deps: bump the desktop-minor-and-patch group across 1 directory with 21 updates

[dependabot]

Bumps the desktop-minor-and-patch group with 21 updates in the / directory:

Package	From	To
@tanstack/react-query	5.101.4	5.103.1
input-otp	1.4.2	1.5.0
jose	6.2.5	6.2.12
react-hook-form	7.83.0	7.88.0
react-router-dom	7.18.2	7.18.4
sonner	2.0.7	2.0.8
tailwind-merge	3.6.0	3.7.0
uuid	14.0.1	14.0.2
@playwright/test	1.62.1	1.63.0
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.7
@types/node	26.1.2	26.6.1
@vitejs/plugin-react	6.0.5	6.1.1
@vitest/coverage-v8	4.1.10	4.1.11
autoprefixer	10.5.4	10.6.1
baseline-browser-mapping	2.11.8	2.11.25
eslint-plugin-react-refresh	0.5.3	0.5.7
globals	17.8.0	17.12.0
postcss	8.5.25	8.5.28
vite	8.2.0	8.3.0
vitest	4.1.10	4.1.11

Updates @tanstack/react-query from 5.101.4 to 5.103.1

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.103.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.103.1
  • @​tanstack/react-query@​5.103.1

@​tanstack/react-query-next-experimental@​5.103.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.103.1

@​tanstack/react-query-persist-client@​5.103.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.103.1
  • @​tanstack/react-query@​5.103.1

@​tanstack/react-query@​5.103.1

Patch Changes

• Updated dependencies [8330b2f, 3212966]:
  • @​tanstack/query-core@​5.103.1

@​tanstack/react-query-devtools@​5.103.0

Patch Changes

• #11501 9567367 - Declare dependencies used by the published devtools source and type declarations so they resolve with strict package managers. Keep runtime dependencies bundled in the compiled devtools.

  Declare the React types used by React Query Devtools as a peer dependency, compatible with React 18 and 19.

• Updated dependencies [9567367]:

  • @​tanstack/query-devtools@​5.103.0
  • @​tanstack/react-query@​5.103.0

@​tanstack/react-query-next-experimental@​5.103.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.103.0

@​tanstack/react-query-persist-client@​5.103.0

Patch Changes

• Updated dependencies [4c7cdbb]:
  • @​tanstack/query-persist-client-core@​5.103.0
  • @​tanstack/react-query@​5.103.0

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.103.1

Patch Changes

• Updated dependencies [8330b2f, 3212966]:
  • @​tanstack/query-core@​5.103.1

5.103.0

Patch Changes

• Updated dependencies [e57f816, fdae2ce, a1119e5, cbf77bf]:
  • @​tanstack/query-core@​5.103.0

5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.8

5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.7

5.102.6

Patch Changes

• #11305 ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

• Updated dependencies []:

  • @​tanstack/query-core@​5.102.6

5.102.5

Patch Changes

• Updated dependencies [578e5c2]:
  • @​tanstack/query-core@​5.102.5

5.102.4

Patch Changes

• Updated dependencies [a05df6a]:
  • @​tanstack/query-core@​5.102.4

... (truncated)

Commits

• c08f576 ci: Version Packages (#11511)
• 19ccf27 ci: Version Packages (#11339)
• 2da46cd chore(*): use eslint description syntax for grandfathered 'no-restricted-synt...
• 58ad3e2 fix: isolate TypeScript test output (#11503)
• d63afc7 Simplifed query methods/internal tests new lint (#11347)
• 23fbdc3 test({react,preact,solid,angular}-query): remove 'fromGenericOptionsQueryFn' ...
• 50680b9 test({react,preact,solid,svelte}-query,angular-query-experimental): rename 'm...
• 0b326b6 test({react,preact}-query/useMutation): add tests for 'MutationFunctionContex...
• a1119e5 ref(hydration): remove outdated dehydratedAt fallback (#11436)
• 1a51bb8 docs(*): clarify 'Promise.all' only waits for all mutateAsync calls when they...
• Additional commits viewable in compare view

Updates input-otp from 1.4.2 to 1.5.0

Release notes

Sourced from input-otp's releases.

v1.5.0

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

• fix(input): reserve the password manager badge gutter only where it fits
• fix(input): disable spellcheck by default
• fix(input): feature-detect ResizeObserver before observing
• fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
• fix(input): clear pending synchronization timeouts on unmount
• feat(input): add a nonce prop for Content-Security-Policy support
• fix(input): guard the input reference used by the selectionchange listener
• fix(input): opt the container out of browser translation
• fix(input): report cosmetic CSS rule failures as warnings instead of errors
• docs: document the stable iOS selection behavior and its cosmetic limitation

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

• revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
• revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
• docs: align the mobile and edge-case documentation with the stable candidate
• test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

• fix(input): reserve the password manager badge gutter only where it fits
  • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
• fix(input): disable spellcheck by default
  • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
• fix(input): feature-detect ResizeObserver before observing
  • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
• fix(input): fall back to 16px font-size until --root-height resolves
  • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
• fix(input): clear pending sync timeouts on unmount
  • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
• feat(input): add nonce prop
  • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
• fix(input): use the guarded input reference inside the selectionchange listener
  • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
• fix(input): opt the container out of browser translation
  • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.
• fix(input): log CSS rule insertion failures as warnings, not errors
  • Some environments reject individual cosmetic selectors (:autofill in older Android WebViews, for instance). Nothing breaks when that happens, but the console.error was captured by Sentry and similar tools as if the application had failed. Same message, warning level.
• chore(types): narrow onComplete to (value: string) => unknown

... (truncated)

Changelog

Sourced from input-otp's changelog.

[1.5.0]

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

• fix(input): reserve the password manager badge gutter only where it fits
• fix(input): disable spellcheck by default
• fix(input): feature-detect ResizeObserver before observing
• fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
• fix(input): clear pending synchronization timeouts on unmount
• feat(input): add a nonce prop for Content-Security-Policy support
• fix(input): guard the input reference used by the selectionchange listener
• fix(input): opt the container out of browser translation
• fix(input): report cosmetic CSS rule failures as warnings instead of errors
• docs: document the stable iOS selection behavior and its cosmetic limitation

[1.5.0-beta.2]

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

• revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
• revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
• docs: align the mobile and edge-case documentation with the stable candidate
• test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

[1.5.0-beta.1]

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

[1.5.0-beta.0]

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

• fix(input): reserve the password manager badge gutter only where it fits
  • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
• fix(input): disable spellcheck by default
  • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
• fix(input): feature-detect ResizeObserver before observing
  • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
• fix(input): fall back to 16px font-size until --root-height resolves
  • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
• fix(input): clear pending sync timeouts on unmount
  • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
• feat(input): add nonce prop
  • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
• fix(input): use the guarded input reference inside the selectionchange listener
  • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
• fix(input): opt the container out of browser translation
  • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for input-otp since your current version.

Updates jose from 6.2.5 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits

• 505a55b chore(release): 6.2.12
• 7bc9a33 perf: encode single-signature JWS input once
• 78637bd perf: normalize General JWE shared headers once
• bf5138b perf: deduplicate pending jwks key imports
• b23a6f3 perf: use native encoding for larger ASCII strings
• fd3ae3f perf: normalize jwks selection metadata once
• 6925d43 perf: avoid copying AES-GCM output
• be62530 docs: clarify and shorten public API guidance
• 1b41312 build: preserve README when generation fails
• 0b51829 build: check tree-shaking for every public binding
• Additional commits viewable in compare view

Updates react-hook-form from 7.83.0 to 7.88.0

Release notes

Sourced from react-hook-form's releases.

Version 7.88.0

✨ Features

• Add Error Message component (#13472)
• Add the Error Message component for displaying validation errors from React Hook Form.

🐞 Fixes

• Fix stale validating state after resetField() (#13735)
• Fix errors and touched state remaining for rows removed by replace() (#13734)
• Fix stale resolver results updating form state after reset() during handleSubmit() (#13733)
• Fix nested registered errors being removed when trigger() targets their parent (#13732)
• Fix resolver-reported root errors being dropped during handleSubmit() (#13731)
• Fix parent errors being incorrectly set when trigger() targets a field with only nested resolver errors (#13730)
• Fix useWatch compute cache not being initialized with the initial output (#13728)
• Fix FileList being lost during flatten/expand and omit undefined values in jsonToFormData (#13725)
• Fix schemaErrorLookup reporting nested containers as exact-name errors (#13727)
• Fix isValidating not being recomputed after unregister() clears validating fields (#13723)
• Fix stale resolver state updates after reset() (#13722)
• Fix iterateFieldsByAction only breaking out of one loop level (#13718)
• Fix stale validation types surviving setError() overwrites (#13716)
• Fix reset() not clearing validating fields (#13714)
• Fix remove() leaking deleted values onto surviving field-array items (#13713)
• Fix the React Server build being unpublished (#13709)
• Fix validateField calling setCustomValidity once per key in validate-object mode (#13707)
• Fix useFieldArray focus behavior for checkboxes and radio buttons in appended rows (#13705)
• Fix getFieldState reading isValidating from the supplied form state (#13704)
• Fix unregister() stripping kept values from the submit payload (#13703)
• Fix useFormState not re-subscribing when control changes (#13702)
• Fix reset() keeping dirtyFields out of sync with isDirty when keepValues is enabled (#13701)
• Fix useForm not reconciling correctly when an Activity subtree is initially hidden (#13698)
• Fix cleared errors returning after the delayError timer fires (#13697)
• Fix cloneObject throwing when checking Blob with instanceof (#13694)
• Fix useFieldArray retaining stale fields after an Activity subtree reconnects (#13688)

🧹 Refactors

• Extend _isTracked to the remaining multi-key proxy/subscribe form-state checks (#13699)
• Extract _isTracked helper for proxy/subscribe form-state checks (#13690)
• Remove the unused abortEarly parameter from iterateFieldsByAction (#13689)
• Remove redundant optional chaining from clearErrors (#13696)

📝 Documentation

• Fix useWatch compute example variable names in JSDoc (#13700)

📦 Dependencies

• Bump joi from 18.2.1 to 18.2.5 (#13719)

... (truncated)

Changelog

Sourced from react-hook-form's changelog.

Changelog

[7.87.0] - 2026-08-30

Added

• shouldTouch option for trigger()
• OpaqueTypes registry for opaque leaf types

Fixed

• Inconsistent behavior among useController().field.onChange()-like APIs
• Controller under a null parent submitting undefined instead of a value
• ERR_MODULE_NOT_FOUND resolving react-hook-form due to a react-server declaration (Next.js builds)
• useWatch never reconciling when an Activity subtree is hidden on its first render
• resetField not recomputing isValid for subscribe-only consumers
• generateWatchOutput ignoring defaultValue for an array of names
• useFormState never reconciling when an Activity subtree is hidden on its first render

[7.86.0] - 2026-08-22

Added

• Type-safe getErrors method

Performance

• Improve createFormControl
• Improve clone object check
• Avoid cloning values in unregister without subscribers

Fixed

• Field array update leaving stale errors and touched state at the updated index
• flatten discarding File and Blob values instead of treating them as leaf nodes
• validateField not passing the field error to setCustomValidity when criteriaMode is all
• hasValidation treating falsy but valid values (min: 0, max: 0, minLength: 0, maxLength: 0, required: '') as no validation
• setValue targeting a nested leaf not notifying a Controller registered on a field array item root
• setValues not updating fields registered under an object or array value
• useWatch returning a stale value on name change when the new value is null
• unregister inverting keepDirty when broadcasting isDirty

[7.85.0] - 2026-08-08

Added

• Support <Activity />

Fixed

... (truncated)

Commits

• 28334fa 7.88.0
• 8b7e0e4 🐞 fix(setValue): compare transformed value for dirty state with valueAs/setVa...
• b5c210b 🐞 fix: cancel nested delayError timers when a parent is cleared or unregister...
• 8918788 🐞 fix: refresh criteriaMode flag when form options are updated at runtime (#1...
• 39cfba0 🐞 fix(resetField): clear stale validating state for the field (#13735)
• a448816 🐞 fix: drop errors and touched state for rows removed by replace() (#13734)
• 3756191 🐞 fix(handleSubmit): ignore stale resolver result after reset (#13733)
• d2b757f 🐞 fix(trigger): keep registered nested errors when trigger targets their pare...
• f32faed 🐞 fix(handleSubmit): keep resolver-reported root errors on submit (#13731)
• cdcbfca 🐞 fix: don't set parent error when trigger target has only nested resolver er...
• Additional commits viewable in compare view

Updates react-router-dom from 7.18.2 to 7.18.4

Changelog

Sourced from react-router-dom's changelog.

v7.18.4

Patch Changes

• Updated dependencies:
  • react-router@7.18.4

v7.18.3

Patch Changes

• Updated dependencies:
  • react-router@7.18.3

Commits

• 1b1e0b0 Release v7.18.4 (#15498)
• 23166df Release v7.18.3 (#15424)
• See full diff in compare view

Updates sonner from 2.0.7 to 2.0.8

Release notes

Sourced from sonner's releases.

v2.0.8

What's Changed

• Added support for custom aria labels by @​hirotomoyamada in emilkowalski/sonner#704
• Fixed handling when hotkey is an empty array by @​hirotomoyamada in emilkowalski/sonner#703
• fix: keep the toaster as top layer when react-aria modal is open by @​sadeghbarati in emilkowalski/sonner#699
• fix: format by @​WuMingDao in emilkowalski/sonner#707
• fix: add missing safari prefix by @​emilkowalski in emilkowalski/sonner#710
• Fix event listener removal in hooks.tsx by @​VishwaGauravIn in emilkowalski/sonner#711
• Fix dismiss for custom toast by @​reegodev in emilkowalski/sonner#717
• Use variables in close button colors instead of hardcoded values by @​faroukfaiz10 in emilkowalski/sonner#726
• Fix a batch of reported issues by @​emilkowalski in emilkowalski/sonner#777

New Contributors

• @​hirotomoyamada made their first contribution in emilkowalski/sonner#704
• @​sadeghbarati made their first contribution in emilkowalski/sonner#699
• @​WuMingDao made their first contribution in emilkowalski/sonner#707
• @​VishwaGauravIn made their first contribution in emilkowalski/sonner#711
• @​reegodev made their first contribution in emilkowalski/sonner#717
• @​faroukfaiz10 made their first contribution in emilkowalski/sonner#726

Full Changelog: emilkowalski/sonner@v2.0.7...v2.0.8

Commits

• 6739aca v2.0.8
• ecce184 Fix a batch of reported issues (#777)
• 45d8940 Use variables in close button colors instead of hardcoded values (#726)
• fe51da1 Fix dismiss for custom toast (#717)
• c2d6990 fix: event listener removal in hooks.tsx (#711)
• 5caadb1 Add safari prefix (#710)
• ea3410f fix: format (#707)
• a685ffc fix: keep the toaster as top layer when react-aria modal is open (#699)
• 7760223 fix(index.tsx): ensure hotkey array is not empty before checking (#703)
• 8c0ce1e feat(toaster): add support for custom aria labels (#704)
• See full diff in compare view

Updates tailwind-merge from 3.6.0 to 3.7.0

Release notes

Sourced from tailwind-merge's releases.

tailwind-merge@3.7.0

New Features

• Prepare some upcoming changes by @​dcastil in dcastil/tailwind-merge#713
  • Theme getters returned by fromTheme now expose the theme key they read as a themeKey property, so tooling can identify the referenced theme scale without calling the getter.
  • Release tags now include the package name, starting with tailwind-merge@3.7.0.

Bug Fixes

• Fix arbitrary values using color() or light-dark() being classified as lengths instead of colors by @​ddussi in dcastil/tailwind-merge#712
• Fix bare bg-conic not merging with other background image classes by @​dcastil in dcastil/tailwind-merge#708
• Fix columns-auto not conflicting with other columns classes by @​dcastil in dcastil/tailwind-merge#707
• Fix container sizes like inline-2xl not merging by @​dcastil in dcastil/tailwind-merge#706
• Fix max-h-none missing in max-h class group by @​mutewinter in dcastil/tailwind-merge#704
• Fix axis shorthands like px not overriding logical sides like ps by @​dcastil in dcastil/tailwind-merge#705
• Fix leading-none being removed when the leading theme scale is overridden by @​chatman-media in dcastil/tailwind-merge#689
• Fix deprecated shadow-inner being classified as shadow color instead of shadow by @​dcastil in dcastil/tailwind-merge#703

Documentation

• Add Deno to install instructions by @​bartlomieju in dcastil/tailwind-merge#687
• Add missing text-shadow theme key to configuration docs by @​dcastil in dcastil/tailwind-merge@3e6d208

Other

• Switch package manager from yarn to pnpm by @​dcastil in dcastil/tailwind-merge#680
• Harden CI security by @​dcastil in dcastil/tailwind-merge#679

Full Changelog: v3.6.0...v3.7.0

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​openclaw, @​sourcegraph, @​cesarvcanal, @​CasperKristiansson, @​jbisasky, @​frontendmasters and more via @​thnxdev for sponsoring tailwind-merge! ❤️

Commits

• 511d68a tailwind-merge@3.7.0
• 2461127 Release tooling: Pass the namespaced tag prefix and commit message to pnpm's ...
• 9d41508 add changelog for tailwind-merge@3.7.0
• c78a80f Configurator: Reuse runtime lookups during pruning
• 49c317d Monorepo: Fix contributing link and include package coverage
• 7b565ca Configurator: prune a generated config to a project's used classes (core step)
• d83e013 Releases: auto-re-pin tag-pinned links on every version bump
• b71fd41 Docs: pin every in-repo file link to a release tag instead of main
• ee29441 Docs: point the ThemeObject JSDoc link at the packaged docs location
• 9521b10 Releases: per-package pipeline with namespaced tags
• Additional commits viewable in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq...

  Description has been truncated

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.