[Snyk] Upgrade @vercel/ncc from 0.34.0 to 0.38.4

[snyk-io]

Snyk has created this PR to upgrade @vercel/ncc from 0.34.0 to 0.38.4.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 8 versions ahead of your current version.

• The recommended version was released 21 days ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	57	Proof of Concept
	Prototype Pollution SNYK-JS-XML2JS-5414874	57	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073	57	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-WORDWRAP-3149973	57	Proof of Concept

Release notes

Package name: @vercel/ncc

• 0.38.4 - 2025-09-18
  

  0.38.4 (2025-09-18)

  Bug Fixes

  • cjs-build: enable evaluating import.meta in cjs build (#1236) (e72d34d), closes /github.com/vercel/ncc/pull/897#discussion_r836916315 #1019
• 0.38.3 - 2024-11-15
  

  0.38.3 (2024-11-15)

  Bug Fixes

  • add missing --asset-builds to cli help message (#1228) (84f8c52)
• 0.38.2 - 2024-09-23
  

  0.38.2 (2024-09-23)

  Bug Fixes

  • deps: update webpack to v5.94.0, terser to v5.33.0 (#1213) (158a1fd), closes #1193 #1194 #1177 #1204 #1195

  Huge thanks to @ theoludwig 🎉

• 0.38.1 - 2023-10-18
  

  0.38.1 (2023-10-18)

  Bug Fixes

  • sourcemap sources removes webpack path (#1122) (ce5984e), closes #1011 #1121
• 0.38.0 - 2023-09-06
  

  0.38.0 (2023-09-06)

  Features

  • Log minification error when --debug (#1102) (e2779f4)
• 0.37.0 - 2023-09-06
  

  0.37.0 (2023-09-06)

  Features

  • add support for TypeScript 5.0's array extends in tsconfig (#1105) (f898f8e)
• 0.36.1 - 2023-01-25
  

  0.36.1 (2023-01-25)

  Bug Fixes

  • add missing pr title lint action (#1032) (c2d03cf)
  • add ncc --version and ncc --help (#1030) (d38b619)
• 0.36.0 - 2022-12-05
  

  0.36.0 (2022-12-05)

  Bug Fixes

  • gitignore should include release.config.js (#1016) (44e2eac)
  • node 18 by update source-map used by Terser to 0.7.4 (#999) (2f69f83)

  Features

  • add semantic-release to autopublish (#1015) (be3405d), closes #1000
• 0.34.0 - 2022-05-25
  

  Changes

  Add support for TS 4.7

  • Chore(deps-dev): bump ts-loader from 8.3.0 to 9.3.0: #921
  • Chore(deps-dev): bump express from 4.17.1 to 4.18.1: #917
  • Chore: add memory-fs to the devDependencies: #927

  Credits

  Huge thanks to @ stscoundrel and @ shogo82148 for helping!

from @vercel/ncc GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
package.json	0% smaller

[snyk-io]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)