[Snyk] Fix for 8 vulnerabilities

[tranmani]

Snyk has created this PR to fix 8 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-NEXT-16638674	756
	Resources Downloaded over Insecure Protocol SNYK-JS-ESBUILD-17750822	746
	Inefficient Algorithmic Complexity SNYK-JS-BRACEEXPANSION-17706650	721
	Infinite loop SNYK-JS-BRACEEXPANSION-15789759	713
	Allocation of Resources Without Limits or Throttling SNYK-JS-NEXT-15954202	713
	Authentication Bypass Using an Alternate Path or Channel SNYK-JS-NEXT-16638685	713
	Server-side Request Forgery (SSRF) SNYK-JS-NEXT-16638682	706
	Authentication Bypass Using an Alternate Path or Channel SNYK-JS-NEXT-16638686	649

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Allocation of Resources Without Limits or Throttling
🦉 Server-side Request Forgery (SSRF)

[tranmani]

This set of upgrades includes two high-risk major version updates for eslint and react-email that require immediate developer action. The eslint upgrade mandates a configuration file migration and a Node.js version update. The react-email upgrade consolidates packages but introduces a critical risk of significant bundle size increases.

Top 3 Impactful Upgrades

• eslint 9.27.0 → 10.0.0 (HIGH): This major upgrade introduces significant breaking changes. Action is required to migrate.
• react-email 5.2.10 → 6.0.4 (HIGH): This major version unifies packages but has a reported side effect of drastically increasing bundle sizes, which can break deployments.
• next 16.1.7 → 16.2.6 (LOW): This minor upgrade focuses on performance improvements and bug fixes with no documented breaking changes.

High-Risk Upgrade Details

eslint 9.27.0 → 10.0.0

This is a major update that requires several migration steps. It modernizes the configuration and drops support for very old environments.

• Mandatory Configuration Migration: Support for the legacy .eslintrc.* configuration format has been completely removed. You must migrate to the eslint.config.js (flat config) format.
• Node.js Version Requirement: Support for Node.js versions below 20.19.0 has been dropped. Your development and CI/CD environments must be updated.
• New Linting Errors Possible: JSX reference tracking is now enabled by default, which may lead to new no-unused-vars errors for components.

Recommendation: Use the official migration script to aid in the transition. Review the migration guide for detailed instructions.
npx codemod @eslint/v9-to-v10

react-email 5.2.10 → 6.0.4

This upgrade consolidates multiple packages into the main react-email package. While this simplifies imports, it introduces a severe risk.

• Unified Package: All components are now imported directly from react-email instead of separate packages like @react-email/components.
• Critical Performance Risk: The new unified package has been reported to eagerly import large dependencies (like tailwindcss, prismjs, and marked) at the top level. This can increase serverless function bundle sizes by 80MB or more, potentially causing deployments to fail or become very slow.

Recommendation: After upgrading, carefully analyze your application's bundle size before deploying to production. If you experience issues, consider the workarounds suggested in the community, such as manually tree-shaking or awaiting a patch from the library authors.

Other Upgrades

• styled-components 6.0.0 → 6.1.0 (LOW): This is a minor update that adds new features, primarily for React Native, and includes bug fixes. No breaking changes are expected.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
portfolio	Ready	Preview, Comment	Jul 11, 2026 11:48pm