Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-26 02:00:52 +01:00
Code Issues Packages Projects Releases Wiki Activity
3,360 Commits 1,279 Branches 2,085 Tags
docs/external-task-protocol-replacement
Commit Graph
141 Commits
Author SHA1 Message Date
dependabot[bot] 5b34d265a4 build(deps): bump @agentclientprotocol/claude-agent-acp from 0.59.0 to 0.63.0 (#10302) 
Bumps
[@agentclientprotocol/claude-agent-acp](https://github.com/agentclientprotocol/claude-agent-acp)
from 0.59.0 to 0.63.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agentclientprotocol/claude-agent-acp/releases">@​agentclientprotocol/claude-agent-acp's
releases</a>.</em></p>
<blockquote>
<h2>v0.63.0</h2>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.62.0...v0.63.0">0.63.0</a>
(2026-07-27)</h2>
<h3>Features</h3>
<ul>
<li>Update to claude agent sdk v0.3.220 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/921">#921</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/4c7b89718306229254879e5045a183233b5ed073">4c7b897</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Only resolve a denied tool call the client was told about (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/923">#923</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/8f67b6a92bec24ae43b3dfbd087fe35df0531857">8f67b6a</a>),
closes <a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/918">#918</a></li>
<li>Report tool_progress heartbeats against the tool call they describe
(<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/916">#916</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/5559ba890ca614cdaa189500aba65d81cc4cd51a">5559ba8</a>)</li>
<li><strong>tools:</strong> key Bash terminal metas off the announced
tool_use id (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/917">#917</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/d0604140f907adbf9747f26a070690926e1de82d">d060414</a>)</li>
</ul>
<h2>v0.62.0</h2>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.61.0...v0.62.0">0.62.0</a>
(2026-07-24)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps:</strong> Bump <code>@​hono/node-server</code> from
1.19.14 to 1.19.15 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/908">#908</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/51936049e175274de8e0fd90bc1be2af988c3ca6">5193604</a>)</li>
<li><strong>deps:</strong> Bump media-typer from 1.1.0 to 1.1.1 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/909">#909</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/5d35001563ffd702a29c3bac3b7ca134e40c77f8">5d35001</a>)</li>
<li><strong>deps:</strong> Bump the minor group with 2 updates (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/900">#900</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/809d41c6b7c9e7ba3cb5b206d00793a70edba64a">809d41c</a>)</li>
<li><strong>deps:</strong> Bump the minor group with 2 updates (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/907">#907</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/14d06273c01ad4ae944912e36700f6b5599c4c4d">14d0627</a>)</li>
<li>Update to claude-agent-sdk 0.3.218 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/904">#904</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/8cbaf97254576089a3b5ee6ae222fb763003c01d">8cbaf97</a>)</li>
</ul>
<h2>v0.61.0</h2>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.60.0...v0.61.0">0.61.0</a>
(2026-07-22)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps:</strong> Bump actions/setup-node from 6.4.0 to 7.0.0
(<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/897">#897</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/d9bd36d8b06764d63656d0387ad9430ec9fcb27d">d9bd36d</a>)</li>
<li><strong>deps:</strong> Update to
<code>@​anthropic-ai/claude-agent-sdk</code> 0.3.217 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/899">#899</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/edf3af043b6d00e5caca2cc81a2285c477c8b2ab">edf3af0</a>)</li>
</ul>
<h2>v0.60.0</h2>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.59.0...v0.60.0">0.60.0</a>
(2026-07-20)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps:</strong> Update to claude-agent-sdk 0.3.215 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/890">#890</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/92548f043547b0ddac95921ece020e69f7c12c5f">92548f0</a>)</li>
<li>implement configurable LLM providers (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/853">#853</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/82cd692e500eedec182f817b18cebb005c4b98ce">82cd692</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>parse Agent/Task trailers without regex (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/879">#879</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/06c3d7bdbd8cc9415c8cabac060a50e0951c758b">06c3d7b</a>)</li>
<li>remove ~15s stall on session/new and model switch by seeding the
context window synchronously (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/894">#894</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/ff9b96d462831b1c3b96722ea20215ff6e529cb1">ff9b96d</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/agentclientprotocol/claude-agent-acp/blob/main/CHANGELOG.md">@​agentclientprotocol/claude-agent-acp's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.62.0...v0.63.0">0.63.0</a>
(2026-07-27)</h2>
<h3>Features</h3>
<ul>
<li>Update to claude agent sdk v0.3.220 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/921">#921</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/4c7b89718306229254879e5045a183233b5ed073">4c7b897</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Only resolve a denied tool call the client was told about (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/923">#923</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/8f67b6a92bec24ae43b3dfbd087fe35df0531857">8f67b6a</a>),
closes <a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/918">#918</a></li>
<li>Report tool_progress heartbeats against the tool call they describe
(<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/916">#916</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/5559ba890ca614cdaa189500aba65d81cc4cd51a">5559ba8</a>)</li>
<li><strong>tools:</strong> key Bash terminal metas off the announced
tool_use id (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/917">#917</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/d0604140f907adbf9747f26a070690926e1de82d">d060414</a>)</li>
</ul>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.61.0...v0.62.0">0.62.0</a>
(2026-07-24)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps:</strong> Bump <code>@​hono/node-server</code> from
1.19.14 to 1.19.15 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/908">#908</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/51936049e175274de8e0fd90bc1be2af988c3ca6">5193604</a>)</li>
<li><strong>deps:</strong> Bump media-typer from 1.1.0 to 1.1.1 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/909">#909</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/5d35001563ffd702a29c3bac3b7ca134e40c77f8">5d35001</a>)</li>
<li><strong>deps:</strong> Bump the minor group with 2 updates (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/900">#900</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/809d41c6b7c9e7ba3cb5b206d00793a70edba64a">809d41c</a>)</li>
<li><strong>deps:</strong> Bump the minor group with 2 updates (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/907">#907</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/14d06273c01ad4ae944912e36700f6b5599c4c4d">14d0627</a>)</li>
<li>Update to claude-agent-sdk 0.3.218 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/904">#904</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/8cbaf97254576089a3b5ee6ae222fb763003c01d">8cbaf97</a>)</li>
</ul>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.60.0...v0.61.0">0.61.0</a>
(2026-07-22)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps:</strong> Bump actions/setup-node from 6.4.0 to 7.0.0
(<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/897">#897</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/d9bd36d8b06764d63656d0387ad9430ec9fcb27d">d9bd36d</a>)</li>
<li><strong>deps:</strong> Update to
<code>@​anthropic-ai/claude-agent-sdk</code> 0.3.217 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/899">#899</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/edf3af043b6d00e5caca2cc81a2285c477c8b2ab">edf3af0</a>)</li>
</ul>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.59.0...v0.60.0">0.60.0</a>
(2026-07-20)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps:</strong> Update to claude-agent-sdk 0.3.215 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/890">#890</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/92548f043547b0ddac95921ece020e69f7c12c5f">92548f0</a>)</li>
<li>implement configurable LLM providers (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/853">#853</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/82cd692e500eedec182f817b18cebb005c4b98ce">82cd692</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>parse Agent/Task trailers without regex (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/879">#879</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/06c3d7bdbd8cc9415c8cabac060a50e0951c758b">06c3d7b</a>)</li>
<li>remove ~15s stall on session/new and model switch by seeding the
context window synchronously (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/894">#894</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/ff9b96d462831b1c3b96722ea20215ff6e529cb1">ff9b96d</a>)</li>
<li>Silence missing PostToolUse callbacks (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/895">#895</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/1887ada215b27bb1025d9b7696a46ae7a4ac0f7a">1887ada</a>),
closes <a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/889">#889</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/15979bba7907484ee22111cdc33b79b0bdcd452d"><code>15979bb</code></a>
chore(main): release 0.63.0 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/922">#922</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/8f67b6a92bec24ae43b3dfbd087fe35df0531857"><code>8f67b6a</code></a>
fix: Only resolve a denied tool call the client was told about (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/923">#923</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/5559ba890ca614cdaa189500aba65d81cc4cd51a"><code>5559ba8</code></a>
fix: Report tool_progress heartbeats against the tool call they describe
(<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/916">#916</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/d0604140f907adbf9747f26a070690926e1de82d"><code>d060414</code></a>
fix(tools): key Bash terminal metas off the announced tool_use id (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/917">#917</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/4c7b89718306229254879e5045a183233b5ed073"><code>4c7b897</code></a>
feat: Update to claude agent sdk v0.3.220 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/921">#921</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/8663170f18c0b92a68972d8b56a91c064ab3df60"><code>8663170</code></a>
Add structured Bash titles and nested subagent transcripts (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/881">#881</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/53a0c36ce3b0b76929d11d8b9565e319da745608"><code>53a0c36</code></a>
chore(main): release 0.62.0 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/901">#901</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/c91f943f8663d847587d8f1b90b30630dde0c345"><code>c91f943</code></a>
<code>@​anthropic-ai/claude-agent-sdk</code> 0.3.218 -&gt; 0.3.219 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/912">#912</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/5d35001563ffd702a29c3bac3b7ca134e40c77f8"><code>5d35001</code></a>
feat(deps): Bump media-typer from 1.1.0 to 1.1.1 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/909">#909</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/51936049e175274de8e0fd90bc1be2af988c3ca6"><code>5193604</code></a>
feat(deps): Bump <code>@​hono/node-server</code> from 1.19.14 to 1.19.15
(<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/908">#908</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.59.0...v0.63.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-29 09:33:08 -07:00
github-actions[bot]andlockfile-bot b8ceddbf11 chore(lockfile): refresh pnpm-lock.yaml (#10391) 
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.

Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
 2026-07-28 14:16:19 -07:00
dependabot[bot] a90f816c89 build(deps): bump lexical from 0.46.0 to 0.48.0 (#10299) 
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work
> - The UI depends on `lexical` for rich text editing in user-facing
flows
> - Dependabot detected a newer `lexical` release with bug fixes and
security hardening
> - A dependency-only bump is the smallest safe way to pick up those
upstream fixes
> - This pull request updates `lexical` from 0.46.0 to 0.48.0
> - The benefit is lower maintenance risk and a smaller security/support
gap without changing app logic

## Linked Issues or Issue Description

- No public issue exists for this maintenance update.
- Related public PR: Refs #9885.

## What Changed

- Bumped `lexical` from 0.46.0 to 0.48.0.
- Refreshed the lockfile entries for the dependency update.

## Verification

- GitHub Actions checks on PR #10299 passed.
- No local code changes were needed for this dependency-only update.

## Risks

- Low risk overall because this is a dependency-only update.
- Upstream editor behavior could still shift subtly; CI and the
dependency bump itself are the primary safeguard.

## Model Used

- OpenAI GPT-5 (Codex), tool-using agent.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 11:58:22 -07:00
dependabot[bot] f9034ab3ca build(deps-dev): bump @types/node from 22.19.21 to 22.20.1 (#10304) 
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 22.19.21 to 22.20.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 10:48:45 -07:00
dependabot[bot] dac7e66724 build(deps-dev): bump storybook from 10.4.6 to 10.5.5 (#10303) 
Bumps
[storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core)
from 10.4.6 to 10.5.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/releases">storybook's
releases</a>.</em></p>
<blockquote>
<h2>v10.5.5</h2>
<h2>10.5.5</h2>
<ul>
<li>CLI: Update AI setup instructions to msw-storybook-addon v3 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35512">#35512</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
<li>Core: Upgrade `ws` to fix security advisories - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35584">#35584</a>,
thanks <a
href="https://github.com/ndelangen"><code>@​ndelangen</code></a>!</li>
<li>ReactNative: Telemetry framework detection fix - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>,
thanks <a
href="https://github.com/ndelangen"><code>@​ndelangen</code></a>!</li>
<li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>,
thanks <a
href="https://github.com/hxy-asdw"><code>@​hxy-asdw</code></a>!</li>
<li>TanStack: Preserve explicit route ids on pathful clones - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35499">#35499</a>,
thanks <a
href="https://github.com/unpunnyfuns"><code>@​unpunnyfuns</code></a>!</li>
<li>TanStack: Resolve mock redirects through Vite's resolver - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35501">#35501</a>,
thanks <a
href="https://github.com/unpunnyfuns"><code>@​unpunnyfuns</code></a>!</li>
<li>TanStack: Respect routeOverrides component overrides in stories - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35497">#35497</a>,
thanks <a
href="https://github.com/unpunnyfuns"><code>@​unpunnyfuns</code></a>!</li>
</ul>
<h2>v10.5.4</h2>
<h2>10.5.4</h2>
<ul>
<li>ReactNative: Telemetry framework detection fix - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>,
thanks <a
href="https://github.com/ndelangen"><code>@​ndelangen</code></a>!</li>
<li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>,
thanks <a
href="https://github.com/hxy-asdw"><code>@​hxy-asdw</code></a>!</li>
</ul>
<h2>v10.5.3</h2>
<h2>10.5.3</h2>
<ul>
<li>Dependencies: Upgrade TypeScript to 6.0.3 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34971">#34971</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
</ul>
<h2>v10.5.2</h2>
<h2>10.5.2</h2>
<ul>
<li>Angular-Vite: Drop <code>@​angular/platform-browser-dynamic</code>
peer dependency - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35457">#35457</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Angular-Vite: Widen TypeScript peer dependency range to support
TypeScript 6 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35455">#35455</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Core: Include chromatic packages in ecosystem identifier - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35170">#35170</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
<li>TanStack: Fix createServerFn validator mock - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35185">#35185</a>,
thanks <a
href="https://github.com/sjh9714"><code>@​sjh9714</code></a>!</li>
<li>TanStack: Support pathless layout routes (id-only) in story routing
- <a
href="https://redirect.github.com/storybookjs/storybook/pull/35465">#35465</a>,
thanks <a
href="https://github.com/unpunnyfuns"><code>@​unpunnyfuns</code></a>!</li>
<li>Tanstack-react: Add missing Hydrate export - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35111">#35111</a>,
thanks <a
href="https://github.com/arun-357"><code>@​arun-357</code></a>!</li>
<li>Tanstack-react: Keep JSX-only component references during dead-code
elimination - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35206">#35206</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>Vitest: Fix coverage toggle crash on Vite 6 by clearing closed
Vitest instance on restart - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35461">#35461</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
</ul>
<h2>v10.5.1</h2>
<h2>10.5.1</h2>
<ul>
<li>Angular-Vite: Drop <code>@​angular/platform-browser-dynamic</code>
peer dependency - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35457">#35457</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Angular-Vite: Widen TypeScript peer dependency range to support
TypeScript 6 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35455">#35455</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Core: Include chromatic packages in ecosystem identifier - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35170">#35170</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
</ul>
<h2>v10.5.0</h2>
<h2>10.5.0</h2>
<blockquote>
<p><em>Foundational changes for new AI workflows</em></p>
</blockquote>
<p>Storybook 10.5 contains hundreds of fixes and improvements:</p>
<ul>
<li>⚡️ Angular-vite framework: Modern, fast dev, docs, and test
(preview)</li>
<li>🌈 Vitest initialGlobals: Test across themes, viewports, locales</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md">storybook's
changelog</a>.</em></p>
<blockquote>
<h2>10.5.5</h2>
<ul>
<li>CLI: Update AI setup instructions to msw-storybook-addon v3 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35512">#35512</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
<li>Core: Upgrade <code>ws</code> to fix security advisories - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35584">#35584</a>,
thanks <a
href="https://github.com/ndelangen"><code>@​ndelangen</code></a>!</li>
<li>ReactNative: Telemetry framework detection fix - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>,
thanks <a
href="https://github.com/ndelangen"><code>@​ndelangen</code></a>!</li>
<li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>,
thanks <a
href="https://github.com/hxy-asdw"><code>@​hxy-asdw</code></a>!</li>
<li>TanStack: Preserve explicit route ids on pathful clones - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35499">#35499</a>,
thanks <a
href="https://github.com/unpunnyfuns"><code>@​unpunnyfuns</code></a>!</li>
<li>TanStack: Resolve mock redirects through Vite's resolver - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35501">#35501</a>,
thanks <a
href="https://github.com/unpunnyfuns"><code>@​unpunnyfuns</code></a>!</li>
<li>TanStack: Respect routeOverrides component overrides in stories - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35497">#35497</a>,
thanks <a
href="https://github.com/unpunnyfuns"><code>@​unpunnyfuns</code></a>!</li>
</ul>
<h2>10.5.4</h2>
<ul>
<li>ReactNative: Telemetry framework detection fix - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>,
thanks <a
href="https://github.com/ndelangen"><code>@​ndelangen</code></a>!</li>
<li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>,
thanks <a
href="https://github.com/hxy-asdw"><code>@​hxy-asdw</code></a>!</li>
</ul>
<h2>10.5.3</h2>
<ul>
<li>Dependencies: Upgrade TypeScript to 6.0.3 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34971">#34971</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
</ul>
<h2>10.5.2</h2>
<ul>
<li>TanStack: Fix createServerFn validator mock - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35185">#35185</a>,
thanks <a
href="https://github.com/sjh9714"><code>@​sjh9714</code></a>!</li>
<li>TanStack: Support pathless layout routes (id-only) in story routing
- <a
href="https://redirect.github.com/storybookjs/storybook/pull/35465">#35465</a>,
thanks <a
href="https://github.com/unpunnyfuns"><code>@​unpunnyfuns</code></a>!</li>
<li>Tanstack-react: Add missing Hydrate export - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35111">#35111</a>,
thanks <a
href="https://github.com/arun-357"><code>@​arun-357</code></a>!</li>
<li>Tanstack-react: Keep JSX-only component references during dead-code
elimination - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35206">#35206</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>Vitest: Fix coverage toggle crash on Vite 6 by clearing closed
Vitest instance on restart - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35461">#35461</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
</ul>
<h2>10.5.1</h2>
<ul>
<li>Angular-Vite: Drop <code>@​angular/platform-browser-dynamic</code>
peer dependency - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35457">#35457</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Angular-Vite: Widen TypeScript peer dependency range to support
TypeScript 6 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35455">#35455</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Core: Include chromatic packages in ecosystem identifier - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35170">#35170</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
</ul>
<h2>10.5.0</h2>
<blockquote>
<p><em>Foundational changes for new AI workflows</em></p>
</blockquote>
<p>Storybook 10.5 contains hundreds of fixes and improvements:</p>
<ul>
<li>⚡️ Angular-vite framework: Modern, fast dev, docs, and test
(preview)</li>
<li>🌈 Vitest initialGlobals: Test across themes, viewports, locales</li>
<li>🤖 Agentic review: AI-curated visual changesets and search results
(experimental)</li>
<li>⚛️ React docgen service: Unified metadata across MCP, Docs, and
Controls (experimental)</li>
<li>🧑‍💻 Claude / Codex plugins: One-click ADE integration
(experimental)</li>
</ul>
<!-- raw HTML omitted -->
<ul>
<li>A11y: Fix MDX heading anchors not keyboard accessible - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34368">#34368</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>A11y: Handle lang attribute throughout preview - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35321">#35321</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/storybookjs/storybook/commit/05a52b7a888c6b85c3f8aa6765ed9a0a69a79e4c"><code>05a52b7</code></a>
Bump version from &quot;10.5.4&quot; to &quot;10.5.5&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/201e77a25c58aea0e48a3510f91d5a5d4da85860"><code>201e77a</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/35512">#35512</a>
from storybookjs/yann/ai-setup-msw-v3</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/cac1e6d595df4a8a814ea2aa5005a5dbed0e18a6"><code>cac1e6d</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/35584">#35584</a>
from storybookjs/norbert/upgrade-ws-8.21</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/9166a91fc2dac3f3b8e58ef60a81711882ef5219"><code>9166a91</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/35567">#35567</a>
from ia319/bug/35566-npm-12-registry-flags</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/3327dc44697304275e28ceaa2cd34d9bede4e333"><code>3327dc4</code></a>
Bump version from &quot;10.5.3&quot; to &quot;10.5.4&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/3f07eb74aec415d985efdb19eeda2e625bd2d339"><code>3f07eb7</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/35560">#35560</a>
from storybookjs/norbert/fix-rn-telemetry-metadata</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/22e36662a2c91c51bdc1204b467155ea3c870304"><code>22e3666</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/35541">#35541</a>
from hxy-asdw/fix/prismjs-dark-mode-contrast-35540</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/9ac273930a49ad33b6a331f1f36dc472f5c36054"><code>9ac2739</code></a>
Bump version from &quot;10.5.2&quot; to &quot;10.5.3&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/b4b00f27662caf7328330b5ab47e9b903218f43a"><code>b4b00f2</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/34971">#34971</a>
from storybookjs/valentin/upgrade-typescript-6</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/518f711cb367d8df184be22f1fab9a218b2743df"><code>518f711</code></a>
Bump version from &quot;10.5.1&quot; to &quot;10.5.2&quot; [skip
ci]</li>
<li>Additional commits viewable in <a
href="https://github.com/storybookjs/storybook/commits/v10.5.5/code/core">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 10:16:56 -07:00
dependabot[bot] 91e1eb43af build(deps): bump i18next from 26.3.1 to 26.3.6 (#10300) 
Bumps [i18next](https://github.com/i18next/i18next) from 26.3.1 to
26.3.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.3.6</h2>
<ul>
<li>fix: allow TypeScript 7 in the optional <code>typescript</code> peer
dependency range (<code>^5 || ^6 || ^7</code>). With
<code>typescript@7.0.2</code> in a project, <code>npm install</code>
failed with an <code>ERESOLVE</code> peer conflict. The published types
are TS7-compatible as-is: every <code>test/typescript</code> suite
produces identical results under 6.0 and 7.0.2. Reported in <a
href="https://redirect.github.com/i18next/react-i18next/issues/1927">react-i18next#1927</a>,
thanks <a
href="https://github.com/andikapradanaarif"><code>@​andikapradanaarif</code></a>.</li>
</ul>
<h2>v26.3.5</h2>
<ul>
<li>fix: <code>$t()</code> nesting options blocks that span multiple
lines are now parsed. <code>nest()</code> decided where the nested key
ends by testing <code>match[1]</code> with <code>/{.*}/</code>, whose
dot does not cross line breaks — so a <code>$t(key, { ... })</code>
options object containing a newline was treated as having no options,
mis-split as formatters, and the nested lookup ran without its options
(placeholders stayed unresolved). The nesting regexp itself already
matches newlines inside <code>$t(...)</code>; adding the <code>s</code>
(dotAll) flag makes multiline options behave like the single-line form.
Thanks <a href="https://github.com/spokodev"><code>@​spokodev</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2440">#2440</a>).</li>
<li>fix: <code>getUsedParamsDetails</code> (the <code>returnDetails:
true</code> path) no longer mutates the passed <code>replace</code>
object. It wrote <code>count</code> straight onto
<code>options.replace</code> so the returned <code>usedParams</code>
would include it — a caller reusing one <code>replace</code> object
across <code>t()</code> calls then carried a stale <code>count</code>
into later interpolations (e.g. a previous call's <code>count: 5</code>
rendered instead of the current call's value). The details are now built
from a copy; <code>usedParams</code> still includes <code>count</code>.
Thanks <a href="https://github.com/spokodev"><code>@​spokodev</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2441">#2441</a>).</li>
<li>fix: with the default <code>skipOnVariables: true</code> +
<code>escapeValue: true</code>, a <code>{{placeholder}}</code> carried
inside an interpolated value now stays literal even when the value
contains escapable characters. The skip logic advanced the regex
<code>lastIndex</code> by the raw value length, but the escaped text
written into the string is longer, so <code>lastIndex</code> landed
inside the inserted value and a trailing <code>{{placeholder}}</code> in
it got interpolated — leaking another in-scope variable that should have
stayed literal (values without escapable characters were already skipped
correctly). The advance now uses the escaped length that is actually
written, and the regex-safe <code>$</code>-doubling is applied only at
the <code>String.replace</code> call so it can't distort the length
arithmetic. Thanks <a
href="https://github.com/spokodev"><code>@​spokodev</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2442">#2442</a>).</li>
</ul>
<h2>v26.3.4</h2>
<ul>
<li>fix(security): <code>deepExtend</code> (used by
<code>addResourceBundle(..., deep, overwrite)</code>) no longer recurses
into inherited properties. It checked key existence with the
<code>in</code> operator, which walks the prototype chain, so a source
key matching an inherited built-in (e.g. <code>hasOwnProperty</code>,
<code>toString</code>) caused recursion into the shared
<code>Object.prototype</code> function and, with <code>overwrite:
true</code>, could overwrite e.g.
<code>Object.prototype.hasOwnProperty.call</code> with a non-callable
value — corrupting a shared built-in process-wide (DoS). Existence is
now checked with <code>Object.prototype.hasOwnProperty.call</code>, so
such keys are copied as plain own data instead. This complements the
existing <code>__proto__</code>/<code>constructor</code> guard and is
also strictly more correct for an own-property merge. Only affects
applications that pass attacker-controlled data with <code>deep:
true</code> and <code>overwrite: true</code>; no standard
backend/integration does this. Distinct from CVE-2026-48713 /
CVE-2026-48714 (different packages, <code>setPath</code> mechanism).
Thanks to zx (Jace) for the responsible disclosure.</li>
</ul>
<h2>v26.3.3</h2>
<ul>
<li>fix(types): selector <code>t($ =&gt; $.arr, { returnObjects: true,
context })</code> on a JSON array of <strong>heterogeneous</strong>
objects now preserves each element's full shape (e.g. <code>{ transKey1:
string; transKey2: string }[]</code>) instead of collapsing to a union
of partial element types. Two type-level causes: (1)
<code>FilterKeys</code> evaluated the whole array element type at once,
so <code>keyof (A | B)</code> only saw the keys common to every element
— it now distributes over the object union and filters each element
independently; (2) when TypeScript merges mismatched array element types
it injects phantom optional <code>undefined</code> keys (e.g.
<code>transKey1_withContext?: undefined</code> on elements that don't
define it), which the context-detection helpers mistook for real context
variants — they now skip keys typed as <code>undefined</code>. Also adds
a dedicated <code>context</code> + <code>returnObjects: true</code>
selector overload using <code>const Fn</code> +
<code>ReturnType&lt;Fn&gt;</code>, so <code>Target</code> is no longer
collapsed to <code>unknown</code> via <code>ApplyTarget</code>. Resolves
Problem 1 of <a
href="https://redirect.github.com/i18next/i18next/issues/2398">#2398</a>
(Problem 2 was already fixed on master). Thanks <a
href="https://github.com/sauravgupta-dotcom"><code>@​sauravgupta-dotcom</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2438">#2438</a>).
Fixes <a
href="https://redirect.github.com/i18next/i18next/issues/2398">#2398</a>.</li>
</ul>
<h2>v26.3.2</h2>
<ul>
<li>fix: chained formatters with a parenthesised option that contains
the format separator (e.g. <code>join(separator: ', ')</code>) now work
at <strong>any</strong> position in the chain, not just first.
Previously the comma-in-parens reassembly only repaired
<code>formats[0]</code>, so <code>{{v, uppercase, join(separator: ',
')}}</code> split the <code>join(...)</code> option on the inner comma
and never rejoined it, producing corrupt output. Replaced the
first-position-only repair with a position-independent pass that
re-joins fragments until each open paren closes. Thanks <a
href="https://github.com/spokodev"><code>@​spokodev</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2437">#2437</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.3.6</h2>
<ul>
<li>fix: allow TypeScript 7 in the optional <code>typescript</code> peer
dependency range (<code>^5 || ^6 || ^7</code>). With
<code>typescript@7.0.2</code> in a project, <code>npm install</code>
failed with an <code>ERESOLVE</code> peer conflict. The published types
are TS7-compatible as-is: every <code>test/typescript</code> suite
produces identical results under 6.0 and 7.0.2. Reported in <a
href="https://redirect.github.com/i18next/react-i18next/issues/1927">react-i18next#1927</a>,
thanks <a
href="https://github.com/andikapradanaarif"><code>@​andikapradanaarif</code></a>.</li>
</ul>
<h2>26.3.5</h2>
<ul>
<li>fix: <code>$t()</code> nesting options blocks that span multiple
lines are now parsed. <code>nest()</code> decided where the nested key
ends by testing <code>match[1]</code> with <code>/{.*}/</code>, whose
dot does not cross line breaks — so a <code>$t(key, { ... })</code>
options object containing a newline was treated as having no options,
mis-split as formatters, and the nested lookup ran without its options
(placeholders stayed unresolved). The nesting regexp itself already
matches newlines inside <code>$t(...)</code>; adding the <code>s</code>
(dotAll) flag makes multiline options behave like the single-line form.
Thanks <a href="https://github.com/spokodev"><code>@​spokodev</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2440">#2440</a>).</li>
<li>fix: <code>getUsedParamsDetails</code> (the <code>returnDetails:
true</code> path) no longer mutates the passed <code>replace</code>
object. It wrote <code>count</code> straight onto
<code>options.replace</code> so the returned <code>usedParams</code>
would include it — a caller reusing one <code>replace</code> object
across <code>t()</code> calls then carried a stale <code>count</code>
into later interpolations (e.g. a previous call's <code>count: 5</code>
rendered instead of the current call's value). The details are now built
from a copy; <code>usedParams</code> still includes <code>count</code>.
Thanks <a href="https://github.com/spokodev"><code>@​spokodev</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2441">#2441</a>).</li>
<li>fix: with the default <code>skipOnVariables: true</code> +
<code>escapeValue: true</code>, a <code>{{placeholder}}</code> carried
inside an interpolated value now stays literal even when the value
contains escapable characters. The skip logic advanced the regex
<code>lastIndex</code> by the raw value length, but the escaped text
written into the string is longer, so <code>lastIndex</code> landed
inside the inserted value and a trailing <code>{{placeholder}}</code> in
it got interpolated — leaking another in-scope variable that should have
stayed literal (values without escapable characters were already skipped
correctly). The advance now uses the escaped length that is actually
written, and the regex-safe <code>$</code>-doubling is applied only at
the <code>String.replace</code> call so it can't distort the length
arithmetic. Thanks <a
href="https://github.com/spokodev"><code>@​spokodev</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2442">#2442</a>).</li>
</ul>
<h2>26.3.4</h2>
<ul>
<li>fix(security): <code>deepExtend</code> (used by
<code>addResourceBundle(..., deep, overwrite)</code>) no longer recurses
into inherited properties. It checked key existence with the
<code>in</code> operator, which walks the prototype chain, so a source
key matching an inherited built-in (e.g. <code>hasOwnProperty</code>,
<code>toString</code>) caused recursion into the shared
<code>Object.prototype</code> function and, with <code>overwrite:
true</code>, could overwrite e.g.
<code>Object.prototype.hasOwnProperty.call</code> with a non-callable
value — corrupting a shared built-in process-wide (DoS). Existence is
now checked with <code>Object.prototype.hasOwnProperty.call</code>, so
such keys are copied as plain own data instead. This complements the
existing <code>__proto__</code>/<code>constructor</code> guard and is
also strictly more correct for an own-property merge. Only affects
applications that pass attacker-controlled data with <code>deep:
true</code> and <code>overwrite: true</code>; no standard
backend/integration does this. Distinct from CVE-2026-48713 /
CVE-2026-48714 (different packages, <code>setPath</code> mechanism). See
advisory <a
href="https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx">GHSA-6jcc-5g8w-32mx</a>,
CVSS 5.9 (<code>CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H</code>).
Thanks to zx (Jace) <a
href="https://github.com/manus-use"><code>@​manus-use</code></a> for the
responsible disclosure.</li>
</ul>
<h2>26.3.3</h2>
<ul>
<li>fix(types): selector <code>t($ =&gt; $.arr, { returnObjects: true,
context })</code> on a JSON array of <strong>heterogeneous</strong>
objects now preserves each element's full shape (e.g. <code>{ transKey1:
string; transKey2: string }[]</code>) instead of collapsing to a union
of partial element types. Two type-level causes: (1)
<code>FilterKeys</code> evaluated the whole array element type at once,
so <code>keyof (A | B)</code> only saw the keys common to every element
— it now distributes over the object union and filters each element
independently; (2) when TypeScript merges mismatched array element types
it injects phantom optional <code>undefined</code> keys (e.g.
<code>transKey1_withContext?: undefined</code> on elements that don't
define it), which the context-detection helpers mistook for real context
variants — they now skip keys typed as <code>undefined</code>. Also adds
a dedicated <code>context</code> + <code>returnObjects: true</code>
selector overload using <code>const Fn</code> +
<code>ReturnType&lt;Fn&gt;</code>, so <code>Target</code> is no longer
collapsed to <code>unknown</code> via <code>ApplyTarget</code>. Resolves
Problem 1 of <a
href="https://redirect.github.com/i18next/i18next/issues/2398">#2398</a>
(Problem 2 was already fixed on master). Thanks <a
href="https://github.com/sauravgupta-dotcom"><code>@​sauravgupta-dotcom</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2438">#2438</a>).
Fixes <a
href="https://redirect.github.com/i18next/i18next/issues/2398">#2398</a>.</li>
</ul>
<h2>26.3.2</h2>
<ul>
<li>fix: chained formatters with a parenthesised option that contains
the format separator (e.g. <code>join(separator: ', ')</code>) now work
at <strong>any</strong> position in the chain, not just first.
Previously the comma-in-parens reassembly only repaired
<code>formats[0]</code>, so <code>{{v, uppercase, join(separator: ',
')}}</code> split the <code>join(...)</code> option on the inner comma
and never rejoined it, producing corrupt output. Replaced the
first-position-only repair with a position-independent pass that
re-joins fragments until each open paren closes. Thanks <a
href="https://github.com/spokodev"><code>@​spokodev</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2437">#2437</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next/commit/e1c60d4dd28a16f91be7f55b3685ffcf9760619b"><code>e1c60d4</code></a>
26.3.6</li>
<li><a
href="https://github.com/i18next/i18next/commit/04da43e08cb799f2e6f9a5578f3674fe2ef49595"><code>04da43e</code></a>
fix: allow typescript 7 in optional peerDependencies range
(react-i18next#1927)</li>
<li><a
href="https://github.com/i18next/i18next/commit/8eed4accc6c69398e9e25f79b617249fd3f7b1ec"><code>8eed4ac</code></a>
build</li>
<li><a
href="https://github.com/i18next/i18next/commit/573ae735682a082ad5a581dea3f2d5f517c53772"><code>573ae73</code></a>
26.3.5</li>
<li><a
href="https://github.com/i18next/i18next/commit/cc54b05b5cab9bf76cf66557c222c978bbb3c082"><code>cc54b05</code></a>
docs(changelog): 26.3.5 — multiline $t() options, replace mutation,
escaped-l...</li>
<li><a
href="https://github.com/i18next/i18next/commit/3180d67291a8fff10950f79660420c106c047f94"><code>3180d67</code></a>
fix: skip interpolation of placeholders inside escaped values (<a
href="https://redirect.github.com/i18next/i18next/issues/2442">#2442</a>)</li>
<li><a
href="https://github.com/i18next/i18next/commit/d16f5a2da748082155007ba0677d32b877b1102e"><code>d16f5a2</code></a>
fix: stop mutating the passed replace object when returning details (<a
href="https://redirect.github.com/i18next/i18next/issues/2441">#2441</a>)</li>
<li><a
href="https://github.com/i18next/i18next/commit/bed56c115979de52bd85c46d9b7a7b13361bf736"><code>bed56c1</code></a>
fix: parse $t() nesting options block that spans multiple lines (<a
href="https://redirect.github.com/i18next/i18next/issues/2440">#2440</a>)</li>
<li><a
href="https://github.com/i18next/i18next/commit/c19e45864f3abbbe90e30be44cc131f2248394bf"><code>c19e458</code></a>
docs(changelog): link GHSA advisory for deepExtend fix</li>
<li><a
href="https://github.com/i18next/i18next/commit/7bb87d09f907b4395ed0825638d7d2c4356f7a89"><code>7bb87d0</code></a>
docs(changelog): reference security advisory for deepExtend fix</li>
<li>Additional commits viewable in <a
href="https://github.com/i18next/i18next/compare/v26.3.1...v26.3.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next&package-manager=npm_and_yarn&previous-version=26.3.1&new-version=26.3.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 10:04:55 -07:00
dependabot[bot] fb680df728 build(deps-dev): bump @storybook/addon-a11y from 10.4.2 to 10.5.4 (#10305) 
Bumps
[@storybook/addon-a11y](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/a11y)
from 10.4.2 to 10.5.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/releases">@​storybook/addon-a11y's
releases</a>.</em></p>
<blockquote>
<h2>v10.5.4</h2>
<h2>10.5.4</h2>
<ul>
<li>ReactNative: Telemetry framework detection fix - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>,
thanks <a
href="https://github.com/ndelangen"><code>@​ndelangen</code></a>!</li>
<li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>,
thanks <a
href="https://github.com/hxy-asdw"><code>@​hxy-asdw</code></a>!</li>
</ul>
<h2>v10.5.3</h2>
<h2>10.5.3</h2>
<ul>
<li>Dependencies: Upgrade TypeScript to 6.0.3 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34971">#34971</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
</ul>
<h2>v10.5.2</h2>
<h2>10.5.2</h2>
<ul>
<li>Angular-Vite: Drop <code>@​angular/platform-browser-dynamic</code>
peer dependency - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35457">#35457</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Angular-Vite: Widen TypeScript peer dependency range to support
TypeScript 6 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35455">#35455</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Core: Include chromatic packages in ecosystem identifier - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35170">#35170</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
<li>TanStack: Fix createServerFn validator mock - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35185">#35185</a>,
thanks <a
href="https://github.com/sjh9714"><code>@​sjh9714</code></a>!</li>
<li>TanStack: Support pathless layout routes (id-only) in story routing
- <a
href="https://redirect.github.com/storybookjs/storybook/pull/35465">#35465</a>,
thanks <a
href="https://github.com/unpunnyfuns"><code>@​unpunnyfuns</code></a>!</li>
<li>Tanstack-react: Add missing Hydrate export - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35111">#35111</a>,
thanks <a
href="https://github.com/arun-357"><code>@​arun-357</code></a>!</li>
<li>Tanstack-react: Keep JSX-only component references during dead-code
elimination - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35206">#35206</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>Vitest: Fix coverage toggle crash on Vite 6 by clearing closed
Vitest instance on restart - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35461">#35461</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
</ul>
<h2>v10.5.1</h2>
<h2>10.5.1</h2>
<ul>
<li>Angular-Vite: Drop <code>@​angular/platform-browser-dynamic</code>
peer dependency - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35457">#35457</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Angular-Vite: Widen TypeScript peer dependency range to support
TypeScript 6 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35455">#35455</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Core: Include chromatic packages in ecosystem identifier - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35170">#35170</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
</ul>
<h2>v10.5.0</h2>
<h2>10.5.0</h2>
<blockquote>
<p><em>Foundational changes for new AI workflows</em></p>
</blockquote>
<p>Storybook 10.5 contains hundreds of fixes and improvements:</p>
<ul>
<li>⚡️ Angular-vite framework: Modern, fast dev, docs, and test
(preview)</li>
<li>🌈 Vitest initialGlobals: Test across themes, viewports, locales</li>
<li>🤖 Agentic review: AI-curated visual changesets and search results
(experimental)</li>
<li>⚛️ React docgen service: Unified metadata across MCP, Docs, and
Controls (experimental)</li>
<li>🧑‍💻 Claude / Codex plugins: One-click ADE integration
(experimental)</li>
</ul>
<!-- raw HTML omitted -->
<ul>
<li>A11y: Fix MDX heading anchors not keyboard accessible - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34368">#34368</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>A11y: Handle lang attribute throughout preview - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35321">#35321</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>A11y: Surface required args and keyboard-reachable Setup controls in
ArgsTable - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35306">#35306</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Addon A11y: Preserve disabled a11y rules with runOnly - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34649">#34649</a>,
thanks <a
href="https://github.com/cyphercodes"><code>@​cyphercodes</code></a>!</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md">@​storybook/addon-a11y's
changelog</a>.</em></p>
<blockquote>
<h2>10.5.4</h2>
<ul>
<li>ReactNative: Telemetry framework detection fix - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>,
thanks <a
href="https://github.com/ndelangen"><code>@​ndelangen</code></a>!</li>
<li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>,
thanks <a
href="https://github.com/hxy-asdw"><code>@​hxy-asdw</code></a>!</li>
</ul>
<h2>10.5.3</h2>
<ul>
<li>Dependencies: Upgrade TypeScript to 6.0.3 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34971">#34971</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
</ul>
<h2>10.5.2</h2>
<ul>
<li>TanStack: Fix createServerFn validator mock - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35185">#35185</a>,
thanks <a
href="https://github.com/sjh9714"><code>@​sjh9714</code></a>!</li>
<li>TanStack: Support pathless layout routes (id-only) in story routing
- <a
href="https://redirect.github.com/storybookjs/storybook/pull/35465">#35465</a>,
thanks <a
href="https://github.com/unpunnyfuns"><code>@​unpunnyfuns</code></a>!</li>
<li>Tanstack-react: Add missing Hydrate export - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35111">#35111</a>,
thanks <a
href="https://github.com/arun-357"><code>@​arun-357</code></a>!</li>
<li>Tanstack-react: Keep JSX-only component references during dead-code
elimination - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35206">#35206</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>Vitest: Fix coverage toggle crash on Vite 6 by clearing closed
Vitest instance on restart - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35461">#35461</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
</ul>
<h2>10.5.1</h2>
<ul>
<li>Angular-Vite: Drop <code>@​angular/platform-browser-dynamic</code>
peer dependency - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35457">#35457</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Angular-Vite: Widen TypeScript peer dependency range to support
TypeScript 6 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35455">#35455</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Core: Include chromatic packages in ecosystem identifier - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35170">#35170</a>,
thanks <a
href="https://github.com/yannbf"><code>@​yannbf</code></a>!</li>
</ul>
<h2>10.5.0</h2>
<blockquote>
<p><em>Foundational changes for new AI workflows</em></p>
</blockquote>
<p>Storybook 10.5 contains hundreds of fixes and improvements:</p>
<ul>
<li>⚡️ Angular-vite framework: Modern, fast dev, docs, and test
(preview)</li>
<li>🌈 Vitest initialGlobals: Test across themes, viewports, locales</li>
<li>🤖 Agentic review: AI-curated visual changesets and search results
(experimental)</li>
<li>⚛️ React docgen service: Unified metadata across MCP, Docs, and
Controls (experimental)</li>
<li>🧑‍💻 Claude / Codex plugins: One-click ADE integration
(experimental)</li>
</ul>
<!-- raw HTML omitted -->
<ul>
<li>A11y: Fix MDX heading anchors not keyboard accessible - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34368">#34368</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>A11y: Handle lang attribute throughout preview - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35321">#35321</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>A11y: Surface required args and keyboard-reachable Setup controls in
ArgsTable - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35306">#35306</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Addon A11y: Preserve disabled a11y rules with runOnly - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34649">#34649</a>,
thanks <a
href="https://github.com/cyphercodes"><code>@​cyphercodes</code></a>!</li>
<li>Addon Docs: DocsContent not filling available width when TOC is
enabled - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35043">#35043</a>,
thanks <a
href="https://github.com/k-utsumi"><code>@​k-utsumi</code></a>!</li>
<li>Addon Docs: Resolve CSF4 module exports without a default export -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/34834">#34834</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Addon Docs: Resolve providerImportSource to a path instead of a
file:// URL - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34841">#34841</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Addon Vitest: Add an initialGlobals option to pin a project's
globals - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35226">#35226</a>,
thanks <a
href="https://github.com/lifeiscontent"><code>@​lifeiscontent</code></a>!</li>
<li>Addon Vitest: Avoid erroring out on benign Win process exits - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35287">#35287</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Addon Vitest: Fix dynamic import failure with Vitest 3 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34927">#34927</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Addon Vitest: Subscribe for run completion before triggering it - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35291">#35291</a>,
thanks <a
href="https://github.com/tsushanth"><code>@​tsushanth</code></a>!</li>
<li>Angular: Add versioned <code>@types/node</code> to packages
installed during <code>storybook init</code> - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34192">#34192</a>,
thanks <a
href="https://github.com/copilot-swe-agent"><code>@​copilot-swe-agent</code></a>!</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/storybookjs/storybook/commit/3327dc44697304275e28ceaa2cd34d9bede4e333"><code>3327dc4</code></a>
Bump version from &quot;10.5.3&quot; to &quot;10.5.4&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/9ac273930a49ad33b6a331f1f36dc472f5c36054"><code>9ac2739</code></a>
Bump version from &quot;10.5.2&quot; to &quot;10.5.3&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/b4b00f27662caf7328330b5ab47e9b903218f43a"><code>b4b00f2</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/addons/a11y/issues/34971">#34971</a>
from storybookjs/valentin/upgrade-typescript-6</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/518f711cb367d8df184be22f1fab9a218b2743df"><code>518f711</code></a>
Bump version from &quot;10.5.1&quot; to &quot;10.5.2&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/c253a0667d39899a0f7a09fa90f262f69ad4ae90"><code>c253a06</code></a>
Bump version from &quot;10.5.0&quot; to &quot;10.5.1&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/9dafcd22ed55947bc4c2fa1d5066b552baa0ebf4"><code>9dafcd2</code></a>
Bump version from &quot;10.5.0-beta.2&quot; to &quot;10.5.0&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/ad709148eb8ea2113bd326a6bc66a5c9b9f8d97c"><code>ad70914</code></a>
Addon A11y: Keep nested command output while closing stdin</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/c557fc0fb6db50c058b69fb4465f977ae786264c"><code>c557fc0</code></a>
CLI: Fix silent hang in deferred addon configuration during upgrade</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/448db85e651a09ca55f978356c4f1593f261f82a"><code>448db85</code></a>
Bump version from &quot;10.5.0-beta.1&quot; to &quot;10.5.0-beta.2&quot;
[skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/a4ce9790a783d8e7720e9de980a08576de9555db"><code>a4ce979</code></a>
Bump version from &quot;10.5.0-beta.0&quot; to &quot;10.5.0-beta.1&quot;
[skip ci]</li>
<li>Additional commits viewable in <a
href="https://github.com/storybookjs/storybook/commits/v10.5.4/code/addons/a11y">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@storybook/addon-a11y&package-manager=npm_and_yarn&previous-version=10.4.2&new-version=10.5.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 10:04:08 -07:00
dependabot[bot] 00b43a7446 build(deps): bump @tanstack/react-query from 5.101.2 to 5.101.4 (#10307) 
Bumps
[@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query)
from 5.101.2 to 5.101.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/TanStack/query/releases">@​tanstack/react-query's
releases</a>.</em></p>
<blockquote>
<h2><code>@​tanstack/react-query-devtools</code><a
href="https://github.com/5"><code>@​5</code></a>.101.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-devtools</code><a
href="https://github.com/5"><code>@​5</code></a>.101.4</li>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.4</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query-next-experimental</code><a
href="https://github.com/5"><code>@​5</code></a>.101.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.4</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query-persist-client</code><a
href="https://github.com/5"><code>@​5</code></a>.101.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-persist-client-core</code><a
href="https://github.com/5"><code>@​5</code></a>.101.4</li>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.4</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-core</code><a
href="https://github.com/5"><code>@​5</code></a>.101.4</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query-devtools</code><a
href="https://github.com/5"><code>@​5</code></a>.101.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-devtools</code><a
href="https://github.com/5"><code>@​5</code></a>.101.3</li>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.3</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query-next-experimental</code><a
href="https://github.com/5"><code>@​5</code></a>.101.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.3</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query-persist-client</code><a
href="https://github.com/5"><code>@​5</code></a>.101.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-persist-client-core</code><a
href="https://github.com/5"><code>@​5</code></a>.101.3</li>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.3</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/TanStack/query/commit/7e3c822a10896f41a8f1031c16b85096277af677"><code>7e3c822</code></a>]:</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md">@​tanstack/react-query's
changelog</a>.</em></p>
<blockquote>
<h2>5.101.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-core</code><a
href="https://github.com/5"><code>@​5</code></a>.101.4</li>
</ul>
</li>
</ul>
<h2>5.101.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/TanStack/query/commit/7e3c822a10896f41a8f1031c16b85096277af677"><code>7e3c822</code></a>]:
<ul>
<li><code>@​tanstack/query-core</code><a
href="https://github.com/5"><code>@​5</code></a>.101.3</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/TanStack/query/commit/86bb8a6fb2c7f15c74ff50afba053d778e6edc23"><code>86bb8a6</code></a>
ci: Version Packages (<a
href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/11094">#11094</a>)</li>
<li><a
href="https://github.com/TanStack/query/commit/181ea826cb5b5f722a774525046d8f4e105dd6bb"><code>181ea82</code></a>
ci: Version Packages (<a
href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/11089">#11089</a>)</li>
<li><a
href="https://github.com/TanStack/query/commit/6d55b0759b4722b888fa516b1bb86c0a56ea47a2"><code>6d55b07</code></a>
test({react,preact}-query): use the '.then()' convention consistently
(<a
href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/11085">#11085</a>)</li>
<li><a
href="https://github.com/TanStack/query/commit/44f38df5deaf72d8d74bc62b620dffed43fdbc05"><code>44f38df</code></a>
test({react,preact,solid}-query/useInfiniteQuery): inline the shared
'fetchIt...</li>
<li><a
href="https://github.com/TanStack/query/commit/d1558c1491629b36661e0a166e1091bb4a256daa"><code>d1558c1</code></a>
test({react,preact}-query/usePrefetchQuery): inline the
'generateQueryFn' fac...</li>
<li><a
href="https://github.com/TanStack/query/commit/99690d18b7937f217d3744b1c2ac78cc47caeaa7"><code>99690d1</code></a>
test({react,preact}-query/usePrefetchInfiniteQuery): inline single-use
helper...</li>
<li><a
href="https://github.com/TanStack/query/commit/10770f0720dacae3a26701a747e33abd6bafbf8a"><code>10770f0</code></a>
test({react,preact}-query/usePrefetchInfiniteQuery): inline the shared
'Suspe...</li>
<li><a
href="https://github.com/TanStack/query/commit/dbd5a86e95284387bc3f172208bc52c0053a1bb2"><code>dbd5a86</code></a>
test({react,preact}-query/usePrefetchQuery): inline the shared
'Suspended' co...</li>
<li><a
href="https://github.com/TanStack/query/commit/b955f60d7965cc521df6ee8b1ce91b3d0e8c046d"><code>b955f60</code></a>
test({react,preact}-query/useSuspenseQuery): assert the 'loading'
fallback is...</li>
<li><a
href="https://github.com/TanStack/query/commit/b9c657e20b1ac1078ab265de8fc691aec192e143"><code>b9c657e</code></a>
test({react,preact}-query/usePrefetchQuery): assert the 'Loading...'
fallback...</li>
<li>Additional commits viewable in <a
href="https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.4/packages/react-query">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@tanstack/react-query&package-manager=npm_and_yarn&previous-version=5.101.2&new-version=5.101.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 10:03:59 -07:00
dependabot[bot] e95045905b build(deps): bump better-auth from 1.6.23 to 1.6.25 (#10306) 
Bumps
[better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth)
from 1.6.23 to 1.6.25.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/better-auth/better-auth/releases">better-auth's
releases</a>.</em></p>
<blockquote>
<h2>v1.6.25</h2>
<h2><code>better-auth</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed Apple OAuth not sending the PKCE code challenge during
authorization, causing token exchange failures (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10294">#10294</a>)</li>
<li>Fixed Google One Tap creating new users when sign-up was disabled on
the Google provider (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10479">#10479</a>)</li>
<li>Fixed <code>$fetch</code> and <code>$store</code> not being exposed
on the Solid client (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10444">#10444</a>)</li>
<li>Fixed internal adapter queries being routed to the wrong table when
a built-in table's <code>modelName</code> was set to another table's
schema key (e.g. <code>user.modelName =
&quot;account&quot;</code>).</li>
</ul>
<p>For detailed changes, see <a
href="https://github.com/better-auth/better-auth/blob/07a646ea190167370fbbb60a0fa2c3be3bec5522/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2>Contributors</h2>
<p>Thanks to everyone who contributed to this release:</p>
<p><a href="https://github.com/birkskyum"><code>@​birkskyum</code></a>,
<a href="https://github.com/jsj"><code>@​jsj</code></a>, <a
href="https://github.com/krish-vachhani"><code>@​krish-vachhani</code></a></p>
<p><strong>Full changelog:</strong> <a
href="https://github.com/better-auth/better-auth/compare/v1.6.24...v1.6.25"><code>v1.6.24...v1.6.25</code></a></p>
<h2>v1.6.24</h2>
<h2><code>better-auth</code></h2>
<h3>Features</h3>
<ul>
<li>Added request context (<code>ctx</code>) as a third argument to
<code>verifyIdToken</code>, enabling custom ID token verifiers to read
request headers (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10376">#10376</a>)</li>
<li>Added <code>beforeStoreCookie</code> option to the last-login-method
plugin for GDPR compliance (<a
href="https://redirect.github.com/better-auth/better-auth/pull/5753">#5753</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Replaced flaky MongoDB where-coercion integration test with a direct
unit test for more reliable test runs (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10369">#10369</a>)</li>
<li>Fixed the <code>get-session</code> endpoint to include
<code>no-store</code> cache control headers, preventing stale session
data from being served (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10222">#10222</a>)</li>
<li>Fixed SQLite migration diffs to recognize <code>BIGINT</code> as a
valid number type, preventing spurious pending changes on rate limiter
columns (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10316">#10316</a>)</li>
<li>Fixed auth requests failing when request cloning throws an error
inside verification callbacks (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10336">#10336</a>)</li>
<li>Fixed <code>useSession({ throw: true })</code> incorrectly excluding
<code>null</code> from its <code>data</code> type (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9787">#9787</a>)</li>
<li>Fixed auth query revalidation and signal listeners not being
restored after a client component remounts (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10379">#10379</a>)</li>
<li>Fixed the <code>CookieAttributes</code> index signature type to be
more precise (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10442">#10442</a>)</li>
<li>Fixed silent misrouting of adapter queries when
<code>user.modelName</code> was set to a value that collides with
another schema key (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10235">#10235</a>)</li>
<li>Fixed Kysely migration generation producing duplicate indexes for
fields marked both <code>unique</code> and <code>index</code> (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10357">#10357</a>)</li>
<li>Fixed magic-link and email-OTP send endpoints to validate the
<code>Origin</code> header on cookieless requests, preventing
cross-origin abuse (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10368">#10368</a>)</li>
<li>Fixed remote MCP auth 401 challenge headers being hidden from
browser clients due to missing CORS exposure (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10290">#10290</a>)</li>
<li>Fixed OpenAPI schema to include plugin user fields (such as
<code>username</code> and <code>displayUsername</code>) in
<code>/sign-up/email</code> and <code>/update-user</code> request bodies
(<a
href="https://redirect.github.com/better-auth/better-auth/pull/10453">#10453</a>)</li>
<li>Fixed <code>organization.listMembers</code> failing with &quot;User
not found for member&quot; for organizations with more than ~100 members
(<a
href="https://redirect.github.com/better-auth/better-auth/pull/10342">#10342</a>)</li>
<li>Fixed organization invitations to use database-generated IDs when
<code>advanced.database.generateId</code> is configured, matching the
behavior of other models (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10040">#10040</a>)</li>
<li>Fixed <code>getDefaultModelName</code> to prefer exact schema key
matches over <code>modelName</code> aliases, preventing adapter queries
from being misrouted when a built-in table's name collides with another
schema key</li>
</ul>
<p>For detailed changes, see <a
href="https://github.com/better-auth/better-auth/blob/9a661c7b7abceaa81123b2c56757ee24f3ad2ed6/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>auth</code></h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's
changelog</a>.</em></p>
<blockquote>
<h2>1.6.25</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10479">#10479</a>
<a
href="https://github.com/better-auth/better-auth/commit/5124c3487903e96223bb3f54347724bb0204bb95"><code>5124c34</code></a>
Thanks <a
href="https://github.com/krish-vachhani"><code>@​krish-vachhani</code></a>!
- Prevent Google One Tap from creating new users when sign-up is
disabled for the Google provider.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10444">#10444</a>
<a
href="https://github.com/better-auth/better-auth/commit/743935991f9991e8243d6c3d14773b9cfca462e8"><code>7439359</code></a>
Thanks <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>! -
Expose the real <code>$fetch</code> instance and <code>$store</code>
atoms from the Solid client instead of resolving them as dynamic API
routes.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/better-auth/better-auth/commit/0ffd1fb28d44a8266d62791cd4c97e263444d03b"><code>0ffd1fb</code></a>]:</p>
<ul>
<li><code>@​better-auth/core</code><a
href="https://github.com/1"><code>@​1</code></a>.6.25</li>
<li><code>@​better-auth/drizzle-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.25</li>
<li><code>@​better-auth/kysely-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.25</li>
<li><code>@​better-auth/memory-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.25</li>
<li><code>@​better-auth/mongo-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.25</li>
<li><code>@​better-auth/prisma-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.25</li>
<li><code>@​better-auth/telemetry</code><a
href="https://github.com/1"><code>@​1</code></a>.6.25</li>
</ul>
</li>
</ul>
<h2>1.6.24</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10235">#10235</a>
<a
href="https://github.com/better-auth/better-auth/commit/03dc5a046f536994950800ea557b8e2e2e0cdfdd"><code>03dc5a0</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@​ping-maxwell</code></a>!
- Fixes silent foreign-key and adapter-join misrouting when a user
remaps a built-in model name to a string that collides with another
schema key</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10357">#10357</a>
<a
href="https://github.com/better-auth/better-auth/commit/750894037639c4158472cc1d4994b0e07bf1f59a"><code>7508940</code></a>
Thanks <a href="https://github.com/c-nicol"><code>@​c-nicol</code></a>!
- Fixes Kysely migration generation for new-table fields that are both
unique: true and index: true.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10342">#10342</a>
<a
href="https://github.com/better-auth/better-auth/commit/bae71988ab79aeb4f19f245ceabac9eca8706a50"><code>bae7198</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@​ping-maxwell</code></a>!
- Fix <code>organization.listMembers</code> failing with &quot;User not
found for member&quot; for orgs with more than ~100 members by applying
the same membership limit to the users query.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10336">#10336</a>
<a
href="https://github.com/better-auth/better-auth/commit/ef4d27360cec8a0bc11a94e135ea4a3dd32b1969"><code>ef4d273</code></a>
Thanks <a
href="https://github.com/Tushar-Khandelwal-2004"><code>@​Tushar-Khandelwal-2004</code></a>!
- Prevent verification callbacks from failing auth requests when cloning
the request throws.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10333">#10333</a>
<a
href="https://github.com/better-auth/better-auth/commit/99dbdd7ea98740d11689394220a718dfb9579276"><code>99dbdd7</code></a>
Thanks <a href="https://github.com/c-nicol"><code>@​c-nicol</code></a>!
- Fixes Drizzle schema generation for fields that are both unique: true
and index: true.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10368">#10368</a>
<a
href="https://github.com/better-auth/better-auth/commit/086ca91f51dd8158aff6cbf54c4f9c7ce220914d"><code>086ca91</code></a>
Thanks <a
href="https://github.com/gaurav0107"><code>@​gaurav0107</code></a>! -
Force-validate the request <code>Origin</code> on the magic-link
(<code>/sign-in/magic-link</code>) and email-otp
(<code>/email-otp/send-verification-otp</code>) send endpoints,
including cookieless requests, to match the built-in
<code>/sign-in/email</code> and <code>/sign-up/email</code> routes. A
cookieless cross-origin POST can no longer trigger a magic-link or
verification-OTP email to an arbitrary address. Cookieless requests that
carry no <code>Origin</code> (server-to-server) are unaffected.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10290">#10290</a>
<a
href="https://github.com/better-auth/better-auth/commit/8f2dedd89301da9fb52c1a64df6a9683f9be55fd"><code>8f2dedd</code></a>
Thanks <a
href="https://github.com/GautamBytes"><code>@​GautamBytes</code></a>! -
Expose the remote MCP auth client's 401 challenge headers to browser
clients using CORS.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10453">#10453</a>
<a
href="https://github.com/better-auth/better-auth/commit/4e685eef420b5576913b9803b58c7e7ee7342203"><code>4e685ee</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@​ping-maxwell</code></a>!
- OpenAPI now includes <code>user.additionalFields</code> and plugin
user schema fields (e.g. username plugin <code>username</code> /
<code>displayUsername</code>) on <code>/sign-up/email</code> and
<code>/update-user</code> request bodies.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10190">#10190</a>
<a
href="https://github.com/better-auth/better-auth/commit/3bf0e4981e025ba9af684013a27b0102a04f7c56"><code>3bf0e49</code></a>
Thanks <a
href="https://github.com/gaurav-init"><code>@​gaurav-init</code></a>! -
Pass the endpoint context as the second argument to
<code>beforeDeleteOrganization</code> and
<code>afterDeleteOrganization</code> hooks in the organization plugin,
matching the signature shown in the docs and the existing
<code>databaseHooks</code> pattern. The Stripe plugin's
<code>beforeDeleteOrganization</code> wrapper now forwards the context
to user-supplied hooks instead of dropping it.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10040">#10040</a>
<a
href="https://github.com/better-auth/better-auth/commit/f59a0ee7895a024ddd4c5c387344173888e17be4"><code>f59a0ee</code></a>
Thanks <a
href="https://github.com/shiminshen"><code>@​shiminshen</code></a>! -
Organization invitations now let the database generate their
<code>id</code> when ID generation is delegated to the database (e.g.
<code>advanced.database.generateId: &quot;uuid&quot;</code> with a
UUID-capable adapter such as Postgres), matching every other model.
Previously <code>createInvitation</code> always generated the invitation
<code>id</code> in application code, so invitation rows received an
app-generated value instead of a database-generated one while
organizations, members and teams correctly deferred to the database (<a
href="https://redirect.github.com/better-auth/better-auth/issues/10024">better-auth/better-auth#10024</a>).
A caller-provided id (e.g. via <code>beforeCreateInvitation</code>) is
still honored.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10302">#10302</a>
<a
href="https://github.com/better-auth/better-auth/commit/0f2cc1b33b77850948dac4d889e5f46bba41e8d5"><code>0f2cc1b</code></a>
Thanks <a
href="https://github.com/momomuchu"><code>@​momomuchu</code></a>! -
Prefer exact schema-key matches over <code>modelName</code> aliases in
<code>getDefaultModelName</code>, so remapping a built-in table onto
another table's schema key (e.g. <code>user.modelName =
&quot;account&quot;</code>) does not reroute internal adapter queries to
the wrong table.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9787">#9787</a>
<a
href="https://github.com/better-auth/better-auth/commit/ae781091186f321b4e4ec9e84f64b6e4d5ea1043"><code>ae78109</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@​ping-maxwell</code></a>!
- Fixes an issue where <code>useSession({ throw: true })</code>
incorrectly excluded <code>null</code> from its <code>data</code>
type.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10222">#10222</a>
<a
href="https://github.com/better-auth/better-auth/commit/46d2bf02c98902da7b344753372d48cfe0e5ebb3"><code>46d2bf0</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@​ping-maxwell</code></a>!
- fix: add no-store cache-control headers to get-session route</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10316">#10316</a>
<a
href="https://github.com/better-auth/better-auth/commit/29a373eaf1778820061a9380c29831c2de2ce704"><code>29a373e</code></a>
Thanks <a
href="https://github.com/vinay-oppuri"><code>@​vinay-oppuri</code></a>!
- Recognize SQLite <code>BIGINT</code> as a valid number type in
migration diffs so database-backed rate limiter columns like
<code>lastRequest</code> no longer report spurious pending changes on
every run.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10379">#10379</a>
<a
href="https://github.com/better-auth/better-auth/commit/f6d18fa8f79b9323e10b50f72e2b1a088844e4bb"><code>f6d18fa</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@​ping-maxwell</code></a>!
- fix(client): restore auth query revalidation and signal listeners
after remount</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/better-auth/better-auth/commit/07a646ea190167370fbbb60a0fa2c3be3bec5522"><code>07a646e</code></a>
chore: release v1.6.25 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10491">#10491</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/743935991f9991e8243d6c3d14773b9cfca462e8"><code>7439359</code></a>
fix(solid): expose $fetch and $store on the solid client (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10444">#10444</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/dac701c94bcd777e7cb124570d644f8b4a7981a5"><code>dac701c</code></a>
chore(deps): bump next from 16.2.6 to 16.2.11 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10493">#10493</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/5124c3487903e96223bb3f54347724bb0204bb95"><code>5124c34</code></a>
fix(one-tap): enforce google provider signup restrictions (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10479">#10479</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/9a661c7b7abceaa81123b2c56757ee24f3ad2ed6"><code>9a661c7</code></a>
chore: release v1.6.24 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10323">#10323</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/4e685eef420b5576913b9803b58c7e7ee7342203"><code>4e685ee</code></a>
fix(open-api): include plugin user fields on sign-up/update bodies (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10453">#10453</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/d3ce7823324ba64efd423895b1c122d85c6d7663"><code>d3ce782</code></a>
fix(cookies): tighten CookieAttributes index signature type (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10441">#10441</a>)
(<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10442">#10442</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/ae781091186f321b4e4ec9e84f64b6e4d5ea1043"><code>ae78109</code></a>
fix(client): preserve null in useSession().data type with throw:true (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9787">#9787</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/f6d18fa8f79b9323e10b50f72e2b1a088844e4bb"><code>f6d18fa</code></a>
fix(client): restore auth query lifecycle after remount (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10379">#10379</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/086ca91f51dd8158aff6cbf54c4f9c7ce220914d"><code>086ca91</code></a>
fix(magic-link, email-otp): force-validate Origin on cookieless send
endpoint...</li>
<li>Additional commits viewable in <a
href="https://github.com/better-auth/better-auth/commits/v1.6.25/packages/better-auth">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=better-auth&package-manager=npm_and_yarn&previous-version=1.6.23&new-version=1.6.25)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 10:03:52 -07:00
dependabot[bot] 0a6532175c build(deps): bump react-resizable-panels from 4.12.1 to 4.12.2 (#10301) 
Bumps
[react-resizable-panels](https://github.com/bvaughn/react-resizable-panels)
from 4.12.1 to 4.12.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md">react-resizable-panels's
changelog</a>.</em></p>
<blockquote>
<h2>4.12.2</h2>
<ul>
<li><a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/726">726</a>:
Updated inline documentation to clarify size units.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/a1eeb7aefdb024bb5879a323218e0ac05f77f28e"><code>a1eeb7a</code></a>
4.12.1 -&gt; 4.12.2</li>
<li>See full diff in <a
href="https://github.com/bvaughn/react-resizable-panels/compare/4.12.1...4.12.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-resizable-panels&package-manager=npm_and_yarn&previous-version=4.12.1&new-version=4.12.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 10:03:49 -07:00
dependabot[bot] 4881f548be build(deps): bump @cursor/sdk from 1.0.19 to 1.0.24 (#10298) 
Bumps [@cursor/sdk](https://github.com/cursor/cursor) from 1.0.19 to
1.0.24.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/cursor/cursor/commits">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~luist18">luist18</a>, a new releaser for
<code>@​cursor/sdk</code> since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@cursor/sdk&package-manager=npm_and_yarn&previous-version=1.0.19&new-version=1.0.24)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 10:03:36 -07:00
github-actions[bot]andlockfile-bot 0650ae970f chore(lockfile): refresh pnpm-lock.yaml (#10136) 
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.

Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
 2026-07-23 18:51:14 -07:00
github-actions[bot]andlockfile-bot 486ecac5e9 chore(lockfile): refresh pnpm-lock.yaml (#9964) 
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.

Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
 2026-07-22 08:58:37 -07:00
dependabot[bot] 0d2bfee972 build(deps): bump radix-ui from 1.6.0 to 1.6.4 (#9895) 
Bumps
[radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui)
from 1.6.0 to 1.6.4.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md">radix-ui's
changelog</a>.</em></p>
<blockquote>
<h2>1.6.4</h2>
<ul>
<li>Fixed a regression where importing primitives from the root
<code>radix-ui</code> entry point erased every primitive's types to
<code>any</code>.</li>
</ul>
<h2>1.6.3</h2>
<h3>Dialog</h3>
<ul>
<li>Fixed broken ARIA references in Dialogs where title or description
elements are not rendered.</li>
</ul>
<h3>Slider</h3>
<ul>
<li>Fixed a bug where <code>onValueCommit</code> was not called when a
slider thumb was dragged across another thumb.</li>
</ul>
<h3>Toast</h3>
<ul>
<li>Fixed <code>Toast</code> removing non-focused toasts when pressing
<code>Escape</code>.</li>
</ul>
<h3>Tooltip</h3>
<ul>
<li>Fixed a bug where <code>Tooltip.Content</code> children were mounted
to the DOM twice.</li>
</ul>
<h3>Other updates</h3>
<ul>
<li>Fixed overriding inline animation style in
<code>Popper.Content</code>.</li>
<li>Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked <code>/* @__PURE__ */</code> and use
named render functions instead of <code>Component.displayName =
...</code> assignments, which previously prevented dead-code elimination
with some bundlers.</li>
<li>Widened <code>virtualRef</code> prop type to allow
<code>RefObject&lt;Measurable | null&gt;</code> in popover
components.</li>
<li>Fixed dev-only checks with conditional exports to drop dev-warnings
from production builds.</li>
<li>Added per-primitive subpath entry points so each primitive can be
imported directly, eg. <code>import { Accordion } from
'radix-ui/accordion'</code> or <code>import * as Accordion from
'radix-ui/accordion'</code>. This mirrors the namespaced exports
available from the root <code>radix-ui</code> entry point.</li>
<li>Fixed a bug where updating a <code>Checkbox</code>,
<code>Switch</code>, or <code>RadioGroup</code> value programmatically
(eg. a &quot;select all&quot; control) while inside a
<code>&lt;form&gt;</code> would dispatch a <code>click</code> event from
the hidden bubble input that propagated to ancestor <code>onClick</code>
handlers.</li>
</ul>
<h2>1.6.2</h2>
<h3>Other updates</h3>
<ul>
<li>Added CSS custom properties for Navigation Menu item indicators'
translate values.</li>
<li>Fixed a bug in Dismissable Layer causing background nested popovers
to close all layers on outside click</li>
<li>Fixed runtime errors for <code>Form.Message</code>,
<code>Form.Control</code>, <code>Form.Label</code> and
<code>Form.ValidityState</code> that are correctly rendered outside of
<code>Form.Field</code> components</li>
<li>Fixed a bug in form control components to ensure their values are
updated when their associated form's is reset. This affects
<code>RadioGroup</code>, <code>Slider</code>, <code>Select</code>, and
<code>Switch</code>.</li>
<li>Fixed menu items, tab triggers, toolbar links, and select items
intercepting <code>Space</code>/<code>Enter</code> keys that originate
from focusable descendants.</li>
<li>Fixed a bug where calling an event handler without an argument would
throw, preventing successive event handlers from being called. This
affected all components that accept event handlers with internal
implementations.</li>
<li>Fixed a bug in Context Menu to ensure that the menu properly
re-anchors to the latest pointer position when re-triggered in its open
state.</li>
<li>Fixed stale <code>onEscapeKeyDown</code>/<code>onDismiss</code>
handlers on React 19.2.</li>
<li>Fixed items in a Roving Focus Group not being auto-focused on mount
within a Focus Scope component.</li>
<li>Fixed a regression in Dismissable Layer originating from a <a
href="https://redirect.github.com/react/react/pull/34831">bug in React's
<code>useEffectEvent</code></a>.</li>
<li>Fixed <code>--radix-scroll-area-corner-width</code> and
<code>--radix-scroll-area-corner-height</code> not resetting to
<code>0</code> when a corner is removed. Previously these values would
stick around and leave a permanent gap on the remaining scrollbar.</li>
<li>Fixed a bug in Slider where stepping with the keyboard would skip a
valid value when the current value is off the step grid. Stepping now
snaps to the next step-aligned value in the direction of travel,
matching native <code>&lt;input type=&quot;range&quot;&gt;</code>
behavior.</li>
</ul>
<h2>1.6.1</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui">compare
view</a></li>
</ul>
</details>
<details>
<summary>Attestation changes</summary>
<p>This version has no provenance attestation, while the previous
version (1.6.0) was attested. Review the <a
href="https://www.npmjs.com/package/radix-ui?activeTab=versions">package
versions</a> before updating.</p>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 12:55:55 -05:00
dependabot[bot] 31c59f8822 build(deps-dev): bump @playwright/test from 1.58.2 to 1.61.1 (#9887) 
Bumps [@playwright/test](https://github.com/microsoft/playwright) from
1.58.2 to 1.61.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/microsoft/playwright/releases">@​playwright/test's
releases</a>.</em></p>
<blockquote>
<h2>v1.61.1</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://redirect.github.com/microsoft/playwright/issues/41365">#41365</a>
[Bug]: Expect.Extend matcher with same name as default matcher in same
expect instance overrides default matchers implementation to custom
matcher</li>
<li><a
href="https://redirect.github.com/microsoft/playwright/issues/41351">#41351</a>
[Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports
unexpected number of bytes (same test passes in headed mode)</li>
<li><a
href="https://redirect.github.com/microsoft/playwright/issues/41360">#41360</a>
[Bug]: Trace viewer: message times in websockets are downscaled by
1000</li>
<li><a
href="https://redirect.github.com/microsoft/playwright/issues/41311">#41311</a>
[Bug]: [Regression]: Sync loader throws
&quot;context.conditions?.includes is not a function&quot; on Node
22.15</li>
<li><a
href="https://redirect.github.com/microsoft/playwright/issues/41371">#41371</a>
[Regression]: Sync ESM loader (registerHooks) fails to resolve
extensionless .ts subpath imports across pnpm workspace symlinks</li>
</ul>
<h2>v1.61.0</h2>
<h2>🔑 WebAuthn passkeys</h2>
<p>New <a
href="https://playwright.dev/docs/api/class-credentials">Credentials</a>
virtual authenticator, available via <a
href="https://playwright.dev/docs/api/class-browsercontext#browser-context-credentials">browserContext.credentials</a>,
lets tests register passkeys and answer
<code>navigator.credentials.create()</code> /
<code>navigator.credentials.get()</code> ceremonies in the page — no
real hardware key required, works in all browsers:</p>
<pre lang="js"><code>const context = await browser.newContext();
<p>// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();</p>
<p>const page = await context.newPage();
await page.goto('<a
href="https://example.com/login">https://example.com/login</a>');
// The page's navigator.credentials.get() is answered with the seeded
passkey.
</code></pre></p>
<p>You can also let the app register a passkey once in a setup test,
read it back with <a
href="https://playwright.dev/docs/api/class-credentials#credentials-get">credentials.get()</a>,
and seed it into later tests — see <a
href="https://playwright.dev/docs/api/class-credentials">Credentials</a>
for details.</p>
<h2>🗃️ Web Storage</h2>
<p>New <a
href="https://playwright.dev/docs/api/class-webstorage">WebStorage</a>
API, available via <a
href="https://playwright.dev/docs/api/class-page#page-local-storage">page.localStorage</a>
and <a
href="https://playwright.dev/docs/api/class-page#page-session-storage">page.sessionStorage</a>,
reads and writes the page's storage for the current origin:</p>
<pre lang="js"><code>await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();
</code></pre>
<h2>New APIs</h2>
<h3>Network</h3>
<ul>
<li><a
href="https://playwright.dev/docs/api/class-apiresponse#api-response-security-details">apiResponse.securityDetails()</a>
and <a
href="https://playwright.dev/docs/api/class-apiresponse#api-response-server-addr">apiResponse.serverAddr()</a>
mirror the browser-side <a
href="https://playwright.dev/docs/api/class-response#response-security-details">response.securityDetails()</a>
and <a
href="https://playwright.dev/docs/api/class-response#response-server-addr">response.serverAddr()</a>.</li>
</ul>
<h3>Browser and Screencast</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/microsoft/playwright/commit/39e3553a4f283a41134d75d7e404484bd9e6865a"><code>39e3553</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/41399">#41399</a>):
fix(test): load require-reached files as commonjs in syn...</li>
<li><a
href="https://github.com/microsoft/playwright/commit/4328122a0fa91df1be287f12d26f272f598ccca7"><code>4328122</code></a>
chore: mark v1.61.1 (<a
href="https://redirect.github.com/microsoft/playwright/issues/41404">#41404</a>)</li>
<li><a
href="https://github.com/microsoft/playwright/commit/2c29a94ed59a2dbb2cb2553ee7d1ba429f027826"><code>2c29a94</code></a>
fix(tracing): stop recording websocket frames outside of chunks (<a
href="https://redirect.github.com/microsoft/playwright/issues/41398">#41398</a>)</li>
<li><a
href="https://github.com/microsoft/playwright/commit/4324b1904199c58ae56d864390f5210df18e33f6"><code>4324b19</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/41367">#41367</a>):
fix(test): keep builtin expect matchers on base extend</li>
<li><a
href="https://github.com/microsoft/playwright/commit/041e7e30002e7c384e1918c29720b34c435145f4"><code>041e7e3</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/41364">#41364</a>):
fix(har): <code>WebSocket</code> message timestamps should be in
mi...</li>
<li><a
href="https://github.com/microsoft/playwright/commit/b8a0fc33932399fc5cfcd211165cf16f8ca01d71"><code>b8a0fc3</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/41309">#41309</a>,
<a
href="https://redirect.github.com/microsoft/playwright/issues/43149">#43149</a>):
Revert &quot;fix(firefox): treat `navigationCommitted...</li>
<li><a
href="https://github.com/microsoft/playwright/commit/b5a31759e6611397bf3afaaa6049a420a5f082bd"><code>b5a3175</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/41319">#41319</a>):
fix(loader): support other node versions</li>
<li><a
href="https://github.com/microsoft/playwright/commit/d4724a91b280ae1ee9a87c426e9d6a953c59756e"><code>d4724a9</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/41290">#41290</a>):
feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image</li>
<li><a
href="https://github.com/microsoft/playwright/commit/1cc5a90cfa3eaa430b1a991963100f95126caa47"><code>1cc5a90</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/41295">#41295</a>):
chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...</li>
<li><a
href="https://github.com/microsoft/playwright/commit/a6772bdede34028cbbd417a3b3d778801899e870"><code>a6772bd</code></a>
cherry-pick(<a
href="https://redirect.github.com/microsoft/playwright/issues/41280">#41280</a>):
Revert &quot;fix(trace-viewer): add keyboard navigation to `N...</li>
<li>Additional commits viewable in <a
href="https://github.com/microsoft/playwright/compare/v1.58.2...v1.61.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 12:26:18 -05:00
dependabot[bot] a3f583b5a9 build(deps-dev): bump @tailwindcss/vite from 4.3.0 to 4.3.3 (#9892) 
Bumps
[@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite)
from 4.3.0 to 4.3.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/releases">@​tailwindcss/vite's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.3</h2>
<h3>Fixed</h3>
<ul>
<li>Support <code>--watch --poll[=ms]</code> in
<code>@tailwindcss/cli</code> when filesystem events are unreliable or
unavailable (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20297">#20297</a>)</li>
<li>Canonicalization: match arbitrary hex colors against theme colors
case-insensitively (e.g. <code>bg-[#fff]</code> and
<code>bg-[#FFF]</code> → <code>bg-white</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20298">#20298</a>)</li>
<li>Prevent Preflight from overriding Firefox's native
<code>iframe:focus-visible</code> outline styles (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20292">#20292</a>)</li>
<li>Ensure <code>theme('colors.foo')</code> in JS plugins resolves
correctly when both <code>--color-foo</code> and
<code>--color-foo-bar</code> exist (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20299">#20299</a>)</li>
<li>Ensure fractional opacity modifiers work with named shadow sizes
like <code>shadow-sm/12.5</code>, <code>text-shadow-sm/12.5</code>,
<code>drop-shadow-sm/12.5</code>, and <code>inset-shadow-sm/12.5</code>
(<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20302">#20302</a>)</li>
<li>Parse selectors like <code>[data-foo]div</code> as two selectors
instead of one (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20303">#20303</a>)</li>
<li>Ensure <code>@tailwindcss/postcss</code> rebuilds when a
preprocessor like Sass changes the input CSS without changing the input
file on disk (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20310">#20310</a>)</li>
<li>Ensure CSS nesting is handled even when Lightning CSS isn't run,
such as in <code>@tailwindcss/browser</code> and Tailwind Play (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20124">#20124</a>)</li>
<li>Prevent achromatic theme colors from shifting hue when mixed in
polar color spaces like <code>oklch</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20314">#20314</a>)</li>
<li>Ensure <code>--spacing(0)</code> is optimized to <code>0px</code>
instead of <code>0</code> so it remains a <code>&lt;length&gt;</code>
when used in <code>calc(…)</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20319">#20319</a>)</li>
<li>Load <code>@parcel/watcher</code> only when needed in
<code>@tailwindcss/cli --watch</code> mode, so one-off builds and
<code>--watch --poll</code> work when <code>@parcel/watcher</code> can't
be loaded (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20325">#20325</a>)</li>
<li>Use explicit platform fonts instead of <code>system-ui</code> and
<code>ui-sans-serif</code> so CJK text respects the page's
<code>lang</code> attribute on Windows (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20318">#20318</a>)</li>
<li>Prevent <code>@tailwindcss/upgrade</code> from rewriting ignored
files when run from a subdirectory (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20329">#20329</a>)</li>
<li>Ensure earlier <code>@source</code> rules pointing to nested files
are scanned when later <code>@source</code> rules point to files in
parent folders (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20335">#20335</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from triggering full page
reloads when scanned files are processed by Vite but haven't been loaded
as modules yet (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20336">#20336</a>)</li>
</ul>
<h2>v4.3.2</h2>
<h3>Fixed</h3>
<ul>
<li>Support bare spacing values for <code>auto-rows-*</code> and
<code>auto-cols-*</code> utilities (e.g. <code>auto-rows-12</code> and
<code>auto-cols-16</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20229">#20229</a>)</li>
<li>Prevent <code>@tailwindcss/cli</code> in <code>--watch</code> mode
from crashing on Windows when <code>@source</code> points to a directory
that doesn't exist (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20242">#20242</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing in Deno v2.8.x
when <code>context.parentURL</code> is not a valid URL (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20245">#20245</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
rebuilds when the input CSS file changes in an ignored directory (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20246">#20246</a>)</li>
<li>Allow <code>@variant</code> rules used in <code>addBase(…)</code> to
use custom variants defined later (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20247">#20247</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing during HMR when
scanned files or directories are deleted (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20259">#20259</a>)</li>
<li>Generate <code>font-size</code> instead of <code>color</code>
declarations for <code>text-[--spacing(…)]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20260">#20260</a>)</li>
<li>Prevent <code>@source</code> patterns from scanning unrelated
sibling files and folders (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20263">#20263</a>)</li>
<li>Extract class candidates adjacent to Template Toolkit delimiters
like <code>%]…[%</code> in <code>.tt</code>, <code>.tt2</code>, and
<code>.tx</code> files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269">#20269</a>)</li>
<li>Extract class candidates from conditional Maud syntax like
<code>p.text-black[condition]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269">#20269</a>)</li>
<li>Prevent <code>@position-try</code> rules from triggering unknown
at-rule warnings when optimizing CSS (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20277">#20277</a>)</li>
<li>Support class suggestions for named opacity modifiers from
<code>--opacity</code> theme values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20287">#20287</a>)</li>
<li>Prevent type errors in <code>@tailwindcss/postcss</code> when used
with newer PostCSS patch releases (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20289">#20289</a>)</li>
</ul>
<h2>v4.3.1</h2>
<h3>Added</h3>
<ul>
<li>Add <code>--silent</code> option to suppress output in
<code>@tailwindcss/cli</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20100">#20100</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Remove deprecation warnings by using
<code>Module#registerHooks</code> instead of
<code>Module#register</code> on Node 26+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20028">#20028</a>)</li>
<li>Canonicalization: don't crash when plugin utilities throw for
unsupported values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20052">#20052</a>)</li>
<li>Allow <code>@apply</code> to be used with CSS mixins (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19427">#19427</a>)</li>
<li>Ensure <code>not-*</code> correctly negates <code>@container</code>
queries, including <code>style(…)</code> queries (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20059">#20059</a>)</li>
<li>Ensure <code>drop-shadow-*</code> color utilities work with custom
shadow values containing <code>calc(…)</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20080">#20080</a>)</li>
<li>Fix 'Sourcemap is likely to be incorrect' warnings when using
<code>@tailwindcss/vite</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20103">#20103</a>)</li>
<li>Ensure <code>@tailwindcss/webpack</code> can be installed in Rspack
projects without requiring <code>webpack</code> as a peer dependency (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20027">#20027</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md">@​tailwindcss/vite's
changelog</a>.</em></p>
<blockquote>
<h2>[4.3.3] - 2026-07-16</h2>
<h3>Fixed</h3>
<ul>
<li>Support <code>--watch --poll[=ms]</code> in
<code>@tailwindcss/cli</code> when filesystem events are unreliable or
unavailable (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20297">#20297</a>)</li>
<li>Canonicalization: match arbitrary hex colors against theme colors
case-insensitively (e.g. <code>bg-[#fff]</code> and
<code>bg-[#FFF]</code> → <code>bg-white</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20298">#20298</a>)</li>
<li>Prevent Preflight from overriding Firefox's native
<code>iframe:focus-visible</code> outline styles (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20292">#20292</a>)</li>
<li>Ensure <code>theme('colors.foo')</code> in JS plugins resolves
correctly when both <code>--color-foo</code> and
<code>--color-foo-bar</code> exist (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20299">#20299</a>)</li>
<li>Ensure fractional opacity modifiers work with named shadow sizes
like <code>shadow-sm/12.5</code>, <code>text-shadow-sm/12.5</code>,
<code>drop-shadow-sm/12.5</code>, and <code>inset-shadow-sm/12.5</code>
(<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20302">#20302</a>)</li>
<li>Parse selectors like <code>[data-foo]div</code> as two selectors
instead of one (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20303">#20303</a>)</li>
<li>Ensure <code>@tailwindcss/postcss</code> rebuilds when a
preprocessor like Sass changes the input CSS without changing the input
file on disk (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20310">#20310</a>)</li>
<li>Ensure CSS nesting is handled even when Lightning CSS isn't run,
such as in <code>@tailwindcss/browser</code> and Tailwind Play (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20124">#20124</a>)</li>
<li>Prevent achromatic theme colors from shifting hue when mixed in
polar color spaces like <code>oklch</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20314">#20314</a>)</li>
<li>Ensure <code>--spacing(0)</code> is optimized to <code>0px</code>
instead of <code>0</code> so it remains a <code>&lt;length&gt;</code>
when used in <code>calc(…)</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20319">#20319</a>)</li>
<li>Load <code>@parcel/watcher</code> only when needed in
<code>@tailwindcss/cli --watch</code> mode, so one-off builds and
<code>--watch --poll</code> work when <code>@parcel/watcher</code> can't
be loaded (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20325">#20325</a>)</li>
<li>Use explicit platform fonts instead of <code>system-ui</code> and
<code>ui-sans-serif</code> so CJK text respects the page's
<code>lang</code> attribute on Windows (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20318">#20318</a>)</li>
<li>Prevent <code>@tailwindcss/upgrade</code> from rewriting ignored
files when run from a subdirectory (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20329">#20329</a>)</li>
<li>Ensure earlier <code>@source</code> rules pointing to nested files
are scanned when later <code>@source</code> rules point to files in
parent folders (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20335">#20335</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from triggering full page
reloads when scanned files are processed by Vite but haven't been loaded
as modules yet (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20336">#20336</a>)</li>
</ul>
<h2>[4.3.2] - 2026-06-26</h2>
<h3>Fixed</h3>
<ul>
<li>Support bare spacing values for <code>auto-rows-*</code> and
<code>auto-cols-*</code> utilities (e.g. <code>auto-rows-12</code> and
<code>auto-cols-16</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20229">#20229</a>)</li>
<li>Prevent <code>@tailwindcss/cli</code> in <code>--watch</code> mode
from crashing on Windows when <code>@source</code> points to a directory
that doesn't exist (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20242">#20242</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing in Deno v2.8.x
when <code>context.parentURL</code> is not a valid URL (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20245">#20245</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
rebuilds when the input CSS file changes in an ignored directory (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20246">#20246</a>)</li>
<li>Allow <code>@variant</code> rules used in <code>addBase(…)</code> to
use custom variants defined later (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20247">#20247</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing during HMR when
scanned files or directories are deleted (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20259">#20259</a>)</li>
<li>Generate <code>font-size</code> instead of <code>color</code>
declarations for <code>text-[--spacing(…)]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20260">#20260</a>)</li>
<li>Prevent <code>@source</code> patterns from scanning unrelated
sibling files and folders (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20263">#20263</a>)</li>
<li>Extract class candidates adjacent to Template Toolkit delimiters
like <code>%]…[%</code> in <code>.tt</code>, <code>.tt2</code>, and
<code>.tx</code> files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269">#20269</a>)</li>
<li>Extract class candidates from conditional Maud syntax like
<code>p.text-black[condition]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269">#20269</a>)</li>
<li>Prevent <code>@position-try</code> rules from triggering unknown
at-rule warnings when optimizing CSS (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20277">#20277</a>)</li>
<li>Support class suggestions for named opacity modifiers from
<code>--opacity</code> theme values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20287">#20287</a>)</li>
<li>Prevent type errors in <code>@tailwindcss/postcss</code> when used
with newer PostCSS patch releases (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20289">#20289</a>)</li>
</ul>
<h2>[4.3.1] - 2026-06-12</h2>
<h3>Added</h3>
<ul>
<li>Add <code>--silent</code> option to suppress output in
<code>@tailwindcss/cli</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20100">#20100</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Remove deprecation warnings by using
<code>Module#registerHooks</code> instead of
<code>Module#register</code> on Node 26+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20028">#20028</a>)</li>
<li>Canonicalization: don't crash when plugin utilities throw for
unsupported values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20052">#20052</a>)</li>
<li>Allow <code>@apply</code> to be used with CSS mixins (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19427">#19427</a>)</li>
<li>Ensure <code>not-*</code> correctly negates <code>@container</code>
queries, including <code>style(…)</code> queries (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20059">#20059</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/c2b24dd15fed1c59dd521bd86082f520c9f5ad0d"><code>c2b24dd</code></a>
4.3.3 (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite/issues/20334">#20334</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/bdcd7087b332d263353d46ed366b7b08040ded7a"><code>bdcd708</code></a>
Don't trigger a full page reload for scanned files that Vite processes
as mod...</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/056a1550721d4bf79ff732d5ab9414fa83f7064f"><code>056a155</code></a>
4.3.2 (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite/issues/20281">#20281</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/bb6a10937c7e1434db39919fbb4df4a8982dba7f"><code>bb6a109</code></a>
use <code>.ts</code> instead of <code>.css</code></li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/8a14a710102cae195f6811e8578bef9477bc6be9"><code>8a14a71</code></a>
4.3.1 (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite/issues/20226">#20226</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/73983e1cf5bc0ae721f4568cc24a5b5067b6b90b"><code>73983e1</code></a>
Fix 'Sourcemap is likely to be incorrect' warnings when using
`@tailwindcss/v...</li>
<li>See full diff in <a
href="https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-vite">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 12:16:25 -05:00
dependabot[bot] 8e856d2518 build(deps): bump @codemirror/state from 6.7.0 to 6.7.1 (#9890) 
Bumps [@codemirror/state](https://github.com/codemirror/state) from
6.7.0 to 6.7.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/codemirror/state/commits">compare view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 12:06:44 -05:00
dependabot[bot] 34f5674cbe build(deps): bump react-i18next from 17.0.9 to 17.0.10 (#9889) 
Bumps [react-i18next](https://github.com/i18next/react-i18next) from
17.0.9 to 17.0.10.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md">react-i18next's
changelog</a>.</em></p>
<blockquote>
<h2>17.0.10</h2>
<ul>
<li>fix(warnings): the <code>useTranslation</code> and
<code>Trans</code> &quot;You will need to pass in an i18next
instance&quot; warnings now match the <code>useSSR</code> wording,
mentioning the props/context alternatives and the most common
unexplained cause at scale: duplicate react-i18next copies in monorepo
setups. The <code>Trans</code> variant also referenced the internal
<code>i18nextReactModule</code> name; it now points to the public
<code>initReactI18next</code> API.</li>
<li>feat(warnings): development-only warning
(<code>SUSPENDED_WHILE_LOADING</code>, logged once) right before
<code>useTranslation</code> suspends while translations are loading.
With the default <code>useSuspense: true</code> and no
<code>&lt;Suspense&gt;</code> boundary this previously surfaced as a
blank screen or a cryptic React error; the warning now names both fixes
(add a <code>&lt;Suspense&gt;</code> boundary or set
<code>react.useSuspense: false</code>). No-op in production builds; the
<code>process.env.NODE_ENV</code> check is wrapped so runtimes without a
<code>process</code> global (raw ESM in the browser, some edge runtimes)
stay silent instead of throwing.</li>
<li>ci: weekly workflow typechecking the test suite against
<code>@types/react@next</code> / <code>@types/react-dom@next</code>, so
the next React major's type changes (like the React 18
<code>TFunctionResult</code>/children wave) surface before user
reports.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/react-i18next/commit/3b71c2766c2507781ccfb7b2b7a638b3ab339958"><code>3b71c27</code></a>
17.0.10</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/57c3500e6a18764eb30ef433f0899ea781c99bad"><code>57c3500</code></a>
build</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/c62476f4d10d7a8d77d6eb5b70ece5c960c978a0"><code>c62476f</code></a>
chore: sync package-lock with i18next ^26.2.0 devDependency bump</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/0126bd1cada6bcf98aa764f32e9f17e5f690e431"><code>0126bd1</code></a>
improve instance warnings (monorepo hint) + dev-only suspense warning +
weekl...</li>
<li>See full diff in <a
href="https://github.com/i18next/react-i18next/compare/v17.0.9...v17.0.10">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-i18next&package-manager=npm_and_yarn&previous-version=17.0.9&new-version=17.0.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 12:04:36 -05:00
dependabot[bot] dc7f09be0d build(deps-dev): bump vitest from 4.1.8 to 4.1.10 (#9886) 
Bumps
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)
from 4.1.8 to 4.1.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-dev/vitest/releases">vitest's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.10</h2>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li><strong>browser</strong>: Check fs access in builtin commands
[backport to v4]  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Hiroshi Ogawa</strong> and <strong>OpenCode
(claude-opus-4-8)</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10680">vitest-dev/vitest#10680</a>
<a href="https://github.com/vitest-dev/vitest/commit/5c18dd267"><!-- raw
HTML omitted -->(5c18d)<!-- raw HTML omitted --></a></li>
<li><strong>vm</strong>: Fix external module resolve error with deps
optimizer query for encoded URI [backport to v4]  -  by <a
href="https://github.com/SveLil"><code>@​SveLil</code></a> and <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10661">vitest-dev/vitest#10661</a>
<a href="https://github.com/vitest-dev/vitest/commit/bae52b511"><!-- raw
HTML omitted -->(bae52)<!-- raw HTML omitted --></a></li>
</ul>
<h5>    <a
href="https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10">View
changes on GitHub</a></h5>
<h2>v4.1.9</h2>
<h3>🐞 Bug Fixes</h3>
<ul>
<li>Fix <code>importOriginal</code> with optimizer and query import
[backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>David
Harris</strong>, <strong>Codex</strong>and <strong>Vladimir</strong> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/10546">vitest-dev/vitest#10546</a>
<a href="https://github.com/vitest-dev/vitest/commit/a5180190c"><!-- raw
HTML omitted -->(a5180)<!-- raw HTML omitted --></a></li>
<li><strong>browser</strong>:
<ul>
<li>Wait for orchestrator readiness before resolving browser sessions
[backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus
O'Connor</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10555">vitest-dev/vitest#10555</a>
<a href="https://github.com/vitest-dev/vitest/commit/7fb29651a"><!-- raw
HTML omitted -->(7fb29)<!-- raw HTML omitted --></a></li>
<li>Wait for iframe tester readiness before preparing [backport to v4] -
by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10497">vitest-dev/vitest#10497</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10556">vitest-dev/vitest#10556</a>
<a href="https://github.com/vitest-dev/vitest/commit/fbc626c40"><!-- raw
HTML omitted -->(fbc62)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>mocker</strong>:
<ul>
<li>Hoist vi.mock() for vite-plus/test imports [backport to v4] - by
<strong>Hiroshi Ogawa</strong>, <strong>LongYinan</strong>,
<strong>Claude Opus 4.8</strong> and <strong>Vladimir</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10548">vitest-dev/vitest#10548</a>
<a href="https://github.com/vitest-dev/vitest/commit/2c9559c02"><!-- raw
HTML omitted -->(2c955)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>pool</strong>:
<ul>
<li>Prevent test run hang on worker crash [backport to v4] - by
<strong>Ari Perkkiö</strong> and <strong>Jattioui Ismail</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10543">vitest-dev/vitest#10543</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/10564">vitest-dev/vitest#10564</a>
<a href="https://github.com/vitest-dev/vitest/commit/934b0f587"><!-- raw
HTML omitted -->(934b0)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<h5><a
href="https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9">View
changes on GitHub</a></h5>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitest-dev/vitest/commit/db616d227b6e0cb07a94f5d1bba262ee95db7e46"><code>db616d2</code></a>
chore: release v4.1.10 (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10718">#10718</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/bae52b5112a6fd8200101b88bf8af9685d077295"><code>bae52b5</code></a>
fix(vm): fix external module resolve error with deps optimizer query for
enco...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a7a61e78c7d0718f00173cff6800a91a344457d4"><code>a7a61e7</code></a>
chore: release v4.1.9 (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10598">#10598</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/934b0f587cb61d8338d83f525295322692a2db40"><code>934b0f5</code></a>
fix(pool): prevent test run hang on worker crash (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10543">#10543</a>)
[backport to v4] (#...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/7fb29651afbae2a9b0cefe6c031a9308f168ac60"><code>7fb2965</code></a>
fix(browser): wait for orchestrator readiness before resolving browser
sessio...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a5180190c1be7089e3705e3dd9e84fea118d09d3"><code>a518019</code></a>
fix: fix <code>importOriginal</code> with optimizer and query import
[backport to v4] (#...</li>
<li>See full diff in <a
href="https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vitest&package-manager=npm_and_yarn&previous-version=4.1.8&new-version=4.1.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 12:04:11 -05:00
dependabot[bot] 4d736b681d build(deps): bump ws from 8.19.0 to 8.21.1 (#9891) 
Bumps [ws](https://github.com/websockets/ws) from 8.19.0 to 8.21.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/websockets/ws/releases">ws's
releases</a>.</em></p>
<blockquote>
<h2>8.21.1</h2>
<h1>Bug fixes</h1>
<ul>
<li>Empty fragments are now counted toward the limit (a2f4e7c0).</li>
<li>The default values of the <code>maxBufferedChunks</code> and
<code>maxFragments</code> options have
been reduced (f197ac65).</li>
</ul>
<h2>8.21.0</h2>
<h1>Features</h1>
<ul>
<li>Introduced the <code>maxBufferedChunks</code> and
<code>maxFragments</code> options (2b2abd45).</li>
</ul>
<h1>Bug fixes</h1>
<ul>
<li>Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).</li>
</ul>
<p>A high volume of tiny fragments and data chunks could be sent by a
peer, using
modest network traffic, to crash a <code>ws</code> server or client due
to OOM.</p>
<pre lang="js"><code>import { WebSocket, WebSocketServer } from 'ws';
<p>const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(<code>ws://localhost:${port}</code>);</p>
<p>ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});</p>
<p>ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(<code>client close - code: ${code} reason:
${reason.toString()}</code>);
});
});</p>
<p>wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(<code>server close - code: ${code} reason:
${reason.toString()}</code>);
});
});
</code></pre></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/websockets/ws/commit/ae1de54330cef77e487548890fabfeb9aae1d83d"><code>ae1de54</code></a>
[dist] 8.21.1</li>
<li><a
href="https://github.com/websockets/ws/commit/8e9511b86b3fc6deebbd97dd9af7c9056deea8d1"><code>8e9511b</code></a>
[ci] Trust Coveralls Homebrew tap</li>
<li><a
href="https://github.com/websockets/ws/commit/f197ac65140920bdcecdab74bfc69c2d7858e55d"><code>f197ac6</code></a>
[fix] Lower default values of <code>maxBufferedChunks</code> and
<code>maxFragments</code></li>
<li><a
href="https://github.com/websockets/ws/commit/8df8265c2f63fd44af3193a98e23cf38888cd991"><code>8df8265</code></a>
[ci] Update actions/checkout action to v7</li>
<li><a
href="https://github.com/websockets/ws/commit/a2f4e7c046c2112bbce6fef39a083dac77d6f0d2"><code>a2f4e7c</code></a>
[fix] Count empty fragments toward the limit (<a
href="https://redirect.github.com/websockets/ws/issues/2329">#2329</a>)</li>
<li><a
href="https://github.com/websockets/ws/commit/e79f912cb3f492ae04c28feb9459a209e186b0ad"><code>e79f912</code></a>
[pkg] Approve install scripts for bufferutil and utf-8-validate</li>
<li><a
href="https://github.com/websockets/ws/commit/4ea355d6d3069394994f82ca1b6d38c32ba208fb"><code>4ea355d</code></a>
[doc] Document 32-bit signed integer coercion for option values</li>
<li><a
href="https://github.com/websockets/ws/commit/2120f4c8c625a76316792680a231496e1b615252"><code>2120f4c</code></a>
[example] Remove uuid dependency</li>
<li><a
href="https://github.com/websockets/ws/commit/4c534a6b8a5224a563af116e85c6ced7d4ca60cf"><code>4c534a6</code></a>
[security] Add latest vulnerability to SECURITY.md</li>
<li><a
href="https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"><code>bca91ad</code></a>
[dist] 8.21.0</li>
<li>Additional commits viewable in <a
href="https://github.com/websockets/ws/compare/8.19.0...8.21.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ws&package-manager=npm_and_yarn&previous-version=8.19.0&new-version=8.21.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 12:03:45 -05:00
dependabot[bot] e171e6f9e6 build(deps): bump react-router-dom from 7.16.0 to 7.18.1 (#9888) 
Bumps
[react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom)
from 7.16.0 to 7.18.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/remix-run/react-router/blob/react-router-dom@7.18.1/packages/react-router-dom/CHANGELOG.md">react-router-dom's
changelog</a>.</em></p>
<blockquote>
<h2>v7.18.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Fix incorrect <code>package.json</code> <code>main</code> field for
CommonJS builds (<a
href="https://redirect.github.com/remix-run/react-router/pull/15238">#15238</a>)</li>
<li>Updated dependencies:
<ul>
<li><a
href="https://github.com/remix-run/react-router/releases/tag/react-router@7.18.1"><code>react-router@7.18.1</code></a></li>
</ul>
</li>
</ul>
<h2>v7.18.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies:
<ul>
<li><a
href="https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0"><code>react-router@7.18.0</code></a></li>
</ul>
</li>
</ul>
<h2>v7.17.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies:
<ul>
<li><a
href="https://github.com/remix-run/react-router/releases/tag/react-router@7.17.0"><code>react-router@7.17.0</code></a></li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/remix-run/react-router/commit/afdf85d3c15448a41017514caca2aca038d3e9ca"><code>afdf85d</code></a>
Release v7.18.1 (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/15253">#15253</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/2ecaa1ddbbcd583999dda46dd5413e907e8a46f3"><code>2ecaa1d</code></a>
Fix react-router-dom main entry metadata (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/15238">#15238</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/6fb1e79f8304eddd8b78759edea83cb32389ebf5"><code>6fb1e79</code></a>
Release v7.18.0 (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/15187">#15187</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/195a0d03c1417127ccee73853058c8521beb4fce"><code>195a0d0</code></a>
Release v7.17.0 (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/15145">#15145</a>)</li>
<li>See full diff in <a
href="https://github.com/remix-run/react-router/commits/react-router-dom@7.18.1/packages/react-router-dom">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-router-dom&package-manager=npm_and_yarn&previous-version=7.16.0&new-version=7.18.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 12:03:39 -05:00
dependabot[bot] 8cdb3552b4 build(deps): bump @lexical/link from 0.46.0 to 0.48.0 (#9885) 
Bumps
[@lexical/link](https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link)
from 0.46.0 to 0.48.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/lexical/releases">@​lexical/link's
releases</a>.</em></p>
<blockquote>
<p>v0.48.0 is a maintenance release focused on bug fixes across
Markdown, tables, lists, links, and selection. It's headlined by a fix
for a v0.46.0 regression that broke native text drag-and-drop (<a
href="https://redirect.github.com/facebook/lexical/pull/8842">#8842</a>)
and a couple of notable security hardening fixes. It also adds a handful
of new features, including an <code>MdastHtmlExtension</code> with
examples for authoring custom Markdown constructs (collapsibles,
<code>kbd</code>, alerts, footnotes), a customizable Yjs shared-type
root name for collaborative editing, and new table row manipulation
helpers.</p>
<h2>New APIs &amp; Features</h2>
<ul>
<li><a
href="https://lexical.dev/docs/api/modules/lexical_table"><code>@lexical/table</code></a>
— Added <code>$moveTableRow</code> for reordering table rows, plus the
previously missing <code>$unmergeCellNode</code> export (<a
href="https://redirect.github.com/facebook/lexical/pull/8833">#8833</a>)</li>
<li><a
href="https://lexical.dev/docs/api/modules/lexical_yjs"><code>@lexical/yjs</code></a>
/ <a
href="https://lexical.dev/docs/api/modules/lexical_react"><code>@lexical/react</code></a>
— The Yjs shared-type root name is now customizable, so Lexical can
share a Yjs document with other content that uses a different root key
(<a
href="https://redirect.github.com/facebook/lexical/pull/8841">#8841</a>)</li>
<li><a
href="https://lexical.dev/docs/api/modules/lexical_extension"><code>@lexical/extension</code></a>
/ <a
href="https://lexical.dev/docs/api/modules/lexical_mdast"><code>@lexical/mdast</code></a>
— Added <code>MdastHtmlExtension</code> and Markdown custom-construct
examples (collapsible sections, <code>kbd</code>, alerts, footnotes)
demonstrating how to extend the Markdown ↔ mdast pipeline. See the <a
href="https://lexical.dev/docs/serialization/markdown-mdast">Markdown
&amp; mdast serialization guide</a> (<a
href="https://redirect.github.com/facebook/lexical/pull/8826">#8826</a>)</li>
</ul>
<h2>Notable Fixes</h2>
<p><strong>Drag &amp; drop (fix for v0.46.0 regression)</strong></p>
<ul>
<li>Don't cancel <code>dragover</code> for text drags, so native drops
work again (<a
href="https://redirect.github.com/facebook/lexical/pull/8842">#8842</a>)</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li><code>LinkNode.sanitizeUrl()</code> now fails closed on unparseable
URLs, preventing a potential XSS vector (<a
href="https://redirect.github.com/facebook/lexical/pull/8846">#8846</a>)</li>
<li>Fixed a <code>serialize-javascript</code> dependency vulnerability
(<a
href="https://redirect.github.com/facebook/lexical/pull/8803">#8803</a>)</li>
</ul>
<p><strong>Markdown &amp; code</strong></p>
<ul>
<li>Roundtrip overlapping inline formats correctly through
mdast/Markdown (<a
href="https://redirect.github.com/facebook/lexical/pull/8825">#8825</a>)</li>
<li>Force re-tokenization after an async language load so highlighting
appears once the grammar is ready (<a
href="https://redirect.github.com/facebook/lexical/pull/8830">#8830</a>)</li>
</ul>
<p><strong>Tables</strong></p>
<ul>
<li>Auto-scroll while drag-selecting cells past the visible edge (<a
href="https://redirect.github.com/facebook/lexical/pull/8822">#8822</a>)</li>
<li>Enable table copy in read-only mode (<a
href="https://redirect.github.com/facebook/lexical/pull/8845">#8845</a>)</li>
</ul>
<p><strong>Lists &amp; character limit</strong></p>
<ul>
<li>Backspace at the start of a list item now outdents or converts to a
paragraph (<a
href="https://redirect.github.com/facebook/lexical/pull/8829">#8829</a>)</li>
<li>Merge adjacent <code>OverflowNode</code>s in
<code>useCharacterLimit</code> (<a
href="https://redirect.github.com/facebook/lexical/pull/8831">#8831</a>)</li>
<li>Count block separators when wrapping character-limit overflow (<a
href="https://redirect.github.com/facebook/lexical/pull/8840">#8840</a>)</li>
</ul>
<p><strong>Links &amp; selection</strong></p>
<ul>
<li>Disable link opening for disabled autolinks (<a
href="https://redirect.github.com/facebook/lexical/pull/8839">#8839</a>)</li>
<li>Skip <code>scrollIntoViewIfNeeded</code> when the selection rect is
above the editor, fixing a Safari RTL caret jump (<a
href="https://redirect.github.com/facebook/lexical/pull/8848">#8848</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>[lexical-mdast][lexical-markdown] Bug Fix: Roundtrip overlapping
inline formats by <a
href="https://github.com/etrepum"><code>@​etrepum</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8825">facebook/lexical#8825</a></li>
<li>[lexical-table][lexical-playground] Bug Fix: Auto-scroll while
drag-selecting cells past the visible edge by <a
href="https://github.com/JohnJunior"><code>@​JohnJunior</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8822">facebook/lexical#8822</a></li>
<li>[lexical-code-shiki] Bug Fix: force re-tokenize after async language
load by <a
href="https://github.com/ochevallier"><code>@​ochevallier</code></a> in
<a
href="https://redirect.github.com/facebook/lexical/pull/8830">facebook/lexical#8830</a></li>
<li>[lexical-react] Bug Fix: Merge adjacent OverflowNodes in
useCharacterLimit by <a
href="https://github.com/mayrang"><code>@​mayrang</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8831">facebook/lexical#8831</a></li>
<li>Open playground links in a new tab by <a
href="https://github.com/potatowagon"><code>@​potatowagon</code></a> in
<a
href="https://redirect.github.com/facebook/lexical/pull/8837">facebook/lexical#8837</a></li>
<li>[lexical-rich-text][lexical-plain-text] Bug Fix: don't cancel
dragover for text drags so native drops work again by <a
href="https://github.com/etrepum"><code>@​etrepum</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8842">facebook/lexical#8842</a></li>
<li>[lexical-link] Bug Fix: disable link opening for disabled autolink
in… by <a
href="https://github.com/ochevallier"><code>@​ochevallier</code></a> in
<a
href="https://redirect.github.com/facebook/lexical/pull/8839">facebook/lexical#8839</a></li>
<li>[lexical-table] Feature: Add $moveTableRow function &amp; Add
missing export for $unmergeCellNode by <a
href="https://github.com/hamo-o"><code>@​hamo-o</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8833">facebook/lexical#8833</a></li>
<li>[lexical-list] Bug Fix: Backspace at start of list item outdents or
converts to paragraph by <a
href="https://github.com/mayrang"><code>@​mayrang</code></a> in <a
href="https://redirect.github.com/facebook/lexical/pull/8829">facebook/lexical#8829</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/lexical/blob/main/CHANGELOG.md">@​lexical/link's
changelog</a>.</em></p>
<blockquote>
<h2>v0.48.0 (2026-07-16)</h2>
<ul>
<li>lexical-reactlexical-table Bug Fix Enable table copy in read-only
mode (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8845">#8845</a>)
mayrang</li>
<li>lexical-extensionlexical-mdastdev-mdast-editor-example Feature Add
MdastHtmlExtension and Markdown custom-construct examples (collapsible,
kbd, alerts, footnotes) (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8826">#8826</a>)
Bob Ippolito</li>
<li>Fix fail closed in LinkNode.sanitizeUrl() on unparseable URLs (XSS)
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8846">#8846</a>)
xiezhenjia-meta</li>
<li>lexical Chore Fix serialize-javascript package dependency
vulnerability (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8803">#8803</a>)
vijay ojha</li>
<li>lexical-react Bug Fix Count block separators in character limit
overflow wrapping (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8840">#8840</a>)
mayrang</li>
<li>lexical-yjslexical-react Feature Customizable Yjs shared-type root
name (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8841">#8841</a>)
mayrang</li>
<li>lexical-list Bug Fix Backspace at start of list item outdents or
converts to paragraph (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8829">#8829</a>)
mayrang</li>
<li>lexical-table Feature Add moveTableRow function Add missing export
for unmergeCellNode (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8833">#8833</a>)</li>
<li>lexical-link Bug Fix disable link opening for disabled autolink in
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8839">#8839</a>)
Olivier Chevallier</li>
<li>lexical-rich-textlexical-plain-text Bug Fix dont cancel dragover for
text drags so native drops work again (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8842">#8842</a>)
Bob Ippolito</li>
<li>Open playground links in a new tab (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8837">#8837</a>)
Sherry</li>
<li>lexical-react Bug Fix Merge adjacent OverflowNodes in
useCharacterLimit (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8831">#8831</a>)
mayrang</li>
<li>lexical-code-shiki Bug Fix force re-tokenize after async language
load (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8830">#8830</a>)
Olivier Chevallier</li>
<li>lexical-tablelexical-playground Bug Fix Auto-scroll while
drag-selecting cells past the visible edge (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8822">#8822</a>)
Oleksandr Trukhnii</li>
<li>lexical-mdastlexical-markdown Bug Fix Roundtrip overlapping inline
formats (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8825">#8825</a>)
Bob Ippolito</li>
<li>v0.47.0 (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8821">#8821</a>)
Bob Ippolito</li>
<li>v0.47.0 Lexical GitHub Actions Bot</li>
</ul>
<h2>v0.47.0 (2026-07-10)</h2>
<ul>
<li>lexicallexical-rich-text Bug Fix Fix formatText toggle direction and
add SETTEXTFORMATCOMMAND (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8807">#8807</a>)
mayrang</li>
<li>scripts Bug Fix Let npm prompt for OTP when publishing bootstrap
stubs (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8820">#8820</a>)
Bob Ippolito</li>
<li>lexical-playground Bug Fix Clear inline font-size when converting to
heading (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8800">#8800</a>)
mayrang</li>
<li>lexical-tablelexical-playground Feature setTableRowIsHeader and
setTableColumnIsHeader utilities (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8815">#8815</a>)
mayrang</li>
<li>lexical-website Documentation Update Rewrite testing guide (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8811">#8811</a>)
mayrang</li>
<li>lexical-mdastlexical-rich-text Feature lexicalmdast, a
micromarkmdast-based alternative to lexicalmarkdown (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8794">#8794</a>)
Bob Ippolito</li>
<li>Make dependency-check resilient to transient registry errors (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8818">#8818</a>)
Gerard Rovira</li>
<li>lexical Refactor Move event module globals into per-editor
InputState (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8809">#8809</a>)
mayrang</li>
<li>lexical Bug Fix getDocument() should fall back to the global
document when there is no active editor (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8813">#8813</a>)
Sherry</li>
<li>lexical-playground Bug Fix Keep cell background color modal open on
first click (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8806">#8806</a>)
sahir</li>
<li>lexical-playground Bug Fix Use consistent default maxWidth for
markdown-imported images (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8810">#8810</a>)
mayrang</li>
<li>lexical-devtoolslexical-playground Chore Update flow, hermes, and
babel packages to latest (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8795">#8795</a>)
Bob Ippolito</li>
<li>Add a 7-day pnpm minimumReleaseAge to match the Dependabot cooldown
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8808">#8808</a>)
Gerard Rovira</li>
<li>lexical Chore Fix tmp package dependency vulnerability (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8802">#8802</a>)
vijay ojha</li>
<li>lexical Chore Add missing Flow type declarations (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8799">#8799</a>)
mayrang</li>
<li>lexical-markdown Feature Add generateNodesFromMarkdownString (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8789">#8789</a>)
mayrang</li>
<li>lexicallexical-playground Chore Refactor IME composition test
infrastructure and add browser-level coverage (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8793">#8793</a>)
mayrang</li>
<li>lexical-playground Bug Fix Use viewBox dimensions for unsized
Excalidraw output (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8798">#8798</a>)
mayrang</li>
<li>lexical-table Bug Fix Export insertTableRowAtNode and
insertTableColumnAtNode (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8791">#8791</a>)</li>
<li>lexical-playgroundlexical-website Feature Add Vercel Analytics and
Speed Insights (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8796">#8796</a>)
Gerard Rovira</li>
<li>lexicallexical-eslint-plugin Feature Add getDocument() API and
Shadow DOM lint enforcement (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8788">#8788</a>)
mayrang</li>
<li>scripts Bug Fix strip misplaced pure annotations from prod builds
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8786">#8786</a>)
Bob Ippolito</li>
<li>lexical Bug Fix deleteCharacter overwrites X11 PRIMARY selection via
Selection.modify (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8774">#8774</a>)
Bob Ippolito</li>
<li>lexical-playground Bug Fix Support Unicode URLs in autolink matcher
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8787">#8787</a>)
mayrang</li>
<li>lexical-table Feature Spread pasted TSV text across table cells (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8780">#8780</a>)
mayrang</li>
<li>Breaking Changelexical Bug Fix Preserve DOM element when composing
on segmented TextNode middle (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8784">#8784</a>)
mayrang</li>
<li>Breaking Changelexical-reactlexical-devtools-core Chore Drop React
17 support, baseline is now React 18 (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8782">#8782</a>)
Bob Ippolito</li>
<li>lexical-playgroundlexical Feature Ruby annotation node with floating
editor (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8741">#8741</a>)
mayrang</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/facebook/lexical/commit/284b7491d014c412a11ecc8e4b8ea8e09e07f7e9"><code>284b749</code></a>
v0.48.0</li>
<li><a
href="https://github.com/facebook/lexical/commit/365516c5fcdcc141561dcbb2eb43b707b48dd5b8"><code>365516c</code></a>
Fix: fail closed in LinkNode.sanitizeUrl() on unparseable URLs (XSS) (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8846">#8846</a>)</li>
<li><a
href="https://github.com/facebook/lexical/commit/71562324c7d2154f64d79f6d20803f67b9bd9c11"><code>7156232</code></a>
[lexical-link] Bug Fix: disable link opening for disabled autolink in…
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8839">#8839</a>)</li>
<li><a
href="https://github.com/facebook/lexical/commit/e4b7cc3f420226059c8aa30df6e89bd5fadbea90"><code>e4b7cc3</code></a>
v0.47.0 (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8821">#8821</a>)</li>
<li><a
href="https://github.com/facebook/lexical/commit/a7666ab11f5e8c674a3f5ca8a83d2e92f1b171d0"><code>a7666ab</code></a>
[*][lexical-devtools][lexical-playground] Chore: Update flow, hermes,
and bab...</li>
<li><a
href="https://github.com/facebook/lexical/commit/e649ab28b7e2dd58c1b4798c446e611f54356518"><code>e649ab2</code></a>
[lexical][lexical-eslint-plugin] Feature: Add $getDocument() API and
Shadow D...</li>
<li><a
href="https://github.com/facebook/lexical/commit/7b76175cc96d99489c2f3c792db193cf2d9bc127"><code>7b76175</code></a>
[lexical-playground] Bug Fix: Support Unicode URLs in autolink matcher
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8787">#8787</a>)</li>
<li><a
href="https://github.com/facebook/lexical/commit/62a4b30f382b4dc60cacd1a9d753a2d1f44d9f5e"><code>62a4b30</code></a>
[lexical][*] Feature: registerEventListener / registerEventListeners DOM
help...</li>
<li><a
href="https://github.com/facebook/lexical/commit/d04ea9e83609bcbdf729287010b6a297ee6a0ac5"><code>d04ea9e</code></a>
[lexical-a11y][lexical-react][lexical-playground][lexical-website]
Feature: @...</li>
<li><a
href="https://github.com/facebook/lexical/commit/51d47b77e852e646091ff5cb7675264fd9aa234e"><code>51d47b7</code></a>
[lexical] Bug Fix: Clean up trailing shadow root after select-all delete
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical-link/issues/8751">#8751</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/facebook/lexical/commits/v0.48.0/packages/lexical-link">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@lexical/link&package-manager=npm_and_yarn&previous-version=0.46.0&new-version=0.48.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 12:03:36 -05:00
dependabot[bot] 2683555d13 build(deps): bump @codemirror/language from 6.12.3 to 6.12.4 (#9894) 
Bumps [@codemirror/language](https://github.com/codemirror/language)
from 6.12.3 to 6.12.4.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/codemirror/language/commits">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@codemirror/language&package-manager=npm_and_yarn&previous-version=6.12.3&new-version=6.12.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 12:03:27 -05:00
dependabot[bot] db61cc97d3 build(deps-dev): bump tsx from 4.22.4 to 4.23.1 (#9480) 
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.22.4 to 4.23.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/privatenumber/tsx/releases">tsx's
releases</a>.</em></p>
<blockquote>
<h2>v4.23.1</h2>
<h2><a
href="https://github.com/privatenumber/tsx/compare/v4.23.0...v4.23.1">4.23.1</a>
(2026-07-13)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>support tsImport after global preload (<a
href="https://github.com/privatenumber/tsx/commit/8d4ffc24f37b396ca2fe3f251aa92c4919f2c1a4">8d4ffc2</a>)</li>
<li><strong>watch:</strong> avoid clearing piped output (<a
href="https://github.com/privatenumber/tsx/commit/95d0672e0247a829ae4469daa493212967ea768e">95d0672</a>)</li>
<li><strong>watch:</strong> treat script and dependency paths literally
(<a
href="https://github.com/privatenumber/tsx/commit/79fddde523d3bb7d0af66682ce1265f95113a073">79fddde</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li>index transform cache lazily (<a
href="https://github.com/privatenumber/tsx/commit/e818ad608159a6fb36fb8a0bd59327fec313323d">e818ad6</a>)</li>
<li>load esbuild lazily in CLI (<a
href="https://github.com/privatenumber/tsx/commit/d0679381b60a55a9b5863603a4022a81db5d13c8">d067938</a>)</li>
<li>map Node TypeScript formats directly (<a
href="https://github.com/privatenumber/tsx/commit/cdcc6232a3277fb3028b226958b66c49a6d86c17">cdcc623</a>)</li>
<li>use sync module hooks on Node v22.22.3+ (<a
href="https://github.com/privatenumber/tsx/commit/f8992f1a50213e11b7ef8ab5121c78e0d2f29384">f8992f1</a>)</li>
</ul>
<hr />
<p>This release is also available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/tsx/v/4.23.1"><code>npm
package (@​latest dist-tag)</code></a></li>
</ul>
<h2>v4.23.0</h2>
<h1><a
href="https://github.com/privatenumber/tsx/compare/v4.22.5...v4.23.0">4.23.0</a>
(2026-07-03)</h1>
<h3>Bug Fixes</h3>
<ul>
<li>avoid redundant filesystem probes during module resolution (<a
href="https://github.com/privatenumber/tsx/commit/257bbbb7eb2784cad6a3bb7a2d9c9747d28d96ec">257bbbb</a>),
closes <a
href="https://redirect.github.com/privatenumber/tsx/issues/809">privatenumber/tsx#809</a></li>
</ul>
<h3>Features</h3>
<ul>
<li>add multi-scenario startup benchmark suite (<a
href="https://github.com/privatenumber/tsx/commit/c178197b104d055fd3431f7448982f3156394d12">c178197</a>),
closes <a
href="https://redirect.github.com/privatenumber/tsx/issues/809">privatenumber/tsx#809</a>
<a
href="https://redirect.github.com/privatenumber/tsx/issues/809">#809</a>
<a href="https://github.com/hi/issues/signal">hi#signal</a> <a
href="https://redirect.github.com/privatenumber/tsx/issues/145">privatenumber/tsx#145</a>
<a
href="https://redirect.github.com/privatenumber/tsx/issues/809">#809</a></li>
</ul>
<hr />
<p>This release is also available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/tsx/v/4.23.0"><code>npm
package (@​latest dist-tag)</code></a></li>
</ul>
<h2>v4.22.5</h2>
<h2><a
href="https://github.com/privatenumber/tsx/compare/v4.22.4...v4.22.5">4.22.5</a>
(2026-07-02)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>isolate hook state per async module.register() registration (<a
href="https://github.com/privatenumber/tsx/commit/a305f365f0cbcc31a44549dcbb0e63dc2883e96d">a305f36</a>)</li>
</ul>
<hr />
<p>This release is also available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/tsx/v/4.22.5"><code>npm
package (@​latest dist-tag)</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/privatenumber/tsx/commit/79fddde523d3bb7d0af66682ce1265f95113a073"><code>79fddde</code></a>
fix(watch): treat script and dependency paths literally</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/e818ad608159a6fb36fb8a0bd59327fec313323d"><code>e818ad6</code></a>
perf: index transform cache lazily</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/cdcc6232a3277fb3028b226958b66c49a6d86c17"><code>cdcc623</code></a>
perf: map Node TypeScript formats directly</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/d0679381b60a55a9b5863603a4022a81db5d13c8"><code>d067938</code></a>
perf: load esbuild lazily in CLI</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/95d0672e0247a829ae4469daa493212967ea768e"><code>95d0672</code></a>
fix(watch): avoid clearing piped output</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/6fd4607e8a99d1efe27f185f749c659138f00ece"><code>6fd4607</code></a>
docs: add per-page metadata</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/f4176d8c6329a12205ed9b8c582e559cafc45018"><code>f4176d8</code></a>
docs: generate sitemap</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/8d4ffc24f37b396ca2fe3f251aa92c4919f2c1a4"><code>8d4ffc2</code></a>
fix: support tsImport after global preload</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/f0e89b244c98849dc5f9483fa33aaaf983ede18f"><code>f0e89b2</code></a>
docs: document Node's public type-stripping API vs internal loader
path</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/f8992f1a50213e11b7ef8ab5121c78e0d2f29384"><code>f8992f1</code></a>
perf: use sync module hooks on Node v22.22.3+</li>
<li>Additional commits viewable in <a
href="https://github.com/privatenumber/tsx/compare/v4.22.4...v4.23.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-16 13:59:26 -05:00
dependabot[bot] c4da1c925f build(deps): bump @agentclientprotocol/claude-agent-acp from 0.52.0 to 0.59.0 (#9484) 
Bumps
[@agentclientprotocol/claude-agent-acp](https://github.com/agentclientprotocol/claude-agent-acp)
from 0.52.0 to 0.59.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agentclientprotocol/claude-agent-acp/releases">@​agentclientprotocol/claude-agent-acp's
releases</a>.</em></p>
<blockquote>
<h2>v0.59.0</h2>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.58.1...v0.59.0">0.59.0</a>
(2026-07-13)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps-dev:</strong> bump nanoid from 3.3.15 to 3.3.16 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/875">#875</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/e67dacdcac629b00e5bdcda94b3de57459696b1e">e67dacd</a>)</li>
<li><strong>deps:</strong> bump
<code>@​anthropic-ai/claude-agent-sdk</code> to 0.3.207 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/874">#874</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/c7f5b8fe768507afa28cdffe5cc3c054c56306ad">c7f5b8f</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Add subagent parent tool use attribution (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/859">#859</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/9cd48c597af68f630774ec00bc3adc85f6b0fd4b">9cd48c5</a>)</li>
<li>forward result text when the turn emitted no assistant message (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/858">#858</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/61ae8609d4343da6758c2376c6cf684c7fb0956a">61ae860</a>)</li>
<li>hold a turn open while its background subagents are still live (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/870">#870</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/7a70f82739e085014cad878f08513cdef7b7fe16">7a70f82</a>)</li>
<li>Refine tool calls from streamed input (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/867">#867</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/2c19974d5b80d3178b35e80a4bb0a1050588aab9">2c19974</a>)</li>
<li>Seed context window from SDK usage report (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/868">#868</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/3ba2d367a282fe3053a73804a416a435cb01ee08">3ba2d36</a>),
closes <a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/596">#596</a></li>
<li>Skip synthetic login messages on replay (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/869">#869</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/c7dff3cf7eeb03cb993493efafa96344f18de81b">c7dff3c</a>),
closes <a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/863">#863</a></li>
</ul>
<h2>v0.58.1</h2>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.58.0...v0.58.1">0.58.1</a>
(2026-07-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Use valid npm version for publish (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/855">#855</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/8b366d8e9ad55e9237bf2d618cfc99b57fac570d">8b366d8</a>)</li>
</ul>
<h2>v0.58.0</h2>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.57.0...v0.58.0">0.58.0</a>
(2026-07-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps:</strong> update to
<code>@​anthropic-ai/claude-agent-sdk</code> 0.3.205 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/854">#854</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/f664ced76df00674d88aedd018a4261da3bc3f3a">f664ced</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Preserve live model on resumed sessions (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/848">#848</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/f3d8ae3eb389ee9367f48c8762562a55280ade0a">f3d8ae3</a>),
closes <a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/845">#845</a></li>
<li>Report usage for cancelled active turns (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/846">#846</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/b03318f59c6165146c8d8e036227f35c3abd0ff4">b03318f</a>),
closes <a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/844">#844</a></li>
<li>tolerate missing text in streamed thinking chunks (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/852">#852</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/e944ceddea79950d6bfb6339266862507c4b964f">e944ced</a>)</li>
<li>Use SDK guards for elicitation validation (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/850">#850</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/32b93501d7a35a3b405b5022b4caaad492eed11c">32b9350</a>)</li>
</ul>
<h2>v0.57.0</h2>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.56.0...v0.57.0">0.57.0</a>
(2026-07-07)</h2>
<h3>Features</h3>
<ul>
<li>Update <code>@​anthropic-ai/claude-agent-sdk</code> to 0.3.202 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/843">#843</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/1612c078953c134e12368a2d968a9bcf14d31b55">1612c07</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/agentclientprotocol/claude-agent-acp/blob/main/CHANGELOG.md">@​agentclientprotocol/claude-agent-acp's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.58.1...v0.59.0">0.59.0</a>
(2026-07-13)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps-dev:</strong> bump nanoid from 3.3.15 to 3.3.16 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/875">#875</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/e67dacdcac629b00e5bdcda94b3de57459696b1e">e67dacd</a>)</li>
<li><strong>deps:</strong> bump
<code>@​anthropic-ai/claude-agent-sdk</code> to 0.3.207 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/874">#874</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/c7f5b8fe768507afa28cdffe5cc3c054c56306ad">c7f5b8f</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Add subagent parent tool use attribution (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/859">#859</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/9cd48c597af68f630774ec00bc3adc85f6b0fd4b">9cd48c5</a>)</li>
<li>forward result text when the turn emitted no assistant message (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/858">#858</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/61ae8609d4343da6758c2376c6cf684c7fb0956a">61ae860</a>)</li>
<li>hold a turn open while its background subagents are still live (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/870">#870</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/7a70f82739e085014cad878f08513cdef7b7fe16">7a70f82</a>)</li>
<li>Refine tool calls from streamed input (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/867">#867</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/2c19974d5b80d3178b35e80a4bb0a1050588aab9">2c19974</a>)</li>
<li>Seed context window from SDK usage report (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/868">#868</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/3ba2d367a282fe3053a73804a416a435cb01ee08">3ba2d36</a>),
closes <a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/596">#596</a></li>
<li>Skip synthetic login messages on replay (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/869">#869</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/c7dff3cf7eeb03cb993493efafa96344f18de81b">c7dff3c</a>),
closes <a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/863">#863</a></li>
</ul>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.58.0...v0.58.1">0.58.1</a>
(2026-07-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Use valid npm version for publish (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/855">#855</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/8b366d8e9ad55e9237bf2d618cfc99b57fac570d">8b366d8</a>)</li>
</ul>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.57.0...v0.58.0">0.58.0</a>
(2026-07-09)</h2>
<h3>Features</h3>
<ul>
<li><strong>deps:</strong> update to
<code>@​anthropic-ai/claude-agent-sdk</code> 0.3.205 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/854">#854</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/f664ced76df00674d88aedd018a4261da3bc3f3a">f664ced</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Preserve live model on resumed sessions (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/848">#848</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/f3d8ae3eb389ee9367f48c8762562a55280ade0a">f3d8ae3</a>),
closes <a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/845">#845</a></li>
<li>Report usage for cancelled active turns (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/846">#846</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/b03318f59c6165146c8d8e036227f35c3abd0ff4">b03318f</a>),
closes <a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/844">#844</a></li>
<li>tolerate missing text in streamed thinking chunks (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/852">#852</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/e944ceddea79950d6bfb6339266862507c4b964f">e944ced</a>)</li>
<li>Use SDK guards for elicitation validation (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/850">#850</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/32b93501d7a35a3b405b5022b4caaad492eed11c">32b9350</a>)</li>
</ul>
<h2><a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.56.0...v0.57.0">0.57.0</a>
(2026-07-07)</h2>
<h3>Features</h3>
<ul>
<li>Update <code>@​anthropic-ai/claude-agent-sdk</code> to 0.3.202 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/843">#843</a>)
(<a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/1612c078953c134e12368a2d968a9bcf14d31b55">1612c07</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/30b7c06f7640fb6a0530ba18f85e26fe2bc08882"><code>30b7c06</code></a>
chore(main): release 0.59.0 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/860">#860</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/c7f5b8fe768507afa28cdffe5cc3c054c56306ad"><code>c7f5b8f</code></a>
feat(deps): bump <code>@​anthropic-ai/claude-agent-sdk</code> to 0.3.207
(<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/874">#874</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/7a70f82739e085014cad878f08513cdef7b7fe16"><code>7a70f82</code></a>
fix: hold a turn open while its background subagents are still live (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/870">#870</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/e67dacdcac629b00e5bdcda94b3de57459696b1e"><code>e67dacd</code></a>
feat(deps-dev): bump nanoid from 3.3.15 to 3.3.16 (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/875">#875</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/61ae8609d4343da6758c2376c6cf684c7fb0956a"><code>61ae860</code></a>
fix: forward result text when the turn emitted no assistant message (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/858">#858</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/2c19974d5b80d3178b35e80a4bb0a1050588aab9"><code>2c19974</code></a>
fix: Refine tool calls from streamed input (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/867">#867</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/c7dff3cf7eeb03cb993493efafa96344f18de81b"><code>c7dff3c</code></a>
fix: Skip synthetic login messages on replay (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/869">#869</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/3ba2d367a282fe3053a73804a416a435cb01ee08"><code>3ba2d36</code></a>
fix: Seed context window from SDK usage report (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/868">#868</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/f4e750decf6057cf984d15afe3a25a42f16f3911"><code>f4e750d</code></a>
feat(deps): bump the minor group with 11 updates (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/862">#862</a>)</li>
<li><a
href="https://github.com/agentclientprotocol/claude-agent-acp/commit/9cd48c597af68f630774ec00bc3adc85f6b0fd4b"><code>9cd48c5</code></a>
fix: Add subagent parent tool use attribution (<a
href="https://redirect.github.com/agentclientprotocol/claude-agent-acp/issues/859">#859</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agentclientprotocol/claude-agent-acp/compare/v0.52.0...v0.59.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-16 13:17:13 -05:00
github-actions[bot]andlockfile-bot b0e9e3664f chore(lockfile): refresh pnpm-lock.yaml (#9305) 
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.

Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
 2026-07-14 13:19:59 -05:00
dependabot[bot] 2617bee422 build(deps-dev): bump @storybook/addon-docs from 10.4.6 to 10.5.0 (#9483) 
Bumps
[@storybook/addon-docs](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs)
from 10.4.6 to 10.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/releases">@​storybook/addon-docs's
releases</a>.</em></p>
<blockquote>
<h2>v10.5.0</h2>
<h2>10.5.0</h2>
<blockquote>
<p><em>Foundational changes for new AI workflows</em></p>
</blockquote>
<p>Storybook 10.5 contains hundreds of fixes and improvements:</p>
<ul>
<li>⚡️ Angular-vite framework: Modern, fast dev, docs, and test
(preview)</li>
<li>🌈 Vitest initialGlobals: Test across themes, viewports, locales</li>
<li>🤖 Agentic review: AI-curated visual changesets and search results
(experimental)</li>
<li>⚛️ React docgen service: Unified metadata across MCP, Docs, and
Controls (experimental)</li>
<li>🧑‍💻 Claude / Codex plugins: One-click ADE integration
(experimental)</li>
</ul>
<!-- raw HTML omitted -->
<ul>
<li>A11y: Fix MDX heading anchors not keyboard accessible - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34368">#34368</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>A11y: Handle lang attribute throughout preview - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35321">#35321</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>A11y: Surface required args and keyboard-reachable Setup controls in
ArgsTable - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35306">#35306</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Addon A11y: Preserve disabled a11y rules with runOnly - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34649">#34649</a>,
thanks <a
href="https://github.com/cyphercodes"><code>@​cyphercodes</code></a>!</li>
<li>Addon Docs: DocsContent not filling available width when TOC is
enabled - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35043">#35043</a>,
thanks <a
href="https://github.com/k-utsumi"><code>@​k-utsumi</code></a>!</li>
<li>Addon Docs: Resolve CSF4 module exports without a default export -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/34834">#34834</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Addon Docs: Resolve providerImportSource to a path instead of a
file:// URL - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34841">#34841</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Addon Vitest: Add an initialGlobals option to pin a project's
globals - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35226">#35226</a>,
thanks <a
href="https://github.com/lifeiscontent"><code>@​lifeiscontent</code></a>!</li>
<li>Addon Vitest: Avoid erroring out on benign Win process exits - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35287">#35287</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Addon Vitest: Fix dynamic import failure with Vitest 3 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34927">#34927</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Addon Vitest: Subscribe for run completion before triggering it - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35291">#35291</a>,
thanks <a
href="https://github.com/tsushanth"><code>@​tsushanth</code></a>!</li>
<li>Angular: Add versioned `@types/node` to packages installed during
`storybook init` - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34192">#34192</a>,
thanks <a
href="https://github.com/copilot-swe-agent"><code>@​copilot-swe-agent</code></a>!</li>
<li>Angular: Fix custom paths for stats.json on angular - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34551">#34551</a>,
thanks <a
href="https://github.com/mrginglymus"><code>@​mrginglymus</code></a>!</li>
<li>Angular: Fix zone.js drop in angular-to-angular-vite migration +
schema sync + transform widening - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35386">#35386</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Angular: Install <code>@​analogjs/vite-plugin-angular</code> in
angular-to-angular-vite automigration - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35432">#35432</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Angular: Introduce <code>@​storybook/angular-vite</code> package -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/34202">#34202</a>,
thanks <a
href="https://github.com/brandonroberts"><code>@​brandonroberts</code></a>!</li>
<li>Angular: Support Angular 22 in Webpack framework - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35318">#35318</a>,
thanks <a
href="https://github.com/EtiennePasteur"><code>@​EtiennePasteur</code></a>!</li>
<li>Angular: Use future-proof API for component reflection - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35228">#35228</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Babel: Remove bugfixes from preset-env in v8 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35266">#35266</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Builder Vite: Fix empty external globals imports - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34348">#34348</a>,
thanks <a
href="https://github.com/raashish1601"><code>@​raashish1601</code></a>!</li>
<li>Builder Vite: Support configLoader via builder options - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34080">#34080</a>,
thanks <a
href="https://github.com/holvi-sebastian"><code>@​holvi-sebastian</code></a>!</li>
<li>CLI: Add `storybook ai <!-- raw HTML omitted -->` MCP passthrough
behind `STORYBOOK_FEATURE_AI_CLI` - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35125">#35125</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
<li>CLI: Add telemetry for the `storybook ai <!-- raw HTML omitted -->`
passthrough - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35138">#35138</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
<li>CLI: Allow -p shorthand to --port for ai command - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35390">#35390</a>,
thanks <a
href="https://github.com/huang-julien"><code>@​huang-julien</code></a>!</li>
<li>CLI: Bundle the `ai` command in core so it never downloads
`@storybook/cli` - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35147">#35147</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
<li>CLI: Do not auto-open the browser in storybook dev under AI agents -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/35412">#35412</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
<li>CLI: Exit process after successful build - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34735">#34735</a>,
thanks <a
href="https://github.com/torleifhalseth"><code>@​torleifhalseth</code></a>!</li>
<li>CLI: Fix angular-to-angular-vite migration failing to configure
addon-vitest - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35404">#35404</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>CLI: Fix silent hang in deferred addon configuration during upgrade
- <a
href="https://redirect.github.com/storybookjs/storybook/pull/35423">#35423</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>CLI: Fix upgrade crash on Storybook latest version check - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35156">#35156</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>CLI: Handle nested array schema for AI help - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35424">#35424</a>,
thanks <a
href="https://github.com/huang-julien"><code>@​huang-julien</code></a>!</li>
<li>CLI: Install MCP when upgrade is ran by agent - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35215">#35215</a>,
thanks <a
href="https://github.com/huang-julien"><code>@​huang-julien</code></a>!</li>
<li>CLI: Load Storybook AI help from preset metadata - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35212">#35212</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
<li>CLI: Match `storybook ai` instances by config dir as well as cwd -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/35392">#35392</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md">@​storybook/addon-docs's
changelog</a>.</em></p>
<blockquote>
<h2>10.5.0</h2>
<blockquote>
<p><em>Foundational changes for new AI workflows</em></p>
</blockquote>
<p>Storybook 10.5 contains hundreds of fixes and improvements:</p>
<ul>
<li>⚡️ Angular-vite framework: Modern, fast dev, docs, and test
(preview)</li>
<li>🌈 Vitest initialGlobals: Test across themes, viewports, locales</li>
<li>🤖 Agentic review: AI-curated visual changesets and search results
(experimental)</li>
<li>⚛️ React docgen service: Unified metadata across MCP, Docs, and
Controls (experimental)</li>
<li>🧑‍💻 Claude / Codex plugins: One-click ADE integration
(experimental)</li>
</ul>
<!-- raw HTML omitted -->
<ul>
<li>A11y: Fix MDX heading anchors not keyboard accessible - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34368">#34368</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>A11y: Handle lang attribute throughout preview - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35321">#35321</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>A11y: Surface required args and keyboard-reachable Setup controls in
ArgsTable - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35306">#35306</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Addon A11y: Preserve disabled a11y rules with runOnly - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34649">#34649</a>,
thanks <a
href="https://github.com/cyphercodes"><code>@​cyphercodes</code></a>!</li>
<li>Addon Docs: DocsContent not filling available width when TOC is
enabled - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35043">#35043</a>,
thanks <a
href="https://github.com/k-utsumi"><code>@​k-utsumi</code></a>!</li>
<li>Addon Docs: Resolve CSF4 module exports without a default export -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/34834">#34834</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Addon Docs: Resolve providerImportSource to a path instead of a
file:// URL - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34841">#34841</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Addon Vitest: Add an initialGlobals option to pin a project's
globals - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35226">#35226</a>,
thanks <a
href="https://github.com/lifeiscontent"><code>@​lifeiscontent</code></a>!</li>
<li>Addon Vitest: Avoid erroring out on benign Win process exits - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35287">#35287</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Addon Vitest: Fix dynamic import failure with Vitest 3 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34927">#34927</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Addon Vitest: Subscribe for run completion before triggering it - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35291">#35291</a>,
thanks <a
href="https://github.com/tsushanth"><code>@​tsushanth</code></a>!</li>
<li>Angular: Add versioned <code>@types/node</code> to packages
installed during <code>storybook init</code> - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34192">#34192</a>,
thanks <a
href="https://github.com/copilot-swe-agent"><code>@​copilot-swe-agent</code></a>!</li>
<li>Angular: Fix custom paths for stats.json on angular - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34551">#34551</a>,
thanks <a
href="https://github.com/mrginglymus"><code>@​mrginglymus</code></a>!</li>
<li>Angular: Fix zone.js drop in angular-to-angular-vite migration +
schema sync + transform widening - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35386">#35386</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Angular: Install <code>@​analogjs/vite-plugin-angular</code> in
angular-to-angular-vite automigration - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35432">#35432</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Angular: Introduce <code>@​storybook/angular-vite</code> package -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/34202">#34202</a>,
thanks <a
href="https://github.com/brandonroberts"><code>@​brandonroberts</code></a>!</li>
<li>Angular: Support Angular 22 in Webpack framework - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35318">#35318</a>,
thanks <a
href="https://github.com/EtiennePasteur"><code>@​EtiennePasteur</code></a>!</li>
<li>Angular: Use future-proof API for component reflection - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35228">#35228</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Babel: Remove bugfixes from preset-env in v8 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35266">#35266</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Builder Vite: Fix empty external globals imports - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34348">#34348</a>,
thanks <a
href="https://github.com/raashish1601"><code>@​raashish1601</code></a>!</li>
<li>Builder Vite: Support configLoader via builder options - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34080">#34080</a>,
thanks <a
href="https://github.com/holvi-sebastian"><code>@​holvi-sebastian</code></a>!</li>
<li>CLI: Add <code>storybook ai &lt;tool&gt;</code> MCP passthrough
behind <code>STORYBOOK_FEATURE_AI_CLI</code> - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35125">#35125</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
<li>CLI: Add telemetry for the <code>storybook ai &lt;command&gt;</code>
passthrough - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35138">#35138</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
<li>CLI: Allow -p shorthand to --port for ai command - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35390">#35390</a>,
thanks <a
href="https://github.com/huang-julien"><code>@​huang-julien</code></a>!</li>
<li>CLI: Bundle the <code>ai</code> command in core so it never
downloads <code>@storybook/cli</code> - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35147">#35147</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
<li>CLI: Do not auto-open the browser in storybook dev under AI agents -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/35412">#35412</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
<li>CLI: Exit process after successful build - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34735">#34735</a>,
thanks <a
href="https://github.com/torleifhalseth"><code>@​torleifhalseth</code></a>!</li>
<li>CLI: Fix angular-to-angular-vite migration failing to configure
addon-vitest - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35404">#35404</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>CLI: Fix silent hang in deferred addon configuration during upgrade
- <a
href="https://redirect.github.com/storybookjs/storybook/pull/35423">#35423</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>CLI: Fix upgrade crash on Storybook latest version check - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35156">#35156</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>CLI: Handle nested array schema for AI help - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35424">#35424</a>,
thanks <a
href="https://github.com/huang-julien"><code>@​huang-julien</code></a>!</li>
<li>CLI: Install MCP when upgrade is ran by agent - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35215">#35215</a>,
thanks <a
href="https://github.com/huang-julien"><code>@​huang-julien</code></a>!</li>
<li>CLI: Load Storybook AI help from preset metadata - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35212">#35212</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
<li>CLI: Match <code>storybook ai</code> instances by config dir as well
as cwd - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35392">#35392</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
<li>CLI: Prefer agent-matched Storybook instances - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35235">#35235</a>,
thanks <a
href="https://github.com/kasperpeulen"><code>@​kasperpeulen</code></a>!</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/storybookjs/storybook/commit/9dafcd22ed55947bc4c2fa1d5066b552baa0ebf4"><code>9dafcd2</code></a>
Bump version from &quot;10.5.0-beta.2&quot; to &quot;10.5.0&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/448db85e651a09ca55f978356c4f1593f261f82a"><code>448db85</code></a>
Bump version from &quot;10.5.0-beta.1&quot; to &quot;10.5.0-beta.2&quot;
[skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/a4ce9790a783d8e7720e9de980a08576de9555db"><code>a4ce979</code></a>
Bump version from &quot;10.5.0-beta.0&quot; to &quot;10.5.0-beta.1&quot;
[skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/f0bf138a0a83443c177f4b6882d74440829de42e"><code>f0bf138</code></a>
Bump version from &quot;10.5.0-alpha.11&quot; to
&quot;10.5.0-beta.0&quot; [skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/fac05a57415eec36b0a72b383befd7ef5071572c"><code>fac05a5</code></a>
Bump version from &quot;10.5.0-alpha.10&quot; to
&quot;10.5.0-alpha.11&quot; [skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/4057c4169f1e63d746d86349fcf4463e321b546e"><code>4057c41</code></a>
Bump version from &quot;10.5.0-alpha.9&quot; to
&quot;10.5.0-alpha.10&quot; [skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/91b9c34e58bc91126baff5e184cefc20f9ada1ec"><code>91b9c34</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs/issues/35321">#35321</a>
from storybookjs/sidnioulz/fix-html-lang-refreshed</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/383d5905dbefbdbb673568ae06ea2afef07ce59e"><code>383d590</code></a>
Merge branch 'next' into sidnioulz/fix-html-lang-refreshed</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/520c70129d6fa0b5ede737ee0b1f16166096e6b8"><code>520c701</code></a>
UI: Add docs.lang and htmlLang parameters</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/d71aa77e16e650371a41f12f82cdc75e77d0ac1f"><code>d71aa77</code></a>
Merge origin/next into docgen/worker-threading</li>
<li>Additional commits viewable in <a
href="https://github.com/storybookjs/storybook/commits/v10.5.0/code/addons/docs">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 10:08:29 -07:00
dependabot[bot] d7961919f5 build(deps): bump react-i18next from 17.0.8 to 17.0.9 (#9481) 
Bumps [react-i18next](https://github.com/i18next/react-i18next) from
17.0.8 to 17.0.9.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md">react-i18next's
changelog</a>.</em></p>
<blockquote>
<h2>17.0.9</h2>
<ul>
<li>fix: allow TypeScript 7 in the optional <code>typescript</code> peer
dependency range (<code>^5 || ^6 || ^7</code>). With
<code>typescript@7.0.2</code> in a project, <code>npm install</code>
failed with an <code>ERESOLVE</code> peer conflict. Fixes <a
href="https://redirect.github.com/i18next/react-i18next/issues/1927">#1927</a>,
thanks <a
href="https://github.com/andikapradanaarif"><code>@​andikapradanaarif</code></a>.</li>
<li>fix(types): <code>&lt;Trans t={t} ns=&quot;ns&quot; …&gt;</code>
with a <code>t</code> from <code>useTranslation(['ns'])</code> now
typechecks under TypeScript 7. TS7 intersects the <code>Ns</code>
inference candidates coming from the <code>t</code> prop (<code>readonly
['ns']</code>) and the <code>ns</code> prop (<code>'ns'</code>) into an
unsatisfiable <code>'ns' &amp; readonly ['ns']</code>, where TS6
resolved them. The <code>ns</code> prop on <code>TransProps</code>,
<code>TransSelectorProps</code> and
<code>IcuTransWithoutContextProps</code> now also accepts a single
namespace out of an array-typed <code>Ns</code> (<code>Ns | (Ns extends
readonly (infer S extends string)[] ? S : never)</code>) — which matches
runtime behavior and is unchanged under TS5/TS6.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/react-i18next/commit/8b4a9ea139b73309471737e5ba9c423f82d5c0cc"><code>8b4a9ea</code></a>
17.0.9</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/422bab13d4c9664e51c0c1025df2da37c0912075"><code>422bab1</code></a>
fix: support typescript 7 — widen peer range and fix Trans ns inference
under...</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/6e18aa95b5ff9257b477301283819697f249ea25"><code>6e18aa9</code></a>
README: mention npx i18next-cli localize as the zero-to-localized
path</li>
<li>See full diff in <a
href="https://github.com/i18next/react-i18next/compare/v17.0.8...v17.0.9">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-i18next&package-manager=npm_and_yarn&previous-version=17.0.8&new-version=17.0.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 10:06:00 -07:00
dependabot[bot] 072f1e9b8e build(deps): bump dompurify from 3.4.8 to 3.4.12 (#9478) 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.8 to
3.4.12.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cure53/DOMPurify/releases">dompurify's
releases</a>.</em></p>
<blockquote>
<h2>DOMPurify 3.4.12</h2>
<ul>
<li>Fixed an issue where a hook would not get called for custom
elements, thanks <a
href="https://github.com/Rikuxx0"><code>@​Rikuxx0</code></a></li>
<li>Hardened the handling of hooks removing elements, <a
href="https://github.com/mkrause-bee360"><code>@​mkrause-bee360</code></a></li>
<li>Added support for a few new SVG attributes, thanks <a
href="https://github.com/cbn-falias"><code>@​cbn-falias</code></a> &amp;
<a
href="https://github.com/Develop-KIM"><code>@​Develop-KIM</code></a></li>
<li>Hardened the handling of declarative partial updates</li>
<li>Updated the documentation is several spots, README, wiki, etc.</li>
<li>Bumped several dependencies where possible</li>
</ul>
<h2>DOMPurify 3.4.11</h2>
<ul>
<li>Fixed an issue with a leaky config for hooks via
<code>setConfig</code>, thanks <a
href="https://github.com/trace37labs"><code>@​trace37labs</code></a></li>
<li>Bumped vulnerable development dependencies to arrive at plain 0 with
<code>npm audit</code></li>
<li>Updated the <code>osv-scanner</code> suppression list as no
vulnerable dependencies are left for now</li>
<li>Updated up the linting tool-chain and removed now-redundant lint
directives</li>
<li>Updated the documentation is several spots, README, wiki, etc.</li>
<li>Bumped several dependencies where possible</li>
</ul>
<h2>DOMPurify 3.4.10</h2>
<ul>
<li>Refactored codebase for clarity: extracted the public type
declarations into <code>types.ts</code></li>
<li>Decomposed the three largest sanitizer functions into focused
helpers</li>
<li>Removed duplicated defaults and dead branches, consolidated
<code>SAFE_FOR_TEMPLATES</code> scrubbing into single shared path</li>
<li>Improved per-node performance by hoisting the mXSS probe regexes and
testing <code>textContent</code> before <code>innerHTML</code></li>
<li>Added a deterministic micro-benchmark harness (<code>npm run
bench</code>) with a <code>--compare</code> mode</li>
<li>Reduced CI cost by running the full three-engine browser suite once
per PR</li>
<li>Refreshed the <code>demos/</code> folder so every demo runs again,
and added a SVG-via-<code>&lt;img&gt;</code> demo</li>
<li>Documented the bench and <code>test:happydom</code> scripts in the
README</li>
<li>Completed the Attack Classes &amp; Bypass History wiki page</li>
<li>Bumped several dependencies where possible</li>
</ul>
<h2>DOMPurify 3.4.9</h2>
<ul>
<li>Further improved the handling of Trusted Types config options,
thanks <a
href="https://github.com/offset"><code>@​offset</code></a></li>
<li>Further improved the handling of <code>IN_PLACE</code> sanitization,
thanks <a
href="https://github.com/mozfreddyb"><code>@​mozfreddyb</code></a></li>
<li>Added more test coverage for <code>IN_PLACE</code> and Trusted Types
related usage</li>
<li>Bumped several dependencies where possible</li>
<li>Updated README and wiki with more accurate documentation &amp;
attack samples</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197"><code>a9ca1e5</code></a>
release: 3.4.12 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1537">#1537</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/0cae5187403132f96a6d357649e4b15633fc210a"><code>0cae518</code></a>
release: 3.4.11 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1494">#1494</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/6ee5716f8336989753611beeca364957c0eb0c3e"><code>6ee5716</code></a>
release: 3.4.10 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1478">#1478</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/52102472d46035857c52df19e44285f8a1e102fc"><code>5210247</code></a>
release: 3.4.9 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1459">#1459</a>)</li>
<li>See full diff in <a
href="https://github.com/cure53/DOMPurify/compare/3.4.8...3.4.12">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dompurify&package-manager=npm_and_yarn&previous-version=3.4.8&new-version=3.4.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 10:03:46 -07:00
dependabot[bot] ff09d8c1d8 build(deps): bump lexical from 0.46.0 to 0.47.0 (#9486) 
Bumps
[lexical](https://github.com/facebook/lexical/tree/HEAD/packages/lexical)
from 0.46.0 to 0.47.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/lexical/releases">lexical's
releases</a>.</em></p>
<blockquote>
<p>v0.47.0 is a monthly release with a lot of bug fixes, particularly
related to IME and composition, and is headlined by two new experimental
packages:</p>
<ul>
<li><a
href="https://lexical.dev/docs/api/modules/lexical_mdast"><code>@lexical/mdast</code></a>
(<a
href="https://redirect.github.com/facebook/lexical/pull/8794">#8794</a>)
— a <a href="https://github.com/micromark/micromark">micromark</a>/<a
href="https://github.com/syntax-tree/mdast">mdast</a>-based alternative
to <code>@lexical/markdown</code>. Parsing, serialization, and markdown
shortcuts all go through the same parser used by <code>remark</code>, so
CommonMark + GFM compliance comes for free and there is no second
grammar to keep in sync. The original syntax of each construct is
preserved on the nodes, so re-serializing produces minimally different
Markdown. <code>@lexical/markdown</code> remains the supported default
for production apps. See the new <a
href="https://lexical.dev/docs/serialization/markdown-mdast">Markdown
with <code>@lexical/mdast</code> guide</a>.</li>
<li><a
href="https://lexical.dev/docs/api/modules/lexical_a11y"><code>@lexical/a11y</code></a>
(<a
href="https://redirect.github.com/facebook/lexical/pull/8591">#8591</a>)
— framework-agnostic accessibility helpers (ARIA live regions, focus
management, roving tab index, focus trap) usable from React, Svelte,
Vue, Solid, or vanilla DOM, with React wrappers shipping from
<code>@lexical/react</code>. The playground adopts them as part of a
WCAG AA reference pass, and the keyboard contracts Lexical follows are
documented in the new <a
href="https://lexical.dev/docs/concepts/keyboard-accessibility">Keyboard
Accessibility guide</a>.</li>
</ul>
<p>Beyond the headliners: React 18 is now the baseline (see Breaking
Changes), the playground gains Find and Replace and a Ruby annotation
node with a floating editor, tables learn to spread pasted TSV across
cells and get row/column header utilities, and there is a long list of
IME/composition, selection, and navigation fixes.</p>
<p>Special recognition once again goes to <a
href="https://github.com/mayrang"><code>@​mayrang</code></a> who has
been plowing through IME, accessibility, and other input related issues
as well as the really cool new Find and Replace and Ruby Annotations
playground features.</p>
<h2>Breaking Changes</h2>
<h3><code>@lexical/react</code> / <code>@lexical/devtools-core</code> —
React 17 support dropped (<a
href="https://redirect.github.com/facebook/lexical/pull/8782">#8782</a>)</h3>
<p>React 18 is now the minimum supported version; the <code>react</code>
/ <code>react-dom</code> peerDependencies require <code>&gt;=18</code>,
and React 17 compatibility code paths were removed. If you are already
on React 18 or 19, no changes are required.</p>
<h3><code>lexical</code> — DOM element preserved when composing on a
segmented TextNode (<a
href="https://redirect.github.com/facebook/lexical/pull/8784">#8784</a>)</h3>
<p>Starting IME composition in the middle of a segmented
<code>TextNode</code> (e.g. a mention) previously replaced the node —
destroying its DOM element and breaking the browser's composition
tracking (caret flashing and styling bleed on Chrome). The node now
temporarily switches to <code>normal</code> mode for the duration of
composition, keeping the same node key and DOM element, and is cleaned
up when composition ends. Subclass transforms or method overrides that
assume a segmented node is always in segmented mode must account for
this transient state — see the updated <a
href="https://lexical.dev/docs/api/classes/lexical.TextNode#setmode"><code>TextNode.setMode()</code>
documentation</a>.</p>
<h2>New APIs</h2>
<ul>
<li><a
href="https://lexical.dev/docs/api/modules/lexical"><code>lexical</code></a>
— <code>$getDocument()</code> returns the owner document of the active
editor (correct inside a <a
href="https://lexical.dev/docs/concepts/shadow-dom">Shadow DOM or
iframe</a>), falling back to the global document when there is no active
editor; a new <code>@lexical/eslint-plugin</code> rule enforces its use
over the <code>document</code> global (<a
href="https://redirect.github.com/facebook/lexical/pull/8788">#8788</a>,
<a
href="https://redirect.github.com/facebook/lexical/pull/8813">#8813</a>)</li>
<li><a
href="https://lexical.dev/docs/api/modules/lexical"><code>lexical</code></a>
— <code>registerEventListener</code> /
<code>registerEventListeners</code>, type-safe
<code>addEventListener</code> helpers that return cleanup functions, now
used throughout the codebase — see the updated <a
href="https://lexical.dev/docs/concepts/dom-events">Working with DOM
Events guide</a> (<a
href="https://redirect.github.com/facebook/lexical/pull/8767">#8767</a>)</li>
<li><a
href="https://lexical.dev/docs/api/modules/lexical"><code>lexical</code></a>
— <code>SET_TEXT_FORMAT_COMMAND</code> sets (rather than toggles) the
selection's text format (see <a
href="https://lexical.dev/docs/concepts/commands">Commands</a>); the
same PR fixes <code>formatText</code> toggle direction (<a
href="https://redirect.github.com/facebook/lexical/pull/8807">#8807</a>)</li>
<li><a
href="https://lexical.dev/docs/api/modules/lexical_markdown"><code>@lexical/markdown</code></a>
— <code>$generateNodesFromMarkdownString</code> parses a markdown string
into Lexical nodes without inserting them into the document or modifying
the selection (<a
href="https://redirect.github.com/facebook/lexical/pull/8789">#8789</a>)</li>
<li><a
href="https://lexical.dev/docs/api/modules/lexical_table"><code>@lexical/table</code></a>
— <code>$setTableRowIsHeader</code> and
<code>$setTableColumnIsHeader</code> utilities (<a
href="https://redirect.github.com/facebook/lexical/pull/8815">#8815</a>);
<code>$insertTableRowAtNode</code> and
<code>$insertTableColumnAtNode</code> are now exported (<a
href="https://redirect.github.com/facebook/lexical/pull/8791">#8791</a>)</li>
</ul>
<h2>Notable Fixes</h2>
<p><strong>IME, composition &amp; mobile</strong></p>
<ul>
<li>Prevent text duplication on iOS Safari when formatting during
composition (<a
href="https://redirect.github.com/facebook/lexical/pull/8755">#8755</a>)</li>
<li>Skip ZWSP insertion for format mismatch on Android Chrome (<a
href="https://redirect.github.com/facebook/lexical/pull/8769">#8769</a>);
deduplicate speech-to-text insertion on Android Chrome (<a
href="https://redirect.github.com/facebook/lexical/pull/8759">#8759</a>)</li>
<li>Event module globals moved into per-editor <code>InputState</code>
(<a
href="https://redirect.github.com/facebook/lexical/pull/8809">#8809</a>);
refactored IME composition test infrastructure with browser-level
coverage (<a
href="https://redirect.github.com/facebook/lexical/pull/8793">#8793</a>)</li>
</ul>
<p><strong>Selection &amp; navigation</strong></p>
<ul>
<li>ArrowUp/Down no longer skip block decorators (<a
href="https://redirect.github.com/facebook/lexical/pull/8775">#8775</a>);
<code>deleteLine</code> no longer removes adjacent block decorators (<a
href="https://redirect.github.com/facebook/lexical/pull/8744">#8744</a>)</li>
<li>Keep selection inside single-child inline elements (<a
href="https://redirect.github.com/facebook/lexical/pull/8772">#8772</a>);
fix navigation across unmergeable TextNode boundaries in inline-grid
containers (<a
href="https://redirect.github.com/facebook/lexical/pull/8797">#8797</a>)</li>
<li><code>$setBlocksType</code> properly handles block-end focus in
backward selections (<a
href="https://redirect.github.com/facebook/lexical/pull/8753">#8753</a>);
<code>insertNodes</code> re-resolves a detached firstBlock (<a
href="https://redirect.github.com/facebook/lexical/pull/8764">#8764</a>)</li>
<li>Place the block cursor between decorators and shadow roots (<a
href="https://redirect.github.com/facebook/lexical/pull/8758">#8758</a>);
clean up the trailing shadow root after select-all delete (<a
href="https://redirect.github.com/facebook/lexical/pull/8751">#8751</a>)</li>
<li><code>deleteCharacter</code> no longer overwrites the X11 PRIMARY
selection via <code>Selection.modify</code> (<a
href="https://redirect.github.com/facebook/lexical/pull/8774">#8774</a>)</li>
<li>Defer <code>onUpdate</code> callbacks during nested commits (<a
href="https://redirect.github.com/facebook/lexical/pull/8672">#8672</a>)</li>
</ul>
<p><strong>Markdown, code &amp; tables</strong></p>
<ul>
<li>Fence-like lines inside a code block stay content (<a
href="https://redirect.github.com/facebook/lexical/pull/8734">#8734</a>);
prevent formatting on <code>TabNode</code> inside code blocks (<a
href="https://redirect.github.com/facebook/lexical/pull/8752">#8752</a>)</li>
<li>Pasted TSV text spreads across table cells (<a
href="https://redirect.github.com/facebook/lexical/pull/8780">#8780</a>)</li>
</ul>
<p><strong>Playground &amp; website</strong></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/lexical/blob/main/CHANGELOG.md">lexical's
changelog</a>.</em></p>
<blockquote>
<h2>v0.47.0 (2026-07-10)</h2>
<ul>
<li>lexicallexical-rich-text Bug Fix Fix formatText toggle direction and
add SETTEXTFORMATCOMMAND (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8807">#8807</a>)
mayrang</li>
<li>scripts Bug Fix Let npm prompt for OTP when publishing bootstrap
stubs (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8820">#8820</a>)
Bob Ippolito</li>
<li>lexical-playground Bug Fix Clear inline font-size when converting to
heading (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8800">#8800</a>)
mayrang</li>
<li>lexical-tablelexical-playground Feature setTableRowIsHeader and
setTableColumnIsHeader utilities (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8815">#8815</a>)
mayrang</li>
<li>lexical-website Documentation Update Rewrite testing guide (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8811">#8811</a>)
mayrang</li>
<li>lexical-mdastlexical-rich-text Feature lexicalmdast, a
micromarkmdast-based alternative to lexicalmarkdown (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8794">#8794</a>)
Bob Ippolito</li>
<li>Make dependency-check resilient to transient registry errors (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8818">#8818</a>)
Gerard Rovira</li>
<li>lexical Refactor Move event module globals into per-editor
InputState (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8809">#8809</a>)
mayrang</li>
<li>lexical Bug Fix getDocument() should fall back to the global
document when there is no active editor (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8813">#8813</a>)
Sherry</li>
<li>lexical-playground Bug Fix Keep cell background color modal open on
first click (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8806">#8806</a>)
sahir</li>
<li>lexical-playground Bug Fix Use consistent default maxWidth for
markdown-imported images (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8810">#8810</a>)
mayrang</li>
<li>lexical-devtoolslexical-playground Chore Update flow, hermes, and
babel packages to latest (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8795">#8795</a>)
Bob Ippolito</li>
<li>Add a 7-day pnpm minimumReleaseAge to match the Dependabot cooldown
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8808">#8808</a>)
Gerard Rovira</li>
<li>lexical Chore Fix tmp package dependency vulnerability (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8802">#8802</a>)
vijay ojha</li>
<li>lexical Chore Add missing Flow type declarations (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8799">#8799</a>)
mayrang</li>
<li>lexical-markdown Feature Add generateNodesFromMarkdownString (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8789">#8789</a>)
mayrang</li>
<li>lexicallexical-playground Chore Refactor IME composition test
infrastructure and add browser-level coverage (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8793">#8793</a>)
mayrang</li>
<li>lexical-playground Bug Fix Use viewBox dimensions for unsized
Excalidraw output (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8798">#8798</a>)
mayrang</li>
<li>lexical-table Bug Fix Export insertTableRowAtNode and
insertTableColumnAtNode (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8791">#8791</a>)</li>
<li>lexical-playgroundlexical-website Feature Add Vercel Analytics and
Speed Insights (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8796">#8796</a>)
Gerard Rovira</li>
<li>lexicallexical-eslint-plugin Feature Add getDocument() API and
Shadow DOM lint enforcement (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8788">#8788</a>)
mayrang</li>
<li>scripts Bug Fix strip misplaced pure annotations from prod builds
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8786">#8786</a>)
Bob Ippolito</li>
<li>lexical Bug Fix deleteCharacter overwrites X11 PRIMARY selection via
Selection.modify (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8774">#8774</a>)
Bob Ippolito</li>
<li>lexical-playground Bug Fix Support Unicode URLs in autolink matcher
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8787">#8787</a>)
mayrang</li>
<li>lexical-table Feature Spread pasted TSV text across table cells (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8780">#8780</a>)
mayrang</li>
<li>Breaking Changelexical Bug Fix Preserve DOM element when composing
on segmented TextNode middle (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8784">#8784</a>)
mayrang</li>
<li>Breaking Changelexical-reactlexical-devtools-core Chore Drop React
17 support, baseline is now React 18 (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8782">#8782</a>)
Bob Ippolito</li>
<li>lexical-playgroundlexical Feature Ruby annotation node with floating
editor (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8741">#8741</a>)
mayrang</li>
<li>lexical-playground Feature Find and Replace (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8779">#8779</a>)
mayrang</li>
<li>lexical-playground Bug Fix restore RTL checkbox position in
checklist (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8783">#8783</a>)
Aldo Ryanda</li>
<li>lexical-rich-text Bug Fix Stop ArrowUpDown from skipping block
decorators (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8775">#8775</a>)
mayrang</li>
<li>lexical-playground Bug Fix Convert remaining icon glyphs to
mask-image for forced-colors support (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8781">#8781</a>)
mayrang</li>
<li>fix(lexical) use extends for type parameter bound in
registerEventListeners flow type (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8778">#8778</a>)
Sherry</li>
<li>lexical Bug Fix Keep selection inside single-child inline elements
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8772">#8772</a>)
mayrang</li>
<li>lexical Feature registerEventListener registerEventListeners DOM
helpers (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8767">#8767</a>)
Bob Ippolito</li>
<li>lexical-playground Bug Fix Restore floating toolbar comment icon
after mask-image conversion (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8773">#8773</a>)
mayrang</li>
<li>lexical Bug Fix Skip ZWSP insertion for format mismatch on Android
Chrome (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8769">#8769</a>)
mayrang</li>
<li>lexical-a11ylexical-reactlexical-playgroundlexical-website Feature
lexicala11y framework-agnostic accessibility helpers WCAG AA reference
adoption (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8591">#8591</a>)
mayrang</li>
<li>Add missing copyright headers to 4 source files (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8768">#8768</a>)
xiezhenjia-meta</li>
<li>lexical-website Bug Fix Remove horizontal scroll on homepage hero
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8760">#8760</a>)
Bakhtiyar</li>
<li>lexical-selection Bug Fix re-resolve detached firstBlock in insert
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8764">#8764</a>)
Olivier Chevallier</li>
<li>lexical Modernize InlineFormattableNode Flow stub syntax rejected by
fb-www flow strict (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8763">#8763</a>)
Sherry</li>
<li>lexical-utils Bug Fix positionNodeOnRange leaking orphan rect nodes
when rects shrink (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8762">#8762</a>)
Durvesh Pilankar</li>
<li>docs fix duplicated words in comments and docs (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8761">#8761</a>)
Durvesh Pilankar</li>
<li>lexical-selection Bug Fix Properly handle block end focus in
backward selections during setBlocksType (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8753">#8753</a>)
Olivier Chevallier</li>
<li>lexicallexical-extension Bug Fix Align DecoratorTextNode format with
TextNode in mixed selections (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8737">#8737</a>)
sahir</li>
<li>lexical Bug Fix Clean up trailing shadow root after select-all
delete (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8751">#8751</a>)
mayrang</li>
<li>lexicallexical-rich-text Bug Fix Place block cursor between
decorators and shadow roots (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8758">#8758</a>)
mayrang</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/facebook/lexical/commit/77ccc19b1e65dbd8a7a2e1c6f5628ee84551b0ef"><code>77ccc19</code></a>
v0.47.0</li>
<li><a
href="https://github.com/facebook/lexical/commit/18a0abf202786afc4dc23ef8aa8494f74e359422"><code>18a0abf</code></a>
[lexical][lexical-rich-text][lexical-selection] Bug Fix: Fix navigation
acros...</li>
<li><a
href="https://github.com/facebook/lexical/commit/02d2562c99028cf2c0494c8f1c7301bed0e1c558"><code>02d2562</code></a>
[lexical][lexical-rich-text] Bug Fix: Fix formatText toggle direction
and add...</li>
<li><a
href="https://github.com/facebook/lexical/commit/932aa67ec95dd86384d2e7e5ed80544e06f60e0f"><code>932aa67</code></a>
[lexical] Refactor: Move event module globals into per-editor InputState
(<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8809">#8809</a>)</li>
<li><a
href="https://github.com/facebook/lexical/commit/b00510c74a98fbc46dea13ef42afff2218ad7ea9"><code>b00510c</code></a>
[lexical] Bug Fix: $getDocument() should fall back to the global
document whe...</li>
<li><a
href="https://github.com/facebook/lexical/commit/a7666ab11f5e8c674a3f5ca8a83d2e92f1b171d0"><code>a7666ab</code></a>
[*][lexical-devtools][lexical-playground] Chore: Update flow, hermes,
and bab...</li>
<li><a
href="https://github.com/facebook/lexical/commit/c07e832ab8dfee640e5348335f7210a1edac5917"><code>c07e832</code></a>
[lexical] Chore: Add missing Flow type declarations (<a
href="https://github.com/facebook/lexical/tree/HEAD/packages/lexical/issues/8799">#8799</a>)</li>
<li><a
href="https://github.com/facebook/lexical/commit/38051a7498461da265a9b670ef1f3585319d4543"><code>38051a7</code></a>
[lexical][lexical-playground] Chore: Refactor IME composition test
infrastruc...</li>
<li><a
href="https://github.com/facebook/lexical/commit/e649ab28b7e2dd58c1b4798c446e611f54356518"><code>e649ab2</code></a>
[lexical][lexical-eslint-plugin] Feature: Add $getDocument() API and
Shadow D...</li>
<li><a
href="https://github.com/facebook/lexical/commit/69abb09cec921e73512d17d6a53bb5e2064d7b72"><code>69abb09</code></a>
[lexical] Bug Fix: deleteCharacter overwrites X11 PRIMARY selection via
Selec...</li>
<li>Additional commits viewable in <a
href="https://github.com/facebook/lexical/commits/v0.47.0/packages/lexical">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lexical&package-manager=npm_and_yarn&previous-version=0.46.0&new-version=0.47.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 10:02:57 -07:00
dependabot[bot] 753544d704 build(deps): bump @clack/prompts from 0.10.1 to 0.11.0 (#9485) 
Bumps
[@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts)
from 0.10.1 to 0.11.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bombshell-dev/clack/releases">@​clack/prompts's
releases</a>.</em></p>
<blockquote>
<h2><code>@​clack/prompts</code><a
href="https://github.com/0"><code>@​0</code></a>.11.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>07ca32d: Reverted a change where placeholders were being set as
values on return.</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [07ca32d]
<ul>
<li><code>@​clack/core</code><a
href="https://github.com/0"><code>@​0</code></a>.5.0</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bombshell-dev/clack/blob/@clack/prompts@0.11.0/packages/prompts/CHANGELOG.md">@​clack/prompts's
changelog</a>.</em></p>
<blockquote>
<h2>0.11.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>07ca32d: Reverted a change where placeholders were being set as
values on return.</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [07ca32d]
<ul>
<li><code>@​clack/core</code><a
href="https://github.com/0"><code>@​0</code></a>.5.0</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bombshell-dev/clack/commit/737f1725696b595c791e73ca51ee0ac4bf0ee289"><code>737f172</code></a>
[ci] release (<a
href="https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts/issues/325">#325</a>)</li>
<li><a
href="https://github.com/bombshell-dev/clack/commit/07ca32dcfca0ab8dc8c42c25117b4109f381621f"><code>07ca32d</code></a>
fix: revert placeholder-on-return change (<a
href="https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts/issues/324">#324</a>)</li>
<li>See full diff in <a
href="https://github.com/bombshell-dev/clack/commits/@clack/prompts@0.11.0/packages/prompts">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@clack/prompts&package-manager=npm_and_yarn&previous-version=0.10.1&new-version=0.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 10:02:53 -07:00
dependabot[bot] f92a6648d5 build(deps): bump better-auth from 1.6.20 to 1.6.23 (#9479) 
Bumps
[better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth)
from 1.6.20 to 1.6.23.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/better-auth/better-auth/releases">better-auth's
releases</a>.</em></p>
<blockquote>
<h2>v1.6.23</h2>
<h2><code>better-auth</code></h2>
<h3>Features</h3>
<ul>
<li>Added Yandex as a social OAuth provider (<a
href="https://redirect.github.com/better-auth/better-auth/pull/9138">#9138</a>)</li>
</ul>
<p>For detailed changes, see <a
href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>@better-auth/drizzle-adapter</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed affected row counting for D1 and postgres-js adapters (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10257">#10257</a>)</li>
</ul>
<p>For detailed changes, see <a
href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/drizzle-adapter/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>@better-auth/stripe</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed organization subscription actions (cancel, upgrade, restore,
and the billing portal) that could act on the wrong organization.</li>
</ul>
<p>For detailed changes, see <a
href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/stripe/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2><code>auth</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed string default values not being properly escaped in the
generated Drizzle schema (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10259">#10259</a>)</li>
</ul>
<p>For detailed changes, see <a
href="https://github.com/better-auth/better-auth/blob/9dfceee14021fc15a2fb93023f39635f25b0b5ba/packages/cli/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<h2>Contributors</h2>
<p>Thanks to everyone who contributed to this release:</p>
<p><a href="https://github.com/bytaesu"><code>@​bytaesu</code></a>, <a
href="https://github.com/vladflotsky"><code>@​vladflotsky</code></a></p>
<p><strong>Full changelog:</strong> <a
href="https://github.com/better-auth/better-auth/compare/v1.6.22...v1.6.23"><code>v1.6.22...v1.6.23</code></a></p>
<h2>v1.6.22</h2>
<h2><code>better-auth</code></h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fixed unproven credentials not being revoked during magic link and
email OTP sign-in (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10239">#10239</a>)</li>
<li>Fixed server-side OAuth requests to refuse redirect responses
instead of following them (<a
href="https://redirect.github.com/better-auth/better-auth/pull/10241">#10241</a>)</li>
</ul>
<p>For detailed changes, see <a
href="https://github.com/better-auth/better-auth/blob/a90d061de7cdbd60e796230aadf5d1082add1fe2/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's
changelog</a>.</em></p>
<blockquote>
<h2>1.6.23</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9138">#9138</a>
<a
href="https://github.com/better-auth/better-auth/commit/8581f97ea0000e03edd6aa7911efabf694a9ff95"><code>8581f97</code></a>
Thanks <a
href="https://github.com/vladflotsky"><code>@​vladflotsky</code></a>! -
Add a pre-configured Yandex provider helper for the generic OAuth
plugin.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/better-auth/better-auth/commit/930b260cfd402e9f8886719a3ced503b9ceff7f6"><code>930b260</code></a>]:</p>
<ul>
<li><code>@​better-auth/drizzle-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.23</li>
<li><code>@​better-auth/core</code><a
href="https://github.com/1"><code>@​1</code></a>.6.23</li>
<li><code>@​better-auth/kysely-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.23</li>
<li><code>@​better-auth/memory-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.23</li>
<li><code>@​better-auth/mongo-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.23</li>
<li><code>@​better-auth/prisma-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.23</li>
<li><code>@​better-auth/telemetry</code><a
href="https://github.com/1"><code>@​1</code></a>.6.23</li>
</ul>
</li>
</ul>
<h2>1.6.22</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10239">#10239</a>
<a
href="https://github.com/better-auth/better-auth/commit/c06a56d83a40bbaeac12d3a8b8b67e59f92a9110"><code>c06a56d</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>!
- Magic-link and email-OTP sign-in now reset the credentials on an
account whose email had never been confirmed. When verification resolves
to such an account, any existing password on it is removed and its
sessions are revoked before the user is signed in, so proven control of
the mailbox is the source of truth for the account.</p>
<p>If you signed up with email and password but first signed in through
a magic link or email OTP rather than confirming the verification email,
your password is cleared and you will need to set a new one through
password reset.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10240">#10240</a>
<a
href="https://github.com/better-auth/better-auth/commit/3a035e968e27bfdee1e53ad857e5569090d9f2d1"><code>3a035e9</code></a>
Thanks <a
href="https://github.com/gustavovalverde"><code>@​gustavovalverde</code></a>!
- Add account-level lockout for two-factor verification. The attempt
limit applies per account across sign-in challenges and across factors:
TOTP, email-OTP, and backup codes share one counter, and a successful
verification resets it.</p>
<p>Enabled by default: an account locks for 15 minutes after 10
consecutive failed verifications, and locked attempts return
<code>429</code> with the <code>ACCOUNT_TEMPORARILY_LOCKED</code> error
code. Configure it with <code>twoFactor({ accountLockout: { enabled,
maxFailedAttempts, durationSeconds } })</code>.</p>
<p>Run a database migration after upgrading: this adds
<code>failedVerificationCount</code> and <code>lockedUntil</code>
columns to the <code>twoFactor</code> table.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/better-auth/better-auth/commit/8bd43d9d8312fd9ddbfb8fb5c827cf0a0e55132d"><code>8bd43d9</code></a>]:</p>
<ul>
<li><code>@​better-auth/core</code><a
href="https://github.com/1"><code>@​1</code></a>.6.22</li>
<li><code>@​better-auth/drizzle-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.22</li>
<li><code>@​better-auth/kysely-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.22</li>
<li><code>@​better-auth/memory-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.22</li>
<li><code>@​better-auth/mongo-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.22</li>
<li><code>@​better-auth/prisma-adapter</code><a
href="https://github.com/1"><code>@​1</code></a>.6.22</li>
<li><code>@​better-auth/telemetry</code><a
href="https://github.com/1"><code>@​1</code></a>.6.22</li>
</ul>
</li>
</ul>
<h2>1.6.21</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10212">#10212</a>
<a
href="https://github.com/better-auth/better-auth/commit/e0762a127ce351a96614e60866b3455e6eddffa1"><code>e0762a1</code></a>
Thanks <a href="https://github.com/bytaesu"><code>@​bytaesu</code></a>!
- In root-mounted deployments, requests whose path does not start with
the configured <code>basePath</code> now return 404 instead of resolving
to an endpoint.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10187">#10187</a>
<a
href="https://github.com/better-auth/better-auth/commit/882cf9e592d1d305b5b78cadbb10aaeee7acd6dc"><code>882cf9e</code></a>
Thanks <a
href="https://github.com/ping-maxwell"><code>@​ping-maxwell</code></a>!
- Admin permission changes and bans now take effect immediately for
admin APIs, even when session cookie cache is enabled. Sensitive session
checks also continue to work in stateless apps where signed cookies are
the session record.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/9939">#9939</a>
<a
href="https://github.com/better-auth/better-auth/commit/f52e1ab50b60d289b64d6b06f1bff5a4358cdfd0"><code>f52e1ab</code></a>
Thanks <a
href="https://github.com/benpsnyder"><code>@​benpsnyder</code></a>! -
fixes a bug causing deviceAuthorization() throwing a ZodError at
construction when called without a schema option</p>
</li>
<li>
<p><a
href="https://redirect.github.com/better-auth/better-auth/pull/10196">#10196</a>
<a
href="https://github.com/better-auth/better-auth/commit/b5bec193a56cec2f7b71c84d71dacb632f0b96a0"><code>b5bec19</code></a>
Thanks <a
href="https://github.com/Paola3stefania"><code>@​Paola3stefania</code></a>!
- OAuth sign-up and account-link profile sync now ignore provider
profile values for user fields marked <code>input: false</code>.
Input-allowed additional fields still persist from
<code>mapProfileToUser</code>, and schema defaults still apply when
OAuth creates a user. Apps that used <code>mapProfileToUser</code> to
fill <code>input: false</code> fields should set those fields in
server-side provisioning code instead.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/better-auth/better-auth/commit/9dfceee14021fc15a2fb93023f39635f25b0b5ba"><code>9dfceee</code></a>
chore: release v1.6.23 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10260">#10260</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/8581f97ea0000e03edd6aa7911efabf694a9ff95"><code>8581f97</code></a>
feat(oauth): add Yandex social provider (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9138">#9138</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/a90d061de7cdbd60e796230aadf5d1082add1fe2"><code>a90d061</code></a>
chore: release v1.6.22 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10245">#10245</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/3a035e968e27bfdee1e53ad857e5569090d9f2d1"><code>3a035e9</code></a>
fix(two-factor): add account-level verification lockout (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10240">#10240</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/c06a56d83a40bbaeac12d3a8b8b67e59f92a9110"><code>c06a56d</code></a>
fix: revoke unproven credentials on magic-link/email-OTP sign-in (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10239">#10239</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/414169d95a88a6e1fac41688bc7011e96feb0d2a"><code>414169d</code></a>
chore: release v1.6.21 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10184">#10184</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/f52e1ab50b60d289b64d6b06f1bff5a4358cdfd0"><code>f52e1ab</code></a>
fix(device-authorization): make <code>schema</code> option optional
under Zod v4 (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/9939">#9939</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/882cf9e592d1d305b5b78cadbb10aaeee7acd6dc"><code>882cf9e</code></a>
fix(admin): use authoritative session reads for authorization (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10187">#10187</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/b5bec193a56cec2f7b71c84d71dacb632f0b96a0"><code>b5bec19</code></a>
fix(oauth): apply user input rules to provider profiles (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10196">#10196</a>)</li>
<li><a
href="https://github.com/better-auth/better-auth/commit/471f81c1ab088368de07383491535c1288fa6543"><code>471f81c</code></a>
refactor: centralize request IP resolver in core (<a
href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10216">#10216</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/better-auth/better-auth/commits/v1.6.23/packages/better-auth">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=better-auth&package-manager=npm_and_yarn&previous-version=1.6.20&new-version=1.6.23)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 10:02:48 -07:00
dependabot[bot] dcb7c323ed build(deps-dev): bump @storybook/react-vite from 10.4.6 to 10.5.0 (#9482) 
Bumps
[@storybook/react-vite](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite)
from 10.4.6 to 10.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/releases">@​storybook/react-vite's
releases</a>.</em></p>
<blockquote>
<h2>v10.5.0</h2>
<h2>10.5.0</h2>
<blockquote>
<p><em>Foundational changes for new AI workflows</em></p>
</blockquote>
<p>Storybook 10.5 contains hundreds of fixes and improvements:</p>
<ul>
<li>⚡️ Angular-vite framework: Modern, fast dev, docs, and test
(preview)</li>
<li>🌈 Vitest initialGlobals: Test across themes, viewports, locales</li>
<li>🤖 Agentic review: AI-curated visual changesets and search results
(experimental)</li>
<li>⚛️ React docgen service: Unified metadata across MCP, Docs, and
Controls (experimental)</li>
<li>🧑‍💻 Claude / Codex plugins: One-click ADE integration
(experimental)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md">@​storybook/react-vite's
changelog</a>.</em></p>
<blockquote>
<h2>10.5.0</h2>
<blockquote>
<p><em>Foundational changes for new AI workflows</em></p>
</blockquote>
<p>Storybook 10.5 contains hundreds of fixes and improvements:</p>
<ul>
<li>⚡️ Angular-vite framework: Modern, fast dev, docs, and test
(preview)</li>
<li>🌈 Vitest initialGlobals: Test across themes, viewports, locales</li>
<li>🤖 Agentic review: AI-curated visual changesets and search results
(experimental)</li>
<li>⚛️ React docgen service: Unified metadata across MCP, Docs, and
Controls (experimental)</li>
<li>🧑‍💻 Claude / Codex plugins: One-click ADE integration
(experimental)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/storybookjs/storybook/commit/9dafcd22ed55947bc4c2fa1d5066b552baa0ebf4"><code>9dafcd2</code></a>
Bump version from &quot;10.5.0-beta.2&quot; to &quot;10.5.0&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/448db85e651a09ca55f978356c4f1593f261f82a"><code>448db85</code></a>
Bump version from &quot;10.5.0-beta.1&quot; to &quot;10.5.0-beta.2&quot;
[skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/a4ce9790a783d8e7720e9de980a08576de9555db"><code>a4ce979</code></a>
Bump version from &quot;10.5.0-beta.0&quot; to &quot;10.5.0-beta.1&quot;
[skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/f0bf138a0a83443c177f4b6882d74440829de42e"><code>f0bf138</code></a>
Bump version from &quot;10.5.0-alpha.11&quot; to
&quot;10.5.0-beta.0&quot; [skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/fac05a57415eec36b0a72b383befd7ef5071572c"><code>fac05a5</code></a>
Bump version from &quot;10.5.0-alpha.10&quot; to
&quot;10.5.0-alpha.11&quot; [skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/4057c4169f1e63d746d86349fcf4463e321b546e"><code>4057c41</code></a>
Bump version from &quot;10.5.0-alpha.9&quot; to
&quot;10.5.0-alpha.10&quot; [skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/da84210b49cdbb1de724c6c5d590ae3d6945887f"><code>da84210</code></a>
Bump version from &quot;10.5.0-alpha.8&quot; to
&quot;10.5.0-alpha.9&quot; [skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/c347410b9f96f3526cf72d20a7f3762153039694"><code>c347410</code></a>
Bump version from &quot;10.5.0-alpha.7&quot; to
&quot;10.5.0-alpha.8&quot; [skip ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/d16ab3008ac721c8311f940183687cc86643a053"><code>d16ab30</code></a>
React: Align react-docgen versions</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/c9a1ac9f72fc5c03b70180a247d42691b26c6904"><code>c9a1ac9</code></a>
Bump version from &quot;10.5.0-alpha.6&quot; to
&quot;10.5.0-alpha.7&quot; [skip ci]</li>
<li>Additional commits viewable in <a
href="https://github.com/storybookjs/storybook/commits/v10.5.0/code/frameworks/react-vite">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@storybook/react-vite&package-manager=npm_and_yarn&previous-version=10.4.6&new-version=10.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 10:02:39 -07:00
dependabot[bot] 26bd07400b build(deps-dev): bump tailwindcss from 4.3.0 to 4.3.2 (#9477) 
Bumps
[tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss)
from 4.3.0 to 4.3.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/releases">tailwindcss's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.2</h2>
<h3>Fixed</h3>
<ul>
<li>Support bare spacing values for <code>auto-rows-*</code> and
<code>auto-cols-*</code> utilities (e.g. <code>auto-rows-12</code> and
<code>auto-cols-16</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20229">#20229</a>)</li>
<li>Prevent <code>@tailwindcss/cli</code> in <code>--watch</code> mode
from crashing on Windows when <code>@source</code> points to a directory
that doesn't exist (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20242">#20242</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing in Deno v2.8.x
when <code>context.parentURL</code> is not a valid URL (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20245">#20245</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
rebuilds when the input CSS file changes in an ignored directory (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20246">#20246</a>)</li>
<li>Allow <code>@variant</code> rules used in <code>addBase(…)</code> to
use custom variants defined later (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20247">#20247</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing during HMR when
scanned files or directories are deleted (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20259">#20259</a>)</li>
<li>Generate <code>font-size</code> instead of <code>color</code>
declarations for <code>text-[--spacing(…)]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20260">#20260</a>)</li>
<li>Prevent <code>@source</code> patterns from scanning unrelated
sibling files and folders (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20263">#20263</a>)</li>
<li>Extract class candidates adjacent to Template Toolkit delimiters
like <code>%]…[%</code> in <code>.tt</code>, <code>.tt2</code>, and
<code>.tx</code> files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269">#20269</a>)</li>
<li>Extract class candidates from conditional Maud syntax like
<code>p.text-black[condition]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269">#20269</a>)</li>
<li>Prevent <code>@position-try</code> rules from triggering unknown
at-rule warnings when optimizing CSS (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20277">#20277</a>)</li>
<li>Support class suggestions for named opacity modifiers from
<code>--opacity</code> theme values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20287">#20287</a>)</li>
<li>Prevent type errors in <code>@tailwindcss/postcss</code> when used
with newer PostCSS patch releases (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20289">#20289</a>)</li>
</ul>
<h2>v4.3.1</h2>
<h3>Added</h3>
<ul>
<li>Add <code>--silent</code> option to suppress output in
<code>@tailwindcss/cli</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20100">#20100</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Remove deprecation warnings by using
<code>Module#registerHooks</code> instead of
<code>Module#register</code> on Node 26+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20028">#20028</a>)</li>
<li>Canonicalization: don't crash when plugin utilities throw for
unsupported values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20052">#20052</a>)</li>
<li>Allow <code>@apply</code> to be used with CSS mixins (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19427">#19427</a>)</li>
<li>Ensure <code>not-*</code> correctly negates <code>@container</code>
queries, including <code>style(…)</code> queries (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20059">#20059</a>)</li>
<li>Ensure <code>drop-shadow-*</code> color utilities work with custom
shadow values containing <code>calc(…)</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20080">#20080</a>)</li>
<li>Fix 'Sourcemap is likely to be incorrect' warnings when using
<code>@tailwindcss/vite</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20103">#20103</a>)</li>
<li>Ensure <code>@tailwindcss/webpack</code> can be installed in Rspack
projects without requiring <code>webpack</code> as a peer dependency (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20027">#20027</a>)</li>
<li>Canonicalization: don't suggest invalid <code>calc(…)</code>
expressions (e.g. <code>px-[calc(1rem+0px)]</code> →
<code>px-[calc(1rem+0)]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20127">#20127</a>)</li>
<li>Canonicalization: avoid suggesting large spacing-scale values for
arbitrary lengths (e.g. <code>left-[99999px]</code> →
<code>left-[99999px]</code>, not <code>left-24999.75</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20130">#20130</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
recovers when a tracked dependency is deleted and restored (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20137">#20137</a>)</li>
<li>Ensure standalone <code>@tailwindcss/cli</code> binaries are ignored
when scanning for class candidates (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20139">#20139</a>)</li>
<li>Ensure class candidates are extracted from Twig
<code>addClass(…)</code> and <code>removeClass(…)</code> calls (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20198">#20198</a>)</li>
<li>Don't crash in the Ruby or Vue preprocessors when scanning files
containing invalid UTF-8 bytes (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19588">#19588</a>)</li>
<li>Allow <code>@variant</code> to be used inside <code>addBase</code>
(<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19480">#19480</a>)</li>
<li>Ensure <code>@source</code> globs with symlinks are preserved (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203">#20203</a>)</li>
<li>Ensure later <code>@source</code> rules can re-include files
excluded by earlier <code>@source not</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203">#20203</a>)</li>
<li>Upgrade: don't migrate empty class rules to invalid
<code>@utility</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20205">#20205</a>)</li>
<li>Ensure transitions between <code>inset-shadow-none</code> and other
inset shadows work correctly (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20208">#20208</a>)</li>
<li>Ensure explicitly referenced <code>@source</code> directories are
scanned even when ignored by git (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20214">#20214</a>)</li>
<li>Ensure <code>@source</code> globs ending in <code>**/*</code>
preserve dynamic path segments to avoid scanning too many files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20217">#20217</a>)</li>
<li>Canonicalization: don't fold <code>calc(…)</code> divisions when the
result would require high precision (e.g.
<code>w-[calc(100%/3.5)]</code> → <code>w-[calc(100%/3.5)]</code>, not
<code>w-[28.571428571428573%]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20221">#20221</a>)</li>
<li>Serve ESM type declarations to ESM importers of
<code>@tailwindcss/postcss</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20228">#20228</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Generate <code>0</code> instead of <code>calc(var(--spacing) *
0)</code> for spacing utilities like <code>m-0</code> and
<code>left-0</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20196">#20196</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md">tailwindcss's
changelog</a>.</em></p>
<blockquote>
<h2>[4.3.2] - 2026-06-26</h2>
<h3>Fixed</h3>
<ul>
<li>Support bare spacing values for <code>auto-rows-*</code> and
<code>auto-cols-*</code> utilities (e.g. <code>auto-rows-12</code> and
<code>auto-cols-16</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20229">#20229</a>)</li>
<li>Prevent <code>@tailwindcss/cli</code> in <code>--watch</code> mode
from crashing on Windows when <code>@source</code> points to a directory
that doesn't exist (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20242">#20242</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing in Deno v2.8.x
when <code>context.parentURL</code> is not a valid URL (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20245">#20245</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
rebuilds when the input CSS file changes in an ignored directory (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20246">#20246</a>)</li>
<li>Allow <code>@variant</code> rules used in <code>addBase(…)</code> to
use custom variants defined later (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20247">#20247</a>)</li>
<li>Prevent <code>@tailwindcss/vite</code> from crashing during HMR when
scanned files or directories are deleted (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20259">#20259</a>)</li>
<li>Generate <code>font-size</code> instead of <code>color</code>
declarations for <code>text-[--spacing(…)]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20260">#20260</a>)</li>
<li>Prevent <code>@source</code> patterns from scanning unrelated
sibling files and folders (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20263">#20263</a>)</li>
<li>Extract class candidates adjacent to Template Toolkit delimiters
like <code>%]…[%</code> in <code>.tt</code>, <code>.tt2</code>, and
<code>.tx</code> files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269">#20269</a>)</li>
<li>Extract class candidates from conditional Maud syntax like
<code>p.text-black[condition]</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20269">#20269</a>)</li>
<li>Prevent <code>@position-try</code> rules from triggering unknown
at-rule warnings when optimizing CSS (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20277">#20277</a>)</li>
<li>Support class suggestions for named opacity modifiers from
<code>--opacity</code> theme values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20287">#20287</a>)</li>
<li>Prevent type errors in <code>@tailwindcss/postcss</code> when used
with newer PostCSS patch releases (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20289">#20289</a>)</li>
</ul>
<h2>[4.3.1] - 2026-06-12</h2>
<h3>Added</h3>
<ul>
<li>Add <code>--silent</code> option to suppress output in
<code>@tailwindcss/cli</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20100">#20100</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Remove deprecation warnings by using
<code>Module#registerHooks</code> instead of
<code>Module#register</code> on Node 26+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20028">#20028</a>)</li>
<li>Canonicalization: don't crash when plugin utilities throw for
unsupported values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20052">#20052</a>)</li>
<li>Allow <code>@apply</code> to be used with CSS mixins (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19427">#19427</a>)</li>
<li>Ensure <code>not-*</code> correctly negates <code>@container</code>
queries, including <code>style(…)</code> queries (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20059">#20059</a>)</li>
<li>Ensure <code>drop-shadow-*</code> color utilities work with custom
shadow values containing <code>calc(…)</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20080">#20080</a>)</li>
<li>Fix 'Sourcemap is likely to be incorrect' warnings when using
<code>@tailwindcss/vite</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20103">#20103</a>)</li>
<li>Ensure <code>@tailwindcss/webpack</code> can be installed in Rspack
projects without requiring <code>webpack</code> as a peer dependency (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20027">#20027</a>)</li>
<li>Canonicalization: don't suggest invalid <code>calc(…)</code>
expressions (e.g. <code>px-[calc(1rem+0px)]</code> →
<code>px-[calc(1rem+0)]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20127">#20127</a>)</li>
<li>Canonicalization: avoid suggesting large spacing-scale values for
arbitrary lengths (e.g. <code>left-[99999px]</code> →
<code>left-[99999px]</code>, not <code>left-24999.75</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20130">#20130</a>)</li>
<li>Ensure <code>@tailwindcss/cli</code> in <code>--watch</code> mode
recovers when a tracked dependency is deleted and restored (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20137">#20137</a>)</li>
<li>Ensure standalone <code>@tailwindcss/cli</code> binaries are ignored
when scanning for class candidates (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20139">#20139</a>)</li>
<li>Ensure class candidates are extracted from Twig
<code>addClass(…)</code> and <code>removeClass(…)</code> calls (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20198">#20198</a>)</li>
<li>Don't crash in the Ruby or Vue preprocessors when scanning files
containing invalid UTF-8 bytes (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19588">#19588</a>)</li>
<li>Allow <code>@variant</code> to be used inside <code>addBase</code>
(<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19480">#19480</a>)</li>
<li>Ensure <code>@source</code> globs with symlinks are preserved (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203">#20203</a>)</li>
<li>Ensure later <code>@source</code> rules can re-include files
excluded by earlier <code>@source not</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20203">#20203</a>)</li>
<li>Upgrade: don't migrate empty class rules to invalid
<code>@utility</code> rules (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20205">#20205</a>)</li>
<li>Ensure transitions between <code>inset-shadow-none</code> and other
inset shadows work correctly (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20208">#20208</a>)</li>
<li>Ensure explicitly referenced <code>@source</code> directories are
scanned even when ignored by git (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20214">#20214</a>)</li>
<li>Ensure <code>@source</code> globs ending in <code>**/*</code>
preserve dynamic path segments to avoid scanning too many files (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20217">#20217</a>)</li>
<li>Canonicalization: don't fold <code>calc(…)</code> divisions when the
result would require high precision (e.g.
<code>w-[calc(100%/3.5)]</code> → <code>w-[calc(100%/3.5)]</code>, not
<code>w-[28.571428571428573%]</code>) (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20221">#20221</a>)</li>
<li>Serve ESM type declarations to ESM importers of
<code>@tailwindcss/postcss</code> (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20228">#20228</a>)</li>
</ul>
<h3>Changed</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/056a1550721d4bf79ff732d5ab9414fa83f7064f"><code>056a155</code></a>
4.3.2 (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20281">#20281</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/c8b081d96376871acb0157923e894b7a929cad5b"><code>c8b081d</code></a>
Add suggestions for named opacity modifiers (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20287">#20287</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/c46f654fa0039ad4741c6ecefbe4e2a208a665c3"><code>c46f654</code></a>
Ensure <code>--alpha(…)</code> is seen as a <code>color</code>, and
<code>--spacing(…)</code> is seen as a `le...</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/5e9f66e4284164c62e80d74e69e0cbd8d9c645cc"><code>5e9f66e</code></a>
Ensure <code>@variant</code> can be used in JS based APIs (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20252">#20252</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/707c23b955bdfa7854a03195e503b95dd730b3d2"><code>707c23b</code></a>
Ensure custom variants can be used via <code>@variant</code> in
<code>addBase</code> (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20247">#20247</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/127d17033a0518701dac8332667b12e0980870ec"><code>127d170</code></a>
Add bare value support for <code>auto-rows-*</code> and
<code>auto-cols-*</code> (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20229">#20229</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/8a14a710102cae195f6811e8578bef9477bc6be9"><code>8a14a71</code></a>
4.3.1 (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20226">#20226</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/12833aa4b3a8813fd32da74be7a2fd75aa706ab7"><code>12833aa</code></a>
Fix canonicalization bug where we end up with a high precision number
(<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20221">#20221</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/97a5b3abfb75ce9722266cd323a24eee057634fc"><code>97a5b3a</code></a>
docs: fix double word 'to to' in test comment (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20216">#20216</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss/commit/d01e103cc4741c29764afaa287d2fb21356f7eea"><code>d01e103</code></a>
Add missing <code>inset</code> keyword for
<code>inset-shadow-none</code> (<a
href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20208">#20208</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tailwindlabs/tailwindcss/commits/v4.3.2/packages/tailwindcss">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tailwindcss&package-manager=npm_and_yarn&previous-version=4.3.0&new-version=4.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-14 10:02:37 -07:00
github-actions[bot]andlockfile-bot 4d50fa9f29 chore(lockfile): refresh pnpm-lock.yaml (#9304) 
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.

Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
 2026-07-09 13:10:22 -05:00
github-actions[bot]andlockfile-bot ea301442e8 chore(lockfile): refresh pnpm-lock.yaml (#9252) 
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.

Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
 2026-07-08 22:15:41 -07:00
dependabot[bot] bdd3aa2110 build(deps): bump sharp from 0.35.2 to 0.35.3 (#9061) 
Bumps [sharp](https://github.com/lovell/sharp) from 0.35.2 to 0.35.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lovell/sharp/releases">sharp's
releases</a>.</em></p>
<blockquote>
<h2>v0.35.3</h2>
<ul>
<li>
<p>Tighten verification of <code>text</code> dimensions, TIFF tile
dimensions and <code>extend</code> values.</p>
</li>
<li>
<p>Improve code bundler support by resolving path to libvips binary.</p>
</li>
<li>
<p>Increase default concurrency when use of
<code>MALLOC_ARENA_MAX</code> is detected.</p>
</li>
<li>
<p>Emit warning about binaries provided by Electron for use on
Linux.</p>
</li>
<li>
<p>Add <code>hasAlpha</code> property to output <code>info</code>.
<a
href="https://redirect.github.com/lovell/sharp/issues/4500">#4500</a></p>
</li>
<li>
<p>TypeScript: Return more precise
<code>Buffer&lt;ArrayBuffer&gt;</code> from <code>toBuffer</code>.
<a href="https://redirect.github.com/lovell/sharp/pull/4520">#4520</a>
<a href="https://github.com/Andarist"><code>@​Andarist</code></a></p>
</li>
<li>
<p>Bound <code>clahe</code> width and height to avoid signed overflow.
<a href="https://redirect.github.com/lovell/sharp/pull/4551">#4551</a>
<a
href="https://github.com/metsw24-max"><code>@​metsw24-max</code></a></p>
</li>
<li>
<p>Bound <code>trim</code> margin to avoid signed overflow.
<a href="https://redirect.github.com/lovell/sharp/pull/4552">#4552</a>
<a
href="https://github.com/metsw24-max"><code>@​metsw24-max</code></a></p>
</li>
<li>
<p>Reject infinite values when validating numbers.
<a href="https://redirect.github.com/lovell/sharp/pull/4553">#4553</a>
<a
href="https://github.com/metsw24-max"><code>@​metsw24-max</code></a></p>
</li>
<li>
<p>Bound extract region to libvips coordinate limit.
<a href="https://redirect.github.com/lovell/sharp/pull/4555">#4555</a>
<a
href="https://github.com/metsw24-max"><code>@​metsw24-max</code></a></p>
</li>
<li>
<p>Verify background colour values are numbers.
<a href="https://redirect.github.com/lovell/sharp/pull/4556">#4556</a>
<a
href="https://github.com/metsw24-max"><code>@​metsw24-max</code></a></p>
</li>
<li>
<p>Bound create and raw input dimensions to coordinate limit.
<a href="https://redirect.github.com/lovell/sharp/pull/4558">#4558</a>
<a
href="https://github.com/metsw24-max"><code>@​metsw24-max</code></a></p>
</li>
<li>
<p>Tighten recomb and affine matrix verification.
<a href="https://redirect.github.com/lovell/sharp/pull/4560">#4560</a>
<a
href="https://github.com/chatman-media"><code>@​chatman-media</code></a></p>
</li>
<li>
<p>Verify cache memory limit to avoid overflow.
<a href="https://redirect.github.com/lovell/sharp/pull/4561">#4561</a>
<a
href="https://github.com/metsw24-max"><code>@​metsw24-max</code></a></p>
</li>
</ul>
<h2>v0.35.3-rc.2</h2>
<ul>
<li>Tighten verification of <code>text</code> dimensions, TIFF tile
dimensions and <code>extend</code> values.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lovell/sharp/commit/1018449164723ba0203c1beffaba0e21f7829c18"><code>1018449</code></a>
Release v0.35.3</li>
<li><a
href="https://github.com/lovell/sharp/commit/ba303a799de6b0639a108e82465870ce0722ee4a"><code>ba303a7</code></a>
Prerelease v0.35.3-rc.2</li>
<li><a
href="https://github.com/lovell/sharp/commit/4f94fc5162a488187be17872ba513d7cadfe22d6"><code>4f94fc5</code></a>
Upgrade to sharp-libvips v1.3.2</li>
<li><a
href="https://github.com/lovell/sharp/commit/c5e7a3ff2043922b110dc9c00700c6f17d478c33"><code>c5e7a3f</code></a>
Bump devDeps, fix Deno/Windows smoke tests</li>
<li><a
href="https://github.com/lovell/sharp/commit/9a8d00268893cf163eea638fcc05aaed65fe01ea"><code>9a8d002</code></a>
Docs: Add changelog entry and note about transferable <a
href="https://redirect.github.com/lovell/sharp/issues/4520">#4520</a></li>
<li><a
href="https://github.com/lovell/sharp/commit/8694db0bac0d227f183d05585ebac7d17048d123"><code>8694db0</code></a>
TypeScript: Return more precise <code>Buffer\&lt;ArrayBuffer&gt;</code>
from <code>toBuffer</code> (<a
href="https://redirect.github.com/lovell/sharp/issues/4520">#4520</a>)</li>
<li><a
href="https://github.com/lovell/sharp/commit/e000d0b5e128e05bb6c499600f37e2a6a4b74314"><code>e000d0b</code></a>
Prerelease v0.35.3-rc.1</li>
<li><a
href="https://github.com/lovell/sharp/commit/9554ca95535e8385ec36815d7c793ce96739bf1c"><code>9554ca9</code></a>
Prerelease v0.35.3-rc.0</li>
<li><a
href="https://github.com/lovell/sharp/commit/6a29fd55db0c569276f143a7b480c62573a7aa16"><code>6a29fd5</code></a>
Emit warning about native binaries on Linux Electron</li>
<li><a
href="https://github.com/lovell/sharp/commit/540d2eada4613f954aa541ffac8c12485375967e"><code>540d2ea</code></a>
Increase default concurrency when use of MALLOC_ARENA_MAX detected</li>
<li>Additional commits viewable in <a
href="https://github.com/lovell/sharp/compare/v0.35.2...v0.35.3">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 13:03:30 -07:00
dependabot[bot] a058f761f3 build(deps-dev): bump rollup from 4.61.1 to 4.62.2 (#9070) 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [rollup](https://github.com/rollup/rollup) from 4.61.1 to 4.62.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rollup/rollup/releases">rollup's
releases</a>.</em></p>
<blockquote>
<h2>v4.62.2</h2>
<h2>4.62.2</h2>
<p><em>2026-06-19</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Do not add spurious side-effect-free external imports to chunks when
using minChunkSize (<a
href="https://redirect.github.com/rollup/rollup/issues/6411">#6411</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6411">#6411</a>:
Skip side-effect-free external imports when hoisting is disabled (<a
href="https://github.com/morgan-coded"><code>@​morgan-coded</code></a>,
<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6416">#6416</a>:
refactor(rust/parser_ast): extract property AstConverter write buffer
kind logic to new method (<a
href="https://github.com/fabianbernhart"><code>@​fabianbernhart</code></a>,
<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>v4.62.1</h2>
<h2>4.62.1</h2>
<p><em>2026-06-19</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Preserve multipart file extensions when deconflicting output chunks
(<a
href="https://redirect.github.com/rollup/rollup/issues/6408">#6408</a>)</li>
<li>Fix an issue where getLogFilter would match additional logs (<a
href="https://redirect.github.com/rollup/rollup/issues/6415">#6415</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6393">#6393</a>:
Use import attributes for importing JSON (<a
href="https://github.com/selfisekai"><code>@​selfisekai</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6408">#6408</a>:
fix: insert conflict numbers before first extension in multi-extension
filenames (<a
href="https://github.com/LeSingh1"><code>@​LeSingh1</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6415">#6415</a>:
fix: advance value past wildcard prefix before suffix check in
getLogFilter (<a
href="https://github.com/JSap0914"><code>@​JSap0914</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6417">#6417</a>:
chore(deps): update msys2/setup-msys2 digest to 66cd2cc (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6418">#6418</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6419">#6419</a>:
chore(deps): update dependency eslint-plugin-unicorn to v66 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6420">#6420</a>:
chore(deps): lock file maintenance minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>v4.62.0</h2>
<h2>4.62.0</h2>
<p><em>2026-06-13</em></p>
<h3>Features</h3>
<ul>
<li>Ensure that shared dependencies between manual chunks and entry
points receive a serparate chunk (<a
href="https://redirect.github.com/rollup/rollup/issues/6374">#6374</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6374">#6374</a>:
Extract the static dependencies imported by manual chunks into separate
chunks (<a
href="https://github.com/TrickyPi"><code>@​TrickyPi</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6405">#6405</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6406">#6406</a>:
chore(deps): pin dependency concurrently to v9 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6407">#6407</a>:
chore(deps): lock file maintenance minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6409">#6409</a>:
chore(deps): update minor/patch updates to v6.2.0 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rollup/rollup/blob/master/CHANGELOG.md">rollup's
changelog</a>.</em></p>
<blockquote>
<h2>4.62.2</h2>
<p><em>2026-06-19</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Do not add spurious side-effect-free external imports to chunks when
using minChunkSize (<a
href="https://redirect.github.com/rollup/rollup/issues/6411">#6411</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6411">#6411</a>:
Skip side-effect-free external imports when hoisting is disabled (<a
href="https://github.com/morgan-coded"><code>@​morgan-coded</code></a>,
<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6416">#6416</a>:
refactor(rust/parser_ast): extract property AstConverter write buffer
kind logic to new method (<a
href="https://github.com/fabianbernhart"><code>@​fabianbernhart</code></a>,
<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>4.62.1</h2>
<p><em>2026-06-19</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Preserve multipart file extensions when deconflicting output chunks
(<a
href="https://redirect.github.com/rollup/rollup/issues/6408">#6408</a>)</li>
<li>Fix an issue where getLogFilter would match additional logs (<a
href="https://redirect.github.com/rollup/rollup/issues/6415">#6415</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6393">#6393</a>:
Use import attributes for importing JSON (<a
href="https://github.com/selfisekai"><code>@​selfisekai</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6408">#6408</a>:
fix: insert conflict numbers before first extension in multi-extension
filenames (<a
href="https://github.com/LeSingh1"><code>@​LeSingh1</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6415">#6415</a>:
fix: advance value past wildcard prefix before suffix check in
getLogFilter (<a
href="https://github.com/JSap0914"><code>@​JSap0914</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6417">#6417</a>:
chore(deps): update msys2/setup-msys2 digest to 66cd2cc (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6418">#6418</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6419">#6419</a>:
chore(deps): update dependency eslint-plugin-unicorn to v66 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6420">#6420</a>:
chore(deps): lock file maintenance minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>4.62.0</h2>
<p><em>2026-06-13</em></p>
<h3>Features</h3>
<ul>
<li>Ensure that shared dependencies between manual chunks and entry
points receive a serparate chunk (<a
href="https://redirect.github.com/rollup/rollup/issues/6374">#6374</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6374">#6374</a>:
Extract the static dependencies imported by manual chunks into separate
chunks (<a
href="https://github.com/TrickyPi"><code>@​TrickyPi</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6405">#6405</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6406">#6406</a>:
chore(deps): pin dependency concurrently to v9 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6407">#6407</a>:
chore(deps): lock file maintenance minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6409">#6409</a>:
chore(deps): update minor/patch updates to v6.2.0 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6410">#6410</a>:
chore(deps): lock file maintenance minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6412">#6412</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6413">#6413</a>:
chore(deps): update dependency eslint-plugin-unicorn to v65 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rollup/rollup/commit/8faa18777374582bb813d54ce3623f4acf1f9e0b"><code>8faa187</code></a>
4.62.2</li>
<li><a
href="https://github.com/rollup/rollup/commit/a38a795c481d589661abf0d5029162ccc4fb79e1"><code>a38a795</code></a>
refactor(rust/parser_ast): extract property AstConverter write buffer
kind lo...</li>
<li><a
href="https://github.com/rollup/rollup/commit/6cc5c316bb5c4497923005601c2742132ae117ff"><code>6cc5c31</code></a>
Skip side-effect-free external imports when hoisting is disabled (<a
href="https://redirect.github.com/rollup/rollup/issues/6411">#6411</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/caacf701b89e5be4a94b3ffdbf70b51e5cfa3a1a"><code>caacf70</code></a>
4.62.1</li>
<li><a
href="https://github.com/rollup/rollup/commit/d1e8297966f5921c249da31c51f31d8cb92d3010"><code>d1e8297</code></a>
Add missing ignore</li>
<li><a
href="https://github.com/rollup/rollup/commit/1ba1fc23874c888605b7cbbf69e3d39f88536978"><code>1ba1fc2</code></a>
fix: insert conflict numbers before first extension in multi-extension
filena...</li>
<li><a
href="https://github.com/rollup/rollup/commit/532bd0ade7e796d6b5990c22fe0ac033464bb8aa"><code>532bd0a</code></a>
Use import attributes for importing JSON (<a
href="https://redirect.github.com/rollup/rollup/issues/6393">#6393</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/2cd8194aa81b2bafaad049b8de06aa7602eb81ac"><code>2cd8194</code></a>
fix: advance value past wildcard prefix before suffix check in
getLogFilter (...</li>
<li><a
href="https://github.com/rollup/rollup/commit/dfac590bd53405167d18c8a6ca6aefc83b854886"><code>dfac590</code></a>
fix(deps): update minor/patch updates (<a
href="https://redirect.github.com/rollup/rollup/issues/6418">#6418</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/1d6db3d32587e7ff46f7fff8eabf18b85ef8ea50"><code>1d6db3d</code></a>
chore(deps): update dependency eslint-plugin-unicorn to v66 (<a
href="https://redirect.github.com/rollup/rollup/issues/6419">#6419</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/rollup/rollup/compare/v4.61.1...v4.62.2">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 13:02:36 -07:00
Nicky Leach 2ef70c3673 build(deps): upgrade lexical family to 0.46.0 and pin via overrides (fixes dual-version getType crash) (#9180) 2026-07-07 13:00:26 -07:00
dependabot[bot] 5356b7d737 build(deps): bump @tanstack/react-query from 5.90.21 to 5.101.2 (#9067) 
Bumps
[@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query)
from 5.90.21 to 5.101.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/TanStack/query/releases">@​tanstack/react-query's
releases</a>.</em></p>
<blockquote>
<h2><code>@​tanstack/react-query-devtools</code><a
href="https://github.com/5"><code>@​5</code></a>.101.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/TanStack/query/commit/f5bf180d933d8b8d9d9e7b845e55b26a3a413b07"><code>f5bf180</code></a>,
<a
href="https://github.com/TanStack/query/commit/25cdd975fed4703d2ca5b600ca5ccd2b600b3dd8"><code>25cdd97</code></a>,
<a
href="https://github.com/TanStack/query/commit/ecd89c8faf7acc226f00633ea3a761d3ab842c1d"><code>ecd89c8</code></a>,
<a
href="https://github.com/TanStack/query/commit/01c763444e3cf3dfa9744f13911aa1533cac3c29"><code>01c7634</code></a>,
<a
href="https://github.com/TanStack/query/commit/49012dbd5192dfe483d3b108b72ffaa7f2849e0f"><code>49012db</code></a>]:
<ul>
<li><code>@​tanstack/query-devtools</code><a
href="https://github.com/5"><code>@​5</code></a>.101.2</li>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.2</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query-next-experimental</code><a
href="https://github.com/5"><code>@​5</code></a>.101.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.2</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query-persist-client</code><a
href="https://github.com/5"><code>@​5</code></a>.101.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-persist-client-core</code><a
href="https://github.com/5"><code>@​5</code></a>.101.2</li>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.2</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-core</code><a
href="https://github.com/5"><code>@​5</code></a>.101.2</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query-devtools</code><a
href="https://github.com/5"><code>@​5</code></a>.101.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-devtools</code><a
href="https://github.com/5"><code>@​5</code></a>.101.1</li>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.1</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query-next-experimental</code><a
href="https://github.com/5"><code>@​5</code></a>.101.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.1</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query-persist-client</code><a
href="https://github.com/5"><code>@​5</code></a>.101.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-persist-client-core</code><a
href="https://github.com/5"><code>@​5</code></a>.101.1</li>
<li><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.1</li>
</ul>
</li>
</ul>
<h2><code>@​tanstack/react-query</code><a
href="https://github.com/5"><code>@​5</code></a>.101.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/TanStack/query/commit/9eff92ed86e284ec0125b3a3539d028688235bd1"><code>9eff92e</code></a>]:</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md">@​tanstack/react-query's
changelog</a>.</em></p>
<blockquote>
<h2>5.101.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-core</code><a
href="https://github.com/5"><code>@​5</code></a>.101.2</li>
</ul>
</li>
</ul>
<h2>5.101.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/TanStack/query/commit/9eff92ed86e284ec0125b3a3539d028688235bd1"><code>9eff92e</code></a>]:
<ul>
<li><code>@​tanstack/query-core</code><a
href="https://github.com/5"><code>@​5</code></a>.101.1</li>
</ul>
</li>
</ul>
<h2>5.101.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-core</code><a
href="https://github.com/5"><code>@​5</code></a>.101.0</li>
</ul>
</li>
</ul>
<h2>5.100.14</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix(react-query): do not go into optimistic fetching state when not
subscribed (<a
href="https://redirect.github.com/TanStack/query/pull/10759">#10759</a>)</p>
</li>
<li>
<p>Updated dependencies []:</p>
<ul>
<li><code>@​tanstack/query-core</code><a
href="https://github.com/5"><code>@​5</code></a>.100.14</li>
</ul>
</li>
</ul>
<h2>5.100.13</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/TanStack/query/commit/d423168f6261a5cb3d353e53b27c8150cc271151"><code>d423168</code></a>]:
<ul>
<li><code>@​tanstack/query-core</code><a
href="https://github.com/5"><code>@​5</code></a>.100.13</li>
</ul>
</li>
</ul>
<h2>5.100.12</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-core</code><a
href="https://github.com/5"><code>@​5</code></a>.100.12</li>
</ul>
</li>
</ul>
<h2>5.100.11</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@​tanstack/query-core</code><a
href="https://github.com/5"><code>@​5</code></a>.100.11</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/TanStack/query/commit/610e8d1684614f63e13f5829ad4bc375782ff06d"><code>610e8d1</code></a>
ci: Version Packages (<a
href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/10996">#10996</a>)</li>
<li><a
href="https://github.com/TanStack/query/commit/1f84256a2e5967882f65fd2b26e6b67b33a7fdd9"><code>1f84256</code></a>
docs: document the <code>select</code> typing caveat for
parallel-queries hooks (<a
href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/10984">#10984</a>)</li>
<li><a
href="https://github.com/TanStack/query/commit/b80929716f9ae36104245da9d99e8af3550e6f58"><code>b809297</code></a>
ci: Version Packages (<a
href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/10977">#10977</a>)</li>
<li><a
href="https://github.com/TanStack/query/commit/ccc843ea44220ba4fb931fd3a0fe06f9e0f9ec74"><code>ccc843e</code></a>
test({react,preact}-query/useQueries): move type-only tests to
'useQueries.te...</li>
<li><a
href="https://github.com/TanStack/query/commit/415461346f319db94c47c9ff1dc47a1b845b6709"><code>4154613</code></a>
test({react,preact}-query/useMutation): split 'should handle conditional
logi...</li>
<li><a
href="https://github.com/TanStack/query/commit/8bb5fdea3e78c20d7d25c8017a0a2f23c6508996"><code>8bb5fde</code></a>
test({react,preact}-query/useMutation): split 'should pass meta to
mutation' ...</li>
<li><a
href="https://github.com/TanStack/query/commit/87426a301609fa56ac595a8d26b846e0ef1ee788"><code>87426a3</code></a>
test(react-query): replace deprecated 'toBeCalledTimes' with
'toHaveBeenCalle...</li>
<li><a
href="https://github.com/TanStack/query/commit/feb1efd804c1262106f72c8adc1d82a8ce9cfbb0"><code>feb1efd</code></a>
test(*): move 'vi.useRealTimers' to the end of 'afterEach' so cleanup
runs un...</li>
<li><a
href="https://github.com/TanStack/query/commit/f3d8d2abbf15bf81ff7575d3be9845d7b402f25a"><code>f3d8d2a</code></a>
ci: Version Packages (<a
href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/10774">#10774</a>)</li>
<li><a
href="https://github.com/TanStack/query/commit/532bb298fba15e945e69c6ee4edc0c759ff21324"><code>532bb29</code></a>
fix(tests): disable local coverage instrumentation (<a
href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/10776">#10776</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.2/packages/react-query">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 10:14:51 -07:00
dependabot[bot] aac7e2ed15 build(deps): bump acpx from 0.11.2 to 0.12.0 (#9062) 
Bumps [acpx](https://github.com/openclaw/acpx) from 0.11.2 to 0.12.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/openclaw/acpx/releases">acpx's
releases</a>.</em></p>
<blockquote>
<h2>acpx 0.12.0</h2>
<h2>v0.12.0</h2>
<h3>Changes</h3>
<ul>
<li>Agents/built-ins: add Grok Build via <code>grok agent stdio</code>,
including cached-login and <code>XAI_API_KEY</code> authentication
selection. Thanks <a
href="https://github.com/TheAngryPit"><code>@​TheAngryPit</code></a>.
(<a
href="https://redirect.github.com/openclaw/acpx/pull/426">#426</a>)</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>CLI/queue: drain active turns before releasing queue-owner leases
and preserve typed retryable shutdown responses while terminating agent
bridges. Thanks <a
href="https://github.com/superWorldSavior"><code>@​superWorldSavior</code></a>.
(<a
href="https://redirect.github.com/openclaw/acpx/pull/430">#430</a>)</li>
<li>CLI/quiet output: emit exactly one structured stderr diagnostic for
direct and queued prompt failures without adding diagnostics to stdout.
Thanks <a
href="https://github.com/superWorldSavior"><code>@​superWorldSavior</code></a>.
(<a
href="https://redirect.github.com/openclaw/acpx/pull/431">#431</a>)</li>
</ul>
<h3>Verification</h3>
<ul>
<li>npm: <a
href="https://www.npmjs.com/package/acpx/v/0.12.0">https://www.npmjs.com/package/acpx/v/0.12.0</a></li>
<li>Registry tarball: <a
href="https://registry.npmjs.org/acpx/-/acpx-0.12.0.tgz">https://registry.npmjs.org/acpx/-/acpx-0.12.0.tgz</a></li>
<li>Integrity:
<code>sha512-APYpN04XFWrCGuSBvM4HTKWWFH8uSIuzc+qI7aCGeVdP9o4euZeBosFEkmNUHvBOop0XBemg6d8RsNvzXN3Mgw==</code></li>
<li>Candidate CI: <a
href="https://github.com/openclaw/acpx/actions/runs/28718352566">https://github.com/openclaw/acpx/actions/runs/28718352566</a></li>
<li>Trusted publish: <a
href="https://github.com/openclaw/acpx/actions/runs/28718550655">https://github.com/openclaw/acpx/actions/runs/28718550655</a></li>
<li>Full local tests, coverage, docs, conformance, mutation, security
audits, packed-install CLI smoke, runtime export smoke, lifecycle proof,
and fresh autoreview passed before tagging.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/openclaw/acpx/blob/main/CHANGELOG.md">acpx's
changelog</a>.</em></p>
<blockquote>
<h2>2026.7.4 (v0.12.0)</h2>
<h3>Changes</h3>
<ul>
<li>Agents/built-ins: add Grok Build via <code>grok agent stdio</code>,
including cached-login and <code>XAI_API_KEY</code> authentication
selection. Thanks <a
href="https://github.com/TheAngryPit"><code>@​TheAngryPit</code></a>.</li>
</ul>
<h3>Breaking</h3>
<h3>Fixes</h3>
<ul>
<li>
<p>CLI/queue: drain active turns before releasing queue-owner leases and
preserve typed retryable shutdown responses while terminating agent
bridges. Thanks <a
href="https://github.com/superWorldSavior"><code>@​superWorldSavior</code></a>.</p>
</li>
<li>
<p>CLI/quiet output: emit exactly one structured stderr diagnostic for
direct and queued prompt failures without adding diagnostics to stdout.
Thanks <a
href="https://github.com/superWorldSavior"><code>@​superWorldSavior</code></a>.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/openclaw/acpx/commit/6a24a546d2349cbe71ed032d52d07cab611e320c"><code>6a24a54</code></a>
chore(release): prepare acpx 0.12.0</li>
<li><a
href="https://github.com/openclaw/acpx/commit/ffd8549355adbb28bfc36ffd1087643d2df29fdb"><code>ffd8549</code></a>
fix: surface quiet-mode failures on stderr (<a
href="https://redirect.github.com/openclaw/acpx/issues/431">#431</a>)</li>
<li><a
href="https://github.com/openclaw/acpx/commit/87327c6e4ac28243b94945afb922c6cbb0dd0f98"><code>87327c6</code></a>
fix: make queue owner shutdown lossless (<a
href="https://redirect.github.com/openclaw/acpx/issues/430">#430</a>)</li>
<li><a
href="https://github.com/openclaw/acpx/commit/7d05c37b470cc357f0e5d6cefac7c74fdc434829"><code>7d05c37</code></a>
feat: add Grok Build ACP agent (<a
href="https://redirect.github.com/openclaw/acpx/issues/426">#426</a>)</li>
<li><a
href="https://github.com/openclaw/acpx/commit/95d75cd000a2f9f99b6e14e1d55e34ff4bf3cced"><code>95d75cd</code></a>
chore(deps): bump tsx to 4.23.0 (<a
href="https://redirect.github.com/openclaw/acpx/issues/429">#429</a>)</li>
<li><a
href="https://github.com/openclaw/acpx/commit/bce1c96d9d1a760cfdc233e19b040492c64fbeae"><code>bce1c96</code></a>
chore(deps-dev): update development toolchain (<a
href="https://redirect.github.com/openclaw/acpx/issues/428">#428</a>)</li>
<li><a
href="https://github.com/openclaw/acpx/commit/8a643e725ab31f9e2ec7f800c17ec8b845d61a14"><code>8a643e7</code></a>
chore(deps-dev): refresh TypeScript native preview (<a
href="https://redirect.github.com/openclaw/acpx/issues/427">#427</a>)</li>
<li><a
href="https://github.com/openclaw/acpx/commit/a18bf74c4b3a774357f993a83a0cfaf40465b044"><code>a18bf74</code></a>
chore(deps): bump <code>@​agentclientprotocol/sdk</code> from 0.28.1 to
1.1.0 (<a
href="https://redirect.github.com/openclaw/acpx/issues/421">#421</a>)</li>
<li><a
href="https://github.com/openclaw/acpx/commit/1d882575e34e18621e59229f0e711723cef223ae"><code>1d88257</code></a>
chore(deps-dev): bump the development group with 7 updates</li>
<li><a
href="https://github.com/openclaw/acpx/commit/c2689c025f36a8ebb76590e85ab44d499fac68ac"><code>c2689c0</code></a>
chore(deps-dev): bump <code>@​types/node</code> from 25.9.3 to
26.0.1</li>
<li>Additional commits viewable in <a
href="https://github.com/openclaw/acpx/compare/v0.11.2...v0.12.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 10:05:10 -07:00
dependabot[bot] 077ba611fa build(deps-dev): bump @types/multer from 2.1.0 to 2.2.0 (#9065) 
Bumps
[@types/multer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/multer)
from 2.1.0 to 2.2.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/multer">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/multer&package-manager=npm_and_yarn&previous-version=2.1.0&new-version=2.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 10:03:47 -07:00
dependabot[bot] faaa9b22e5 build(deps-dev): bump storybook from 10.4.2 to 10.4.6 (#9063) 
Bumps
[storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core)
from 10.4.2 to 10.4.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/releases">storybook's
releases</a>.</em></p>
<blockquote>
<h2>v10.4.6</h2>
<h2>10.4.6</h2>
<ul>
<li>CSF: Allow partial globals overrides in story and meta annotations -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/34985">#34985</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Dependencies: Upgrade esbuild - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35157">#35157</a>,
thanks <a
href="https://github.com/Kakadus"><code>@​Kakadus</code></a>!</li>
</ul>
<h2>v10.4.5</h2>
<h2>10.4.5</h2>
<ul>
<li>Core: Rework AI checklist feature gate - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35053">#35053</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Preview: Stop mixed CSF3+4 stories getting core annotations injected
twice - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35094">#35094</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
</ul>
<h2>v10.4.4</h2>
<h2>10.4.4</h2>
<ul>
<li>Telemetry: Add timeout to event-log POST to prevent build hang - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35085">#35085</a>,
thanks <a
href="https://github.com/badams"><code>@​badams</code></a>!</li>
</ul>
<h2>v10.4.3</h2>
<h2>10.4.3</h2>
<ul>
<li>Addon Docs: Fix Primary and Controls blocks not rendering in custom
MDX pages - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34496">#34496</a>,
thanks <a
href="https://github.com/NYCU-Chung"><code>@​NYCU-Chung</code></a>!</li>
<li>Core: Respect !dev tag on MDX docs in sidebar - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35031">#35031</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
<li>React: Add support for resolving subcomponents attached as
properties of a parent component - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34967">#34967</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>UI: Prevent docs page scroll reset on HMR re-render - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35021">#35021</a>,
thanks <a
href="https://github.com/LongTangGithub"><code>@​LongTangGithub</code></a>!</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md">storybook's
changelog</a>.</em></p>
<blockquote>
<h2>10.4.6</h2>
<ul>
<li>CSF: Allow partial globals overrides in story and meta annotations -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/34985">#34985</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Dependencies: Upgrade esbuild - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35157">#35157</a>,
thanks <a
href="https://github.com/Kakadus"><code>@​Kakadus</code></a>!</li>
</ul>
<h2>10.4.5</h2>
<ul>
<li>Core: Rework AI checklist feature gate - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35053">#35053</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Preview: Stop mixed CSF3+4 stories getting core annotations injected
twice - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35094">#35094</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
</ul>
<h2>10.4.4</h2>
<ul>
<li>Telemetry: Add timeout to event-log POST to prevent build hang - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35085">#35085</a>,
thanks <a
href="https://github.com/badams"><code>@​badams</code></a>!</li>
</ul>
<h2>10.4.3</h2>
<ul>
<li>Addon Docs: Fix Primary and Controls blocks not rendering in custom
MDX pages - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34496">#34496</a>,
thanks <a
href="https://github.com/NYCU-Chung"><code>@​NYCU-Chung</code></a>!</li>
<li>Core: Respect !dev tag on MDX docs in sidebar - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35031">#35031</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
<li>React: Add support for resolving subcomponents attached as
properties of a parent component - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34967">#34967</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>UI: Prevent docs page scroll reset on HMR re-render - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35021">#35021</a>,
thanks <a
href="https://github.com/LongTangGithub"><code>@​LongTangGithub</code></a>!</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/storybookjs/storybook/commit/5496a4270da7f3a8e0203185792685cba671fdc5"><code>5496a42</code></a>
Bump version from &quot;10.4.5&quot; to &quot;10.4.6&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/a80a5afdddc48e741edffabcfe5f7be4a559023e"><code>a80a5af</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/34985">#34985</a>
from TheSeydiCharyyev/fix/issue-34951-partial-globals</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/5b929cadfbef571342b48b2039b31cddfd0ef894"><code>5b929ca</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/35157">#35157</a>
from Kakadus/update-esbuild</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/48e7b20074222ed926d14fb6c678c2edfc86ee7b"><code>48e7b20</code></a>
Bump version from &quot;10.4.4&quot; to &quot;10.4.5&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/730f744aa65abdb73479ee119c5356070c624040"><code>730f744</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/35094">#35094</a>
from storybookjs/jeppe-cursor/a236965c</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/dc88f70020c22a690f5dbb3e60c230fffece1a61"><code>dc88f70</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/35053">#35053</a>
from storybookjs/sidnioulz/double-gate-ai-optin</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/5adebe753f29d414d1e214e935c94d6e5451861f"><code>5adebe7</code></a>
Bump version from &quot;10.4.3&quot; to &quot;10.4.4&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/ce1491d9e4c6d2b42864028fdf57801b855fc573"><code>ce1491d</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/35085">#35085</a>
from badams/fix/telemetry-fetch-timeout</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/624e6187fd462e56719cbd80c1b4bfb67b68fc89"><code>624e618</code></a>
Bump version from &quot;10.4.2&quot; to &quot;10.4.3&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/c89882282295be3bc05b3a366916c53d7a499841"><code>c898822</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/core/issues/34496">#34496</a>
from NYCU-Chung/fix/docs-blocks-custom-mdx</li>
<li>Additional commits viewable in <a
href="https://github.com/storybookjs/storybook/commits/v10.4.6/code/core">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=storybook&package-manager=npm_and_yarn&previous-version=10.4.2&new-version=10.4.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 10:02:51 -07:00
dependabot[bot] f10464fee4 build(deps): bump @radix-ui/react-slot from 1.2.4 to 1.3.0 (#9066) 
Bumps
[@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot)
from 1.2.4 to 1.3.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md">@​radix-ui/react-slot's
changelog</a>.</em></p>
<blockquote>
<h2>1.3.0</h2>
<h3>Added generic type arguments for <code>SlotProps</code> and
<code>createSlot</code></h3>
<p><code>SlotProps</code> and <code>createSlot</code> now accept generic
type arguments to specify the type of element a slot should render, as
well as its props.</p>
<pre lang="tsx"><code>const Slot = createSlot&lt;HTMLButtonElement,
MyCustomButtonProps&gt;('Slot');
</code></pre>
<h2>1.2.5</h2>
<ul>
<li>Fixed infinite re-render loop in React 19 caused by
<code>Slot</code> creating a new ref callback on every render</li>
<li>Added support for nested <code>Slottable</code> via a render prop,
so a slotted element can be wrapped while still merging Slot props and
refs onto it</li>
<li>Added repository.directory to all package.json files</li>
<li>Improved error messages for invalid slot children</li>
<li>Updated dependencies:
<code>@radix-ui/react-compose-refs@1.1.3</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@​radix-ui/react-slot</code> since your current
version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@radix-ui/react-slot&package-manager=npm_and_yarn&previous-version=1.2.4&new-version=1.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 10:02:47 -07:00
dependabot[bot] 773bf45720 build(deps): bump @zed-industries/codex-acp from 0.12.0 to 0.16.0 (#9068) 
Bumps
[@zed-industries/codex-acp](https://github.com/zed-industries/codex-acp)
from 0.12.0 to 0.16.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/zed-industries/codex-acp/releases">@​zed-industries/codex-acp's
releases</a>.</em></p>
<blockquote>
<h2>Release 0.16.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update Codex dependencies to rust-v0.137.0 by <a
href="https://github.com/benbrandt"><code>@​benbrandt</code></a> in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/320">zed-industries/codex-acp#320</a></li>
<li>Use thread store for session listing by <a
href="https://github.com/benbrandt"><code>@​benbrandt</code></a> in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/321">zed-industries/codex-acp#321</a></li>
<li>chore(acp): Update to ACP 0.14.0 by <a
href="https://github.com/mrjones2014"><code>@​mrjones2014</code></a> in
<a
href="https://redirect.github.com/zed-industries/codex-acp/pull/317">zed-industries/codex-acp#317</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/mrjones2014"><code>@​mrjones2014</code></a>
made their first contribution in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/317">zed-industries/codex-acp#317</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/zed-industries/codex-acp/compare/v0.15.0...v0.16.0">https://github.com/zed-industries/codex-acp/compare/v0.15.0...v0.16.0</a></p>
<h2>Release 0.15.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update Codex to 0.133.0 by <a
href="https://github.com/benbrandt"><code>@​benbrandt</code></a> in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/303">zed-industries/codex-acp#303</a></li>
<li>Stop output buffer resend in terminal_interaction stdin path by <a
href="https://github.com/frozename"><code>@​frozename</code></a> in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/270">zed-industries/codex-acp#270</a></li>
<li>fix: Detach pending permission request tasks on cancel by <a
href="https://github.com/benbrandt"><code>@​benbrandt</code></a> in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/304">zed-industries/codex-acp#304</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/zed-industries/codex-acp/compare/v0.14.0...v0.15.0">https://github.com/zed-industries/codex-acp/compare/v0.14.0...v0.15.0</a></p>
<h2>Release 0.14.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump openssl from 0.10.78 to 0.10.79 in the cargo group across 1
directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/265">zed-industries/codex-acp#265</a></li>
<li>Update to codex 0.129 by <a
href="https://github.com/benbrandt"><code>@​benbrandt</code></a> in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/268">zed-industries/codex-acp#268</a></li>
<li>Fix O(N²) memory growth in exec_command_output_delta fallback by <a
href="https://github.com/frozename"><code>@​frozename</code></a> in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/269">zed-industries/codex-acp#269</a></li>
<li>Emit image generation tool calls by <a
href="https://github.com/benbrandt"><code>@​benbrandt</code></a> in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/271">zed-industries/codex-acp#271</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/frozename"><code>@​frozename</code></a>
made their first contribution in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/269">zed-industries/codex-acp#269</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/zed-industries/codex-acp/compare/v0.13.0...v0.14.0">https://github.com/zed-industries/codex-acp/compare/v0.13.0...v0.14.0</a></p>
<h2>Release 0.13.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Upgrade to codex 0.128.0 by <a
href="https://github.com/benbrandt"><code>@​benbrandt</code></a> in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/261">zed-industries/codex-acp#261</a></li>
<li>Reload auth file before failing check_auth() by <a
href="https://github.com/anvilpete"><code>@​anvilpete</code></a> in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/259">zed-industries/codex-acp#259</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/anvilpete"><code>@​anvilpete</code></a>
made their first contribution in <a
href="https://redirect.github.com/zed-industries/codex-acp/pull/259">zed-industries/codex-acp#259</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/zed-industries/codex-acp/compare/v0.12.0...v0.13.0">https://github.com/zed-industries/codex-acp/compare/v0.12.0...v0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/zed-industries/codex-acp/commit/bb590500e8646f6daf879b8b3c6a659fbd29017d"><code>bb59050</code></a>
Bump version to 0.16.0</li>
<li><a
href="https://github.com/zed-industries/codex-acp/commit/c81fa46d897275ed014065a3947596bf0fd1975b"><code>c81fa46</code></a>
chore(acp): Update to ACP 0.14.0 (<a
href="https://redirect.github.com/zed-industries/codex-acp/issues/317">#317</a>)</li>
<li><a
href="https://github.com/zed-industries/codex-acp/commit/4a853a1cf65309751a88d425c029ee81d3a33c48"><code>4a853a1</code></a>
Use thread store for session listing (<a
href="https://redirect.github.com/zed-industries/codex-acp/issues/321">#321</a>)</li>
<li><a
href="https://github.com/zed-industries/codex-acp/commit/9841e8b5a82f950f4ce30563884d18d93457e6dc"><code>9841e8b</code></a>
Update Codex dependencies to rust-v0.137.0 (<a
href="https://redirect.github.com/zed-industries/codex-acp/issues/320">#320</a>)</li>
<li><a
href="https://github.com/zed-industries/codex-acp/commit/863d433fc91855d0b5427372bf635c894bf68cb6"><code>863d433</code></a>
v0.15.0</li>
<li><a
href="https://github.com/zed-industries/codex-acp/commit/f67ca5f35feb82232ff736ba326c2b07dbf8cdd4"><code>f67ca5f</code></a>
fix: Detach pending permission request tasks on cancel (<a
href="https://redirect.github.com/zed-industries/codex-acp/issues/304">#304</a>)</li>
<li><a
href="https://github.com/zed-industries/codex-acp/commit/8aef91bc08de288531fc694248b5a370d5a3ade5"><code>8aef91b</code></a>
Stop output buffer resend in terminal_interaction stdin path (<a
href="https://redirect.github.com/zed-industries/codex-acp/issues/270">#270</a>)</li>
<li><a
href="https://github.com/zed-industries/codex-acp/commit/0c2d8280f26cc9583e44ca31d0a11f3f3f38d0b5"><code>0c2d828</code></a>
Update README.md</li>
<li><a
href="https://github.com/zed-industries/codex-acp/commit/d9bf1c157994feb9ebdc6117c8de0bc73dfe696f"><code>d9bf1c1</code></a>
Update Codex to 0.133.0 (<a
href="https://redirect.github.com/zed-industries/codex-acp/issues/303">#303</a>)</li>
<li><a
href="https://github.com/zed-industries/codex-acp/commit/156cb0da12f6c7b1c697f90b5f22d5e14be31165"><code>156cb0d</code></a>
Emit image generation tool calls (<a
href="https://redirect.github.com/zed-industries/codex-acp/issues/271">#271</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/zed-industries/codex-acp/compare/v0.12.0...v0.16.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@zed-industries/codex-acp&package-manager=npm_and_yarn&previous-version=0.12.0&new-version=0.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 10:02:43 -07:00
github-actions[bot]andlockfile-bot f95efe6292 chore(lockfile): refresh pnpm-lock.yaml (#8957) 
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.

Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
 2026-07-03 18:55:34 -07:00
dependabot[bot] 5bd6c6ec3c build(deps): bump acpx from 0.6.1 to 0.11.2 (#8741) 
Bumps [acpx](https://github.com/openclaw/acpx) from 0.6.1 to 0.11.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/openclaw/acpx/releases">acpx's
releases</a>.</em></p>
<blockquote>
<h2>acpx 0.11.0</h2>
<h2>v0.11.0</h2>
<h3>Changes</h3>
<ul>
<li>Agents/built-ins: bump the default Claude ACP adapter range to
<code>@agentclientprotocol/claude-agent-acp@^0.37.0</code>. Thanks <a
href="https://github.com/trumpyla"><code>@​trumpyla</code></a>.</li>
<li>Runtime/embedding: surface cost, token usage breakdowns, and
advertised command metadata on runtime status/events. Thanks <a
href="https://github.com/DaniAkash"><code>@​DaniAkash</code></a>.</li>
<li>Agents/built-ins: add <code>fast-agent</code> as a built-in
fast-agent ACP adapter via <code>uvx fast-agent-mcp acp</code>.</li>
<li>Agents/built-ins: add <code>mux</code> as a built-in coder/mux ACP
adapter via <code>npx -y mux@^0.27.0 acp</code>. Thanks <a
href="https://github.com/ThomasK33"><code>@​ThomasK33</code></a>.</li>
<li>CLI: add <code>acpx compare</code> to run one prompt across multiple
agents and summarize timing, token usage, stop reason, permissions, and
final output side by side. Thanks <a
href="https://github.com/mvanhorn"><code>@​mvanhorn</code></a>.</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>CLI/Claude: isolate built-in Claude ACP sessions from user settings
by default so globally enabled channel and daemon plugins cannot
interfere with a spawned session. Set
<code>ACPX_CLAUDE_INCLUDE_USER_SETTINGS=1</code> to restore user
settings deliberately. Fixes <a
href="https://redirect.github.com/openclaw/acpx/issues/361">#361</a>.</li>
<li>ACP/models: support SDK 0.25 model config options while preserving
<code>session/set_model</code> compatibility for adapters that
explicitly advertise legacy model metadata.</li>
<li>CLI/Claude: let Claude Code adjudicate model selectors missing from
a stale advertised model list on later persistent turns, and preserve
the adapter-reported current model after model switches. Thanks <a
href="https://github.com/oakif"><code>@​oakif</code></a>.</li>
<li>Client/ACP: advertise scoped Devin/Windsurf-compatible client
metadata and handle Devin extension requests/notifications without noisy
method-not-found logs. Thanks <a
href="https://github.com/LivioGama"><code>@​LivioGama</code></a>.</li>
<li>Runtime/sessions: treat corrupt public file-session records as
missing while preserving genuine filesystem errors. Thanks <a
href="https://github.com/KrasimirKralev"><code>@​KrasimirKralev</code></a>.</li>
</ul>
<h3>Verification</h3>
<ul>
<li>npm: <a
href="https://www.npmjs.com/package/acpx/v/0.11.0">https://www.npmjs.com/package/acpx/v/0.11.0</a></li>
<li>Registry tarball: <a
href="https://registry.npmjs.org/acpx/-/acpx-0.11.0.tgz">https://registry.npmjs.org/acpx/-/acpx-0.11.0.tgz</a></li>
<li>Integrity:
<code>sha512-l42LJFmd6kvbr1UytvwWmr5Mdy/v9l3FM6Necs01PWbjUIkxjCdxg97duqoRfRqxtDAfnNPb1IlgIf2ZgMZQqA==</code></li>
<li>Candidate CI: <a
href="https://github.com/openclaw/acpx/actions/runs/27676359224">https://github.com/openclaw/acpx/actions/runs/27676359224</a></li>
<li>Trusted publish: <a
href="https://github.com/openclaw/acpx/actions/runs/27676823793">https://github.com/openclaw/acpx/actions/runs/27676823793</a></li>
<li>Packed CLI and real Codex ACP adapter E2E passed before
tagging.</li>
</ul>
<h2>2026.5.23 (v0.10.0)</h2>
<h3>Changes</h3>
<ul>
<li>CLI/sessions: add <code>sessions export</code> and <code>sessions
import</code> for moving portable session archives between machines.
Thanks <a
href="https://github.com/mvanhorn"><code>@​mvanhorn</code></a>.</li>
</ul>
<h3>Release Proof</h3>
<ul>
<li>npm: <a
href="https://www.npmjs.com/package/acpx/v/0.10.0">https://www.npmjs.com/package/acpx/v/0.10.0</a></li>
<li>registry tarball: <a
href="https://registry.npmjs.org/acpx/-/acpx-0.10.0.tgz">https://registry.npmjs.org/acpx/-/acpx-0.10.0.tgz</a></li>
<li>integrity:
<code>sha512-hd48XV03gG3sd409T1lDrOKJTTz1ap4g0wrndXjxQ590tN85pBYlvfNLyerybvGRrtUGsZjNdt99r1jpIt6ukA==</code></li>
<li>release workflow: <a
href="https://github.com/openclaw/acpx/actions/runs/26323055145">https://github.com/openclaw/acpx/actions/runs/26323055145</a></li>
<li>CI: <a
href="https://github.com/openclaw/acpx/actions/runs/26323053524">https://github.com/openclaw/acpx/actions/runs/26323053524</a></li>
</ul>
<h2>2026.5.22 (v0.9.0)</h2>
<h3>Changes</h3>
<ul>
<li>Tooling: add Slophammer TypeScript quality gates for coverage,
complexity,
unsafe types, mutation testing, DRY checks, and dependency
boundaries.</li>
<li>Agents/built-ins: switch the default Codex adapter to
<code>@agentclientprotocol/codex-acp</code>, with Codex model selection
handled through advertised ACP model ids, and bump the default Claude
ACP adapter range.</li>
<li>Tooling: add a repo-local autoreview skill and helper for
Codex-first</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/openclaw/acpx/blob/main/CHANGELOG.md">acpx's
changelog</a>.</em></p>
<blockquote>
<h2>2026.6.23 (v0.11.2)</h2>
<h3>Changes</h3>
<h3>Breaking</h3>
<h3>Fixes</h3>
<ul>
<li>Runtime/status: persist token usage reported on successful prompt
responses,
including adapters that only provide a sparse
<code>usage_update</code>.</li>
</ul>
<h2>Unreleased</h2>
<h3>Changes</h3>
<h3>Breaking</h3>
<h3>Fixes</h3>
<h2>2026.6.23 (v0.11.1)</h2>
<h3>Changes</h3>
<ul>
<li>Runtime/embedding: preserve per-agent environment variables across
ACP session
creation, queue handoff, persistence, and reconnects. Thanks <a
href="https://github.com/zhangguiping-xydt"><code>@​zhangguiping-xydt</code></a>.</li>
</ul>
<h3>Breaking</h3>
<h3>Fixes</h3>
<ul>
<li>CLI/queue: harden command parsing, queue-owner startup, stale
process cleanup,
and release/CI checks found by <code>clawpatch</code>.</li>
<li>Windows/Claude: only export a native <code>.exe</code> as
<code>CLAUDE_CODE_EXECUTABLE</code>;
unresolved <code>.cmd</code>, <code>.bat</code>, and <code>.ps1</code>
shims now fall back to the Claude ACP
adapter's bundled native binary. Fixes <a
href="https://redirect.github.com/openclaw/openclaw/issues/93465">openclaw/openclaw#93465</a>.</li>
<li>Client/ACP: ignore non-object JSON lines from adapter stdout before
ACP
dispatch, preventing primitive frames from crashing the SDK message
path.</li>
<li>ACP/models: call the current SDK <code>session/set_model</code>
method for legacy model
metadata instead of the generic extension fallback.</li>
<li>CLI/config: add <code>--mcp-config</code> for session-scoped MCP
servers without writing
a project config file. Live persistent sessions reject MCP config
changes until
closed. Fixes <a
href="https://redirect.github.com/openclaw/acpx/issues/387">#387</a>.</li>
</ul>
<h2>2026.6.17 (v0.11.0)</h2>
<h3>Changes</h3>
<ul>
<li>Agents/built-ins: bump the default Claude ACP adapter range to
<code>@agentclientprotocol/claude-agent-acp@^0.37.0</code>. Thanks <a
href="https://github.com/trumpyla"><code>@​trumpyla</code></a>.</li>
<li>Runtime/embedding: surface cost, token usage breakdowns, and
advertised command metadata on runtime status/events. Thanks <a
href="https://github.com/DaniAkash"><code>@​DaniAkash</code></a>.</li>
<li>Agents/built-ins: add <code>fast-agent</code> as a built-in
fast-agent ACP adapter via <code>uvx fast-agent-mcp acp</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/openclaw/acpx/commits/v0.11.2">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 10:11:40 -07:00
dependabot[bot] c06e2be21a build(deps): bump @tailwindcss/typography from 0.5.19 to 0.5.20 (#8738) 
Bumps
[@tailwindcss/typography](https://github.com/tailwindlabs/tailwindcss-typography)
from 0.5.19 to 0.5.20.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss-typography/releases">@​tailwindcss/typography's
releases</a>.</em></p>
<blockquote>
<h2>v0.5.20</h2>
<h3>Fixed</h3>
<ul>
<li>Support installing with stable versions of Tailwind CSS v4 (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/pull/424">#424</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss-typography/blob/main/CHANGELOG.md">@​tailwindcss/typography's
changelog</a>.</em></p>
<blockquote>
<h2>[0.5.20] - 2026-06-08</h2>
<h3>Fixed</h3>
<ul>
<li>Support installing with stable versions of Tailwind CSS v4 (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/pull/424">#424</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/e3714a3fe55551ce9d51eec4721183ed6b1d5cd1"><code>e3714a3</code></a>
0.5.20</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/f34283d2961e18dd0dc2a849702e0dfd45fc80cb"><code>f34283d</code></a>
Update tailwindcss peer dependency version (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/issues/424">#424</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/543de4274390e90c4aab5d216729b46a3ba5541b"><code>543de42</code></a>
bump Node.js</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/881b0488df9fd05e5361276b66a9ee8e7f39a3a7"><code>881b048</code></a>
Setup OIDC (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/issues/423">#423</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/74a3da779bb43e4e68f446395224c768704c1fb6"><code>74a3da7</code></a>
Fix typo in README.md (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/issues/413">#413</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/3963dfede4845f46451db1863fd5321f4cdea03b"><code>3963dfe</code></a>
Bump js-yaml from 3.14.1 to 3.14.2 (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/issues/410">#410</a>)</li>
<li><a
href="https://github.com/tailwindlabs/tailwindcss-typography/commit/abf85cc6e1b4f9b914b0f66453e5a97a9899a15c"><code>abf85cc</code></a>
className instead of classname (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss-typography/issues/406">#406</a>)</li>
<li>See full diff in <a
href="https://github.com/tailwindlabs/tailwindcss-typography/compare/v0.5.19...v0.5.20">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@​tailwindcss/typography</code> since your current
version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@tailwindcss/typography&package-manager=npm_and_yarn&previous-version=0.5.19&new-version=0.5.20)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 10:05:08 -07:00
dependabot[bot] 8f3fa07d59 build(deps): bump @pierre/diffs from 1.1.22 to 1.2.11 (#8744) 
Bumps @pierre/diffs from 1.1.22 to 1.2.11.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@pierre/diffs&package-manager=npm_and_yarn&previous-version=1.1.22&new-version=1.2.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 10:04:31 -07:00
dependabot[bot] b755ab55fd build(deps): bump multer from 2.1.1 to 2.2.0 (#8743) 
Bumps [multer](https://github.com/expressjs/multer) from 2.1.1 to 2.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/multer/releases">multer's
releases</a>.</em></p>
<blockquote>
<h2>v2.2.0</h2>
<h2>Important</h2>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-5038">CVE-2026-5038</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm">GHSA-3p4h-7m6x-2hcm</a>)</li>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-5079">CVE-2026-5079</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j">GHSA-72gw-mp4g-v24j</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/multer/pull/1397">expressjs/multer#1397</a></li>
<li>chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/multer/pull/1409">expressjs/multer#1409</a></li>
<li>chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/multer/pull/1410">expressjs/multer#1410</a></li>
<li>ci: add Node 26 to test matrix by <a
href="https://github.com/gameroman"><code>@​gameroman</code></a> in <a
href="https://redirect.github.com/expressjs/multer/pull/1404">expressjs/multer#1404</a></li>
<li>Release: 2.2.0 by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/multer/pull/1412">expressjs/multer#1412</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/gameroman"><code>@​gameroman</code></a>
made their first contribution in <a
href="https://redirect.github.com/expressjs/multer/pull/1404">expressjs/multer#1404</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/expressjs/multer/compare/v2.1.1...v2.2.0">https://github.com/expressjs/multer/compare/v2.1.1...v2.2.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/multer/blob/main/CHANGELOG.md">multer's
changelog</a>.</em></p>
<blockquote>
<h2>2.2.0</h2>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-5038">CVE-2026-5038</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm">GHSA-3p4h-7m6x-2hcm</a>)</li>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-5079">CVE-2026-5079</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j">GHSA-72gw-mp4g-v24j</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/expressjs/multer/commit/2e2af08157c66cbbc76539ccbd8869097a0c8feb"><code>2e2af08</code></a>
2.2.0 (<a
href="https://redirect.github.com/expressjs/multer/issues/1412">#1412</a>)</li>
<li><a
href="https://github.com/expressjs/multer/commit/a192b5278f240967f5eb13dd1e9a413b4e1b6533"><code>a192b52</code></a>
feat: add fieldNestingDepth limit option</li>
<li><a
href="https://github.com/expressjs/multer/commit/9c801c7136fdaa8437b84c6455cd46a3467a8058"><code>9c801c7</code></a>
fix: clean up in-progress disk writes on abort</li>
<li><a
href="https://github.com/expressjs/multer/commit/0adb21d0294fe7315344feb6ddee00b0666d9e8a"><code>0adb21d</code></a>
ci: add Node 26 to test matrix (<a
href="https://redirect.github.com/expressjs/multer/issues/1404">#1404</a>)</li>
<li><a
href="https://github.com/expressjs/multer/commit/f5e17c39c818edade71b4deec7d114fdaafd54af"><code>f5e17c3</code></a>
chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (<a
href="https://redirect.github.com/expressjs/multer/issues/1410">#1410</a>)</li>
<li><a
href="https://github.com/expressjs/multer/commit/de1fefd9d201f0ae48f1de056f00a349dd12f9bc"><code>de1fefd</code></a>
chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 (<a
href="https://redirect.github.com/expressjs/multer/issues/1409">#1409</a>)</li>
<li><a
href="https://github.com/expressjs/multer/commit/67abfc89f4caa5f842eb75083ddb3854db4cc38a"><code>67abfc8</code></a>
chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/expressjs/multer/issues/1397">#1397</a>)</li>
<li>See full diff in <a
href="https://github.com/expressjs/multer/compare/v2.1.1...v2.2.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=multer&package-manager=npm_and_yarn&previous-version=2.1.1&new-version=2.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-30 10:04:26 -07:00