chore(deps): bump the production-dependencies group across 1 directory with 9 updates

[dependabot]

Bumps the production-dependencies group with 9 updates in the /apps/ui directory:

Package	From	To
@sentry/react	11.2.0	11.6.0
@tanstack/react-query	5.104.0	5.104.2
@tanstack/react-query-devtools	5.104.0	5.104.2
i18next	26.4.2	26.4.4
lucide-react	1.49.0	1.55.0
radix-ui	1.6.7	1.8.0
react-hook-form	7.89.0	7.90.0
react-i18next	17.0.15	17.0.16
zod	4.6.5	4.6.6

Updates @sentry/react from 11.2.0 to 11.6.0

Release notes

Sourced from @​sentry/react's releases.

11.6.0

Important Changes

• feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

  The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.

  import * as Sentry from '@sentry/nextjs/cloudflare';
  import handler from './.open-next/worker.js';
  export default Sentry.withSentry(
  env => ({
  dsn: env.SENTRY_DSN,
  tracesSampleRate: 1.0,
  }),
  handler,
  );

• feat(server-utils): Add instrumentation for pi-durable (#24993)

  The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

• fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

  When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).

Other Changes

• feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
• feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
• feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)
• feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)
• fix(browser): Check for clock drift on page lifecycle events (#25091)
• fix(core): Exclude attachments from internal exception events (#25160)
• fix(effect): Convert Effect span times to the Sentry clock (#24972)
• fix(effect): Detect HTTP spans named after the request method (#25159)
• fix(node): Register Vercel keep-alive listeners once (#25146)
• fix(replay): Place CLS and INP web vitals at the right time (#24990)
• fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)
• fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)

• chore: Add external contributor to CHANGELOG.md (#25136)
• chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)
• chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)
• feat(cloudflare): Wrap vinext Worker entries with @sentry/nextjs/cloudflare (#25000)

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

11.6.0

Important Changes

• feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

  The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.

  import * as Sentry from '@sentry/nextjs/cloudflare';
  import handler from './.open-next/worker.js';
  export default Sentry.withSentry(
  env => ({
  dsn: env.SENTRY_DSN,
  tracesSampleRate: 1.0,
  }),
  handler,
  );

• feat(server-utils): Add instrumentation for pi-durable (#24993)

  The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

• fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

  When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).

Other Changes

• feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
• feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
• feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)
• feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)
• fix(browser): Check for clock drift on page lifecycle events (#25091)
• fix(core): Exclude attachments from internal exception events (#25160)
• fix(effect): Convert Effect span times to the Sentry clock (#24972)
• fix(effect): Detect HTTP spans named after the request method (#25159)
• fix(node): Register Vercel keep-alive listeners once (#25146)
• fix(replay): Place CLS and INP web vitals at the right time (#24990)
• fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)
• fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)

• chore: Add external contributor to CHANGELOG.md (#25136)
• chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)
• chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)

... (truncated)

Commits

• 3c0c830 release: 11.6.0
• 13743e9 Merge pull request #25184 from getsentry/prepare-release/11.6.0
• 3605c50 chore(size-limit): Bump @​sentry/node size limits
• 53ae996 meta(changelog): Update changelog for 11.6.0
• e99e6e1 feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
• 2fdcb23 test(e2e): Add Mastra Jev classifier test to node-mastra (#25115)
• 5bb9a68 feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate span...
• 221dd86 test(e2e): Add a cloudflare-pi-durable end-to-end application (#25022)
• 966e1ff feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
• b70f6bb test(e2e): Add a node-pi-durable end-to-end application (#24994)
• Additional commits viewable in compare view

Updates @tanstack/react-query from 5.104.0 to 5.104.2

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.104.2
  • @​tanstack/react-query@​5.104.2

@​tanstack/react-query-next-experimental@​5.104.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.2

@​tanstack/react-query-persist-client@​5.104.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.104.2
  • @​tanstack/react-query@​5.104.2

@​tanstack/react-query@​5.104.2

Patch Changes

• Updated dependencies [03e8c39]:
  • @​tanstack/query-core@​5.104.2

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.2

Patch Changes

• Updated dependencies [03e8c39]:
  • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.104.1

Commits

• b699b52 ci: Version Packages (#11849)
• e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
• df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
• 833062c chore: replace prettier with oxfmt (#11939)
• d0cfa6a chore: replace eslint with oxlint (#11938)
• 0012ec1 docs(react-query): add JSDoc to the properties of the exported interfaces and...
• b5e8e7b docs(react-query): add JSDoc to the exported classes, methods, and arrow func...
• 01abab3 docs(*): note that 'throwOnError' makes the hook rethrow the errors of 'mutat...
• b42166e docs(react-query): add JSDoc to the exported interfaces and type aliases (#11...
• 205d422 docs(*): add missing JSDoc descriptions and enforce 'jsdoc/require-descriptio...
• Additional commits viewable in compare view

Updates @tanstack/react-query-devtools from 5.104.0 to 5.104.2

Release notes

Sourced from @​tanstack/react-query-devtools's releases.

@​tanstack/react-query-devtools@​5.104.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.104.2
  • @​tanstack/react-query@​5.104.2

Changelog

Sourced from @​tanstack/react-query-devtools's changelog.

5.104.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.104.2
  • @​tanstack/react-query@​5.104.2

5.104.1

Patch Changes

• Updated dependencies [ec060b6]:
  • @​tanstack/query-devtools@​5.104.1
  • @​tanstack/react-query@​5.104.1

Commits

• b699b52 ci: Version Packages (#11849)
• e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
• df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
• d0cfa6a chore: replace eslint with oxlint (#11938)
• 688f6e0 docs(*): describe 'shadowDOMTarget' as the shadow DOM the devtools styles are...
• b42166e docs(react-query): add JSDoc to the exported interfaces and type aliases (#11...
• ba341f5 docs(react-query): add missing JSDoc to react-query, react-query-next-experim...
• 9dd8afe docs(*): remove blank lines between JSDoc descriptions and tags and enforce '...
• 5ab1aae chore(eslint.config): use 'defineConfig' from 'eslint/config' (#11819)
• 29859ae ci: Version Packages (#11806)
• Additional commits viewable in compare view

Updates i18next from 26.4.2 to 26.4.4

Release notes

Sourced from i18next's releases.

v26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
• fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

• perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

Changelog

Sourced from i18next's changelog.

26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. See advisory GHSA-5jr9-983r-c8x4, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
• fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

26.4.3

• perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

Commits

• f6a7746 26.4.4
• 25988d5 build
• c9f8eba fix(security): nesting regexp ReDoS on unclosed $t( and single-pass nest(), c...
• 0d2845a 26.4.3
• a2dbe15 build
• e75843f perf: cache non-empty bundles in hasLanguageSomeTranslations, changelog v26.4.3
• edaea71 Fix TypeScript examples build and update them to i18next v26 (#2448)
• 4ebd19d docs: "For AI assistants" paragraph in the README and a fuller saveMissing JSDoc
• See full diff in compare view

Updates lucide-react from 1.49.0 to 1.55.0

Release notes

Sourced from lucide-react's releases.

Version 1.55.0

What's Changed

• feat(icons): added mail-dot icon by @​elenakovelskikh in lucide-icons/lucide#3230
• ci(lint): split lint jobs and annotate Prettier and JSON schema errors in PRs by @​ericfennis in lucide-icons/lucide#4982
• chore(deps-dev): bump sharp from 0.35.4 to 0.35.5 by @​dependabot[bot] in lucide-icons/lucide#4987
• chore(deps): bump next from 16.3.6 to 16.3.8 by @​dependabot[bot] in lucide-icons/lucide#4988
• test(lucide): add tests for empty icons error and DocumentFragment root in createIcons by @​grzdev in lucide-icons/lucide#4967
• feat(icons): added phone-log icon by @​Levi-Bensley in lucide-icons/lucide#3598
• chore(copilot-instruction): Adjust instruction text to allow more then 4 use-cases by @​ericfennis in lucide-icons/lucide#4989
• feat(icons): added wifi-lock icon by @​benhaube in lucide-icons/lucide#4913
• feat(icons): Add handle-bottom-right icon by @​ocavue in lucide-icons/lucide#1793
• test(lucide-react): add tests for DynamicIcon fallback and ref forwarding by @​grzdev in lucide-icons/lucide#4966
• feat(icons): added screw icon by @​edik17 in lucide-icons/lucide#4932
• feat(icons): added user-round-star icon by @​karsa-mistmere in lucide-icons/lucide#3469
• feat(icons): added shield-house icon by @​benhaube in lucide-icons/lucide#4602

New Contributors

• @​grzdev made their first contribution in lucide-icons/lucide#4967
• @​Levi-Bensley made their first contribution in lucide-icons/lucide#3598
• @​edik17 made their first contribution in lucide-icons/lucide#4932

Full Changelog: lucide-icons/lucide@1.54.0...1.55.0

Version 1.54.0

What's Changed

• feat(icons): added lens icon by @​rrod497 in lucide-icons/lucide#4923

Full Changelog: lucide-icons/lucide@1.53.0...1.54.0

Version 1.53.0

What's Changed

• chore(deps-dev): bump preact from 10.29.8 to 11.0.0 in the preact-deps group by @​dependabot[bot] in lucide-icons/lucide#4961
• chore(deps): bump vue from 3.5.42 to 3.5.43 in the vue-deps group by @​dependabot[bot] in lucide-icons/lucide#4958
• fix(site): Fix reset button and rename absolute stroke width to non-scaling stroke by @​ericfennis in lucide-icons/lucide#4956
• chore(deps-dev): bump simple-git from 3.36.0 to 4.0.1 by @​dependabot[bot] in lucide-icons/lucide#4968
• chore(deps-dev): bump the angular-deps group across 1 directory with 11 updates by @​dependabot[bot] in lucide-icons/lucide#4960
• chore(categories): Add description field to categories by @​ericfennis in lucide-icons/lucide#4909
• feat(icons): added groceries icon by @​rrod497 in lucide-icons/lucide#4907
• fix(icons): changed pen-tool icon by @​karsa-mistmere in lucide-icons/lucide#4972
• feat(icons): added new hiking-stick icon by @​kamilasw in lucide-icons/lucide#4711
• feat(icons): added scratch-blocks icon by @​mc20000-01 in lucide-icons/lucide#4969
• fix(icons): changed soup and salad icons by @​karsa-mistmere in lucide-icons/lucide#4971

New Contributors

• @​mc20000-01 made their first contribution in lucide-icons/lucide#4969

Full Changelog: lucide-icons/lucide@1.52.0...1.53.0

Version 1.52.0

... (truncated)

Commits

• 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
• 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
• 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
• See full diff in compare view

Updates radix-ui from 1.6.7 to 1.8.0

Changelog

Sourced from radix-ui's changelog.

1.8.0

Context Menu

• Allowed side, sideOffset, and align props to be overridden on ContextMenu.Content.

Navigation Menu

• Added data-state attribute to the content element when using NavigationMenu.Viewport for consistency.

Popover

• Fixed aria-controls being set on Popover.Trigger while the popover is closed.

Select

• Fixed content alignment when all items are disabled.
• Fixed a bug where updating a Select value programmatically while inside a <form> would dispatch a click event from the hidden bubble select that propagated to ancestor onClick handlers.

Slider

• Fixed a bug where updating a Slider value programmatically while inside a <form> would dispatch an input event that propagated to ancestor onInput handlers.

Slot

• Fixed Slot throwing when an asChild child is a lazy reference whose resolved value is itself a lazy reference.

Toast

• Fixed Toast.Viewport forcing a still-hydrating Suspense boundary to client-render.

Tooltip

• Fixed a bug where tabbing away from a focusable tooltip trigger nested in a modal popover moved focus to the popover's root instead of the next element in the popover.

Other updates

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
• Fixed timing bugs in useCallbackRef.
• Fixed FocusScope throwing a TypeError in test environments after teardown.
• Fixed a bug resulting from incorrect tree-shaking in SWC-minified code.
• Some small and breaking changes in unstable collection APIs. This package is an internal utility, undocumented, and unstable APIs may change without a major version bump. Capturing those changes here just in case you did a naughty and used them.
  • Renamed unstable_CollectionProps to unstable_CollectionSlotProps and unstable_CollectionItemMap to unstable_CollectionDict.
  • Added useGetCollection to the functions returned from unstable_createCollection.
  • Fixed display names of the collection context providers returned from unstable_createCollection.
  • Fixed collections keeping a stale item order when React moved items in the DOM without remounting them.

1.7.0

... (truncated)

Commits

• See full diff in compare view

Updates react-hook-form from 7.89.0 to 7.90.0

Release notes

Sourced from react-hook-form's releases.

Version 7.90.0

🐞 Fixes

• Fix useForm marking fields named after Object.prototype members as touched on blur and setValue (#13833)
• Fix cloneObject preserving the length of sparse arrays (#13834)
• Fix dirty values extraction for fields named hasOwnProperty (#13832)
• Fix useForm retaining options removed from props on re-render (#13831)
• Fix useFieldArray handling duplicate indexes in remove() without mutating the provided indexes (#13830)
• Fix useFieldArray unregistering fields while a parent array reindexes (#13828)
• Fix input values edited before the form is ready being lost (#13827)
• Fix useWatch not updating watched objects after an Activity subtree reconnects (#13819)
• Fix reset() incorrectly setting isDirty when using keepDefaultValues without values (#13820)
• Fix Controller blur validation not working after reset() (#13817)
• Fix watch using stale shouldUnregister options when registering fields (#13814)
• Fix form value comparison for fields named ref (#13812)
• Fix native validation using stale shouldUseNativeValidation options (#13806)
• Fix cloneObject not cloning objects with a null prototype (#13808)
• Fix useWatch array names not prioritizing form defaultValues (#13805)
• Fix error updates not producing a new errors reference (#13800)
• Fix setError and clearErrors not producing a new errors reference (#13791)

⚡ Performance Improvements

• Improve dirty fields checking (#13788)
• Improve subscription value handling (#13787)
• Improve watch API performance (#13792)
• Improve named scoped subscriptions (#13793)
• Preserve form-state tracking across unsubscribe (#13794)
• Improve subject subscription handling (#13795)
• Skip redundant form-state merges during subscriber notifications (#13796)
• Avoid allocations when matching subscription names (#13823)

🧹 Refactors

• Reduce bundle size (#13797, #13798)
• Clean up tests and fix warnings (#13835)

🧪 Tests

• Add coverage for useFieldArray index boundary and no-op behavior (#13815, #13822, #13824, #13829)
• Add coverage for JSON stringify and parse edge cases (#13821)

📦 Dependencies

• Bump fast-uri from 3.1.2 to 3.1.8 (#13811)
• Bump joi from 18.2.5 to 18.2.6 (#13810)

❤️ Thank You

Thanks to @​charan-rathore, @​zigzagdev, @​AdzerKI, @​huytdps13400, @​dfedoryshchev, @​kory-kaai, @​Mohamed-Elshesheny, @​breken-ai, @​sarmah-rup, @​00200200, @​giaBaoJS and @​bluebill1049 for their contributions! 🎉

Changelog

Sourced from react-hook-form's changelog.

[7.90.0] - 2026-10-10

Changed

• Improve performance of watch, subscribe, scoped subscriptions, dirty field checks and form state fan-out
• Reduce bundle size

Fixed

• Fields named after Object.prototype members not being marked as touched on blur and setValue
• Dirty values extraction for fields named hasOwnProperty
• cloneObject dropping the length of sparse arrays
• cloneObject failing on objects with a null prototype
• Form options removed from props on re-render not being reset
• remove() mishandling duplicated indexes and mutating the indexes passed in
• useFieldArray unregistering fields while a parent array reindexes
• Input edited before the form is ready being overwritten
• useWatch not updating watched objects after an <Activity> subtree reconnects
• useWatch preferring its own defaultValue over form defaultValues for array names
• reset without values and keepDefaultValues setting isDirty to true
• Controller blur validation not working after reset
• watch reading a stale shouldUnregister option when a field registers
• Native validation reading a stale shouldUseNativeValidation option when stopping at the first error
• Form values stored under a ref key not being compared correctly
• setError, clearErrors and remaining error updates not producing a new errors reference

Commits

• 8ac7cc0 7.90.0
• 8f7d2de 🧪 tests cleanup and fix warnings (#13835)
• e76876b 🐞 fix(useForm): mark fields named after Object.prototype members as touched o...
• 08ddcd6 🐞 fix(cloneObject): keep the length of sparse arrays (#13834)
• b8e0a6d 🐞 fix: safely extract dirty values for hasOwnProperty fields (#13832)
• 36e5329 🐞 fix(useForm): reset options that are removed from the props on re-render (#...
• c7cb33a 🐞 fix(useFieldArray): ignore duplicated indexes and keep the indexes passed t...
• 91856c2 🧪 test(swap): cover self-index no-op behavior (#13829)
• 000faaf 🐞 fix(useFieldArray): skip unregister while a parent array reindexes (#13828)
• 7838f08 🐞 fix #13802: keep input edited before the form is ready (#13827)
• Additional commits viewable in compare view

Updates react-i18next from 17.0.15 to 17.0.16

Changelog

Sourced from react-i18next's changelog.

17.0.16

• fix(Trans): a selector i18nKey that points into a secondary namespace of useTranslation now resolves the same way t() does. With const { t } = useTranslation(['ns1', 'ns2']), t($ => $.ns2.message) works since 17.0.7, but <Trans t={t} i18nKey={$ => $.ns2.message} /> rendered the raw key (or its children). Trans always passed an ns option to t, filled from t.ns (the primary namespace only), and an explicit ns makes i18next's fixed t skip the hook's full namespace list (scopeNs). When Trans or TransWithoutContext gets a t that carries its own namespace and no ns prop, it now leaves ns out and lets that t apply its own. String keys, keyPrefix, nsMode: 'fallback', an explicit ns prop and Trans without a t prop behave as before. Compatibility note: if the primary namespace has a nested object named like a secondary namespace (ns1 → ns2.message), Trans now resolves $ => $.ns2.message to ns2:message, as t() already does. Fixes #1933.

Commits

• 606b6a5 17.0.16
• 51b7c26 fix(Trans): resolve selector keys into useTranslation's secondary namespaces
• 0a2f018 fix(examples): load the Swedish file in test-jest and align the ru plural tag...
• See full diff in compare view

Updates zod from 4.6.5 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• 34a626f docs: tighten the z.locales tree-shaking note
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

[//]: # (dependabot-autom...

Description has been truncated