chore(deps): bump the web group across 1 directory with 15 updates

[dependabot]

Bumps the web group with 15 updates in the /web directory:

Package	From	To
@cosmos.gl/graph	2.6.4	3.4.1
@hpcc-js/wasm-graphviz	1.21.5	1.28.0
@xyflow/react	12.10.2	12.11.3
js-yaml	4.2.0	5.3.0
lucide-react	0.468.0	1.31.0
monaco-editor	0.52.2	0.56.0
react	18.3.1	19.2.8
@types/react	18.3.28	19.2.18
react-dom	18.3.1	19.2.8
@types/react-dom	18.3.7	19.2.4
react-router	7.16.0	8.3.0
@playwright/test	1.60.0	1.62.1
@vitejs/plugin-react	4.7.0	6.0.5
typescript	5.9.3	7.0.2
vite	6.4.3	8.2.1

Updates @cosmos.gl/graph from 2.6.4 to 3.4.1

Release notes

Sourced from @​cosmos.gl/graph's releases.

Release v3.4

🎉 What's New

Better-Looking Dense Graphs

The repulsion force was rebuilt around one idea: handle far and near neighbors differently.

• Far away — a stack of grids, coarse for distant points and finer closer in. A distant group counts as one blob at its average position, and every part of space is counted exactly once: no gaps, no double counting, nothing to tune.
• Up close — real point-to-point forces instead of an average. From each nearby grid cell a point takes up to 8 actual neighbors, picked at random and re-picked every tick, weighted so it averages out to the exact answer as the layout settles. Cells holding 8 points or fewer use all of them, so most graphs get exact close-range forces.
• Stacked points — points sitting at exactly the same spot have no direction to separate along, so each is pushed along its own random direction and the pile comes apart instead of staying stuck.

Dense hubs spread into readable clouds and tight clusters open up. It's also faster per simulation step. How it works in detail →

simulationRepulsionTheta no longer does anything — the new algorithm has no distance bands to tune. It's still accepted so existing configs keep working, but you can safely delete it.

Smoother Hover on Large Graphs

The GPU now keeps extra, off-screen images of the graph in which every pixel records which point — or which link — covers it. Hovering is then a quick lookup: read the pixels right under the cursor, instead of checking every point in the graph.

The point image is drawn smaller than the screen — half resolution, and capped on very large displays. Hover doesn't need pixel-perfect precision, and at full size the image would cost tens of megabytes of GPU memory. Links keep full resolution, because a thin link would otherwise fall between pixels and become hard to hover. Both images are redrawn only when the scene changes, and hover reads them without making anything wait.

Hover does nothing at all while the scene and the cursor are both still, and picking is forgiving: you don't have to hit a point dead-center.

Faster Rendering When Points Overlap

When opaque points overlap, only the one on top is visible. The opaque middles are now drawn first, starting with the topmost point, so the GPU can skip whatever is buried underneath instead of drawing it and painting over it. Soft edges and see-through points follow in a second pass, so the picture looks exactly the same — while heavily overlapping scenes render faster.

It's on by default, and applies while points are fully opaque and highlighting isn't in use — otherwise rendering falls back to the old single pass on its own. Set pointOcclusionCulling: false to switch it off entirely. Live demo: Misc → Point Occlusion Culling.

On-Demand Rendering

Frames are drawn only when something changes, and rendering stops completely when your graph is idle — no GPU, CPU, or battery spent on a static scene. Interactions, config changes, and data updates all wake rendering automatically.

Release v3.3

🎉 What's New

Link Styles: Dashed, Dotted, and Gradient Links

Screen.Recording.2026-07-08.at.7.30.41.PM.mp4

Links can now be dashed or dotted, and colored as a gradient between their endpoint colors. Both combine freely — per link.

import { Graph, LinkStyle } from '@cosmos.gl/graph'
// one value per link, like setPointShapes
graph.setLinkStyles(new Float32Array([LinkStyle.Solid, LinkStyle.Dashed, LinkStyle.Dotted]))
// gradient from source to target point color
</tr></table>

... (truncated)

Commits

• e5b502d 3.4.1
• 9303283 fix(links): hide greyed-out links when link blending is off
• ea1342c fix(docs): make render/create/start/unpause docs match the code
• 202691a docs(history): record the tracked-index redesign and int-precision findings
• d0edabe fix(force): declare highp int for near-field point indices
• b2dbb9a fix(points): close the lasso with integer modulo
• c36d3b0 fix(points): tracked points follow the point, not a baked texel
• 03456ad fix(data): validate endpoints in getConnectedPointIndices too
• 62194c9 fix(data): reject link endpoints that are not real points
• 6859cbe fix(links): unblended link edges: opaque hard cut without losing thin strokes
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @hpcc-js/wasm-graphviz from 1.21.5 to 1.28.0

Release notes

Sourced from @​hpcc-js/wasm-graphviz's releases.

wasm-graphviz: v1.28.0

1.28.0 (2026-07-24)

Features

• nam-core: Add WebAssembly wrapper for Neural Amp Modeler DSP models (ca2c8ac)
• update DuckDB version to 1.5.5 in README, tests, and vcpkg configuration (ab79021)

Bug Fixes

• prevent automatic id attribute synchronization for implicitly created nodes in addEdge (522e4d5)

wasm-graphviz: v1.27.3

1.27.3 (2026-07-22)

Bug Fixes

• update load and unload methods for consistency and error handling (874c9f3)

wasm-graphviz: v1.27.2

1.27.2 (2026-07-21)

Bug Fixes

• add /docs/nam-core to .gitignore (2de35d2)

wasm-graphviz: v1.27.1

1.27.1 (2026-07-21)

Bug Fixes

• graphviz: update graph creation identifiers from 'name' to 'id' for consistency (bbcff19)

wasm-graphviz: v1.27.0

1.27.0 (2026-07-17)

Features

• enhance Subgraph and Graph classes with additional attributes for nodes, edges, and subgraphs (40e2e4c)

wasm-graphviz: v1.26.0

1.26.0 (2026-07-15)

... (truncated)

Commits

• 1d7a356 chore: release main (#424)
• ca2c8ac feat(nam-core): Add WebAssembly wrapper for Neural Amp Modeler DSP models
• 522e4d5 fix: prevent automatic id attribute synchronization for implicitly created no...
• ab79021 feat: update DuckDB version to 1.5.5 in README, tests, and vcpkg configuration
• b4279f0 chore: release main (#423)
• 874c9f3 fix: update load and unload methods for consistency and error handling
• 5a6e4ac chore: release main (#422)
• 2de35d2 fix: add /docs/nam-core to .gitignore
• cb49500 chore: release main (#421)
• bbcff19 fix(graphviz): update graph creation identifiers from 'name' to 'id' for cons...
• Additional commits viewable in compare view

Updates @xyflow/react from 12.10.2 to 12.11.3

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.11.3

Patch Changes

• #5902 393d951 - Allow middle-mouse viewport panning to start from a selection rectangle.

• #5889 ff126a0 - Fix extent: 'parent' not immediately resolving when parent has width or initialWidth.

• #5943 d1def59 - Invoke an error if handle can not be found

• #5947 2ba040f - Use correct nodeExtent for internal setNodes.

• #5918 c5d7442 - Fix selection box appearing when dragging the pane via touch. Prefer touch panning over drag selection when selectionOnDrag is combined with mouse-button-specific panOnDrag settings.

• #5922 392da00 - Allow Control to activate pane panning with a primary-button drag.

• #5929 4c5d7d2 - Allow key combinations of three or more keys (e.g. 'Meta+Shift+s') for useKeyPress.

• #5938 91a052f - Fix <Background /> pattern offset miscalculation.

• Updated dependencies [393d951, ff126a0, e5d86bd, 392da00]:

  • @​xyflow/system@​0.0.80

@​xyflow/react@​12.11.2

Patch Changes

• #5825 5072914 - Only create an XYDrag instance for draggable nodes.

• #5847 742860c - Stop the MiniMap from re-rendering on every store update.

• #5846 17c64a1 - Apply the viewport pan/zoom transform imperatively so the Viewport component only renders once.

• Updated dependencies [c707267, 0c0cebc, 56cf3b0, a01bb6b, 9b3f390, cdfcbeb]:

  • @​xyflow/system@​0.0.79

@​xyflow/react@​12.11.1

Patch Changes

• #5815 87da45c - Fix FinalConnectionState type so it preserves the discriminated union.

• #5823 a6afc91 - Update attribution link

... (truncated)

Changelog

Sourced from @​xyflow/react's changelog.

12.11.3

Patch Changes

• #5902 393d951 - Allow middle-mouse viewport panning to start from a selection rectangle.

• #5889 ff126a0 - Fix extent: 'parent' not immediately resolving when parent has width or initialWidth.

• #5943 d1def59 - Invoke an error if handle can not be found

• #5947 2ba040f - Use correct nodeExtent for internal setNodes.

• #5918 c5d7442 - Fix selection box appearing when dragging the pane via touch. Prefer touch panning over drag selection when selectionOnDrag is combined with mouse-button-specific panOnDrag settings.

• #5922 392da00 - Allow Control to activate pane panning with a primary-button drag.

• #5929 4c5d7d2 - Allow key combinations of three or more keys (e.g. 'Meta+Shift+s') for useKeyPress.

• #5938 91a052f - Fix <Background /> pattern offset miscalculation.

• Updated dependencies [393d951, ff126a0, e5d86bd, 392da00]:

  • @​xyflow/system@​0.0.80

12.11.2

Patch Changes

• #5825 5072914 - Only create an XYDrag instance for draggable nodes.

• #5847 742860c - Stop the MiniMap from re-rendering on every store update.

... (truncated)

Commits

• 359f70c chore(packages): bump
• e90a1b6 Merge pull request #5938 from Feyyus/fix/background-offset-precedence
• 2ba040f fix(react): use the current nodeExtent in setNodes
• 42f367e Merge pull request #5922 from Skyline-23/fix/control-pan-activation
• d7dbd57 Merge pull request #5929 from Jian-Zhang08/fix/usekeypress-multi-key-combination
• bdcf89a fix(edge-wrapper): pass onError prop closes #5936, closes #5932
• 91a052f fix(react): correct offset math in Background pattern
• 4c5d7d2 fix(react): make useKeyPress work with combinations of three or more keys
• 392da00 fix(system): allow Control key to activate pane panning
• c5d7442 fix(pane): prefer touch panning over drag selection
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​xyflow/react since your current version.

Updates js-yaml from 4.2.0 to 5.3.0

Changelog

Sourced from js-yaml's changelog.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

• Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.
• Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

Deprecated

• Deprecated flat constant exports. Use grouped ones instead.

Removed

• Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

• Validate << sequence items at merge time, so aliased merge sources are checked too.
• Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

[5.2.3] - 2026-08-01

Fixed

• Prevent prototype fallback when resolving tags and mapping entries, #782.
• Resolve !!timestamp years 0000-0099 correctly, #775.
• Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
• Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

[5.2.2] - 2026-07-24

Fixed

• Quote flow scalars where a colon precedes a flow indicator, #773.

Security

• Avoid exponential parsing time for nested flow sequence pairs.

... (truncated)

Commits

• 04db458 5.3.0 released
• 22ce0a0 Changelog update
• fae37b8 fix: << outside a mapping key no longer leaks the internal merge symbol
• b62ef83 fix: validate << sequence items at merge time, so aliased sources are check...
• cc665ec docs: review and update annotations
• 2aa24a6 Changelog update
• eec6902 Restore deprecated parser constant exports
• 03397ac Move throwErrorAt to YAMLException as throwAt
• d9dd2c7 docs: new condensed theme
• 0f898e6 docs: annotation tweaks
• Additional commits viewable in compare view

Updates lucide-react from 0.468.0 to 1.31.0

Release notes

Sourced from lucide-react's releases.

Version 1.31.0

What's Changed

• feat(icons): added mail-badge icon by @​lazerg in lucide-icons/lucide#4638
• feat(icons): add angle by @​samuelalake in lucide-icons/lucide#4545
• feat(icons): added eject icon by @​ThibautMarechal in lucide-icons/lucide#4043

New Contributors

• @​lazerg made their first contribution in lucide-icons/lucide#4638
• @​ThibautMarechal made their first contribution in lucide-icons/lucide#4043

Full Changelog: lucide-icons/lucide@1.30.0...1.31.0

Version 1.30.0

What's Changed

• chore(icons): refine & rename various emoji icons by @​karsa-mistmere in lucide-icons/lucide#4606
• fix(scripts): removed toBeRemovedInVersion from all scripts and tools by @​karsa-mistmere in lucide-icons/lucide#4674
• feat(icons): added audio-lines-x icon by @​karsa-mistmere in lucide-icons/lucide#4590
• feat(lab): added chinese-character icon to lab by @​congemcd in lucide-icons/lucide#4212
• test(packages): updates unit test snapshots with face-slightly-smiling by @​karsa-mistmere in lucide-icons/lucide#4676
• ci(dev): fix post-release job by downloading lucide-font artifact by name by @​ericfennis with @​Copilot in lucide-icons/lucide#4675
• feat(icons): add shield-lock icon by @​Caisere in lucide-icons/lucide#3508
• ci(security): Pin sha actions by @​jguddas in lucide-icons/lucide#4678
• feat(icons): added broom icon by @​karsa-mistmere in lucide-icons/lucide#4683

New Contributors

• @​congemcd made their first contribution in lucide-icons/lucide#4212
• @​Caisere made their first contribution in lucide-icons/lucide#3508

Full Changelog: lucide-icons/lucide@1.29.0...1.30.0

Version 1.29.0

What's Changed

• fix(@​lucide/lab): Fix lab build by @​ericfennis in lucide-icons/lucide#4618
• feat(copilot): remove incorrect spaces clause from copilot instructions by @​karsa-mistmere in lucide-icons/lucide#4623
• feat(docs): remove Super and Noodle from showcase by @​karsa-mistmere in lucide-icons/lucide#4626
• chore(deps-dev): bump @​angular/platform-server from 21.2.18 to 21.2.19 by @​dependabot[bot] in lucide-icons/lucide#4629
• ci(security): improve security with adding permissions by @​ericfennis in lucide-icons/lucide#4619
• feat(dependabot): added dependabot config, grouping PRs for each package by @​karsa-mistmere in lucide-icons/lucide#4633
• fix(ci): limit certain github workflows to main repository by @​karsa-mistmere in lucide-icons/lucide#4628
• fix(dependabot): Revert dependabot groups by @​ericfennis in lucide-icons/lucide#4665
• chore(dependabot): Group by dependency group by @​ericfennis in lucide-icons/lucide#4666
• chore(deps-dev): bump the svelte-deps group with 3 updates by @​dependabot[bot] in lucide-icons/lucide#4671
• chore(deps): bump the vue-deps group with 3 updates by @​dependabot[bot] in lucide-icons/lucide#4670
• chore(deps): bump the github-actions group with 13 updates by @​dependabot[bot] in lucide-icons/lucide#4668
• feat(icons): added layer reordering icons by @​karsa-mistmere in lucide-icons/lucide#4617

Full Changelog: lucide-icons/lucide@1.28.0...1.29.0

Version 1.28.0

... (truncated)

Commits

• 0f8d48b test(packages): updates unit test snapshots with face-slightly-smiling (#4676)
• f229f83 chore(depedencies): Update dependencies (#4553)
• 5ff536e ci(release.yml): Fix workflow and remove version scripts in package scripts...
• 07c885e fix(docs): fix zephyr-cloud URL in readmes
• 50d8af5 docs(readme): Update readme files (#4320)
• 653e44b feat(packages): use .mjs for ESM bundles (#4285)
• 7623e23 feat(docs): add Zephyr Cloud to Hero Backers tier & rework updateSponsors scr...
• dada0a8 fix(lucide-react): Fix dynamic imports (#4210)
• a6e648a fix(lucide-react): correct client directives in RSC files (#4189)
• 1f010a3 fix(lucide-react): Fixes provider export and RSC render issues (#4175)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lucide-react since your current version.

Updates monaco-editor from 0.52.2 to 0.56.0

Release notes

Sourced from monaco-editor's releases.

v0.56.0

Changes:

• #5392: Bump websocket-driver from 0.7.4 to 0.7.5 in /website
• #5396: Release Monaco Editor 0.56.0
• #5385: Bump websocket-driver from 0.7.4 to 0.7.5 in /samples
• #5379: Removes leftover debugger statements.
• #5376: fixes pipeline
• #5374: Bump webpack-dev-server from 5.2.4 to 5.2.5 in /samples
• #5373: Bump webpack-dev-server from 5.2.4 to 5.2.5 in /website
• #5371: Bump undici from 7.24.7 to 7.28.0
• #5372: Fixes CI
• #5363: Bump launch-editor from 2.10.0 to 2.14.1 in /samples

• #5362: Bump @​babel/core from 7.17.8 to 7.29.6 in /samples/browser-esm-webpack-typescript-react
• #5361: Bump js-yaml from 4.1.1 to 4.2.0
• #5360: Bump vite from 7.3.2 to 7.3.5
• #5358: Bump shell-quote from 1.8.3 to 1.8.4 in /samples
• #5359: Bump ws from 8.20.1 to 8.21.0 in /monaco-lsp-client
• #5357: Bump esbuild and vite in /samples/browser-esm-vite-react
• #5354: Bump shell-quote from 1.8.3 to 1.8.4 in /website
• #5333: Bump dompurify from 3.2.7 to 3.4.5
• #5347: Revert "Bump dompurify from 3.2.7 to 3.4.5"
• #5337: Bump qs from 6.14.2 to 6.15.2
• #5338: Bump qs and express in /samples
• #5336: Bump qs and express in /website
• #5335: Bump webpack-dev-server from 5.2.1 to 5.2.4 in /website
• #5331: Bump ws from 8.18.3 to 8.20.1 in /monaco-lsp-client
• #5330: Bump webpack-dev-server from 5.2.1 to 5.2.4 in /samples
• #5326: Run npm audit fix and update lockfile
• #5323: Bump postcss from 8.5.6 to 8.5.14 in /samples/browser-esm-vite-react
• #5322: Bump postcss from 8.5.6 to 8.5.14 in /website
• #5320: Bump @​babel/plugin-transform-modules-systemjs from 7.17.8 to 7.29.4 in /samples/browser-esm-webpack-typescript-react
• #5317: Bump fast-uri from 3.1.0 to 3.1.2 in /webpack-plugin
• #5315: Bump fast-uri from 3.0.6 to 3.1.2 in /samples
• #5316: Bump fast-uri from 3.1.0 to 3.1.2
• #5318: Bump fast-uri from 3.1.0 to 3.1.2 in /website
• #5319: Bump fast-uri from 3.1.0 to 3.1.2 in /samples/browser-esm-webpack-typescript-react
• #5313: Bump postcss from 8.4.31 to 8.5.13 in /samples
• #5308: Bump postcss from 8.5.6 to 8.5.12
• #5306: Bump postcss from 8.4.31 to 8.5.10 in /webpack-plugin
• #5301: Bump follow-redirects from 1.15.9 to 1.16.0 in /samples
• #5300: Bump follow-redirects from 1.15.11 to 1.16.0 in /website
• #5299: Bump follow-redirects from 1.15.6 to 1.16.0
• #5295: Bump vite from 5.4.21 to 6.4.2 in /samples/browser-esm-vite-react
• #5293: Bump lodash from 4.17.23 to 4.18.1 in /website
• #5292: Bump lodash from 4.17.23 to 4.18.1 in /samples

... (truncated)

Changelog

Sourced from monaco-editor's changelog.

[0.56.0]

Breaking Changes

• Reorganizes the exported ESM modules to provide supported, tree-shakeable entry points (#5155). The monaco-editor entry point continues to load all features and languages. Custom bundles can now import monaco-editor/editor and opt into:
  • all editor features with monaco-editor/features/register.all, or individual features with monaco-editor/features/<feature>/register;
  • all language definitions with monaco-editor/languages/definitions/register.all, or individual definitions with monaco-editor/languages/definitions/<language>/register;
  • the CSS, HTML, JSON, and TypeScript language features with monaco-editor/languages/features/register.all, or their individual register entry points.
• Renames the misspelled IOverlayWidgetPosition.stackOridinal property to stackOrdinal.
• Removes the deprecated IMirrorModel and IWorkerContext worker API types.

New Features and APIs

• Adds editor.doubleClickSelectsBlock.
• Adds editor.find.closeOnResult and editor.inlayHints.showLongLineWarning.
• Adds offWhenInlineCompletions to QuickSuggestionsValue.
• Adds model and provider option support to inline completion providers.
• Adds ICodeEditor.revealAllCursors, ICodeEditor.getWidthOfLine, and ICodeEditor.renderAsync.
• Adds advanced-external and advanced-wasm diff algorithms.
• Exposes typed native LSP client and transport APIs.

Fixes

• Treats Markdown returned by language servers as untrusted (#5280).
• Updates the editor core to the version used by 0.56.0-dev-20260625.

[0.55.1]

• Fixes missing language exports (monaco.json/typescript/...) due to wrong "types" path - #5123

[0.55.0]

Breaking Changes

• Moves nested namespaces (languages.css, languages.html, languages.json, languages.typescript) to top level namespaces (css, html, json, typescript) to simplify the build process and align with typescript recommendations.

New Features

• Adds native LSP support (see new lsp namespace).

Bug Fixes

• Updates dompurify to 3.2.7

[0.54.0]

• Adds option editor.mouseMiddleClickAction
• Various bug fixes

[0.53.0]

• ⚠️ This release deprecates the AMD build and ships with significant changes of the AMD build. The AMD build will still be shipped for a while, but we don't offer support for it anymore. Please migrate to the ESM build.

... (truncated)

Commits

• 13f0c87 Bump websocket-driver from 0.7.4 to 0.7.5 in /website (#5392)
• b5f23a3 Merge pull request #5396 from microsoft/hediet/b/release-0.56.0
• 9d053ab Improve Monaco Editor 0.56.0 changelog
• 0ba33d0 Release Monaco Editor 0.56.0
• 6d961b1 Bump websocket-driver from 0.7.4 to 0.7.5 in /samples (#5385)
• d8c9ff0 Removes leftover debugger statements. (#5379)
• 59285ab fixes pipeline (#5376)
• aaf58db Bump webpack-dev-server from 5.2.4 to 5.2.5 in /samples (#5374)
• d8ac38e Bump webpack-dev-server from 5.2.4 to 5.2.5 in /website (#5373)
• 874af57 Bump undici from 7.24.7 to 7.28.0 (#5371)
• Additional commits viewable in compare view

Updates react from 18.3.1 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

19.2.3 (December 11th, 2025)

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #35351)

19.2.2 (December 11th, 2025)

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon facebook/react#35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #35289, #35345)

19.2.1 (December 3rd, 2025)

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #35277)

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

... (truncated)

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #36425)

19.2.5 (March 18, 2026)

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #36236)

19.2.4 (Jan 26, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (@​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable #35632)

19.2.3 (Dec 11, 2025)

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #35351)

19.2.2 (Dec 11, 2025)

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #35289, #35345)

19.2.1 (Dec 3, 2025)

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #35277)

19.2.0 (October 1st, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

... (truncated)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• 23f4f9f 19.2.5
• 90ab3f8 Version 19.2.4
• 612e371 Version 19.2.3
• b910fc1 Version 19.2.2
• 053df4e Version 19.2.1
• 5667a41 Bump next prerelease version numbers (#34639)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates @types/react from 18.3.28 to 19.2.18

Commits

• See full diff in compare view

Updates react-dom from 18.3.1 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbab...

  Description has been truncated

[qiansheng91]

Summary

Reviewed PR #97: chore(deps): bump the web group in /web with 15 updates

The changes appear reasonable. No critical issues found in the diff.

---

Automated review by github-manager-bot

[qiansheng91]

Issue Evaluation

Category: enhancement | Status: Evaluated

Thank you for this suggestion. It has been classified as an enhancement request.

Assessment:

• This enhancement will be reviewed for feasibility and scope
• Community feedback is welcome
• If aligned with project goals, a spec and implementation PR may follow

---

Automated evaluation by github-manager-bot

[qiansheng91]

Issue Evaluation

Category: question

Thank you for your question. This has been flagged for maintainer review.

For more details, refer to the project documentation.

---

Automated evaluation by github-manager-bot

[qiansheng91]

Issue Evaluation

Category: needs-triage | Status: Needs Manual Review

Thank you @ for this issue. The automated classifier could not determine a clear category.

A maintainer will review and classify this issue manually.

---

Automated evaluation by github-manager-bot

[qiansheng91]

Issue Evaluation

Category: triage | Status: Needs Classification

This issue has been scanned but could not be automatically classified with high confidence. A maintainer review is recommended.

---

Automated evaluation by github-manager

[qiansheng91]

Issue Evaluation

Category: enhancement | Status: Evaluated

Thank you for the suggestion. This has been classified as an enhancement/dependency update.

Assessment:

• This will be reviewed by maintainers for feasibility and scope
• If accepted, it may be implemented in a future release

---

Automated evaluation by github-manager-bot

[qiansheng91]

Issue Evaluation

Category: triage | Status: Needs Classification

This issue has been received and is awaiting manual classification by a maintainer.

---

Automated evaluation by github-manager-bot

[qiansheng91]

Issue Evaluation

Category: bug | Status: Under Review

Thank you for reporting this issue. It has been classified as a potential bug and flagged for code-level verification.

A maintainer or automated agent will verify this against the current codebase. If confirmed, an automated fix proposal may be generated.

---

Automated evaluation by github-manager-bot