wrap a topicPartitions array and memberAssignment/memberMetadata are nullable (#487)

Correct the TypeScript FetchOffsetsPartition.error type returned by admin.fetchOffsets to LibrdKafkaError | null, matching the runtime which always populates the field. It never returnes undefined. (#489)

Correct broken "types" path so TS consumers get types (#484)

Resolve IHeaders import for installed clients (#492)

Fix error callback passing and object to the logger instead of a string (#483)

Fix security vulnerabilities in dependencies (#478)

Handle missing Protobuf message index bytes in ProtobufDeserializer (#481)

confluent-kafka-javascript 1.9.0

v1.9.0 is a feature release. It is supported for all usage.

Enhancements

References librdkafka v2.14.0. Refer to the librdkafka v2.14.0 release notes for more information.

Add AssociatedNameStrategy (#454).

Add enableAt to RuleSet (#470).

confluent-kafka-javascript 1.8.2

v1.8.2 is a maintenance release. It is supported for all usage.

Enhancements

Minor enhancement to JSON Schema validation reporting (#434)

Minor upgrade axios to 1.13.5 (#447)

... (truncated)

Commits

5889e9a v1.10.0 (#504)
43257d7 v1.10.0 rc1 changes (#502)
af425d3 Update chagelog (#503)
1970c10 Reapply "Revert union of Pools PR (#459)" (#500)
90c7a97 [Typescript] Handle non-HTTP errors during retries (#499)
cf4cf8f v1.9.1 (#494)
1c06ed0 v1.9.1-rc1 (#493)
eacb098 [fix] pass string as first arg to user logger on error events (#483)
9357d60 NONJAVACLI-4353: bump axios and pin transitive deps for CVE fixes (#478)
ce56a23 Resolve IHeaders import for installed clients (#492)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

PR-Codex overview

This PR updates several dependencies across various packages, including significant version upgrades for @confluentinc/kafka-javascript and zod, as well as minor updates for various other libraries. It enhances compatibility and potentially introduces new features or fixes.

Detailed summary

Updated @confluentinc/kafka-javascript from 1.4.0 to 1.10.0.
Updated zod from 3.25.75 to 4.1.12.
Various dependencies in pnpm-lock.yaml were updated to newer versions, including:
- @noble/hashes from 1.8.0 to 2.2.0.
- utf-8-validate from 6.0.5 to 6.0.6.
- @babel/core from 7.28.4 to 7.29.7.
- next and its related dependencies were also updated to reflect newer versions.

The following files were skipped due to too many changes: pnpm-lock.yaml

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

Bumps [@confluentinc/kafka-javascript](https://github.com/confluentinc/confluent-kafka-javascript) from 1.4.0 to 1.10.0. - [Release notes](https://github.com/confluentinc/confluent-kafka-javascript/releases) - [Changelog](https://github.com/confluentinc/confluent-kafka-javascript/blob/master/CHANGELOG.md) - [Commits](confluentinc/confluent-kafka-javascript@v1.4.0...v1.10.0) --- updated-dependencies: - dependency-name: "@confluentinc/kafka-javascript" dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-07-20T20:35:48Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-v2	Ready	Preview, Comment	Jul 20, 2026 8:48pm
nebula	Ready	Preview, Comment	Jul 20, 2026 8:48pm
thirdweb_playground	Error		Jul 20, 2026 8:48pm
thirdweb-www	Error		Jul 20, 2026 8:48pm
wallet-ui	Ready	Preview, Comment	Jul 20, 2026 8:48pm

socket-security · 2026-07-20T20:38:40Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@wagmi/cli@2.10.0
	@confluentinc/kafka-javascript@1.10.0

View full report

socket-security · 2026-07-20T20:38:42Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@internationalized/date` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/@internationalized/date@3.12.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@internationalized/date@3.12.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@walletconnect/sign-client` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/@walletconnect/sign-client@2.23.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@walletconnect/sign-client@2.23.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `node-fetch-native` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/node-fetch-native@1.6.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-fetch-native@1.6.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `node-forge` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@coinbase/wallet-mobile-sdk@1.1.2` → `npm/expo-application@6.0.1` → `npm/@mobile-wallet-protocol/client@1.0.0` → `npm/expo-linking@8.0.8` → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/expo-web-browser@15.0.9` → `npm/wagmi@2.19.4` → `npm/node-forge@1.4.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-forge@1.4.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `react-aria` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/react-aria@3.50.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/react-aria@3.50.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `react-stately` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/react-stately@3.48.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/react-stately@3.48.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `yargs` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@coinbase/wallet-mobile-sdk@1.1.2` → `npm/expo-application@6.0.1` → `npm/@mobile-wallet-protocol/client@1.0.0` → `npm/vitest@3.2.4` → `npm/expo-linking@8.0.8` → `npm/@abstract-foundation/agw-react@1.10.0` → `npm/expo-web-browser@15.0.9` → `npm/wagmi@2.19.4` → `npm/yargs@17.7.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/yargs@17.7.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-07-28T02:13:47Z

This PR has been inactive for 7 days. It is now marked as stale and will be closed in 2 days if no further activity occurs.

dependabot · 2026-07-31T02:14:28Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot Bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 20, 2026

dependabot Bot requested a review from a team as a code owner July 20, 2026 20:35

dependabot Bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 20, 2026

github-actions Bot added the packages label Jul 20, 2026

vercel Bot deployed to Preview – wallet-ui July 20, 2026 20:40 View deployment

vercel Bot had a problem deploying to Preview – thirdweb-www July 20, 2026 20:40 Failure

vercel Bot deployed to Preview – nebula July 20, 2026 20:40 View deployment

vercel Bot had a problem deploying to Preview – thirdweb_playground July 20, 2026 20:41 Failure

vercel Bot deployed to Preview – docs-v2 July 20, 2026 20:48 View deployment

github-actions Bot added the Stale label Jul 28, 2026

github-actions Bot closed this Jul 31, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/confluentinc/kafka-javascript-1.10.0 branch July 31, 2026 02:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): Bump @confluentinc/kafka-javascript from 1.4.0 to 1.10.0 - #8848

build(deps): Bump @confluentinc/kafka-javascript from 1.4.0 to 1.10.0#8848
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/confluentinc/kafka-javascript-1.10.0

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited by pr-codex Bot

Loading

Uh oh!

vercel Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 20, 2026

Uh oh!

socket-security Bot commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026 • edited by pr-codex Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Enhancements

Fixes

v1.10.0-rc1

Enhancements

Fixes

Enhancements

Fixes

Enhancements

Fixes

confluent-kafka-javascript 1.10.0

Enhancements

Fixes

confluent-kafka-javascript 1.9.1

Enhancements

Fixes

confluent-kafka-javascript 1.9.0

Enhancements

confluent-kafka-javascript 1.8.2

Enhancements

PR-Codex overview

Detailed summary

Uh oh!

vercel Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 20, 2026

Uh oh!

socket-security Bot commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited by pr-codex Bot

Loading

vercel Bot commented Jul 20, 2026 •

edited

Loading