Repository navigation
fix: bump @stripe/stripe-js from 9.17.0 to 10.2.1 - #2618
Merged
groupthinking merged 1 commit intoNov 10, 2026
Merged
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
Bumps [@stripe/stripe-js](https://github.com/stripe/stripe-js) from 9.17.0 to 10.2.1. - [Release notes](https://github.com/stripe/stripe-js/releases) - [Commits](stripe/stripe-js@v9.17.0...v10.2.1) --- updated-dependencies: - dependency-name: "@stripe/stripe-js" dependency-version: 10.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/stripe/stripe-js-10.2.1
branch
from
November 9, 2026 22:43
fd28a2f to
cbf8f76
Compare
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
approved these changes
Nov 10, 2026
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Reviewed exact head cbf8f76ea77fab91048e4f9df4fd9c4ebfa11f50. The complete two-file diff updates the direct web declaration and its frozen lock entry from Stripe.js 9.17.0 to 10.2.1; the package moves into the web workspace, retains MIT licensing, and introduces no unrelated package version changes.
I checked Stripe's v10 breaking changes against tracked application source: there are no imports of @stripe/stripe-js or uses of the removed browser APIs. Existing checkout code uses the separate server stripe package, whose version and implementation are unchanged. A clean frozen install and web type check pass; all 82 focused billing tests pass. The installed public browser-loader package also returns null during server rendering without making a network request. These checks do not constitute a live payment test.
Hosted CI passes 1,532 web tests with one skip, type/lint validation, the 47-page application and Docker builds, and 21 real Studio preflight checks. The preview pipeline passes 16/16, including ready-pack lineage. Those preview tests concern the video pipeline and may use cached packs; they do not exercise real Stripe payments.
The dependency review passes. I downloaded the artifact and verified its ZIP/raw-diff digests, exact base/head/run identity, successful verdict, and all four typed rows against the current live comparison. It reports only Stripe.js declaration/locked-version replacements, zero vulnerability entries, no pagination link and no snapshot-warning value. All 29 current checks completed: 26 passed and three skipped; no review threads are unresolved.
Approving this scoped dependency update. The full npm audit still fails with 25 high and 22 moderate package findings, with no new advisory IDs versus the verified main baseline. Repository-wide security clearance, a live payment, a production deployment and merge authorization are not established by this approval. Auto-merge remains disabled.
groupthinking
deleted the
dependabot/npm_and_yarn/stripe/stripe-js-10.2.1
branch
November 10, 2026 15:02
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @stripe/stripe-js from 9.17.0 to 10.2.1.
Release notes
Sourced from @stripe/stripe-js's releases.
... (truncated)
Commits
6287f71v10.2.10a835b9Add types for Pricing SDK (beta) (#1003)3e90d0cAdd Canary Islands NIF to Checkout and Tax ID Element types (#1002)fc91effv10.2.0d7bca50Add individual/business name update actions and nameCollection to EwCS types ...da1c94dRemove un-updatable PE layout options from types (#1000)37537e3add missing RON currency to PMME (#999)3de39c5v10.1.0062c997Bump proxy-addr from 2.0.7 to 2.0.8 in /examples/rollup (#995)47d3472Bump brace-expansion from 1.1.16 to 1.1.21 in /examples/parcel (#994)