Skip to content

deps: bump the desktop-minor-and-patch group across 1 directory with 18 updates - #241

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/desktop-minor-and-patch-a1b04aae92
Open

deps: bump the desktop-minor-and-patch group across 1 directory with 18 updates#241
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/desktop-minor-and-patch-a1b04aae92

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the desktop-minor-and-patch group with 17 updates in the / directory:

Package From To
@tanstack/react-query 5.101.4 5.102.8
input-otp 1.4.2 1.5.0
jose 6.2.5 6.2.10
react-hook-form 7.83.0 7.87.0
react-router-dom 7.18.2 7.18.3
sonner 2.0.7 2.0.8
uuid 14.0.1 14.0.2
@testing-library/react 16.3.2 16.3.3
@testing-library/user-event 14.6.1 14.6.7
@types/node 26.1.2 26.4.1
@vitejs/plugin-react 6.0.5 6.1.1
@vitest/coverage-v8 4.1.10 4.1.11
baseline-browser-mapping 2.11.8 2.11.21
eslint-plugin-react-refresh 0.5.3 0.5.6
globals 17.8.0 17.12.0
postcss 8.5.25 8.5.28
vite 8.2.0 8.2.2

Updates @tanstack/react-query from 5.101.4 to 5.102.8

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.102.8
    • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-next-experimental@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-persist-client@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.102.8
    • @​tanstack/react-query@​5.102.8

@​tanstack/react-query@​5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.8

@​tanstack/react-query-devtools@​5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.102.7
    • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-next-experimental@​5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-persist-client@​5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.102.7
    • @​tanstack/react-query@​5.102.7

@​tanstack/react-query@​5.102.7

Patch Changes

  • Updated dependencies []:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.102.8

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.8

5.102.7

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.7

5.102.6

Patch Changes

  • #11305 ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

  • Updated dependencies []:

    • @​tanstack/query-core@​5.102.6

5.102.5

Patch Changes

  • Updated dependencies [578e5c2]:
    • @​tanstack/query-core@​5.102.5

5.102.4

Patch Changes

  • Updated dependencies [a05df6a]:
    • @​tanstack/query-core@​5.102.4

5.102.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.102.3

5.102.2

Patch Changes

  • Updated dependencies [80fbf73]:
    • @​tanstack/query-core@​5.102.2

... (truncated)

Commits

Updates input-otp from 1.4.2 to 1.5.0

Release notes

Sourced from input-otp's releases.

v1.5.0

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

  • fix(input): reserve the password manager badge gutter only where it fits
  • fix(input): disable spellcheck by default
  • fix(input): feature-detect ResizeObserver before observing
  • fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
  • fix(input): clear pending synchronization timeouts on unmount
  • feat(input): add a nonce prop for Content-Security-Policy support
  • fix(input): guard the input reference used by the selectionchange listener
  • fix(input): opt the container out of browser translation
  • fix(input): report cosmetic CSS rule failures as warnings instead of errors
  • docs: document the stable iOS selection behavior and its cosmetic limitation

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

  • revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
  • revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
  • docs: align the mobile and edge-case documentation with the stable candidate
  • test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

  • fix(input): reserve the password manager badge gutter only where it fits
    • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
  • fix(input): disable spellcheck by default
    • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
  • fix(input): feature-detect ResizeObserver before observing
    • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
  • fix(input): fall back to 16px font-size until --root-height resolves
    • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
  • fix(input): clear pending sync timeouts on unmount
    • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
  • feat(input): add nonce prop
    • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
  • fix(input): use the guarded input reference inside the selectionchange listener
    • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
  • fix(input): opt the container out of browser translation
    • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.
  • fix(input): log CSS rule insertion failures as warnings, not errors
    • Some environments reject individual cosmetic selectors (:autofill in older Android WebViews, for instance). Nothing breaks when that happens, but the console.error was captured by Sentry and similar tools as if the application had failed. Same message, warning level.
  • chore(types): narrow onComplete to (value: string) => unknown

... (truncated)

Changelog

Sourced from input-otp's changelog.

[1.5.0]

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

  • fix(input): reserve the password manager badge gutter only where it fits
  • fix(input): disable spellcheck by default
  • fix(input): feature-detect ResizeObserver before observing
  • fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
  • fix(input): clear pending synchronization timeouts on unmount
  • feat(input): add a nonce prop for Content-Security-Policy support
  • fix(input): guard the input reference used by the selectionchange listener
  • fix(input): opt the container out of browser translation
  • fix(input): report cosmetic CSS rule failures as warnings instead of errors
  • docs: document the stable iOS selection behavior and its cosmetic limitation

[1.5.0-beta.2]

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

  • revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
  • revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
  • docs: align the mobile and edge-case documentation with the stable candidate
  • test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

[1.5.0-beta.1]

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

[1.5.0-beta.0]

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

  • fix(input): reserve the password manager badge gutter only where it fits
    • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
  • fix(input): disable spellcheck by default
    • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
  • fix(input): feature-detect ResizeObserver before observing
    • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
  • fix(input): fall back to 16px font-size until --root-height resolves
    • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
  • fix(input): clear pending sync timeouts on unmount
    • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
  • feat(input): add nonce prop
    • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
  • fix(input): use the guarded input reference inside the selectionchange listener
    • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
  • fix(input): opt the container out of browser translation
    • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for input-otp since your current version.


Updates jose from 6.2.5 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

6.2.9 (2026-08-15)

... (truncated)

Commits
  • 3eab152 chore(release): 6.2.10
  • 021abf4 refactor(jws): specialize compact processing
  • a998927 refactor(jwe): specialize compact processing
  • eedb124 refactor(jose): share binary input validation
  • 52ba159 refactor(jwt): share producer claim state
  • 85e30ed refactor(jose): share compact token processing internals
  • 0bd81d2 test(jose): cover hidden critical-header options
  • 9cf7876 test(jose): reject callable object impostors
  • f23cafd test(jose): preserve resolved key data properties
  • 1ee6f61 refactor(jwe): consolidate CBC decryption failures
  • Additional commits viewable in compare view

Updates react-hook-form from 7.83.0 to 7.87.0

Release notes

Sourced from react-hook-form's releases.

Version 7.87.0

✨ Features

  • Add shouldTouch option to trigger() ([#13671](react-hook-form/react-hook-form#13671))

    setValue already supported shouldTouch; trigger() now does too. This allows you to mark field(s) as touched after manual or programmatic validation, such as validate-on-mount or multi-step form navigation, without needing a setValue workaround:

    // Mark a single field as touched after validating it
await trigger('firstName', { shouldTouch: true });
// Mark every mounted field as touched after validating the whole form
await trigger(undefined, { shouldTouch: true });

  • Add OpaqueTypes registry for opaque leaf types ([#13676](react-hook-form/react-hook-form#13676))

    Recursive type helpers (Path, DeepPartial, DeepRequired, FieldErrorsImpl, etc.) previously stopped only at Primitive | BrowserNativeObject. As a result, rich third-party value types such as Dayjs and Decimal could be recursively traversed member-by-member, potentially causing TypeScript to report "Excessive complexity" diagnostics on large form types.

    You can now register a type as an opaque leaf via declaration merging:

    import type { Dayjs } from 'dayjs';
declare module 'react-hook-form' {
interface OpaqueTypes {
dayjs: Dayjs;
}
}

    While the registry is empty, types remain identical to the existing behavior. This is purely opt-in.

🐞 Fixes

❤️ Thank You

Thanks to @​giaBaoJS, @​dfedoryshchev, @​Alioth-91, @​Masatoshi0227, @​modosc, and @​bluebill1049 for their contributions! 🎉

Version 7.86.0

✨ Features

... (truncated)

Changelog

Sourced from react-hook-form's changelog.

[7.87.0] - 2026-08-30

Added

  • shouldTouch option for trigger()
  • OpaqueTypes registry for opaque leaf types

Fixed

  • Inconsistent behavior among useController().field.onChange()-like APIs
  • Controller under a null parent submitting undefined instead of a value
  • ERR_MODULE_NOT_FOUND resolving react-hook-form due to a react-server declaration (Next.js builds)
  • useWatch never reconciling when an Activity subtree is hidden on its first render
  • resetField not recomputing isValid for subscribe-only consumers
  • generateWatchOutput ignoring defaultValue for an array of names
  • useFormState never reconciling when an Activity subtree is hidden on its first render

[7.86.0] - 2026-08-22

Added

  • Type-safe getErrors method

Performance

  • Improve createFormControl
  • Improve clone object check
  • Avoid cloning values in unregister without subscribers

Fixed

  • Field array update leaving stale errors and touched state at the updated index
  • flatten discarding File and Blob values instead of treating them as leaf nodes
  • validateField not passing the field error to setCustomValidity when criteriaMode is all
  • hasValidation treating falsy but valid values (min: 0, max: 0, minLength: 0, maxLength: 0, required: '') as no validation
  • setValue targeting a nested leaf not notifying a Controller registered on a field array item root
  • setValues not updating fields registered under an object or array value
  • useWatch returning a stale value on name change when the new value is null
  • unregister inverting keepDirty when broadcasting isDirty

[7.85.0] - 2026-08-08

Added

  • Support <Activity />

Fixed

  • getFieldState error resolution from a field path
  • useWatch discarding useForm({ defaultValues }) in favor of its own defaultValue before the form mounts

... (truncated)

Commits
  • 29af888 7.87.0
  • 1eeab63 🐞 fix(useFormState): never reconciles when an Activity subtree is hidden on i...
  • 145441c 🐞 fix(generateWatchOutput): defaultValue is ignored for an array of names (#1...
  • 1fb065c 🐞 fix(resetField): isValid not recomputed for subscribe-only consumers (#13684)
  • 2f7380e 🧹refactor: use continue instead of return in setFieldValues' hasOwnProper...
  • 1b0a314 📖 remove comment
  • a457ca7 🐞 fix #13680: useWatch never reconciles when an Activity subtree is hidden on...
  • bb3360f 🐞 fix #13681 issue: ERR_MODULE_NOT_FOUND, Can't resolve react-hook-form due t...
  • f646948 🪅 feat: add OpaqueTypes registry for opaque leaf types (#13676)
  • e17a95c 🧇 chore: scope the lock workflow to issues so its scheduled run can finish (#...
  • Additional commits viewable in compare view

Updates react-router-dom from 7.18.2 to 7.18.3

Changelog

Sourced from react-router-dom's changelog.

v7.18.3

Patch Changes

Commits

Updates sonner from 2.0.7 to 2.0.8

Release notes

Sourced from sonner's releases.

v2.0.8

What's Changed

New Contributors

Full Changelog: emilkowalski/sonner@v2.0.7...v2.0.8

Commits

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Commits
  • fd59f02 chore(main): release 14.0.2 (#967)
  • f3c564e docs: point the Node support permalink at the CI version matrix (#974)
  • b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
  • 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
  • ea83515 docs: cleanup API summary (#968)
  • ac36860 chore: pin publint version in CI (#966)
  • a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
  • See full diff in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

  • Avoid act() re-entrant when dispatching events (#1468) (20ce75f)
Commits

Updates @testing-library/user-event from 14.6.1 to 14.6.7

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.7

14.6.7 (2026-09-02)

Bug Fixes

  • normalize DataTransfer format aliases (#1326) (1e0020b)
  • feature: Add iframe support for user.keyboard typing (#1275) (1e0020b)

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

  • default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

  • tab retargeting if focus moved during keydown (#1296) (43efda7)

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

v14.6.3

14.6.3 (2026-08-03)

Bug Fixes

v14.6.2

14.6.2 (2026-08-03)

C...

Description has been truncated

@dependabot
deps: bump the desktop-minor-and-patch group across 1 directory with …
d53b749 
…18 updates

Bumps the desktop-minor-and-patch group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.102.8` |
| [input-otp](https://github.com/guilhermerodz/input-otp/tree/HEAD/packages/input-otp) | `1.4.2` | `1.5.0` |
| [jose](https://github.com/panva/jose) | `6.2.5` | `6.2.10` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.83.0` | `7.87.0` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.2` | `7.18.3` |
| [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` |
| [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.1` | `14.6.7` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.4.1` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.1` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.11.8` | `2.11.21` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.3` | `0.5.6` |
| [globals](https://github.com/sindresorhus/globals) | `17.8.0` | `17.12.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.25` | `8.5.28` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.0` | `8.2.2` |



Updates `@tanstack/react-query` from 5.101.4 to 5.102.8
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.8/packages/react-query)

Updates `input-otp` from 1.4.2 to 1.5.0
- [Release notes](https://github.com/guilhermerodz/input-otp/releases)
- [Changelog](https://github.com/guilhermerodz/input-otp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/guilhermerodz/input-otp/commits/v1.5.0/packages/input-otp)

Updates `jose` from 6.2.5 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.5...v6.2.10)

Updates `react-hook-form` from 7.83.0 to 7.87.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.83.0...v7.87.0)

Updates `react-router-dom` from 7.18.2 to 7.18.3
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.3/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.3/packages/react-router-dom)

Updates `sonner` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](emilkowalski/sonner@v2.0.7...v2.0.8)

Updates `uuid` from 14.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v14.0.1...v14.0.2)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

Updates `@testing-library/user-event` from 14.6.1 to 14.6.7
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.1...v14.6.7)

Updates `@types/node` from 26.1.2 to 26.4.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)

Updates `baseline-browser-mapping` from 2.11.8 to 2.11.21
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.11.8...v2.11.21)

Updates `eslint-plugin-react-refresh` from 0.5.3 to 0.5.6
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.5.3...v0.5.6)

Updates `globals` from 17.8.0 to 17.12.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.8.0...v17.12.0)

Updates `postcss` from 8.5.25 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.25...8.5.28)

Updates `vite` from 8.2.0 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.102.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: desktop-minor-and-patch
- dependency-name: input-otp
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: desktop-minor-and-patch
- dependency-name: jose
  dependency-version: 6.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
- dependency-name: react-hook-form
  dependency-version: 7.87.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: desktop-minor-and-patch
- dependency-name: react-router-dom
  dependency-version: 7.18.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: desktop-minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: desktop-minor-and-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
- dependency-name: eslint-plugin-react-refresh
  dependency-version: 0.5.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
- dependency-name: globals
  dependency-version: 17.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: desktop-minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: desktop-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 7, 2026
@strix-security

strix-security Bot commented Sep 7, 2026

Copy link
Copy Markdown

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants