chore(deps): bump the minor-patch group across 1 directory with 19 updates

[dependabot]

Bumps the minor-patch group with 19 updates in the /frontend directory:

Package	From	To
@radix-ui/react-dropdown-menu	2.1.24	2.2.1
@radix-ui/react-label	2.1.15	2.1.17
@radix-ui/react-select	2.3.7	2.4.1
@radix-ui/react-separator	1.1.15	1.2.0
@radix-ui/react-slot	1.3.3	1.5.0
@tanstack/react-query	5.104.0	5.104.2
i18next	26.4.2	26.4.4
lucide-react	1.48.0	1.56.0
radix-ui	1.6.7	1.8.1
react-hook-form	7.89.0	7.90.0
react-i18next	17.0.15	17.0.16
zod	4.6.5	4.6.7
@tanstack/eslint-plugin-query	5.104.0	5.104.2
@types/node	26.6.3	26.6.5
@vitejs/plugin-react	6.1.1	6.1.2
eslint	10.11.0	10.12.0
globals	17.12.0	17.13.0
typescript-eslint	8.70.1	8.71.2
vite	8.3.1	8.3.4

Updates @radix-ui/react-dropdown-menu from 2.1.24 to 2.2.1

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.2.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-menu@2.2.1

2.2.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-menu@2.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

2.1.25

• Updated dependencies: @radix-ui/react-menu@2.1.25, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-label from 2.1.15 to 2.1.17

Changelog

Sourced from @​radix-ui/react-label's changelog.

2.1.17

• Updated dependencies: @radix-ui/react-primitive@2.2.0

2.1.16

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-select from 2.3.7 to 2.4.1

Changelog

Sourced from @​radix-ui/react-select's changelog.

2.4.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

2.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
• Fixed content alignment when all items are disabled.
• Fixed a bug where updating a Select value programmatically while inside a <form> would dispatch a click event from the hidden bubble select that propagated to ancestor onClick handlers.
• Fixed a bug resulting from incorrect tree-shaking in SWC-minified code.
• Updated dependencies: @radix-ui/react-collection@1.2.0, @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-direction@1.2.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0, @radix-ui/react-use-callback-ref@1.1.5, @radix-ui/react-visually-hidden@1.2.13

2.3.8

• Fixed a bug where internal event handlers were still called on disabled Select.Item elements. Consumer-provided event handlers still run, but Radix's own selection logic no longer fires for disabled items.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-separator from 1.1.15 to 1.2.0

Changelog

Sourced from @​radix-ui/react-separator's changelog.

1.2.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/react-primitive@2.2.0

1.1.16

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-slot from 1.3.3 to 1.5.0

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.5.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed Slot throwing when an asChild child is a lazy reference whose resolved value is itself a lazy reference.

1.4.0

• Added support for multiple aria-describedby attributes.
• Fixed compatibility issues with React Server Components.

Commits

• See full diff in compare view

Updates @tanstack/react-query from 5.104.0 to 5.104.2

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.104.2
  • @​tanstack/react-query@​5.104.2

@​tanstack/react-query-next-experimental@​5.104.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.2

@​tanstack/react-query-persist-client@​5.104.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.104.2
  • @​tanstack/react-query@​5.104.2

@​tanstack/react-query@​5.104.2

Patch Changes

• Updated dependencies [03e8c39]:
  • @​tanstack/query-core@​5.104.2

@​tanstack/react-query-devtools@​5.104.1

Patch Changes

• Updated dependencies [ec060b6]:
  • @​tanstack/query-devtools@​5.104.1
  • @​tanstack/react-query@​5.104.1

@​tanstack/react-query-next-experimental@​5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.1

@​tanstack/react-query-persist-client@​5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.104.1
  • @​tanstack/react-query@​5.104.1

@​tanstack/react-query@​5.104.1

Patch Changes

• Updated dependencies []:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.2

Patch Changes

• Updated dependencies [03e8c39]:
  • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.104.1

Commits

• b699b52 ci: Version Packages (#11849)
• e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
• df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
• 833062c chore: replace prettier with oxfmt (#11939)
• d0cfa6a chore: replace eslint with oxlint (#11938)
• 0012ec1 docs(react-query): add JSDoc to the properties of the exported interfaces and...
• b5e8e7b docs(react-query): add JSDoc to the exported classes, methods, and arrow func...
• 01abab3 docs(*): note that 'throwOnError' makes the hook rethrow the errors of 'mutat...
• b42166e docs(react-query): add JSDoc to the exported interfaces and type aliases (#11...
• 205d422 docs(*): add missing JSDoc descriptions and enforce 'jsdoc/require-descriptio...
• Additional commits viewable in compare view

Updates i18next from 26.4.2 to 26.4.4

Release notes

Sourced from i18next's releases.

v26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
• fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

• perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

Changelog

Sourced from i18next's changelog.

26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. See advisory GHSA-5jr9-983r-c8x4, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
• fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

26.4.3

• perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

Commits

• f6a7746 26.4.4
• 25988d5 build
• c9f8eba fix(security): nesting regexp ReDoS on unclosed $t( and single-pass nest(), c...
• 0d2845a 26.4.3
• a2dbe15 build
• e75843f perf: cache non-empty bundles in hasLanguageSomeTranslations, changelog v26.4.3
• edaea71 Fix TypeScript examples build and update them to i18next v26 (#2448)
• 4ebd19d docs: "For AI assistants" paragraph in the README and a fuller saveMissing JSDoc
• See full diff in compare view

Updates lucide-react from 1.48.0 to 1.56.0

Release notes

Sourced from lucide-react's releases.

Version 1.56.0

What's Changed

• feat(icons): added server-nas icon by @​benhaube in lucide-icons/lucide#4537
• fix(icons,categories): fix notifications category name and refine circle-x tags by @​Rachit315 in lucide-icons/lucide#4994
• feat(icons): add message-circle-text icon by @​ericfennis in lucide-icons/lucide#4898

New Contributors

• @​Rachit315 made their first contribution in lucide-icons/lucide#4994

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

Version 1.55.0

What's Changed

• feat(icons): added mail-dot icon by @​elenakovelskikh in lucide-icons/lucide#3230
• ci(lint): split lint jobs and annotate Prettier and JSON schema errors in PRs by @​ericfennis in lucide-icons/lucide#4982
• chore(deps-dev): bump sharp from 0.35.4 to 0.35.5 by @​dependabot[bot] in lucide-icons/lucide#4987
• chore(deps): bump next from 16.3.6 to 16.3.8 by @​dependabot[bot] in lucide-icons/lucide#4988
• test(lucide): add tests for empty icons error and DocumentFragment root in createIcons by @​grzdev in lucide-icons/lucide#4967
• feat(icons): added phone-log icon by @​Levi-Bensley in lucide-icons/lucide#3598
• chore(copilot-instruction): Adjust instruction text to allow more then 4 use-cases by @​ericfennis in lucide-icons/lucide#4989
• feat(icons): added wifi-lock icon by @​benhaube in lucide-icons/lucide#4913
• feat(icons): Add handle-bottom-right icon by @​ocavue in lucide-icons/lucide#1793
• test(lucide-react): add tests for DynamicIcon fallback and ref forwarding by @​grzdev in lucide-icons/lucide#4966
• feat(icons): added screw icon by @​edik17 in lucide-icons/lucide#4932
• feat(icons): added user-round-star icon by @​karsa-mistmere in lucide-icons/lucide#3469
• feat(icons): added shield-house icon by @​benhaube in lucide-icons/lucide#4602

New Contributors

• @​grzdev made their first contribution in lucide-icons/lucide#4967
• @​Levi-Bensley made their first contribution in lucide-icons/lucide#3598
• @​edik17 made their first contribution in lucide-icons/lucide#4932

Full Changelog: lucide-icons/lucide@1.54.0...1.55.0

Version 1.54.0

What's Changed

• feat(icons): added lens icon by @​rrod497 in lucide-icons/lucide#4923

Full Changelog: lucide-icons/lucide@1.53.0...1.54.0

Version 1.53.0

What's Changed

• chore(deps-dev): bump preact from 10.29.8 to 11.0.0 in the preact-deps group by @​dependabot[bot] in lucide-icons/lucide#4961
• chore(deps): bump vue from 3.5.42 to 3.5.43 in the vue-deps group by @​dependabot[bot] in lucide-icons/lucide#4958
• fix(site): Fix reset button and rename absolute stroke width to non-scaling stroke by @​ericfennis in lucide-icons/lucide#4956
• chore(deps-dev): bump simple-git from 3.36.0 to 4.0.1 by @​dependabot[bot] in lucide-icons/lucide#4968
• chore(deps-dev): bump the angular-deps group across 1 directory with 11 updates by @​dependabot[bot] in lucide-icons/lucide#4960
• chore(categories): Add description field to categories by @​ericfennis in lucide-icons/lucide#4909
• feat(icons): added groceries icon by @​rrod497 in lucide-icons/lucide#4907

... (truncated)

Commits

• 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
• 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
• 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
• e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
• See full diff in compare view

Updates radix-ui from 1.6.7 to 1.8.1

Changelog

Sourced from radix-ui's changelog.

1.8.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-accordion@1.3.1, @radix-ui/react-avatar@1.3.1, @radix-ui/react-checkbox@1.4.1, @radix-ui/react-collapsible@1.2.1, @radix-ui/react-context-menu@2.4.1, @radix-ui/react-dialog@1.3.1, @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-dropdown-menu@2.2.1, @radix-ui/react-focus-scope@1.3.1, @radix-ui/react-hover-card@1.2.1, @radix-ui/react-menu@2.2.1, @radix-ui/react-menubar@1.2.1, @radix-ui/react-navigation-menu@1.4.1, @radix-ui/react-one-time-password-field@0.2.1, @radix-ui/react-password-toggle-field@0.2.1, @radix-ui/react-popover@1.3.1, @radix-ui/react-progress@1.2.1, @radix-ui/react-roving-focus@1.2.1, @radix-ui/react-select@2.4.1, @radix-ui/react-slider@1.6.1, @radix-ui/react-switch@1.4.1, @radix-ui/react-tabs@1.2.1, @radix-ui/react-toast@1.3.1, @radix-ui/react-toggle@1.2.1, @radix-ui/react-toggle-group@1.2.1, @radix-ui/react-tooltip@1.4.1, @radix-ui/react-alert-dialog@1.2.1, @radix-ui/react-radio-group@1.5.1, @radix-ui/react-toolbar@1.2.1

1.8.0

Context Menu

• Allowed side, sideOffset, and align props to be overridden on ContextMenu.Content.

Navigation Menu

• Added data-state attribute to the content element when using NavigationMenu.Viewport for consistency.

Popover

• Fixed aria-controls being set on Popover.Trigger while the popover is closed.

Select

• Fixed content alignment when all items are disabled.
• Fixed a bug where updating a Select value programmatically while inside a <form> would dispatch a click event from the hidden bubble select that propagated to ancestor onClick handlers.

Slider

• Fixed a bug where updating a Slider value programmatically while inside a <form> would dispatch an input event that propagated to ancestor onInput handlers.

Slot

• Fixed Slot throwing when an asChild child is a lazy reference whose resolved value is itself a lazy reference.

Toast

• Fixed Toast.Viewport forcing a still-hydrating Suspense boundary to client-render.

Tooltip

• Fixed a bug where tabbing away from a focusable tooltip trigger nested in a modal popover moved focus to the popover's root instead of the next element in the popover.

Other updates

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
• Fixed timing bugs in useCallbackRef.
• Fixed FocusScope throwing a TypeError in test environments after teardown.
• Fixed a bug resulting from incorrect tree-shaking in SWC-minified code.
• Some small and breaking changes in unstable collection APIs. This package is an internal utility, undocumented, and unstable APIs may change without a major version bump. Capturing those changes here just in case you did a naughty and used them.
  • Renamed unstable_CollectionProps to unstable_CollectionSlotProps and unstable_CollectionItemMap to unstable_CollectionDict.
  • Added useGetCollection to the functions returned from unstable_createCollection.

... (truncated)

Commits

• See full diff in compare view

Updates react-hook-form from 7.89.0 to 7.90.0

Release notes

Sourced from react-hook-form's releases.

Version 7.90.0

🐞 Fixes

• Fix useForm marking fields named after Object.prototype members as touched on blur and setValue (#13833)
• Fix cloneObject preserving the length of sparse arrays (#13834)
• Fix dirty values extraction for fields named hasOwnProperty (#13832)
• Fix useForm retaining options removed from props on re-render (#13831)
• Fix useFieldArray handling duplicate indexes in remove() without mutating the provided indexes (#13830)
• Fix useFieldArray unregistering fields while a parent array reindexes (#13828)
• Fix input values edited before the form is ready being lost (#13827)
• Fix useWatch not updating watched objects after an Activity subtree reconnects (#13819)
• Fix reset() incorrectly setting isDirty when using keepDefaultValues without values (#13820)
• Fix Controller blur validation not working after reset() (#13817)
• Fix watch using stale shouldUnregister options when registering fields (#13814)
• Fix form value comparison for fields named ref (#13812)
• Fix native validation using stale shouldUseNativeValidation options (#13806)
• Fix cloneObject not cloning objects with a null prototype (#13808)
• Fix useWatch array names not prioritizing form defaultValues (#13805)
• Fix error updates not producing a new errors reference (#13800)
• Fix setError and clearErrors not producing a new errors reference (#13791)

⚡ Performance Improvements

• Improve dirty fields checking (#13788)
• Improve subscription value handling (#13787)
• Improve watch API performance (#13792)
• Improve named scoped subscriptions (#13793)
• Preserve form-state tracking across unsubscribe (#13794)
• Improve subject subscription handling (#13795)
• Skip redundant form-state merges during subscriber notifications (#13796)
• Avoid allocations when matching subscription names (#13823)

🧹 Refactors

• Reduce bundle size (#13797, #13798)
• Clean up tests and fix warnings (#13835)

🧪 Tests

• Add coverage for useFieldArray index boundary and no-op behavior (#13815, #13822, #13824, #13829)
• Add coverage for JSON stringify and parse edge cases (#13821)

📦 Dependencies

• Bump fast-uri from 3.1.2 to 3.1.8 (#13811)
• Bump joi from 18.2.5 to 18.2.6 (#13810)

❤️ Thank You

Thanks to @​charan-rathore, @​zigzagdev, @​AdzerKI, @​huytdps13400, @​dfedoryshchev, @​kory-kaai, @​Mohamed-Elshesheny, @​breken-ai, @​sarmah-rup, @​00200200, @​giaBaoJS and @​bluebill1049 for their contributions! 🎉

Changelog

Sourced from react-hook-form's changelog.

[7.90.0] - 2026-10-10

Changed

• Improve performance of watch, subscribe, scoped subscriptions, dirty field checks and form state fan-out
• Reduce bundle size

Fixed

• Fields named after Object.prototype members not being marked as touched on blur and setValue
• Dirty values extraction for fields named hasOwnProperty
• cloneObject dropping the length of sparse arrays
• cloneObject failing on objects with a null prototype
• Form options removed from props on re-render not being reset
• remove() mishandling duplicated indexes and mutating the indexes passed in
• useFieldArray unregistering fields while a parent array reindexes
• Input edited before the form is ready being overwritten
• useWatch not updating watched objects after an <Activity> subtree reconnects
• useWatch preferring its own defaultValue over form defaultValues for array names
• reset without values and keepDefaultValues setting isDirty to true
• Controller blur validation not working after reset
• watch reading a stale shouldUnregister option when a field registers
• Native validation reading a stale shouldUseNativeValidation option when stopping at the first error
• Form values stored under a ref key not being compared correctly
• setError, clearErrors and remaining error updates not producing a new errors reference

Commits

• 8ac7cc0 7.90.0
• 8f7d2de 🧪 tests cleanup and fix warnings (#13835)
• e76876b 🐞 fix(useForm): mark fields named after Object.prototype members as touched o...
• 08ddcd6 🐞 fix(cloneObject): keep the length of sparse arrays (#13834)
• b8e0a6d 🐞 fix: safely extract dirty values for hasOwnProperty fields (#13832)
• 36e5329 🐞 fix(useForm): reset options that are removed from the props on re-render (#...
• c7cb33a 🐞 fix(useFieldArray): ignore duplicated indexes and keep the indexes passed t...
• 91856c2 🧪 test(swap): cover self-index no-op behavior (#13829)
• 000faaf 🐞 fix(useFieldArray): skip unregister while a parent array reindexes (#13828)
• 7838f08 🐞 fix #13802: keep input edited before the form is ready (#13827)
• Additional commits viewable in compare view

Updates react-i18next from 17.0.15 to 17.0.16

Changelog

Sourced from react-i18next's changelog.

17.0.16

• fix(Trans): a selector i18nKey that points into a secondary namespace of useTranslation now resolves the same way t() does. With const { t } = useTranslation(['ns1', 'ns2']), t($ => $.ns2.message) works since 17.0.7, but <Trans t={t} i18nKey={$ => $.ns2.message} /> rendered the raw key (or its children). Trans always passed an ns option to t, filled from t.ns (the primary namespace only), and an explicit ns makes i18next's fixed t skip the hook's full namespace list (scopeNs). When Trans or TransWithoutContext gets a t that carries its own namespace and no ns prop, it now leaves ns out and lets that t apply its own. String keys, keyPrefix, nsMode: 'fallback', an explicit ns prop and Trans without a t prop behave as before. Compatibility note: if the primary namespace has a nested object named like a secondary namespace (ns1 → ns2.message), Trans now resolves $ => $.ns2.message to ns2:message, as t() already does. Fixes #1933.

Commits

• 606b6a5 17.0.16
• 51b7c26 fix(Trans): resolve selector keys into useTranslation's secondary namespaces
• 0a2f018 fix(examples): load the Swedish file in test-jest and align the ru plural tag...
• See full diff in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

• b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

• b500a2e 4.6.7
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• Additional commits viewable in compare view

Updates @tanstack/eslint-plugin-query from 5.104.0 to 5.104.2

Release notes

Sourced from @​tanstack/eslint-plugin-query's releases.

@​tanstack/eslint-plugin-query@​5.104.2

No changes in this release.

@​tanstack/eslint-plugin-query@​5.104.1

No changes in this release.

Changelog

Sourced from @​tanstack/eslint-plugin-query's changelog.

5.104.2

No changes in this release.

5.104.1

No changes in this release.

Commits

• b699b52 ci: Version Packages (#11849)
• e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
• df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
• d0cfa6a chore: replace eslint with oxlint (#11938)
• e3415e0 docs(eslint-plugin-query): add JSDoc to the properties of the exported interf...
• f9fe54c docs(eslint-plugin-query): add JSDoc to the exported classes, methods, and ar...
• 847036b docs(eslint-plugin-query): add JSDoc to the exported interfaces and type alia...
• 4736791 docs(*): end JSDoc descriptions with a period and start them with an uppercas...
• cbdb214 docs(*): replace JSDoc descriptions that only repeat the names and enforce 'j...
• fe30a84 docs(eslint-plugin-query): add missing JSDoc to rule helpers and utilities (#...
• Additional commits viewable in compare view

Updates @types/node from 26.6.3 to 26.6.5

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.1.1 to 6.1.2

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.2

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.2 (2026-10-05)

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not work...

Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: tinyauthapp/tinyauth/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 261a7bc2-c2c6-4a7f-805e-308458b3c1c5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}