chore(deps): bump the minor-and-patch group across 1 directory with 41 updates

[dependabot]

Bumps the minor-and-patch group with 40 updates in the / directory:

Package	From	To
@radix-ui/react-accordion	1.2.2	1.2.12
@radix-ui/react-alert-dialog	1.1.4	1.1.15
@radix-ui/react-aspect-ratio	1.1.1	1.1.8
@radix-ui/react-avatar	1.1.2	1.1.11
@radix-ui/react-checkbox	1.1.3	1.3.3
@radix-ui/react-collapsible	1.1.2	1.1.12
@radix-ui/react-context-menu	2.2.4	2.2.16
@radix-ui/react-dialog	1.1.4	1.1.15
@radix-ui/react-dropdown-menu	2.1.4	2.1.16
@radix-ui/react-hover-card	1.1.4	1.1.15
@radix-ui/react-label	2.1.1	2.1.8
@radix-ui/react-menubar	1.1.4	1.1.16
@radix-ui/react-navigation-menu	1.2.3	1.2.14
@radix-ui/react-popover	1.1.4	1.1.15
@radix-ui/react-progress	1.1.1	1.1.8
@radix-ui/react-radio-group	1.2.2	1.3.8
@radix-ui/react-scroll-area	1.2.2	1.2.10
@radix-ui/react-select	2.1.4	2.2.6
@radix-ui/react-separator	1.1.1	1.1.8
@radix-ui/react-slider	1.2.2	1.3.6
@radix-ui/react-slot	1.1.1	1.2.4
@radix-ui/react-switch	1.1.2	1.2.6
@radix-ui/react-tabs	1.1.2	1.1.13
@radix-ui/react-toast	1.2.4	1.2.15
@radix-ui/react-toggle	1.1.1	1.1.10
@radix-ui/react-toggle-group	1.1.1	1.1.11
@radix-ui/react-tooltip	1.1.6	1.2.8
@supabase/supabase-js	2.89.0	2.106.1
autoprefixer	10.4.23	10.5.0
cmdk	1.0.4	1.1.1
date-fns	4.1.0	4.3.0
embla-carousel-react	8.5.1	8.6.0
geist	1.5.1	1.7.1
input-otp	1.4.1	1.4.2
next	15.5.9	15.5.18
react	19.2.3	19.2.6
@types/react	19.2.7	19.2.15
react-dom	19.2.3	19.2.6
react-hook-form	7.69.0	7.76.1
postcss	8.5.6	8.5.15

Updates @radix-ui/react-accordion from 1.2.2 to 1.2.12

Commits

• See full diff in compare view

Updates @radix-ui/react-alert-dialog from 1.1.4 to 1.1.15

Commits

• See full diff in compare view

Updates @radix-ui/react-aspect-ratio from 1.1.1 to 1.1.8

Commits

• See full diff in compare view

Updates @radix-ui/react-avatar from 1.1.2 to 1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-checkbox from 1.1.3 to 1.3.3

Commits

• See full diff in compare view

Updates @radix-ui/react-collapsible from 1.1.2 to 1.1.12

Commits

• See full diff in compare view

Updates @radix-ui/react-context-menu from 2.2.4 to 2.2.16

Commits

• See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.4 to 1.1.15

Commits

• See full diff in compare view

Updates @radix-ui/react-dropdown-menu from 2.1.4 to 2.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-hover-card from 1.1.4 to 1.1.15

Commits

• See full diff in compare view

Updates @radix-ui/react-label from 2.1.1 to 2.1.8

Commits

• See full diff in compare view

Updates @radix-ui/react-menubar from 1.1.4 to 1.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-navigation-menu from 1.2.3 to 1.2.14

Commits

• See full diff in compare view

Updates @radix-ui/react-popover from 1.1.4 to 1.1.15

Commits

• See full diff in compare view

Updates @radix-ui/react-progress from 1.1.1 to 1.1.8

Commits

• See full diff in compare view

Updates @radix-ui/react-radio-group from 1.2.2 to 1.3.8

Commits

• See full diff in compare view

Updates @radix-ui/react-scroll-area from 1.2.2 to 1.2.10

Commits

• See full diff in compare view

Updates @radix-ui/react-select from 2.1.4 to 2.2.6

Commits

• See full diff in compare view

Updates @radix-ui/react-separator from 1.1.1 to 1.1.8

Commits

• See full diff in compare view

Updates @radix-ui/react-slider from 1.2.2 to 1.3.6

Commits

• See full diff in compare view

Updates @radix-ui/react-slot from 1.1.1 to 1.2.4

Commits

• See full diff in compare view

Updates @radix-ui/react-switch from 1.1.2 to 1.2.6

Commits

• See full diff in compare view

Updates @radix-ui/react-tabs from 1.1.2 to 1.1.13

Commits

• See full diff in compare view

Updates @radix-ui/react-toast from 1.2.4 to 1.2.15

Commits

• See full diff in compare view

Updates @radix-ui/react-toggle from 1.1.1 to 1.1.10

Commits

• See full diff in compare view

Updates @radix-ui/react-toggle-group from 1.1.1 to 1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-tooltip from 1.1.6 to 1.2.8

Commits

• See full diff in compare view

Updates @supabase/supabase-js from 2.89.0 to 2.106.1

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.106.1

2.106.1 (2026-05-20)

🩹 Fixes

• auth: encode client-id in oauth requests (#2383)
• misc: hide dynamic import from hermesc (#2381)

❤️ Thank You

• Etienne Stalmans @​staaldraad
• Katerina Skroumpelou @​mandarini

v2.106.1-canary.1

2.106.1-canary.1 (2026-05-20)

🩹 Fixes

• misc: hide dynamic import from hermesc (#2381)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.106.1-canary.0

2.106.1-canary.0 (2026-05-20)

🩹 Fixes

• auth: encode client-id in oauth requests (#2383)

❤️ Thank You

• Etienne Stalmans @​staaldraad

v2.106.1-beta.3

2.106.1-beta.3 (2026-05-20)

🩹 Fixes

• auth: encode client-id in oauth requests (#2383)
• misc: otel import issue (8aa1ba2b)
• misc: add tests (459f429d)
• misc: address comments (6fdf9145)
• misc: another approach (334de162)
• misc: more fixes (26c6bbcb)
• misc: fix build (ebfbb428)
• misc: consolidate magic comments for rolldown (149ae914)
• misc: format (1a3f34b7)
• misc: trim comments (2c01bd16)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.106.1 (2026-05-20)

🩹 Fixes

• misc: hide dynamic import from hermesc (#2381)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.106.0 (2026-05-18)

🚀 Features

• supabase: W3C/OpenTelemetry trace context propagation (#2163)

🩹 Fixes

• release: mark @​supabase/tracing private and snapshot it for JSR (#2370)

❤️ Thank You

• Claude Sonnet 4.5
• Guilherme Souza
• Katerina Skroumpelou @​mandarini

2.105.4 (2026-05-08)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.105.2 (2026-05-04)

🩹 Fixes

• auth: forward lockAcquireTimeout to SupabaseAuthClient (#2309)
• misc: widen enum-like unions with (string & {}) for forward compat (#2303)

❤️ Thank You

• Muzzaiyyan Hussain @​MuzzaiyyanHussain

2.105.1 (2026-04-28)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.105.0 (2026-04-27)

🚀 Features

• auth: add passkey support with WebAuthn registration, authentication, and management (#2283)

... (truncated)

Commits

• 3f9628a fix(misc): hide dynamic import from hermesc (#2381)
• 1761a62 chore(release): version 2.106.0 changelogs (#2379)
• 1c48755 chore(deps): cleanups and updates (#2371)
• 9dfba1c chore(repo): migrate to pnpm (#2368)
• 6731c4a fix(release): mark @​supabase/tracing private and snapshot it for JSR (#2370)
• 2fe1801 feat(supabase): W3C/OpenTelemetry trace context propagation (#2163)
• fae6772 chore(repo): update to nx 22 (#2353)
• c6f7a38 chore(release): version 2.105.4 changelogs (#2342)
• db53b0f chore(release): version 2.105.2 changelogs (#2323)
• 5223888 [patchback] docs(repo): @​category and @​subcategory tags across all packages (...
• Additional commits viewable in compare view

Updates autoprefixer from 10.4.23 to 10.5.0

Release notes

Sourced from autoprefixer's releases.

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

Changelog

Sourced from autoprefixer's changelog.

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

Commits

• faf456a Release 10.5 version
• b841fc5 Update dependencies
• 47d6e68 Update email
• 45cfc08 Replace ESLint and Prettier to oxlint and oxfmt
• 7e3ec7d Add prefixing support for mask-position-x and mask-position-y (#1548)
• 360f2d9 Release 10.4.27 version
• ab5260c Update clean-publish
• 09e9dd1 Release 10.4.26 version
• ec75540 Ignore local patches
• 59601b8 Update c8 and clean-publish
• Additional commits viewable in compare view

Updates cmdk from 1.0.4 to 1.1.1

Release notes

Sourced from cmdk's releases.

v1.1.1

What's Changed

• Fix unintended double triggering of key bindings during IME composition by @​JaeSeoKim in pacocoursey/cmdk#339

New Contributors

• @​JaeSeoKim made their first contribution in pacocoursey/cmdk#339

Full Changelog: dip/cmdk@v1.1.0...v1.1.1

v1.1.0

What's Changed

• fix useCmdk return type by @​lsmurray in pacocoursey/cmdk#329
• fix: update the type of the defaultFilter by @​muZk in pacocoursey/cmdk#338
• [Accessibility] Use id instead of children by @​UltimateGG in pacocoursey/cmdk#254
• Use @radix-ui/react-compose-refs to merge refs, save on bundle size
• Use React built-in useSyncExternalStore and remove shim. Note that React 18 has always been a required peerDependency of cmdk

New Contributors

• @​lsmurray made their first contribution in pacocoursey/cmdk#329
• @​muZk made their first contribution in pacocoursey/cmdk#338
• @​UltimateGG made their first contribution in pacocoursey/cmdk#254

Full Changelog: dip/cmdk@v1.0.4...v1.1.0

Commits

• fb4ea04 v1.1.1
• f34d463 Fix unintended double triggering of key bindings during IME composition (#339)
• 2814a00 v1.1.0
• d46ed21 use built-in React uSES
• ec02b5e use composeRefs from radix
• e5444d2 remove unused code
• 34f3074 [Accessibility] Use id instead of children (#254)
• b2d94bd fix: update the type of the defaultFilter (#338)
• 9827edf fix useCmdk return type (#329)
• See full diff in compare view

Updates date-fns from 4.1.0 to 4.3.0

Release notes

Sourced from date-fns's releases.

v4.3.0

Kudos to @​ImRodry and @​puneetdixit200 for their contributions.

Fixed

• Fixed missing modularized optimization fallback (for Next.js and others). See #4193.

• Fixed pt locale first day of week to be Sunday. See #4195 by @​ImRodry.

• Fixed zh-CN, zh-HK, and zh-TW locale month parsing for October, November, and December. See #4194 by @​puneetdixit200.

v4.2.1

Fixed

• Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

• Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.

Commits

• f95bcf1 (docs): Add missing tsx dependency
• baaca11 Add //pkgs/core:release/docs task
• 8aa0373 Update docs website secrets location in scripts
• c7ad6eb Promote to v4.3.0
• da8c548 Add change log entry for Chinese locale fix (#4194)
• f8d8fa8 Split Chinese locale tests (#4194)
• b9c5865 Fix Chinese locale month parsing (#4194)
• 39d1e14 Add pt fix change log entry (#4195)
• f3f1963 Fix pt locale first day of week to be Sunday (#4195)
• cd6ebda Add basic AGENTS.md
• Additional commits viewable in compare view

Updates embla-carousel-react from 8.5.1 to 8.6.0

Release notes

Sourced from embla-carousel-react's releases.

v8.6.0

Support

Embla Carousel is an open source MIT licensed project. If you are interested in supporting this project you can sponsor it here:

• 💖 Sponsor

What's Changed

• [Bug]: scrollProgress not tightly synced to container translate by @​Matoseb in davidjerleke/embla-carousel#1134

New Contributors

• @​Matoseb made their first contribution in davidjerleke/embla-carousel#1134

Full Changelog: davidjerleke/embla-carousel@v8.5.2...v8.6.0

v8.5.2

Support

Embla Carousel is an open source MIT licensed project. If you are interested in supporting this project you can sponsor it here:

• 💖 Sponsor

What's Changed

• [Bug]: Offset by 1 issue for canScrollNext when tab size has fractional width by @​yasuhiro-yamamoto in davidjerleke/embla-carousel#1096
• [Bug]: Autoplay never starts if page with carousel is loaded in inactive browser tab by @​davidjerleke in davidjerleke/embla-carousel#1101

New Contributors

• @​yasuhiro-yamamoto made their first contribution in davidjerleke/embla-carousel#1096

Full Changelog: davidjerleke/embla-carousel@v8.5.1...v8.5.2

Commits

• 0fe6583 8.6.0
• a34a015 Merge pull request #1134 from Matoseb/master
• b0ef3dc Bug fix for #1132.
• 2617456 Build docs with v8.5.2.
• 5ee3c4e 8.5.2
• acad2f5 Merge pull request #1101 from davidjerleke/bug/#1082
• 6727eed Bug fix for #1082.
• 1b01939 Merge pull request #1096 from yasuhiro-yamamoto/fix/issue-899
• 266ef1b Bug fix for #899.
• ba2c14c Instantly start animation progress.
• Additional commits viewable in compare view

Updates framer-motion from 12.23.26 to 12.40.0

Changelog

Sourced from framer-motion's changelog.

[12.40.0] 2026-05-21

Added

• path option to transition.
• arc() for motion along an arc.

[12.39.0] 2026-05-18

Added

• Support for repeatType and repeatDelay in animation sequences.

Fixed

• Variants: Re-run keyframe animations when switching between variant labels even when they share identical keyframe arrays.
• Drag: Preserve in-flight motion value animations across React 19 reorder unmount/remount so dragSnapToOrigin no longer leaves the drag transform stranded after a layout swap.
• LazyMotion: Share React contexts between the framer-motion and framer-motion/m (and therefore motion/react and motion/react-m) CJS bundles so that <m.div> from the /m subpath picks up features loaded by <LazyMotion> from the main entry point.
• useScroll: Support hydrating target and container refs from anywhere in the tree.
• Drag: Gesture no longer starts from incorrect start point when rendered inside <AnimatePresence initial={false} />.
• Drag: dragConstraints, when set as viewport-relative ref, no longer break on scroll.§
• Updated visualElement hydration order.
• useAnimate: Now respects skipAnimations.
• AnimatePresence: Fix object-form initial values not applied on re-entry after exit completes.
• scroll: Fixed callback progress when tracking an element.
• useScroll: Fix hardware acceleration when tracking an element.

[12.38.0] 2026-03-16

Added

• Added layoutAnchor prop to configure custom anchor point for resolving relative projection boxes.

Fixed

• Reorder: Fix axis switching after window resize.
• Reorder: Fix with virtualised lists.
• AnimatePresence: Ensure children are removed when exit animation matches current values.

[12.37.0] 2026-03-16

Added

• Support for hardware accelerating "start" and "end" offsets in scroll and useScroll.
• Support for oklch, oklab, lab, lch, color, color-mix, light-dark color types.

Fixed

• Fix whileInView with client-side navigation.
• Fix draggable elements when layout updates due to surrounding element re-renders.

... (truncated)

Commits

• 38ebb94 v12.40.0
• b1f766c Latest
• bca5544 Merge pull request #3699 from motiondivision/lochie/arcs-injectable
• f1a96cf arc(): rename amp/rotate, expose MotionPath, fix explicit cw/ccw
• b4aaba0 pathRotation: non-destructive orientToPath rotation channel
• 8604ef3 Make arcs injectable via transition.path = arc()
• f90fe29 add orientToPath
• 9ebe999 fix: test
• bc2107e Revert "no should"
• 6eeb92d no should
• Additional commits viewable in compare view

Updates geist from 1.5.1 to 1.7.1

Release notes

Sourced from geist's releases.

geist@1.7.0

We're excited to announce a new member to our font family: Geist Pixel

It's a display typeface family featuring five unique pixel-based variants, each with a distinct visual style. It is designed for decorative use in headlines, logos, and other display contexts where a pixelated aesthetic is desired.

It includes five distinct variants, each exported separately:

Export	CSS Variable	Description
GeistPixelSquare	--font-geist-pixel-square	Square pixel shapes
GeistPixelGrid	--font-geist-pixel-grid	Grid-based pixel pattern
GeistPixelCircle	--font-geist-pixel-circle	Circular pixel shapes
GeistPixelTriangle	--font-geist-pixel-triangle	Triangular pixel shapes
GeistPixelLine	--font-geist-pixel-line	Line-based pixel pattern

import {
  GeistPixelSquare,
  GeistPixelGrid,
  GeistPixelCircle,
  GeistPixelTriangle,
  GeistPixelLine,
} from "geist/font/pixel";

Changelog

Sourced from geist's changelog.

1.7.1

Patch Changes

• c8ed578: Fix Geist Mono rendering source-code text with unintended programming ligatures.

  v1.7.0 unintentionally activated programming-ligature substitutions (-->, ==, !=, ..., --, etc.) under the liga (Standard Ligatures) OpenType feature, which is on by default in every renderer. As a result, text like --debug-prerender, [id...], [...id], or NODE_OPTIONS='--debug-prerender' node rendered with ligated glyphs and broke monospace alignment in code.

  The source-level fix is in #217; this release ships the rebuilt binaries.

1.7.0

Minor Changes

• d7ef63c: We're excited to announce a new member to our font family: Geist Pixel

  It's a display typeface family featuring five unique pixel-based variants, each with a distinct visual style. It is designed for decorative use in headlines, logos, and other display contexts where a pixelated aesthetic is desired.

  It includes five distinct variants, each exported separately:

  Export	CSS Variable	Description
  GeistPixelSquare	--font-geist-pixel-square	Square pixel shapes
  GeistPixelGrid	--font-geist-pixel-grid	Grid-based pixel pattern
  GeistPixelCircle	--font-geist-pixel-circle	Circular pixel shapes
  GeistPixelTriangle	--font-geist-pixel-triangle	Triangular pixel shapes
  GeistPixelLine	--font-geist-pixel-line	Line-based pixel pattern

  import {
    GeistPixelSquare,
    GeistPixelGrid,
    GeistPixelCircle,
    GeistPixelTriangle,
    GeistPixelLine,
  } from "geist/font/pixel";

Commits

• 8b8b75f fix(release): sync package.json version and unignore packages/**/package.json...
• 88309a4 Version Packages (#223)
• 6af2e7f ci: harden release workflow (#222)
• c8ed578 chore: add changeset for geist@1.7.1 (Mono liga regression fix) (#221)
• a0a06a3 make build
• 855f609 Fix broken link in README.md
• 8aad8b1 trigger release
• 723e7ec fix: remove beta, switch to 1.7.0 to sync with GH release version number
• 750611c update: changeset release note
• 2d6add6 chore: version packages for beta release
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for geist since your current version.

Updates input-otp from 1.4.1 to 1.4.2

Changelog

Sourced from input-otp's changelog.

[1.4.2]

• chore(input): remove unintentional log within internal pasteListener

Commits

• See full diff in compare view

Updates next from 15.5.9 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.16

This release contains security fixes for the following advisories:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits

• 9ff92ce v15.5.18
• 00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
• 62c97ab v15.5.17
• 423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
• fa78739 Turbopack: Fix middleware matcher suffix (#93590)
• 36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
• 36589b5 [backport][test] Pin package manager to patch versions (#93596)
• ad6fd4e v15.5.16
• 79d7dff Ignore malformed CSP nonce headers (#103)
• c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates react from 19.2.3 to 19.2.6

Release notes

Sourced from react's releases.

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

Commits

• eaf3e95 Version 19.2.6
• 23f4f9f 19.2.5
• 90ab3f8 Version 19.2.4
• See full diff in compare view

Updates @types/react from 19.2.7 to 19.2.15

Commits

• See full diff in compare view

Updates react-dom from 19.2.3 to 19.2.6

Release notes

Sourced from react-dom's releases.

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

Commits

• eaf3e95 Version 19.2.6
• 23f4f9f 19.2.5
• 90ab3f8 Version 19.2.4
• See full diff in compare view

Updates react-hook-form from 7.69.0 to 7.76.1

Release notes

Sourced from react-hook-form's releases.

Version 7.76.1

🐞 fix: pass options parameter through setValues to enable validation (#13457) 🐞 fix(setValues): emit whole-form change without stale name/type (#13450) 🚗 perf(setValues): thread skipClone through setFieldValue (#13448) 🚗 perf(setValues): skip redundant per-field deep clones (#13445) Revert "🐞 fix: treat NaN as empty when valueAsNumber is true in validateField (#13388)"

thanks to @​philibea & @​maxkostow

Version v7.76.0

🪭 close #13141 improve isDirty sync with dirtyFields state (#13370) 🐞 fix isValidating reactivity when validatingFields is not subscribed (#13440) 🛺 test: fix duplicate-word typos in test descriptions (#13439) 🐞 fix #13436: errors state when using form level validation (#13437) 🐞 fix #13429 append({ obj: null }) is silently replaced by defaultValues after remove() (#13435) 🐞 fix native validation tooltip suppression caused by duplicate submit-error focus (#13432) 🐞 fix: propagate setValues updates to mounted Controller fields (#13431) 🐞 fix: rreserve reset values for conditionally mounted Controller fields with shouldUnregister 🐞 fix: useFieldArray remove leaves array with empty object when using values prop (#13422) 🐞 fix #13260: notify all matching field-array roots on nested setValue updates (#13420) 🐞 fix #13104: preserve nested resolver field-array errors in trigger() (#13419) 🐞 fix #13413: preserve formState.defaultValues when useFieldArray + watch are used together 📝 docs: fix JSDoc for IsNever, register, and getFieldState (#13410) (#13411) 🐞 fix(Watch): restore TypeScript 4 compatibility (#13409)

Big thanks to @​dfedoryshchev for multiple fixes, and to @​EduardF1, @​in-ch and @​johnstrand.

Version 7.75.0

🦧 feat: improve get dirty fields prune empty fields (#13363)

+ dirtyFields: { test: [{ data: false }] }
- dirtyFields: {} // removed the empty node with false value

🎹 typescript 6.0 (#13330) 🌡️ chore: minor improvement on setValue & reset (#13366) 🐞 fix #13403: include setValues in FormProvider context value (

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fusiontik	Ready	Preview, Comment	May 25, 2026 2:41am