deps: bump the desktop-minor-and-patch group across 1 directory with 20 updates

[dependabot]

Bumps the desktop-minor-and-patch group with 19 updates in the / directory:

Package	From	To
@tanstack/react-query	5.101.4	5.102.8
input-otp	1.4.2	1.5.0
jose	6.2.5	6.2.12
react-hook-form	7.83.0	7.87.0
react-router-dom	7.18.2	7.18.3
sonner	2.0.7	2.0.8
uuid	14.0.1	14.0.2
@playwright/test	1.62.1	1.63.0
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.7
@types/node	26.1.2	26.5.1
@vitejs/plugin-react	6.0.5	6.1.1
@vitest/coverage-v8	4.1.10	4.1.11
autoprefixer	10.5.4	10.5.6
baseline-browser-mapping	2.11.8	2.11.22
eslint-plugin-react-refresh	0.5.3	0.5.6
globals	17.8.0	17.12.0
postcss	8.5.25	8.5.28
vite	8.2.0	8.3.0

Updates @tanstack/react-query from 5.101.4 to 5.102.8

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.102.8
  • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-next-experimental@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-persist-client@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.102.8
  • @​tanstack/react-query@​5.102.8

@​tanstack/react-query@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.8

@​tanstack/react-query-devtools@​5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.102.7
  • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-next-experimental@​5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-persist-client@​5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.102.7
  • @​tanstack/react-query@​5.102.7

@​tanstack/react-query@​5.102.7

Patch Changes

• Updated dependencies []:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.8

5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.7

5.102.6

Patch Changes

• #11305 ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

• Updated dependencies []:

  • @​tanstack/query-core@​5.102.6

5.102.5

Patch Changes

• Updated dependencies [578e5c2]:
  • @​tanstack/query-core@​5.102.5

5.102.4

Patch Changes

• Updated dependencies [a05df6a]:
  • @​tanstack/query-core@​5.102.4

5.102.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.3

5.102.2

Patch Changes

• Updated dependencies [80fbf73]:
  • @​tanstack/query-core@​5.102.2

... (truncated)

Commits

• 2969edf ci: Version Packages (#11316)
• 2eb3c7c ci: Version Packages (#11313)
• 714df67 ci: Version Packages (#11306)
• ac2b612 fix(react-query): propagate falsy errors to the error boundary (#11305)
• 1836e61 ci: Version Packages (#11303)
• 51f12db ci: Version Packages (#11294)
• 730b3aa ci: Version Packages (#11276)
• 388bbaf ci: Version Packages (#11265)
• bc423b3 ci: Version Packages (#11261)
• be1352b test(*): add adapter-level type coverage for optional undefinable mutate vari...
• Additional commits viewable in compare view

Updates input-otp from 1.4.2 to 1.5.0

Release notes

Sourced from input-otp's releases.

v1.5.0

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

• fix(input): reserve the password manager badge gutter only where it fits
• fix(input): disable spellcheck by default
• fix(input): feature-detect ResizeObserver before observing
• fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
• fix(input): clear pending synchronization timeouts on unmount
• feat(input): add a nonce prop for Content-Security-Policy support
• fix(input): guard the input reference used by the selectionchange listener
• fix(input): opt the container out of browser translation
• fix(input): report cosmetic CSS rule failures as warnings instead of errors
• docs: document the stable iOS selection behavior and its cosmetic limitation

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

• revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
• revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
• docs: align the mobile and edge-case documentation with the stable candidate
• test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

• fix(input): reserve the password manager badge gutter only where it fits
  • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
• fix(input): disable spellcheck by default
  • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
• fix(input): feature-detect ResizeObserver before observing
  • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
• fix(input): fall back to 16px font-size until --root-height resolves
  • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
• fix(input): clear pending sync timeouts on unmount
  • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
• feat(input): add nonce prop
  • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
• fix(input): use the guarded input reference inside the selectionchange listener
  • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
• fix(input): opt the container out of browser translation
  • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.
• fix(input): log CSS rule insertion failures as warnings, not errors
  • Some environments reject individual cosmetic selectors (:autofill in older Android WebViews, for instance). Nothing breaks when that happens, but the console.error was captured by Sentry and similar tools as if the application had failed. Same message, warning level.
• chore(types): narrow onComplete to (value: string) => unknown

... (truncated)

Changelog

Sourced from input-otp's changelog.

[1.5.0]

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

• fix(input): reserve the password manager badge gutter only where it fits
• fix(input): disable spellcheck by default
• fix(input): feature-detect ResizeObserver before observing
• fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
• fix(input): clear pending synchronization timeouts on unmount
• feat(input): add a nonce prop for Content-Security-Policy support
• fix(input): guard the input reference used by the selectionchange listener
• fix(input): opt the container out of browser translation
• fix(input): report cosmetic CSS rule failures as warnings instead of errors
• docs: document the stable iOS selection behavior and its cosmetic limitation

[1.5.0-beta.2]

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

• revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
• revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
• docs: align the mobile and edge-case documentation with the stable candidate
• test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

[1.5.0-beta.1]

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

[1.5.0-beta.0]

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

• fix(input): reserve the password manager badge gutter only where it fits
  • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
• fix(input): disable spellcheck by default
  • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
• fix(input): feature-detect ResizeObserver before observing
  • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
• fix(input): fall back to 16px font-size until --root-height resolves
  • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
• fix(input): clear pending sync timeouts on unmount
  • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
• feat(input): add nonce prop
  • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
• fix(input): use the guarded input reference inside the selectionchange listener
  • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
• fix(input): opt the container out of browser translation
  • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for input-otp since your current version.

Updates jose from 6.2.5 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits

• 505a55b chore(release): 6.2.12
• 7bc9a33 perf: encode single-signature JWS input once
• 78637bd perf: normalize General JWE shared headers once
• bf5138b perf: deduplicate pending jwks key imports
• b23a6f3 perf: use native encoding for larger ASCII strings
• fd3ae3f perf: normalize jwks selection metadata once
• 6925d43 perf: avoid copying AES-GCM output
• be62530 docs: clarify and shorten public API guidance
• 1b41312 build: preserve README when generation fails
• 0b51829 build: check tree-shaking for every public binding
• Additional commits viewable in compare view

Updates react-hook-form from 7.83.0 to 7.87.0

Release notes

Sourced from react-hook-form's releases.

Version 7.87.0

✨ Features

• Add shouldTouch option to trigger() ([#13671](react-hook-form/react-hook-form#13671))

  setValue already supported shouldTouch; trigger() now does too. This allows you to mark field(s) as touched after manual or programmatic validation, such as validate-on-mount or multi-step form navigation, without needing a setValue workaround:

  // Mark a single field as touched after validating it
  await trigger('firstName', { shouldTouch: true });
  // Mark every mounted field as touched after validating the whole form
  await trigger(undefined, { shouldTouch: true });

• Add OpaqueTypes registry for opaque leaf types ([#13676](react-hook-form/react-hook-form#13676))

  Recursive type helpers (Path, DeepPartial, DeepRequired, FieldErrorsImpl, etc.) previously stopped only at Primitive | BrowserNativeObject. As a result, rich third-party value types such as Dayjs and Decimal could be recursively traversed member-by-member, potentially causing TypeScript to report "Excessive complexity" diagnostics on large form types.

  You can now register a type as an opaque leaf via declaration merging:

  import type { Dayjs } from 'dayjs';
  declare module 'react-hook-form' {
  interface OpaqueTypes {
  dayjs: Dayjs;
  }
  }

  While the registry is empty, types remain identical to the existing behavior. This is purely opt-in.

🐞 Fixes

• Fix inconsistent behavior among useController().field.onChange()-like APIs. ([#13673](react-hook-form/react-hook-form#13673))
• Fix Controller under a null parent submitting undefined instead of a value. ([#13675](react-hook-form/react-hook-form#13675))
• Fix ERR_MODULE_NOT_FOUND when resolving react-hook-form due to a react-server declaration in Next.js builds. ([#13682](react-hook-form/react-hook-form#13682))
• Fix useWatch never reconciling when an Activity subtree is hidden on its first render. ([#13683](react-hook-form/react-hook-form#13683))
• Fix resetField not recomputing isValid for subscribe-only consumers. ([#13684](react-hook-form/react-hook-form#13684))
• Fix generateWatchOutput ignoring defaultValue for an array of names. ([#13686](react-hook-form/react-hook-form#13686))
• Fix useFormState never reconciling when an Activity subtree is hidden on its first render. ([#13687](react-hook-form/react-hook-form#13687))

❤️ Thank You

Thanks to @​giaBaoJS, @​dfedoryshchev, @​Alioth-91, @​Masatoshi0227, @​modosc, and @​bluebill1049 for their contributions! 🎉

Version 7.86.0

✨ Features

... (truncated)

Changelog

Sourced from react-hook-form's changelog.

[7.87.0] - 2026-08-30

Added

• shouldTouch option for trigger()
• OpaqueTypes registry for opaque leaf types

Fixed

• Inconsistent behavior among useController().field.onChange()-like APIs
• Controller under a null parent submitting undefined instead of a value
• ERR_MODULE_NOT_FOUND resolving react-hook-form due to a react-server declaration (Next.js builds)
• useWatch never reconciling when an Activity subtree is hidden on its first render
• resetField not recomputing isValid for subscribe-only consumers
• generateWatchOutput ignoring defaultValue for an array of names
• useFormState never reconciling when an Activity subtree is hidden on its first render

[7.86.0] - 2026-08-22

Added

• Type-safe getErrors method

Performance

• Improve createFormControl
• Improve clone object check
• Avoid cloning values in unregister without subscribers

Fixed

• Field array update leaving stale errors and touched state at the updated index
• flatten discarding File and Blob values instead of treating them as leaf nodes
• validateField not passing the field error to setCustomValidity when criteriaMode is all
• hasValidation treating falsy but valid values (min: 0, max: 0, minLength: 0, maxLength: 0, required: '') as no validation
• setValue targeting a nested leaf not notifying a Controller registered on a field array item root
• setValues not updating fields registered under an object or array value
• useWatch returning a stale value on name change when the new value is null
• unregister inverting keepDirty when broadcasting isDirty

[7.85.0] - 2026-08-08

Added

• Support <Activity />

Fixed

• getFieldState error resolution from a field path
• useWatch discarding useForm({ defaultValues }) in favor of its own defaultValue before the form mounts

... (truncated)

Commits

• 29af888 7.87.0
• 1eeab63 🐞 fix(useFormState): never reconciles when an Activity subtree is hidden on i...
• 145441c 🐞 fix(generateWatchOutput): defaultValue is ignored for an array of names (#1...
• 1fb065c 🐞 fix(resetField): isValid not recomputed for subscribe-only consumers (#13684)
• 2f7380e 🧹refactor: use continue instead of return in setFieldValues' hasOwnProper...
• 1b0a314 📖 remove comment
• a457ca7 🐞 fix #13680: useWatch never reconciles when an Activity subtree is hidden on...
• bb3360f 🐞 fix #13681 issue: ERR_MODULE_NOT_FOUND, Can't resolve react-hook-form due t...
• f646948 🪅 feat: add OpaqueTypes registry for opaque leaf types (#13676)
• e17a95c 🧇 chore: scope the lock workflow to issues so its scheduled run can finish (#...
• Additional commits viewable in compare view

Updates react-router-dom from 7.18.2 to 7.18.3

Changelog

Sourced from react-router-dom's changelog.

v7.18.3

Patch Changes

• Updated dependencies:
  • react-router@7.18.3

Commits

• 23166df Release v7.18.3 (#15424)
• See full diff in compare view

Updates sonner from 2.0.7 to 2.0.8

Release notes

Sourced from sonner's releases.

v2.0.8

What's Changed

• Added support for custom aria labels by @​hirotomoyamada in emilkowalski/sonner#704
• Fixed handling when hotkey is an empty array by @​hirotomoyamada in emilkowalski/sonner#703
• fix: keep the toaster as top layer when react-aria modal is open by @​sadeghbarati in emilkowalski/sonner#699
• fix: format by @​WuMingDao in emilkowalski/sonner#707
• fix: add missing safari prefix by @​emilkowalski in emilkowalski/sonner#710
• Fix event listener removal in hooks.tsx by @​VishwaGauravIn in emilkowalski/sonner#711
• Fix dismiss for custom toast by @​reegodev in emilkowalski/sonner#717
• Use variables in close button colors instead of hardcoded values by @​faroukfaiz10 in emilkowalski/sonner#726
• Fix a batch of reported issues by @​emilkowalski in emilkowalski/sonner#777

New Contributors

• @​hirotomoyamada made their first contribution in emilkowalski/sonner#704
• @​sadeghbarati made their first contribution in emilkowalski/sonner#699
• @​WuMingDao made their first contribution in emilkowalski/sonner#707
• @​VishwaGauravIn made their first contribution in emilkowalski/sonner#711
• @​reegodev made their first contribution in emilkowalski/sonner#717
• @​faroukfaiz10 made their first contribution in emilkowalski/sonner#726

Full Changelog: emilkowalski/sonner@v2.0.7...v2.0.8

Commits

• 6739aca v2.0.8
• ecce184 Fix a batch of reported issues (#777)
• 45d8940 Use variables in close button colors instead of hardcoded values (#726)
• fe51da1 Fix dismiss for custom toast (#717)
• c2d6990 fix: event listener removal in hooks.tsx (#711)
• 5caadb1 Add safari prefix (#710)
• ea3410f fix: format (#707)
• a685ffc fix: keep the toaster as top layer when react-aria modal is open (#699)
• 7760223 fix(index.tsx): ensure hotkey array is not empty before checking (#703)
• 8c0ce1e feat(toaster): add support for custom aria labels (#704)
• See full diff in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Commits

• fd59f02 chore(main): release 14.0.2 (#967)
• f3c564e docs: point the Node support permalink at the CI version matrix (#974)
• b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
• 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
• ea83515 docs: cleanup API summary (#968)
• ac36860 chore: pin publint version in CI (#966)
• a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
• See full diff in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates @testing-library/user-event from 14.6.1 to 14.6.7

Release notes

Sourced from

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.