Skip to content

Bump the medusa group with 20 updates - #7

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/medusa-dcb7a96fcf
Open

Bump the medusa group with 20 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/medusa-dcb7a96fcf

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the medusa group with 20 updates:

Package From To
@medusajs/icons 2.18.0 2.20.0
@medusajs/ui 4.1.19 4.2.2
@mercurjs/dashboard-sdk 2.3.0 2.3.3
@mercurjs/dashboard-shared 2.3.0 2.3.3
@mercurjs/client 2.2.0 2.3.3
@mercurjs/docs 2.3.0 2.3.3
@medusajs/admin-sdk 2.18.0 2.20.0
@medusajs/cli 2.18.0 2.20.0
@medusajs/core-flows 2.18.0 2.20.0
@medusajs/framework 2.18.0 2.20.0
@medusajs/dashboard 2.18.0 2.20.0
@medusajs/admin-shared 2.18.0 2.20.0
@medusajs/medusa 2.18.0 2.20.0
@medusajs/draft-order 2.18.0 2.20.0
@mercurjs/core 2.3.0 2.3.3
@mercurjs/types 2.2.0 2.3.3
@mercurjs/cli 2.3.0 2.3.3
@mercurjs/admin 2.3.0 2.3.3
@mercurjs/vendor 2.3.0 2.3.3
@medusajs/types 2.18.0 2.20.0

Updates @medusajs/icons from 2.18.0 to 2.20.0

Release notes

Sourced from @​medusajs/icons's releases.

v2.20.0: Security Fixes, Performance Improvements, Calculated Shipping Options in Draft Orders

Highlights

Medusa MCP users can update their project using the following prompt:

Update my Medusa project to v2.20.0

Payment providers are now validated against the cart's region

Security fix: creating a payment session no longer trusts the payment provider ID passed in the request. The createPaymentSessionsWorkflow and the cart payment validation step now verify that the chosen provider is actually enabled in the cart's (or payment collection's) region, and reject the request otherwise. Previously a store customer could initiate a payment session with any payment provider installed in the application, even one that was not linked to their region.

No action is required, but if your storefront relied on passing an arbitrary provider ID, make sure the provider is linked to the region the cart belongs to.

MFA Challenge Enforcement on MFA Routes

Security fix: An attacker who already had a user's valid password could use that token to regenerate the recovery codes through POST /auth/mfa/recovery-codes and use one of them to complete the challenge, or enroll and delete MFA factors. This releases fixes this issue by tracking whether a user has completed MFA before allowing them to access the recovery codes route.

Relations Limit on Store API Routes

🚧 Breaking change

This only affects Store API requests that expand deeply nested relations through fields. Admin routes are unaffected.

Store API routes now reject requests that expand more than three levels of relations in a single query by default, since deeply nested expansions can cause bad performance. A request such as fields=*products.variants.options.values now returns a 400 error listing the offending fields.

The product routes are the only core Store routes that raise the limit above the default, allowing four levels of relations:

  • GET /store/products
  • GET /store/products/:id

To change the limit for every Store route, set storeRelationsLimit in your HTTP configuration:

module.exports = defineConfig({
</tr></table>

... (truncated)

Changelog

Sourced from @​medusajs/icons's changelog.

2.20.0

2.19.0

Patch Changes

Commits

Updates @medusajs/ui from 4.1.19 to 4.2.2

Changelog

Sourced from @​medusajs/ui's changelog.

4.2.2

Patch Changes

  • Updated dependencies []:
    • @​medusajs/icons@​2.20.0

4.2.1

Patch Changes

4.2.0

Minor Changes

Patch Changes

  • #14661 8f97e3f3710a2bae662415dac7098e1c6e60c3c9 Thanks @​NicolasGorga! - feat(dashboard,admin-vite-plugin,admin-shared,ui,settings,js-sdk,types): view configuration UI enhancements — dynamic filter/sort resolution, custom cell renderer registration, property labels management UI

  • Updated dependencies []:

    • @​medusajs/icons@​2.18.0
Commits

Updates @mercurjs/dashboard-sdk from 2.3.0 to 2.3.3

Release notes

Sourced from @​mercurjs/dashboard-sdk's releases.

v2.3.3

   🐞 Bug Fixes

    View changes on GitHub

v2.3.2

A security and hardening release. All marketplaces running 2.3.1 or earlier should upgrade.

🔒 Security

This release fixes a critical broken-access-control (BOLA/IDOR) vulnerability in the vendor API, privately reported by @​hackchang under coordinated disclosure. Thank you.

The issue: the /vendor/sellers/:id route subtree operated on the URL id parameter without binding it to the authenticated seller. Any authenticated vendor could target another seller's id to read that store's full record (profile, payment details, professional/tax details), overwrite its profile, and manage its team members — invite themselves in, change roles, remove members. In effect, full account takeover of any other vendor's store.

Weakness: CWE-639 / CWE-862 · Severity: Critical (CVSS 3.1 ~9.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

What changed:

  • Every /vendor/sellers/:id handler is now scoped to the authenticated seller; a mismatched id no longer resolves (#1449)
  • Member-management routes bind member_id to the caller's own seller
  • GET /vendor/stores now requires member authentication (#1450)
  • The vendor stores query has its selectable fields restricted (#1453)

A GitHub Security Advisory with a CVE request is being published from the repository's Security tab, with @​hackchang credited as reporter.

✨ Features

  • Attribute edits now go through the product-change diff pipeline, the same way product edits do (#1444)
  • CLI builds admin dashboard extensions, and a package can ship its own entry point (#1424)
  • create-mercur-app pins generated projects to the CLI's release channel (#1459) — scaffolding with @rc no longer mixes in latest packages

🐛 Fixes

Checkout & orders

  • Core owns the payment webhook so carts complete as split orders (#1418)
  • Split-order payment status is reported correctly on the admin and store order routes (#1458)
  • Payment statuses are no longer double-counted (#1399) — thanks @​shin4141
  • Cart shipping profiles are validated against the offer (#1417), and shipping-method cleanup is derived from offers rather than products (#1455)

Offers & attributes

  • Created offer prices are attributed by rule instead of position (#1397)
  • New scoped-axis option values are associated with their product (#1454)
  • Attribute possible-values pagination fixed (#1447) — thanks @​adeaviladev01
  • The pending product-change guard is actor-scoped (#1443)

Dashboards

  • RouteDrawer dialogs have an accessible title (#1415)
  • The admin invite form carries the roles field, so invited admins aren't locked out (#1420)

... (truncated)

Commits
  • 4e91ae1 chore: v2.3.3 (#1462)
  • 80bd554 chore: v2.3.2
  • 560f82d chore: v2.3.2-canary.5
  • 2a61175 chore: v2.3.2-canary.4
  • a1b8c16 fix(dashboard-sdk): resolve plugin roots via Node, and stop emitting top-leve...
  • 4233bac chore: v2.3.2-canary.3
  • 34ddd04 chore: v2.3.2-canary.2
  • 02486bc feat: RBAC foundation — shared permission guards + route policy enforcement (...
  • 21b294d chore: v2.3.2-canary.1
  • eb77e44 chore: v2.3.2-canary.0
  • Additional commits viewable in compare view

Updates @mercurjs/dashboard-shared from 2.3.0 to 2.3.3

Release notes

Sourced from @​mercurjs/dashboard-shared's releases.

v2.3.3

   🐞 Bug Fixes

    View changes on GitHub

v2.3.2

A security and hardening release. All marketplaces running 2.3.1 or earlier should upgrade.

🔒 Security

This release fixes a critical broken-access-control (BOLA/IDOR) vulnerability in the vendor API, privately reported by @​hackchang under coordinated disclosure. Thank you.

The issue: the /vendor/sellers/:id route subtree operated on the URL id parameter without binding it to the authenticated seller. Any authenticated vendor could target another seller's id to read that store's full record (profile, payment details, professional/tax details), overwrite its profile, and manage its team members — invite themselves in, change roles, remove members. In effect, full account takeover of any other vendor's store.

Weakness: CWE-639 / CWE-862 · Severity: Critical (CVSS 3.1 ~9.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

What changed:

  • Every /vendor/sellers/:id handler is now scoped to the authenticated seller; a mismatched id no longer resolves (#1449)
  • Member-management routes bind member_id to the caller's own seller
  • GET /vendor/stores now requires member authentication (#1450)
  • The vendor stores query has its selectable fields restricted (#1453)

A GitHub Security Advisory with a CVE request is being published from the repository's Security tab, with @​hackchang credited as reporter.

✨ Features

  • Attribute edits now go through the product-change diff pipeline, the same way product edits do (#1444)
  • CLI builds admin dashboard extensions, and a package can ship its own entry point (#1424)
  • create-mercur-app pins generated projects to the CLI's release channel (#1459) — scaffolding with @rc no longer mixes in latest packages

🐛 Fixes

Checkout & orders

  • Core owns the payment webhook so carts complete as split orders (#1418)
  • Split-order payment status is reported correctly on the admin and store order routes (#1458)
  • Payment statuses are no longer double-counted (#1399) — thanks @​shin4141
  • Cart shipping profiles are validated against the offer (#1417), and shipping-method cleanup is derived from offers rather than products (#1455)

Offers & attributes

  • Created offer prices are attributed by rule instead of position (#1397)
  • New scoped-axis option values are associated with their product (#1454)
  • Attribute possible-values pagination fixed (#1447) — thanks @​adeaviladev01
  • The pending product-change guard is actor-scoped (#1443)

Dashboards

  • RouteDrawer dialogs have an accessible title (#1415)
  • The admin invite form carries the roles field, so invited admins aren't locked out (#1420)

... (truncated)

Commits
  • 4e91ae1 chore: v2.3.3 (#1462)
  • 80bd554 chore: v2.3.2
  • 560f82d chore: v2.3.2-canary.5
  • 3631eb9 fix(dashboard): let NoRecords empty state grow instead of overflowing (#1456)
  • e075de6 fix(dashboard-shared): enable DataGrid column resizing (#1452)
  • 2a61175 chore: v2.3.2-canary.4
  • 4233bac chore: v2.3.2-canary.3
  • 3669848 fix(dashboard): make react-router-dom a peer dependency (#1426)
  • 34ddd04 chore: v2.3.2-canary.2
  • 02486bc feat: RBAC foundation — shared permission guards + route policy enforcement (...
  • Additional commits viewable in compare view

Updates @mercurjs/client from 2.2.0 to 2.3.3

Release notes

Sourced from @​mercurjs/client's releases.

v2.3.3

   🐞 Bug Fixes

    View changes on GitHub

v2.3.2

A security and hardening release. All marketplaces running 2.3.1 or earlier should upgrade.

🔒 Security

This release fixes a critical broken-access-control (BOLA/IDOR) vulnerability in the vendor API, privately reported by @​hackchang under coordinated disclosure. Thank you.

The issue: the /vendor/sellers/:id route subtree operated on the URL id parameter without binding it to the authenticated seller. Any authenticated vendor could target another seller's id to read that store's full record (profile, payment details, professional/tax details), overwrite its profile, and manage its team members — invite themselves in, change roles, remove members. In effect, full account takeover of any other vendor's store.

Weakness: CWE-639 / CWE-862 · Severity: Critical (CVSS 3.1 ~9.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

What changed:

  • Every /vendor/sellers/:id handler is now scoped to the authenticated seller; a mismatched id no longer resolves (#1449)
  • Member-management routes bind member_id to the caller's own seller
  • GET /vendor/stores now requires member authentication (#1450)
  • The vendor stores query has its selectable fields restricted (#1453)

A GitHub Security Advisory with a CVE request is being published from the repository's Security tab, with @​hackchang credited as reporter.

✨ Features

  • Attribute edits now go through the product-change diff pipeline, the same way product edits do (#1444)
  • CLI builds admin dashboard extensions, and a package can ship its own entry point (#1424)
  • create-mercur-app pins generated projects to the CLI's release channel (#1459) — scaffolding with @rc no longer mixes in latest packages

🐛 Fixes

Checkout & orders

  • Core owns the payment webhook so carts complete as split orders (#1418)
  • Split-order payment status is reported correctly on the admin and store order routes (#1458)
  • Payment statuses are no longer double-counted (#1399) — thanks @​shin4141
  • Cart shipping profiles are validated against the offer (#1417), and shipping-method cleanup is derived from offers rather than products (#1455)

Offers & attributes

  • Created offer prices are attributed by rule instead of position (#1397)
  • New scoped-axis option values are associated with their product (#1454)
  • Attribute possible-values pagination fixed (#1447) — thanks @​adeaviladev01
  • The pending product-change guard is actor-scoped (#1443)

Dashboards

  • RouteDrawer dialogs have an accessible title (#1415)
  • The admin invite form carries the roles field, so invited admins aren't locked out (#1420)

... (truncated)

Commits

Updates @mercurjs/docs from 2.3.0 to 2.3.3

Release notes

Sourced from @​mercurjs/docs's releases.

v2.3.3

   🐞 Bug Fixes

    View changes on GitHub

v2.3.2

A security and hardening release. All marketplaces running 2.3.1 or earlier should upgrade.

🔒 Security

This release fixes a critical broken-access-control (BOLA/IDOR) vulnerability in the vendor API, privately reported by @​hackchang under coordinated disclosure. Thank you.

The issue: the /vendor/sellers/:id route subtree operated on the URL id parameter without binding it to the authenticated seller. Any authenticated vendor could target another seller's id to read that store's full record (profile, payment details, professional/tax details), overwrite its profile, and manage its team members — invite themselves in, change roles, remove members. In effect, full account takeover of any other vendor's store.

Weakness: CWE-639 / CWE-862 · Severity: Critical (CVSS 3.1 ~9.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

What changed:

  • Every /vendor/sellers/:id handler is now scoped to the authenticated seller; a mismatched id no longer resolves (#1449)
  • Member-management routes bind member_id to the caller's own seller
  • GET /vendor/stores now requires member authentication (#1450)
  • The vendor stores query has its selectable fields restricted (#1453)

A GitHub Security Advisory with a CVE request is being published from the repository's Security tab, with @​hackchang credited as reporter.

✨ Features

  • Attribute edits now go through the product-change diff pipeline, the same way product edits do (#1444)
  • CLI builds admin dashboard extensions, and a package can ship its own entry point (#1424)
  • create-mercur-app pins generated projects to the CLI's release channel (#1459) — scaffolding with @rc no longer mixes in latest packages

🐛 Fixes

Checkout & orders

  • Core owns the payment webhook so carts complete as split orders (#1418)
  • Split-order payment status is reported correctly on the admin and store order routes (#1458)
  • Payment statuses are no longer double-counted (#1399) — thanks @​shin4141
  • Cart shipping profiles are validated against the offer (#1417), and shipping-method cleanup is derived from offers rather than products (#1455)

Offers & attributes

  • Created offer prices are attributed by rule instead of position (#1397)
  • New scoped-axis option values are associated with their product (#1454)
  • Attribute possible-values pagination fixed (#1447) — thanks @​adeaviladev01
  • The pending product-change guard is actor-scoped (#1443)

Dashboards

  • RouteDrawer dialogs have an accessible title (#1415)
  • The admin invite form carries the roles field, so invited admins aren't locked out (#1420)

... (truncated)

Commits

Updates @medusajs/admin-sdk from 2.18.0 to 2.20.0

Release notes

Sourced from @​medusajs/admin-sdk's releases.

v2.20.0: Security Fixes, Performance Improvements, Calculated Shipping Options in Draft Orders

Highlights

Medusa MCP users can update their project using the following prompt:

Update my Medusa project to v2.20.0

Payment providers are now validated against the cart's region

Security fix: creating a payment session no longer trusts the payment provider ID passed in the request. The createPaymentSessionsWorkflow and the cart payment validation step now verify that the chosen provider is actually enabled in the cart's (or payment collection's) region, and reject the request otherwise. Previously a store customer could initiate a payment session with any payment provider installed in the application, even one that was not linked to their region.

No action is required, but if your storefront relied on passing an arbitrary provider ID, make sure the provider is linked to the region the cart belongs to.

MFA Challenge Enforcement on MFA Routes

Security fix: An attacker who already had a user's valid password could use that token to regenerate the recovery codes through POST /auth/mfa/recovery-codes and use one of them to complete the challenge, or enroll and delete MFA factors. This releases fixes this issue by tracking whether a user has completed MFA before allowing them to access the recovery codes route.

Relations Limit on Store API Routes

🚧 Breaking change

This only affects Store API requests that expand deeply nested relations through fields. Admin routes are unaffected.

Store API routes now reject requests that expand more than three levels of relations in a single query by default, since deeply nested expansions can cause bad performance. A request such as fields=*products.variants.options.values now returns a 400 error listing the offending fields.

The product routes are the only core Store routes that raise the limit above the default, allowing four levels of relations:

  • GET /store/products
  • GET /store/products/:id

To change the limit for every Store route, set storeRelationsLimit in your HTTP configuration:

module.exports = defineConfig({
</tr></table>

... (truncated)

Changelog

Sourced from @​medusajs/admin-sdk's changelog.

2.20.0

Patch Changes

2.19.0

Patch Changes

Commits

Updates @medusajs/cli from 2.18.0 to 2.20.0

Release notes

Sourced from @​medusajs/cli's releases.

v2.20.0: Security Fixes, Performance Improvements, Calculated Shipping Options in Draft Orders

Highlights

Medusa MCP users can update their project using the following prompt:

Update my Medusa project to v2.20.0

Payment providers are now validated against the cart's region

Security fix: creating a payment session no longer trusts the payment provider ID passed in the request. The createPaymentSessionsWorkflow and the cart payment validation step now verify that the chosen provider is actually enabled in the cart's (or payment collection's) region, and reject the request otherwise. Previously a store customer could initiate a payment session with any payment provider installed in the application, even one that was not linked to their region.

No action is required, but if your storefront relied on passing an arbitrary provider ID, make sure the provider is linked to the region the cart belongs to.

MFA Challenge Enforcement on MFA Routes

Security fix: An attacker who already had a user's valid password could use that token to regenerate the recovery codes through POST /auth/mfa/recovery-codes and use one of them to complete the challenge, or enroll and delete MFA factors. This releases fixes this issue by tracking whether a user has completed MFA before allowing them to access the recovery codes route.

Relations Limit on Store API Routes

🚧 Breaking change

This only affects Store API requests that expand deeply nested relations through fields. Admin routes are unaffected.

Store API routes now reject requests that expand more than three levels of relations in a single query by default, since deeply nested expansions can cause bad performance. A request such as fields=*products.variants.options.values now returns a 400 error listing the offending fields.

The product routes are the only core Store routes that raise the limit above the default, allowing four levels of relations:

  • GET /store/products
  • GET /store/products/:id

To change the limit for every Store route, set storeRelationsLimit in your HTTP configuration:

module.exports = defineConfig({
</tr></table>

... (truncated)

Changelog

Sourced from @​medusajs/cli's changelog.

2.20.0

Patch Changes

2.19.0

Patch Changes

Commits

Updates @medusajs/core-flows from 2.18.0 to 2.20.0

Release notes

Sourced from @​medusajs/core-flows's releases.

v2.20.0: Security Fixes, Performance Improvements, Calculated Shipping Options in Draft Orders

Highlights

Medusa MCP users can update their project using the following prompt:

Update my Medusa project to v2.20.0

Payment providers are now validated against the cart's region

Security fix: creating a payment session no longer trusts the payment provider ID passed in the request. The createPaymentSessionsWorkflow and the cart payment validation step now verify that the chosen provider is actually enabled in the cart's (or payment collection's) region, and reject the request otherwise. Previously a store customer could initiate a payment session with any payment provider installed in the application, even one that was not linked to their region.

No action is required, but if your storefront relied on passing an arbitrary provider ID, make sure the provider is linked to the region the cart belongs to.

MFA Challenge Enforcement on MFA Routes

Security fix: An attacker who already had a user's valid password could use that token to regenerate the recovery codes through POST /auth/mfa/recovery-codes and use one of them to complete the challenge, or enroll and delete MFA factors. This releases fixes this issue by tracking whether a user has completed MFA before allowing them to access the recovery codes route.

Relations Limit on Store API Routes

🚧 Breaking change

This only affects Store API requests that expand deeply nested relations through fields. Admin routes are unaffected.

Store API routes now reject requests that expand more than three levels of relations in a single query by default, since deeply nested expansions can cause bad performance. A request such as fields=*products.variants.options.values now returns a 400 error listing the offending fields.

The product routes are the only core Store routes that raise the limit above the default, allowing four levels of relations:

  • GET /store/products
  • GET /store/products/:id

To change the limit for every Store route, set storeRelationsLimit in your HTTP configuration:

module.exports = defineConfig({
</tr></table>

... (truncated)

Commits

Updates @medusajs/framework from 2.18.0 to 2.20.0

Release notes

Sourced from @​medusajs/framework's releases.

v2.20.0: Security Fixes, Performance Improvements, Calculated Shipping Options in Draft Orders

Highlights

Medusa MCP users can update their project using the following prompt:

Update my Medusa project to v2.20.0

Payment providers are now validated against the cart's region

Security fix: creating a payment session no longer trusts the payment provider ID passed in the request. The createPaymentSessionsWorkflow and the cart payment validation step now verify that the chosen provider is actually enabled in the cart's (or payment collection's) region, and reject the request otherwise. Previously a store customer could initiate a payment session with any payment provider installed in the application, even one that was not linked to their region.

No action is required, but if your storefront relied on passing an arbitrary provider ID, make sure the provider is linked to the region the cart belongs to.

MFA Challenge Enforcement on MFA Routes

Security fix: An attacker who already had a user's valid password could use that token to regenerate the recovery codes through POST /auth/mfa/recovery-codes and use one of them to complete the challenge, or enroll and delete MFA factors. This releases fixes this issue by tracking whether a user has completed MFA before allowing them to access the recovery codes route.

Relations Limit on Store API Routes

🚧 Breaking change

This only affects Store API requests that expand deeply nested relations through fields. Admin routes are unaffected.

Store API routes now reject requests that expand more than three levels of relations in a single query by default, since deeply nested expansions can cause bad performance. A request such as fields=*products.variants.options.values now returns a 400 error listing the offending fields.

The product routes are the only core Store routes that raise the limit above the default, allowing four levels of relations:

  • GET /store/products
  • GET /store/products/:id

To change the limit for every Store route, set storeRelationsLimit in your HTTP configuration:

module.exports = defineConfig({
</tr></table>

... (truncated)

Changelog

Sourced from @​medusajs/framework's changelog.

2.20.0

Minor Changes

Patch Changes

2.19.0

Patch Changes

@dependabot
Bump the medusa group with 20 updates
183ebee 
Bumps the medusa group with 20 updates:

| Package | From | To |
| --- | --- | --- |
| [@medusajs/icons](https://github.com/medusajs/medusa/tree/HEAD/packages/design-system/icons) | `2.18.0` | `2.20.0` |
| [@medusajs/ui](https://github.com/medusajs/medusa/tree/HEAD/packages/design-system/ui) | `4.1.19` | `4.2.2` |
| [@mercurjs/dashboard-sdk](https://github.com/mercurjs/mercur/tree/HEAD/packages/dashboard-sdk) | `2.3.0` | `2.3.3` |
| [@mercurjs/dashboard-shared](https://github.com/mercurjs/mercur/tree/HEAD/packages/dashboard-shared) | `2.3.0` | `2.3.3` |
| [@mercurjs/client](https://github.com/mercurjs/mercur/tree/HEAD/packages/client) | `2.2.0` | `2.3.3` |
| [@mercurjs/docs](https://github.com/mercurjs/mercur/tree/HEAD/packages/docs) | `2.3.0` | `2.3.3` |
| [@medusajs/admin-sdk](https://github.com/medusajs/medusa/tree/HEAD/packages/admin/admin-sdk) | `2.18.0` | `2.20.0` |
| [@medusajs/cli](https://github.com/medusajs/medusa/tree/HEAD/packages/cli/medusa-cli) | `2.18.0` | `2.20.0` |
| [@medusajs/core-flows](https://github.com/medusajs/medusa/tree/HEAD/packages/core-flows) | `2.18.0` | `2.20.0` |
| [@medusajs/framework](https://github.com/medusajs/medusa/tree/HEAD/packages/core/framework) | `2.18.0` | `2.20.0` |
| [@medusajs/dashboard](https://github.com/medusajs/medusa/tree/HEAD/packages/admin/dashboard) | `2.18.0` | `2.20.0` |
| [@medusajs/admin-shared](https://github.com/medusajs/medusa/tree/HEAD/packages/admin/admin-shared) | `2.18.0` | `2.20.0` |
| [@medusajs/medusa](https://github.com/medusajs/medusa/tree/HEAD/packages/medusa) | `2.18.0` | `2.20.0` |
| [@medusajs/draft-order](https://github.com/medusajs/medusa/tree/HEAD/packages/plugins/draft-order) | `2.18.0` | `2.20.0` |
| [@mercurjs/core](https://github.com/mercurjs/mercur/tree/HEAD/packages/core) | `2.3.0` | `2.3.3` |
| [@mercurjs/types](https://github.com/mercurjs/mercur/tree/HEAD/packages/types) | `2.2.0` | `2.3.3` |
| [@mercurjs/cli](https://github.com/mercurjs/mercur/tree/HEAD/packages/cli) | `2.3.0` | `2.3.3` |
| [@mercurjs/admin](https://github.com/mercurjs/mercur/tree/HEAD/packages/admin) | `2.3.0` | `2.3.3` |
| [@mercurjs/vendor](https://github.com/mercurjs/mercur/tree/HEAD/packages/vendor) | `2.3.0` | `2.3.3` |
| [@medusajs/types](https://github.com/medusajs/medusa/tree/HEAD/packages/core/types) | `2.18.0` | `2.20.0` |


Updates `@medusajs/icons` from 2.18.0 to 2.20.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/design-system/icons/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.20.0/packages/design-system/icons)

Updates `@medusajs/ui` from 4.1.19 to 4.2.2
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/design-system/ui/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/HEAD/packages/design-system/ui)

Updates `@mercurjs/dashboard-sdk` from 2.3.0 to 2.3.3
- [Release notes](https://github.com/mercurjs/mercur/releases)
- [Commits](https://github.com/mercurjs/mercur/commits/v2.3.3/packages/dashboard-sdk)

Updates `@mercurjs/dashboard-shared` from 2.3.0 to 2.3.3
- [Release notes](https://github.com/mercurjs/mercur/releases)
- [Commits](https://github.com/mercurjs/mercur/commits/v2.3.3/packages/dashboard-shared)

Updates `@mercurjs/client` from 2.2.0 to 2.3.3
- [Release notes](https://github.com/mercurjs/mercur/releases)
- [Commits](https://github.com/mercurjs/mercur/commits/v2.3.3/packages/client)

Updates `@mercurjs/docs` from 2.3.0 to 2.3.3
- [Release notes](https://github.com/mercurjs/mercur/releases)
- [Commits](https://github.com/mercurjs/mercur/commits/v2.3.3/packages/docs)

Updates `@medusajs/admin-sdk` from 2.18.0 to 2.20.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/admin/admin-sdk/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.20.0/packages/admin/admin-sdk)

Updates `@medusajs/cli` from 2.18.0 to 2.20.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/cli/medusa-cli/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.20.0/packages/cli/medusa-cli)

Updates `@medusajs/core-flows` from 2.18.0 to 2.20.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Commits](https://github.com/medusajs/medusa/commits/v2.20.0/packages/core-flows)

Updates `@medusajs/framework` from 2.18.0 to 2.20.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/core/framework/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.20.0/packages/core/framework)

Updates `@medusajs/dashboard` from 2.18.0 to 2.20.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/admin/dashboard/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.20.0/packages/admin/dashboard)

Updates `@medusajs/admin-shared` from 2.18.0 to 2.20.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/admin/admin-shared/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.20.0/packages/admin/admin-shared)

Updates `@medusajs/medusa` from 2.18.0 to 2.20.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/medusa/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.20.0/packages/medusa)

Updates `@medusajs/draft-order` from 2.18.0 to 2.20.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/plugins/draft-order/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.20.0/packages/plugins/draft-order)

Updates `@mercurjs/core` from 2.3.0 to 2.3.3
- [Release notes](https://github.com/mercurjs/mercur/releases)
- [Commits](https://github.com/mercurjs/mercur/commits/v2.3.3/packages/core)

Updates `@mercurjs/types` from 2.2.0 to 2.3.3
- [Release notes](https://github.com/mercurjs/mercur/releases)
- [Commits](https://github.com/mercurjs/mercur/commits/v2.3.3/packages/types)

Updates `@mercurjs/cli` from 2.3.0 to 2.3.3
- [Release notes](https://github.com/mercurjs/mercur/releases)
- [Commits](https://github.com/mercurjs/mercur/commits/v2.3.3/packages/cli)

Updates `@mercurjs/admin` from 2.3.0 to 2.3.3
- [Release notes](https://github.com/mercurjs/mercur/releases)
- [Commits](https://github.com/mercurjs/mercur/commits/v2.3.3/packages/admin)

Updates `@mercurjs/vendor` from 2.3.0 to 2.3.3
- [Release notes](https://github.com/mercurjs/mercur/releases)
- [Commits](https://github.com/mercurjs/mercur/commits/v2.3.3/packages/vendor)

Updates `@medusajs/types` from 2.18.0 to 2.20.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/core/types/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.20.0/packages/core/types)

---
updated-dependencies:
- dependency-name: "@medusajs/icons"
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@medusajs/ui"
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@mercurjs/dashboard-sdk"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: medusa
- dependency-name: "@mercurjs/dashboard-shared"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: medusa
- dependency-name: "@mercurjs/client"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@mercurjs/docs"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: medusa
- dependency-name: "@medusajs/admin-sdk"
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@medusajs/cli"
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@medusajs/core-flows"
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@medusajs/framework"
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@medusajs/dashboard"
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@medusajs/admin-shared"
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@medusajs/medusa"
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@medusajs/draft-order"
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@mercurjs/core"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: medusa
- dependency-name: "@mercurjs/types"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
- dependency-name: "@mercurjs/cli"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: medusa
- dependency-name: "@mercurjs/admin"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: medusa
- dependency-name: "@mercurjs/vendor"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: medusa
- dependency-name: "@medusajs/types"
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: medusa
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 6, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 27, 2026

Copy link
Copy Markdown
Author

Dependabot could not run Bun to update your dependencies due to a configuration error. Because of this, Dependabot cannot update this pull request.

5 similar comments
@dependabot @github

dependabot Bot commented on behalf of github Oct 4, 2026

Copy link
Copy Markdown
Author

Dependabot could not run Bun to update your dependencies due to a configuration error. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Oct 11, 2026

Copy link
Copy Markdown
Author

Dependabot could not run Bun to update your dependencies due to a configuration error. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Oct 18, 2026

Copy link
Copy Markdown
Author

Dependabot could not run Bun to update your dependencies due to a configuration error. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Author

Dependabot could not run Bun to update your dependencies due to a configuration error. Because of this, Dependabot cannot update this pull request.

@dependabot @github

dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Author

Dependabot could not run Bun to update your dependencies due to a configuration error. Because of this, Dependabot cannot update this pull request.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants