fix(deps): update rjsf monorepo to v6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@rjsf/core	^5.24.8 → ^6.0.0
@rjsf/utils	^5.24.8 → ^6.0.0
@rjsf/validator-ajv8	^5.24.8 → ^6.0.0

---

Release Notes

rjsf-team/react-jsonschema-form (@​rjsf/core)

v6.6.2

Compare Source

@​rjsf/core

• Fixed schema-change handling so dependent enum updates sanitize invalid scalar field data without over-sanitizing root, object, array, readonly, or disabled field changes, fixing #​3838
• Updated Form tests to verify fix for #​1357 and #​2492
  • Also added console message suppression support to the tests to reduce noise
• Updated MultiSchemaField by skipping next option recalculation when a user selects an option, fixing #​3833
• Updated Form's validate() function to pass the original schema to AJV when no pre-resolved schema is provided, fixing #​3368
• Improved performance of IconButtons in all themes, ArrayField components and ObjectField components using memoization, partially fixing #​3183
• Fixed ObjectField so renaming an additionalProperties key to an empty string is no longer silently dropped, using Object.hasOwn instead of a falsy check (#​5098)

@​rjsf/utils

• Updated sanitizeDataForNewSchema() to preserve valid enum values while replacing or clearing stale values across enum, oneOf, and anyOf schema changes, fixing #​3838
• Updated sanitizeDataForNewSchema() to filter out invalid enum values in arrays, fixing #​1357 and #​2492

Dev / docs / playground

• Upgraded vitest and jsdom to the latest to remove deprecated package warnings
• Fix a documentation error related to precedence when setting default values (#​5089)

v6.6.1

Compare Source

Dev / docs / playground

• Updated peer dependencies to 6.6.x

v6.6.0

Compare Source

@​rjsf/core

• Updated Form to stop using removeOptionalEmptyObjects() and deprecating removeEmptyOptionalObjects prop

@​rjsf/utils

• Adopted the svelte-jsonschema-form algorithm for omitExtraData(), adding in support for the code from removeOptionalEmptyObjects(), exporting the isValueEmpty() function from the library
• Deprecated the removeOptionalEmptyObject() and toPathSchema() functions, toPathSchema() on SchemaUtilsType and the PathSchema type
• Added relaxOptionsForScoring() utility that normalizes a oneOf/anyOf option list for scoring with optional $refs resolution
  Converts boolean schemas to object equivalents and widens additionalProperties: false → true so that getClosestMatchingOption does not produce false negatives when form data contains keys not declared in properties
• Fixed resolveAnyOrOneOfSchemas (called by schemaParser with expandAllBranches=true) to use getFirstMatchingOption on the options returned from relaxOptionsForScoring() so that they are captured for precompiled validators
• Extracted the shallowAllOfMerge() function from retrieveSchema.ts into its own file for additional use in omitExtraData.ts

@​rjsf/validator-ajv8

• Added integration tests verifying that getFirstMatchingOption, getClosestMatchingOption, and omitExtraData work correctly when given an AJV8PrecompiledValidator compiled from a oneOf schema whose branches carry additionalProperties: false (both direct options and options defined via $ref)

@​rjsf/validator-ata

• Added @rjsf/validator-ata, an ata-validator backed alternative to @rjsf/validator-ajv8. The public surface mirrors the AJV package (customizeValidator(), ValidatorType<T, S, F>, custom formats, transformErrors, customValidate, suppressDuplicateFiltering), so swapping the import is enough for existing forms to keep working. AJV-only options (AjvClass, ajvFormatOptions, ajvOptionsOverrides) are replaced by ataOptionsOverrides, and the ata-validator format set is always installed. Depends on ata-validator ^0.17.4, which carries stable ATA#### error codes and rich error metadata (expected, received, schemaSource, dataFrame, suggestion, docUrl) that transformErrors can consume. See the validator-ata API reference for the full list of differences (#​5063)
• Wired through precompiled validators. compileSchemaValidators compiles a schema to a standalone module via ata-validator's bundleStandalone, and createPrecompiledValidator loads it as a ValidatorType, mirroring @rjsf/validator-ajv8. Error output matches the non-precompiled validator, including per-field errors for schema-valued additionalProperties (ata-validator >= 0.17.4); an invalid anyOf reports a single error on the field, the same as the runtime path. Custom formats in a precompiled bundle must be a RegExp or string pattern, since a function checker cannot be serialized into the standalone bundle (#​5078)

Dev / docs / playground

• Added a validator-ata API reference page under api-reference describing the package and its differences from validator-ajv8 (#​5063)
• Documented the compileSchemaValidators and createPrecompiledValidator APIs on the validator-ata API reference page (#​5078)
• Added ATA and ATA (coerceTypes) choices to the playground validator picker (#​5063)
• Removed the ataValidatorBrowserCompat workaround from the playground Vite config. The bump to ata-validator ^0.18.2 makes the patch unnecessary, since the validator no longer touches the filesystem at module init. See ata-core/ata-validator#25
• Updated the form-props.md and utility-functions.md to document the deprecations and uiSchema.md to cleanup the enumNames docs slightly
• Switched out eslint/prettier for OxLint/Oxfmt and jest/babel for vitest

v6.5.3

Compare Source

@​rjsf/core

• Fixed processPendingChange leaving optional object keys as undefined after clearing text inputs (invalid for AJV type: "string"), by unsetting keys for resolved non-oneOf/anyOf leaves while preserving explicit undefined for oneOf/anyOf branches, fixing #​4518
• Added support for the JSON Schema deprecated keyword in SchemaField, providing options to hide, disable, or label deprecated fields via a new deprecatedHandling global UI option, fixing #​5024
• Pass FieldPathList through to findFieldInSchema without per-segment string mapping now that SchemaFieldPath is supported in @rjsf/utils (follow-up to #​4518 fix)

@​rjsf/utils

• Added deprecatedHandling to GlobalUISchemaOptions and updated StrictRJSFSchema to be recursive, ensuring the deprecated keyword (and future extensions) are supported in all nested schema structures without requiring type casts, fixing #​5024
  • Also added DeprecatedLabel to TranslatableString to support internationalization of the deprecated field suffix
• Added SchemaFieldPath (string | FieldPathList) for getFromSchema / findFieldInSchema; fixed schema descent when a segment is numeric 0 (previously skipped due to falsy check); use string keys for required / oneOf fallback matching
• Fixed mergeDefaultsWithFormData calling Object.entries on non-object defaults (e.g. long data: URL strings for single file fields), which iterated every character and caused severe UI freezes, fixing #​5055

v6.5.2

Compare Source

@​rjsf/core

• Fixed processPendingChange() using originalErrorSchema (which already contains merged extraErrors) as the base for mergeErrors(), causing sibling-field extraErrors to accumulate duplicate entries on every array mutation, fixing #​5041
• Added ObjectField test for renaming a nested additionalProperties key using userEvent and reset() via a form ref, verifying fix for #​4948
• Updated ArrayField's change handling to only null out data for paths that are directly an array indexed value and not object properties within them, fixing #​4952

@​rjsf/mui

• Added computeSxProp() helper to utils.ts, ran the MUI v9.0.0/system-props codemod on the directory and then updated the sx changes to use computeSxProps()
• Also transformed the use of style blocks for margins or explicit marginTop or marginBottom in MUI into sx values within DescriptionField, FieldHelpTemplate, ObjectFieldTemplate and SubmitButton,
  • Updated snapshots accordingly
• Upgraded the peerDependencies to add support for MUI v9

@​rjsf/utils

• Switched deepEquals from lodash.isEqualWith to fast-equals.createCustomEqual with cycle detection enabled, and replaced direct lodash.isEqual usage in useDeepCompareMemo, isRootSchema, and findSelectedOptionInXxxOf with deepEquals, fixing #​4291
• Fixed getObjectDefaults re-injecting stale schema-level default keys into an additionalProperties object when formData already contains its own keys (e.g. after a key rename), preventing ghost entries from reappearing, fixing #​4948

@​rjsf/validator-ajv8

• Cached the most recent rootSchema reference in handleSchemaUpdate so repeated isValid calls with the same root schema skip the deep-equality check and Ajv re-registration, fixing #​4291

Dev / docs / playground

• Cleaned up testing to make registry mocks simpler using getTestRegistry() function
• Refactored antd specific test setup out of testing/testSetup.ts
• Updated the Playground to use MUI v9

v6.5.1

Compare Source

Dev / docs / playground

• Updated peer dependencies to 6.5.x

v6.5.0

Compare Source

@​rjsf/antd

• Updated BaseInputTemplate to remove type and set changeOnWheel to false for the InputNumber component, fixing #​5002
• Updated ErrorList and IconButton to destructure icons imported from @ant-design/icons, fixing #​4953
• Added key={label} to key input in WrapIfAdditionalTemplate to reset input value after duplicate key rename (#​4999)
• Updated BaseInputTemplate to destructure and guard min/max before spreading onto InputNumber, fixing a build error caused by the widened InputPropsType (number | string)
• Added support for Antd v6, addressing #​4995

@​rjsf/chakra-ui

• Added key={label} to key input in WrapIfAdditionalTemplate to reset input value after duplicate key rename (#​4999)
• Added opt-in optionValueFormat: 'realValue' support to SelectWidget, RadioWidget, and CheckboxesWidget (#​4693)

@​rjsf/core

• Added a new removeEmptyOptionalObjects boolean prop to gracefully prune optional empty objects preventing form submission lockouts, fixing #​4954
• Included button elements in focusOnError querySelector so that radio and checkbox groups receive focus on validation error, fixing #​4870
• Fixed focus being lost when renaming additional property keys by preserving React key for renamed properties (#​4999)
• Removed expandUiSchemaDefinitions call at form init, now handled at runtime by resolveUiSchema, fixing #​4986
• Used useRef to track latest formData in handleKeyRename, preventing stale closure data when multiple additional property keys are renamed in quick succession, fixing #​5021
• Added opt-in optionValueFormat: 'realValue' support to SelectWidget, RadioWidget, and CheckboxesWidget for rendering real enum values in DOM attributes instead of array indices (#​4693)

@​rjsf/daisyui

• Added key={label} to key input in WrapIfAdditionalTemplate to reset input value after duplicate key rename (#​4999)
• Added opt-in optionValueFormat: 'realValue' support to SelectWidget, RadioWidget, and CheckboxesWidget (#​4693)

@​rjsf/fluentui-rc

• Added key={label} to key input in WrapIfAdditionalTemplate to reset input value after duplicate key rename (#​4999)
• Added opt-in optionValueFormat: 'realValue' support to SelectWidget, RadioWidget, and CheckboxesWidget (#​4693)

@​rjsf/mantine

• Added key={label} to key input in WrapIfAdditionalTemplate to reset input value after duplicate key rename (#​4999)
• Updated BaseInputTemplate to destructure and guard min/max before spreading onto NumberInput, fixing a build error caused by the widened InputPropsType (number | string)
• Added opt-in optionValueFormat: 'realValue' support to SelectWidget, RadioWidget, and CheckboxesWidget (#​4693)

@​rjsf/mui

• Added key={label} to key input in WrapIfAdditionalTemplate to reset input value after duplicate key rename (#​4999)
• Added opt-in optionValueFormat: 'realValue' support to SelectWidget, RadioWidget, and CheckboxesWidget (#​4693)
• Added support for passing MUI-specific props (e.g., sx, rjsfSlotProps, variant) directly through uiSchema for all templates and widgets, fixing #​4996

@​rjsf/primereact

• Added key={label} to key input in WrapIfAdditionalTemplate to reset input value after duplicate key rename (#​4999)
• Added opt-in optionValueFormat: 'realValue' support to SelectWidget, RadioWidget, and CheckboxesWidget (#​4693)

@​rjsf/react-bootstrap

• Added key={label} to key input in WrapIfAdditionalTemplate to reset input value after duplicate key rename (#​4999)
• Added opt-in optionValueFormat: 'realValue' support to SelectWidget, RadioWidget, and CheckboxesWidget (#​4693)

@​rjsf/semantic-ui

• Added key={label} to key input in WrapIfAdditionalTemplate to reset input value after duplicate key rename (#​4999)
• Added opt-in optionValueFormat: 'realValue' support to SelectWidget, RadioWidget, and CheckboxesWidget (#​4693)

@​rjsf/shadcn

• Added key={label} to key input in WrapIfAdditionalTemplate to reset input value after duplicate key rename (#​4999)
• Added opt-in optionValueFormat: 'realValue' support to SelectWidget, RadioWidget, and CheckboxesWidget (#​4693)

@​rjsf/utils

• Added removeOptionalEmptyObjects utility function to recursively strip fully empty optional objects based on their parent's required properties, fixing #​4954
• Updated InputPropsType to widen min and max to number | string to support date values (e.g. "2020-01-01")
• Updated getInputProps() to propagate formatMinimum and formatMaximum schema keywords to the HTML min/max attributes for date, datetime-local, time, week, and month input types, aligning browser-native date picker constraints with AJV validation
• Fixed ui:title from ui:definitions not applied to oneOf/anyOf dropdowns beyond first recursion level, fixing #​4986
• Added enumOptionValueEncoder, enumOptionValueDecoder, and enumOptionSelectedValue utilities for opt-in real enum value rendering in select/radio/checkbox widgets (#​4693)
• Added optionValueFormat: 'indexed' | 'realValue' to GlobalUISchemaOptions and the OptionValueFormat type for opt-in real enum values in widget DOM attributes (#​4693)

v6.4.2

Compare Source

@​rjsf/antd

• Forward required to BaseInputTemplate so that required string and number fields render the HTML required attribute, fixing #​3743

@​rjsf/core

• Fixed a breaking change introduced in v6.4.0 where array properties with enum items no longer used ui:enumNames from the array property's uiSchema (#​4985)
• Passed parentUiSchema to ArrayFieldItem to maintain uiSchema, this prop was introduced recently but was not being passed
• Fixed extraErrors not displaying when customErrors are also present (e.g., with array fields and controlled formData), fixing #​4982

Dev / docs / playground

• Fixed scrolling of Monaco editors in the playground, fixing #​4992

v6.4.1

Compare Source

Dev / docs / playground

• Updated peer dependencies to 6.4.x

v6.4.0

Compare Source

@​rjsf/core

• Fixed extraErrors not displaying on first async set after submit, fixing #​4965
• Updated multi-select ArrayFields to properly use the items uiSchema for enumerated options, fixing #​4955
• Fixed validateForm() clearing extraErrors from state when schema validation passes, fixing #​4962

@​rjsf/utils

• Fixed resolveAllReferences to preserve $ref on resolved schemas, enabling ui:definitions beyond the first recursion level, fixing #​4966
• Fixed omitExtraData stripping additionalProperties inside oneOf/anyOf options, fixing #​4366
• Added support for map-based ui:enumNames and ui:enumOrder for controlling enum display labels and ordering, fixing #​4969

Dev / docs / playground

• Added documentation and playground examples for map-based ui:enumNames and ui:enumOrder

v6.3.1

Compare Source

Dev / docs / playground

• Changed all @rjsf/* dev dependencies from ^6.3.0 to 6.3.0 so that the latest version of nx keeps automatically updating them
• Updated peer dependencies to ^6.3.x due to type changes in @rjsf/utils that are required in the other libraries

v6.3.0

Compare Source

@​rjsf/antd

• Fixed duplicate React keys in datalist when schema examples and default have different types, fixing #​4927

@​rjsf/chakra-ui

• Fixed duplicate React keys in datalist when schema examples and default have different types, fixing #​4927
• Updated NativeSelectWidget so that is properly renders a placeholder, fixing #​4942

@​rjsf/core

• Fixed duplicate React keys in datalist when schema examples and default have different types, fixing #​4927
• Integrated ui:definitions support for recursive and reusable uiSchema (#​4947)

@​rjsf/daisyui

• Fixed duplicate React keys in datalist when schema examples and default have different types, fixing #​4927

@​rjsf/fluentui-rc

• Fixed duplicate React keys in datalist when schema examples and default have different types, fixing #​4927

@​rjsf/mantine

• Fixed duplicate React keys in datalist when schema examples and default have different types, fixing #​4927

@​rjsf/mui

• Fixed duplicate React keys in datalist when schema examples and default have different types, fixing #​4927

@​rjsf/react-bootstrap

• Fixed duplicate React keys in datalist when schema examples and default have different types, fixing #​4927

@​rjsf/semantic-ui

• Fixed duplicate React keys in datalist when schema examples and default have different types, fixing #​4927

@​rjsf/shadcn

• Fixed duplicate React keys in datalist when schema examples and default have different types, fixing #​4927

@​rjsf/utils

• Added expandUiSchemaDefinitions() and resolveUiSchema() functions, and UiSchemaDefinitions type to support defining reusable uiSchema for schema $ref references (#​4947)

Dev / docs / playground

• Updated References sample in playground to demonstrate ui:definitions feature (#​4947)
• Added documentation for ui:definitions in uiSchema.md and definitions.md (#​4947)
• Updated the libraries via the npm run bump-all-libraries command, fixing new lint errors and updating the snapshots due to fixes in the theme libraries

v6.2.5

Compare Source

@​rjsf/mui

• Updated BaseInputTemplate to properly handle slotProps and InputProps (deprecated by MUI) with existing endAdornments when the allowClearTextInputs flag is true, fixing #​4938

Dev / docs / playground

• Updated uiSchema.md to add documentation for allowClearTextInputs
• Updated the formTests.tsx in snapshot-tests to render string fields with the allowClearTextInputs flag enabled, with data and readonly to test the new feature

v6.2.4

Compare Source

Dev / docs / playground

• Updated the package.json for chakra-ui to add the repository information so that publishing works for it
• Updated the release.yml to remove the push tag stuff as it isn't needed

v6.2.3

Compare Source

@​rjsf/mantine

• Updated cleanupOptions() to add enableMarkdownInHelp and globalOptions to avoid DOM errors

@​rjsf/primereact

• Updated ArrayFieldTemplate to destructure additional fields to avoid DOM errors

Dev / docs / playground

• Updated the release.yml to move the permissions within the job, switch to node 24 and add push checking

v6.1.2

Compare Source

@​rjsf/antd

• Updated SelectWidget to add a static getPopupContainerCallback to the SelectWidget component, partially fixing #​3609
  • Also, added the explicit open state to the Select in conjunction with providing the setOpen as the onOpenChange prop
• In BaseInputTemplate added comments explaining why step='1' is returned, closing #​4022

@​rjsf/mantine

• Align Mantine’s behavior with other themes when clearing string fields: clearing an input now removes the key from formData instead of setting it to an empty string. (#​4875)

@​rjsf/utils

• Replace json-schema-merge-allof with @​x0k/json-schema-merge (#​4774)

@​rjsf/validator-ajv8

• Updated CustomValidatorOptionsType to add new extenderFn?: (ajv: Ajv) => Ajv prop
• Updated createAjvInstance() to add new extenderFn?: (ajv: Ajv) => Ajv parameter, using it to extend the ajv instance, fixing #​4746
  • Updated the AJV8Validator and compileSchemaValidatorsCode() to pass extenderFn from the options into createAjvInstance()
• Updated transformRJSFValidationErrors() to add filtering of duplicate anyOf/oneOf based errors from the returned errors, fixing #​4167

Dev / docs / playground

• Updated DemoFrame as follows to fix #​3609
  • Override antd's SelectWidget.getPopupContainerCallback callback function to return undefined
  • Added a AntdSelectPatcher component that observes the creation of antd select dropdowns and makes sure they open in the correct location
  • Update the antd theme wrapper to render the AntdSelectPatcher, AntdStyleProvider and ConfigProvider with it's own getPopupContainer() function inside of a FrameContextConsumer
• Updated the base TypeScript configuration to use "moduleResolution": "bundler"
• Updated the validation.md documentation to note that HTML 5 validation is not translatable via RJSF translation mechanisms and should be turned off, fixing #​4092
  • Also added documentation for the new extenderFn prop on CustomValidatorOptionsType

v6.1.1

Compare Source

@​rjsf/core

• Updated ObjectField to get errors and formData by wrapping name in brackets to prevent names that have dots in them incorrectly getting data from a lower level, fixing #​3846

@​rjsf/shadcn

• Updated package.json to copy css files to new resources directory

Dev / docs / playground

• Updated the playground to use the css files for @rjsf/shadcn from the CDN connected with github, pointing to the new resources directory
• Added new antdIconsReplacer.ts and used it in @rjsf/antd during build time to append .js onto imports of @antd/icons to fix es build issues on webpack and vite

v6.1.0

Compare Source

@​rjsf/antd

• Added support for rendering ui:help as markdown via new ui:enableMarkdownInHelp flag in FieldHelpTemplate
• Updated ArrayFieldItemTemplate and ArrayFieldTemplate to adjust sizes and buttons location using displayLabel and hasDescription, fixing #​3296
• Updated FieldTemplate, ObjectFieldTemplate and WrapIfAdditionalTemplate to adjust the sizes and buttons location using displayLabel

@​rjsf/chakra-ui

• Added support for rendering ui:help as markdown via new ui:enableMarkdownInHelp flag in FieldHelpTemplate
• Updated FieldTemplate and WrapIfAdditionalTemplate to adjust the sizes and buttons location using displayLabel and rawDescription

@​rjsf/core

• Added new RichHelp component for use in all the themes for help rendering, fixing #​4601
• Updated ArrayField to compute and pass displayLabel and hasDescription to the rendered ArrayFieldItemTemplate to support fixing #​3296
• Updated StringField to extract the title from the props and pass it down to the widget if provided
• Updated ArrayFieldItemTemplate to adjust buttons location using displayLabel and hasDescription, fixing #​3296
• Updated AddButton to improve it's responsiveness in relation to the ArrayFieldItemTemplate changes
• Updated WrapIfAdditionalTemplate to adjust the sizes and buttons location using displayLabel and rawDescription

@​rjsf/daisyui

• Added support for rendering ui:help as markdown via new ui:enableMarkdownInHelp flag in FieldHelpTemplate
• Updated ArrayFieldItemTemplate to adjust buttons location using displayLabel and hasDescription, fixing #​3296
• Updated WrapIfAdditionalTemplate to add flexGrow and BaseInputTemplate to add w-full to allow the array item fields to grow properly
• Updated FieldTemplate to render the description which was missing in the theme
• Updated FieldTemplate and WrapIfAdditionalTemplate to adjust the sizes and buttons location using displayLabel and rawDescription

@​rjsf/fluentui-rc

• Added support for rendering ui:help as markdown via new ui:enableMarkdownInHelp flag in FieldHelpTemplate
• Updated ArrayFieldItemTemplate to adjust buttons location using displayLabel, fixing #​3296
• Updated WrapIfAdditionalTemplate to add flexGrow to allow the array item fields to grow properly for non-container elements
• Updated FieldTemplate and WrapIfAdditionalTemplate to adjust the sizes and buttons location using displayLabel and rawDescription

@​rjsf/mantine

• Added support for rendering ui:help as markdown via new ui:enableMarkdownInHelp flag in FieldHelpTemplate
• Updated utils.ts to add label to the cleanup fields to filter it from the uiOptions
• Updated BaseInputTemplate to display description which was missing in the theme
• Updated ArrayFieldTitleTemplate to support the optionalData
• Updated FieldTemplate and WrapIfAdditionalTemplate to adjust the sizes and buttons location using displayLabel and rawDescription

@​rjsf/mui

• Added support for rendering ui:help as markdown via new ui:enableMarkdownInHelp flag in FieldHelpTemplate
• Updated ArrayFieldItemTemplate to adjust buttons location using displayLabel and hasDescription, fixing #​3296
• Updated FieldTemplate, ObjectFieldTemplate and WrapIfAdditionalTemplate to adjust the sizes and buttons location using displayLabel

@​rjsf/primereact

• Added support for rendering ui:help as markdown via new ui:enableMarkdownInHelp flag in FieldHelpTemplate
• Updated ArrayFieldItemTemplate to adjust buttons location using displayLabel, fixing #​3296
• Updated WrapIfAdditionalTemplate to adjust the sizes and buttons location using displayLabel and rawDescription

@​rjsf/react-bootstrap

• Added support for rendering ui:help as markdown via new ui:enableMarkdownInHelp flag in FieldHelpTemplate
• Updated ArrayFieldItemTemplate to adjust buttons location using displayLabel and hasDescription, fixing #​3296
• Updated ArrayFieldTemplate to improve it's responsiveness in relation to the ArrayFieldItemTemplate changes
• Updated FieldTemplate, ObjectFieldTemplate and WrapIfAdditionalTemplate to adjust the sizes and buttons location using displayLabel and rawDescription

@​rjsf/semantic-ui

• Added support for rendering ui:help as markdown via new ui:enableMarkdownInHelp flag in FieldHelpTemplate
• Updated ArrayFieldItemTemplate to adjust buttons location using displayLabel and hasDescription, fixing #​3296
• Updated FieldTemplate and WrapIfAdditionalTemplate to adjust the sizes and buttons location using displayLabel and rawDescription

@​rjsf/shadcn

• Added support for rendering ui:help as markdown via new ui:enableMarkdownInHelp flag in FieldHelpTemplate
• Updated ArrayFieldItemTemplate to adjust buttons location using displayLabel and hasDescription, fixing #​3296
• Updated ArrayFieldTemplate to add justify-end to the AddButton rendering
• Updated FieldTemplate, ObjectFieldTemplate and WrapIfAdditionalTemplate to adjust the sizes and buttons location using displayLabel and rawDescription

@​rjsf/utils

• Added new enableMarkdownInHelp to the GlobalUISchemaOptions type, fixing #​4601
• Added new displayLabel and hasDescription flags in the ArrayFieldItemTemplateProps to support fixing #​3296
• Updated the three hooks to add use client directive to support NextJS builds
• Updated WrapIfAdditionalTemplateProps to also pick the displayLabel and rawDescription props from FieldProps for use in adjusting the Additional Properties buttons location
• Fixed bug in getDisplayLabel() to return false ALWAYS, when the ui:options is set to false AND to return true for array and object types when they were added via additionalProperties

Dev / docs / playground

• Updated uiSchema.md in the docs to document the new enableMarkdownInHelp flag
• Updated objectTests.tsx to increase the variations of the additionalProperties tests to include labels off, descriptions and object and array types

v6.0.2

Compare Source

@​rjsf/antd

• Updated FieldTemplate to skip label and description rendering for checkbox widgets, fixing (#​4742)
• Updated ArrayFieldTemplate and ObjectFieldTemplate to remove the rendering of a duplicate description (since the FieldTemplate already does it), fixing #​3624

@​rjsf/chakra-ui

• Modified CheckboxesWidget to render the Title, fixing (#​4840)
• Updated CheckboxWidget to handle label and description rendering consistently, fixing (#​4742)

@​rjsf/core

• Fixed duplicate label and description rendering in CheckboxWidget by conditionally rendering them based on widget type
  • Updated CheckboxWidget to handle label and description rendering consistently
  • Modified FieldTemplate to skip label and description rendering for checkbox widgets, fixing (#​4742)
• Updated ObjectField to change the removal of an additional property to defer the work to the processPendingChange() handler in Form, fixing #​4850
• Updated FallbackField to support object and array types, and improved ArrayField so that it handles missing items properly with the fallback field

@​rjsf/fluentui-rc

• Updated FieldTemplate to skip label and description rendering for checkbox widgets, fixing (#​4742)

@​rjsf/mantine

• Updated CheckboxWidget to handle label and description rendering consistently, fixing (#​4742)

@​rjsf/mui

• Updated FieldTemplate to skip label and description rendering for checkbox widgets, fixing (#​4742)
• Updated ArrayFieldItemTemplate to switch size from 'auto' to responsive values on the Grid, fixing #​4838

@​rjsf/primereact

• Updated FieldTemplate to skip label and description rendering for checkbox widgets, fixing (#​4742)

@​rjsf/react-bootstrap

• Updated FieldTemplate to skip label and description rendering for checkbox widgets, fixing (#​4742)

@​rjsf/semantic-ui

• Updated FieldTemplate to skip label and description rendering for checkbox widgets, fixing (#​4742)

@​rjsf/shadcn

• Updated FieldTemplate to skip label and description rendering for checkbox widgets, fixing (#​4742)
• Updated the Command component to properly handle forwardRef

@​rjsf/utils

• Updated getDefaultFormState() to not save an undefined field value into an object when the type is null and excludeObjectChildren is provided, fixing #​4821

Dev / docs / playground

• Updated the OptionsDrawer of the playground to add idPrefix and idSeparator fields
• Updated test files to switch to using the React Testing library instead of react-test-renderer, updating all snapshots accordingly
• Updated Fluent libraries to latest, with updated snapshots
• Added Node 24 to ci.yml, removing v5 and old Node 14 non-docs builds

v6.0.1

Compare Source

Dev / docs / playground

• Updated peer dependencies for packages to 6.x

v6.0.0

Compare Source

@​rjsf/antd

• Updated the README.md to show the theme snapshot with the latest theme UI from the playground, making it a link to the theme

@​rjsf/chakra-ui

• Updated the README.md to show the theme snapshot with the latest theme UI from the playground, making it a link to the theme

@​rjsf/core

• Updated SchemaField to add a new optional property childFieldPathId to the FieldComponent render to prevent duplicate ids, fixing (#​4819)[#​4819]
  • Also updated ObjectField and ArrayField to make children use the childFieldPathId if present, falling back to the fieldPathId if not

Dev / docs / playground

• Updated the libraries to the latest ones that aren't problematic
  Updated the playground to modernize the UI using MUI components
• Updated the documentation to switch to using an animated gif based on the latest modernized playground UI
• Updated the README.md in all themes to show the theme snapshot with the latest theme UI from the playground, making it a link to the theme

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend,every weekday after 5pm,every weekday before 8am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

JS Dependency Audit

0 added · 0 removed · 169 total (0 vs base)

Projects audited

• . (manager: yarn-berry)
• ./packages/app (manager: unknown) — skipped on PR head: no recognized lockfile
• ./packages/backend (manager: unknown) — skipped on PR head: no recognized lockfile
• ./packages/backend-common (manager: unknown) — skipped on PR head: no recognized lockfile
• ./packages/backend-headless-service (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/agent-platform (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/ai-chat (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/ai-chat-backend (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/ai-chat-react (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/auth-backend-module-gs (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/catalog-backend-module-gs (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/error-reporter-react (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/flux (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/flux-react (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/gs (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/gs-backend (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/gs-common (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/gs-node (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/kubernetes-react (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/muster (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/muster-backend (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/plans (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/plans-backend (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/roadmap (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/roadmap-backend (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/scaffolder-backend-module-gs (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/techdocs-backend-module-gs (manager: unknown) — skipped on PR head: no recognized lockfile
• ./plugins/ui-react (manager: unknown) — skipped on PR head: no recognized lockfile

No change in vulnerabilities compared to the base branch.

Full current vulnerability list (169)

• 🔴 critical cipher-base (<=1.0.4) — cipher-base is missing type checks, leading to hash rewind and passing on crafted data advisory
• 🔴 critical elliptic (<=6.6.0) — Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) advisory
• 🔴 critical handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has JavaScript Injection via AST Type Confusion advisory
• 🔴 critical pbkdf2 (>=3.0.10 <=3.1.2) — pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos advisory
• 🔴 critical pbkdf2 (>=1.0.0 <=3.1.2) — pbkdf2 silently disregards Uint8Array input, returning static keys advisory
• 🔴 critical shell-quote (>=1.1.0 <=1.8.3) — shell-quote quote() does not escape newlines in object .op values advisory
• 🟠 high @backstage/backend-defaults (<0.12.2) — Backstage has a Possible Symlink Path Traversal in Scaffolder Actions advisory
• 🟠 high @backstage/plugin-scaffolder-node (>=0.12.0 <0.12.3) — Backstage has a Possible Symlink Path Traversal in Scaffolder Actions advisory
• 🟠 high @backstage/plugin-scaffolder-node (<0.11.2) — Backstage has a Possible Symlink Path Traversal in Scaffolder Actions advisory
• 🟠 high @grpc/grpc-js (>=1.14.0 <1.14.4) — @grpc/grpc-js: A malformed request can cause a server crash advisory
• 🟠 high @grpc/grpc-js (>=1.14.0 <1.14.4) — @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash advisory
• 🟠 high @hono/node-server (<1.19.10) — @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware advisory
• 🟠 high adm-zip (<0.6.0) — adm-zip: Crafted ZIP file triggers 4GB memory allocation advisory
• 🟠 high fast-uri (<=3.1.0) — fast-uri vulnerable to path traversal via percent-encoded dot segments advisory
• 🟠 high fast-uri (<=3.1.1) — fast-uri vulnerable to host confusion via percent-encoded authority delimiters advisory
• 🟠 high fast-xml-parser (>=4.0.0-beta.3 <4.5.5) — fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) advisory
• 🟠 high fast-xml-parser (>=5.0.0 <5.5.6) — fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) advisory
• 🟠 high flatted (<3.4.0) — flatted vulnerable to unbounded recursion DoS in parse() revive phase advisory
• 🟠 high flatted (<=3.4.1) — Prototype Pollution via parse() in NodeJS flatted advisory
• 🟠 high glob (>=10.2.0 <10.5.0) — glob CLI: Command injection via -c/--cmd executes matches with shell:true advisory
• 🟠 high glob (>=11.0.0 <11.1.0) — glob CLI: Command injection via -c/--cmd executes matches with shell:true advisory
• 🟠 high handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block advisory
• 🟠 high handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial advisory
• 🟠 high handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation advisory
• 🟠 high handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options advisory
• 🟠 high hono (<4.12.25) — hono: CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard advisory
• 🟠 high immutable (<3.8.3) — Immutable is vulnerable to Prototype Pollution advisory
• 🟠 high jsonata (<2.2.0) — jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion advisory
• 🟠 high jws (=4.0.0) — auth0/node-jws Improperly Verifies HMAC Signature advisory
• 🟠 high jws (<3.2.3) — auth0/node-jws Improperly Verifies HMAC Signature advisory
• 🟠 high linkify-it (<=5.0.0) — LinkifyIt#match scan loop has quadratic algorithmic complexity advisory
• 🟠 high lodash (>=4.0.0 <=4.17.23) — lodash vulnerable to Code Injection via _.template imports key names advisory
• 🟠 high lodash-es (>=4.0.0 <=4.17.23) — lodash vulnerable to Code Injection via _.template imports key names advisory
• 🟠 high path-to-regexp (>=8.0.0 <8.4.0) — path-to-regexp vulnerable to Denial of Service via sequential optional groups advisory
• 🟠 high picomatch (<2.3.2) — Picomatch has a ReDoS vulnerability via extglob quantifiers advisory
• 🟠 high picomatch (>=4.0.0 <4.0.4) — Picomatch has a ReDoS vulnerability via extglob quantifiers advisory
• 🟠 high tmp (<0.2.6) — tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape advisory
• 🟠 high underscore (<=1.13.7) — Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack advisory
• 🟡 moderate @babel/runtime (<7.26.10) — Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups advisory
• 🟡 moderate @backstage/backend-common (0.25.0) — This package is deprecated, please follow the deprecation instructions for the exports you still use
• 🟡 moderate @backstage/cli-common (<=0.1.16) — @backstage/cli-common has a possible resolveSafeChildPath Symlink Chain Bypass advisory
• 🟡 moderate @backstage/plugin-circleci (0.3.35) — This package has been moved to the to the https://github.com/CircleCI-Public/backstage-plugin repository. You should migrate to using that instead.
• 🟡 moderate @fortawesome/react-fontawesome (0.2.6) — v0.2.x is no longer supported. Unless you are still using FontAwesome 5, please update to v3.1.1 or greater.
• 🟡 moderate @hono/node-server (<1.19.13) — @hono/node-server: Middleware bypass via repeated slashes in serveStatic advisory
• 🟡 moderate @humanwhocodes/config-array (0.13.0) — Use @eslint/config-array instead
• 🟡 moderate @humanwhocodes/object-schema (2.0.3) — Use @eslint/object-schema instead
• 🟡 moderate @material-ui/core (4.12.4) — Material UI v4 doesn't receive active development since September 2021. See the guide https://mui.com/material-ui/migration/migration-v4/ to upgrade to v5.
• 🟡 moderate @material-ui/lab (4.0.0-alpha.61) — Material UI v4 doesn't receive active development since September 2021. See the guide https://mui.com/material-ui/migration/migration-v4/ to upgrade to v5.
• 🟡 moderate @material-ui/pickers (3.3.11) — This package no longer supported. It has been relaced by @mui/x-date-pickers
• 🟡 moderate @material-ui/styles (4.11.5) — Material UI v4 doesn't receive active development since September 2021. See the guide https://mui.com/material-ui/migration/migration-v4/ to upgrade to v5.
• 🟡 moderate @octokit/endpoint (>=9.0.5 <9.0.6) — @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking advisory
• 🟡 moderate @octokit/plugin-paginate-rest (>=1.0.0 <9.2.2) — @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking advisory
• 🟡 moderate @octokit/plugin-paginate-rest (>=9.3.0-beta.1 <11.4.1) — @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking advisory
• 🟡 moderate @octokit/request (>=1.0.0 <8.4.1) — @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking advisory
• 🟡 moderate @octokit/request-error (>=1.0.0 <5.1.1) — @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking advisory
• 🟡 moderate @react-hookz/deep-equal (1.0.4) — PACKAGE IS DEPRECATED AND WILL BE DETED SOON, USE @ver0/deep-equal INSTEAD
• 🟡 moderate @rjsf/material-ui (5.24.13) — Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
• 🟡 moderate @sentry/browser (<7.119.1) — Sentry SDK Prototype Pollution gadget in JavaScript SDKs advisory
• 🟡 moderate @types/http-proxy-middleware (1.0.0) — This is a stub types definition. http-proxy-middleware provides its own type definitions, so you do not need this installed.
• 🟡 moderate @types/keyv (4.2.0) — This is a stub types definition. keyv provides its own type definitions, so you do not need this installed.
• 🟡 moderate @ungap/structured-clone (1.3.0) — Potential CWE-502 - Update to 1.3.1 or higher
• 🟡 moderate atlassian-openapi (1.0.19) — DEPRECATED: atlassian-openapi has moved to @atlassian/atlassian-openapi. The latest version is 1.0.6. Please update your dependency.
• 🟡 moderate bn.js (>=5.0.0 <5.2.3) — bn.js affected by an infinite loop advisory
• 🟡 moderate bn.js (<4.12.3) — bn.js affected by an infinite loop advisory
• 🟡 moderate boolean (3.2.0) — Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
• 🟡 moderate brace-expansion (<1.1.13) — brace-expansion: Zero-step sequence causes process hang and memory exhaustion advisory
• 🟡 moderate brace-expansion (>=2.0.0 <2.0.3) — brace-expansion: Zero-step sequence causes process hang and memory exhaustion advisory
• 🟡 moderate brace-expansion (>=4.0.0 <5.0.5) — brace-expansion: Zero-step sequence causes process hang and memory exhaustion advisory
• 🟡 moderate brace-expansion (>=5.0.0 <5.0.6) — brace-expansion: Large numeric range defeats documented max DoS protection advisory
• 🟡 moderate core-js (2.6.12) — core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
• 🟡 moderate dompurify (>=3.1.3 <3.2.7) — DOMPurify contains a Cross-site Scripting vulnerability advisory
• 🟡 moderate dompurify (>=3.1.3 <=3.3.1) — DOMPurify contains a Cross-site Scripting vulnerability advisory
• 🟡 moderate dompurify (<=3.3.1) — DOMPurify ADD_ATTR predicate skips URI validation advisory
• 🟡 moderate dompurify (<=3.3.1) — DOMPurify USE_PROFILES prototype pollution allows event handlers advisory
• 🟡 moderate dompurify (<=3.3.3) — DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation advisory
• 🟡 moderate dompurify (<3.4.0) — DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) advisory
• 🟡 moderate dompurify (>=1.0.10 <3.4.0) — DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode advisory
• 🟡 moderate dompurify (>=3.0.1 <3.4.0) — DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback advisory
• 🟡 moderate dompurify (<3.3.2) — DOMPurify is vulnerable to mutation-XSS via Re-Contextualization advisory
• 🟡 moderate dompurify (<3.4.7) — DOMPurify: Hook mutation of data.allowedTags / data.allowedAttributes permanently pollutes DEFAULT_ALLOWED_TAGS / DEFAULT_ALLOWED_ATTR advisory
• 🟡 moderate dompurify (<=3.4.5) — DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound instanceof checks advisory
• 🟡 moderate dompurify (<=3.4.5) — DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM advisory
• 🟡 moderate dompurify (<=3.4.6) — DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content advisory
• 🟡 moderate dompurify (<=3.4.10) — DOMPurify: Permanent ALLOWED_ATTR pollution via setConfig() bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) advisory
• 🟡 moderate eslint (8.57.1) — This version is no longer supported. Please see https://eslint.org/version-support for other options.
• 🟡 moderate fast-xml-parser (>=5.0.0 <5.5.7) — Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser advisory
• 🟡 moderate fast-xml-parser (>=4.0.0-beta.3 <4.5.5) — Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser advisory
• 🟡 moderate fast-xml-parser (<5.7.0) — fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters advisory
• 🟡 moderate file-type (>=13.0.0 <21.3.1) — file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header advisory
• 🟡 moderate follow-redirects (<=1.15.11) — follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets advisory
• 🟡 moderate glob (7.2.3) — Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
• 🟡 moderate handlebars (>=4.0.0 <4.7.9) — Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection advisory
• 🟡 moderate handlebars (>=4.6.0 <=4.7.8) — Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry advisory
• 🟡 moderate har-validator (5.1.5) — this library is no longer supported
• 🟡 moderate hono (<4.12.12) — Hono missing validation of cookie name on write path in setCookie() advisory
• 🟡 moderate hono (<4.12.12) — Hono: Non-breaking space prefix bypass in cookie name handling in getCookie() advisory
• 🟡 moderate hono (>=4.0.0 <=4.12.11) — Hono: Path traversal in toSSG() allows writing files outside the output directory advisory
• 🟡 moderate hono (<4.12.12) — Hono: Middleware bypass via repeated slashes in serveStatic advisory
• 🟡 moderate hono (<4.12.12) — Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses advisory
• 🟡 moderate hono (<4.12.18) — Hono has CSS Declaration Injection via Style Object Values in JSX SSR advisory
• 🟡 moderate hono (<4.12.18) — Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage advisory
• 🟡 moderate hono (<4.12.16) — Hono: bodyLimit() can be bypassed for chunked / unknown-length requests advisory
• 🟡 moderate hono (<4.12.16) — hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection advisory
• 🟡 moderate hono (<4.12.21) — Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 advisory
• 🟡 moderate hono (<4.12.21) — Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection advisory
• 🟡 moderate hono (<4.12.21) — Hono: JWT middleware accepts any Authorization scheme, not only Bearer advisory
• 🟡 moderate hono (<4.12.21) — Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths advisory
• 🟡 moderate hono (<4.12.25) — hono: Path traversal in serve-static on Windows via encoded backslash (%5C) advisory
• 🟡 moderate hono (<4.12.25) — hono: AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice advisory
• 🟡 moderate hono (<4.12.25) — hono: Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length advisory
• 🟡 moderate hono (<4.12.25) — hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest advisory
• 🟡 moderate hono (<4.12.14) — hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR advisory
• 🟡 moderate http-proxy-middleware (>=3.0.0 <3.0.5) — http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed advisory
• 🟡 moderate http-proxy-middleware (>=3.0.0 <3.0.4) — http-proxy-middleware can call writeBody twice because "else if" is not used advisory
• 🟡 moderate http-proxy-middleware (>=0.16.0 <2.0.10) — http-proxy-middleware router host+path substring matching allows Host-header-driven backend routing bypass advisory
• 🟡 moderate http-proxy-middleware (>=3.0.0 <3.0.6) — http-proxy-middleware router host+path substring matching allows Host-header-driven backend routing bypass advisory
• 🟡 moderate inflight (1.0.6) — This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
• 🟡 moderate ip-address (<=10.1.0) — ip-address has XSS in Address6 HTML-emitting methods advisory
• 🟡 moderate js-yaml (<3.15.0) — JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases advisory
• 🟡 moderate js-yaml (>=4.0.0 <=4.1.1) — JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases advisory
• 🟡 moderate launch-editor (<=2.14.0) — launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows advisory
• 🟡 moderate lodash (<=4.17.23) — lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit advisory
• 🟡 moderate lodash-es (<=4.17.23) — lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit advisory
• 🟡 moderate lodash-es (>=4.0.0 <=4.17.22) — Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions advisory
• 🟡 moderate lodash.get (4.4.2) — This package is deprecated. Use the optional chaining (?.) operator instead.
• 🟡 moderate lodash.isequal (4.5.0) — This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
• 🟡 moderate markdown-it (>=13.0.0 <14.1.1) — markdown-it is has a Regular Expression Denial of Service (ReDoS) advisory
• 🟡 moderate markdown-it (<=14.1.1) — markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations advisory
• 🟡 moderate morgan (>=1.2.0 <=1.10.1) — morgan vulnerable to Log Forging via unneutralized control characters in :remote-user advisory
• 🟡 moderate nanoid (<3.3.8) — Predictable results in nanoid generation when given non-integer values advisory
• 🟡 moderate node-domexception (1.0.0) — Use your platform's native DOMException instead
• 🟡 moderate path-to-regexp (>=8.0.0 <8.4.0) — path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards advisory
• 🟡 moderate picomatch (<2.3.2) — Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching advisory
• 🟡 moderate picomatch (>=4.0.0 <4.0.4) — Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching advisory
• 🟡 moderate postcss (<8.5.10) — PostCSS has XSS via Unescaped </style> in its CSS Stringify Output advisory
• 🟡 moderate prebuild-install (7.1.3) — No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
• 🟡 moderate prismjs (<1.30.0) — PrismJS DOM Clobbering vulnerability advisory
• 🟡 moderate qs (<6.14.1) — qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion advisory
• 🟡 moderate qs (>=6.11.1 <=6.15.1) — qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set advisory
• 🟡 moderate react-beautiful-dnd (13.1.1) — react-beautiful-dnd is now deprecated. Context and options: react-beautiful-dnd is now deprecated atlassian/react-beautiful-dnd#2672
• 🟡 moderate request (<=2.88.2) — Server-Side Request Forgery in Request advisory
• 🟡 moderate rimraf (3.0.2) — Rimraf versions prior to v4 are no longer supported
• 🟡 moderate stable (0.1.8) — Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility
• 🟡 moderate tough-cookie (<4.1.3) — tough-cookie Prototype Pollution vulnerability advisory
• 🟡 moderate uuid (<11.1.1) — uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided advisory
• 🟡 moderate webpack-dev-server (<=5.2.3) — webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins advisory
• 🟡 moderate webpack-dev-server (<5.2.5) — webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies advisory
• 🟡 moderate yaml (>=1.0.0 <1.10.3) — yaml is vulnerable to Stack Overflow via deeply nested YAML collections advisory
• 🟡 moderate yaml (>=2.0.0 <2.8.3) — yaml is vulnerable to Stack Overflow via deeply nested YAML collections advisory
• 🔵 low @babel/core (<=7.29.0) — @babel/core: Arbitrary File Read via sourceMappingURL Comment advisory
• 🔵 low @backstage/backend-defaults (<0.12.2) — Backstage has a Possible SSRF when reading from allowed URL's in backend.reading.allow advisory
• 🔵 low @backstage/integration (<=1.20.0) — Backstage vulnerable to potential reading of SCM URLs using built in token advisory
• 🔵 low @smithy/config-resolver (<4.4.0) — AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value advisory
• 🔵 low @tootallnate/once (<2.0.1) — @tootallnate/once vulnerable to Incorrect Control Flow Scoping advisory
• 🔵 low brace-expansion (>=1.0.0 <=1.1.11) — brace-expansion Regular Expression Denial of Service vulnerability advisory
• 🔵 low brace-expansion (>=2.0.0 <=2.0.1) — brace-expansion Regular Expression Denial of Service vulnerability advisory
• 🔵 low cookie (<0.7.0) — cookie accepts cookie name, path, and domain with out of bounds characters advisory
• 🔵 low diff (>=4.0.0 <4.0.4) — jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch advisory
• 🔵 low diff (>=5.0.0 <5.2.2) — jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch advisory
• 🔵 low dompurify (<=3.4.6) — DOMPurify: IN_PLACE mode trusts attacker-controlled nodeName on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects advisory
• 🔵 low dompurify (<3.4.9) — DOMPurify: Trusted Types policy survives clearConfig() and can poison later RETURN_TRUSTED_TYPE output advisory
• 🔵 low dompurify (>=3.0.0 <=3.4.7) — DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside content when using DOM output modes advisory
• 🔵 low elliptic (<6.6.0) — Valid ECDSA signatures erroneously rejected in Elliptic advisory
• 🔵 low elliptic (<=6.6.1) — Elliptic Uses a Cryptographic Primitive with a Risky Implementation advisory
• 🔵 low esbuild (>=0.27.3 <0.28.1) — esbuild allows arbitrary file read when running the development server on Windows advisory
• 🔵 low handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has a Property Access Validation Bypass in container.lookup advisory
• 🔵 low hono (<4.12.18) — Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() advisory
• 🔵 low on-headers (<1.1.0) — on-headers is vulnerable to http response header manipulation advisory
• 🔵 low tmp (<=0.2.3) — tmp allows arbitrary temporary file / directory write via symbolic link dir parameter advisory

[marians]

Closing — rjsf in this repo belongs to Backstage's scaffolder, not to us.

Our custom scaffolder field extensions plug into the rjsf <Form> rendered by @backstage/plugin-scaffolder-react, which hard-pins @rjsf/* → 5.24.13. Upstream Backstage hasn't migrated the scaffolder to rjsf v6 yet, so bumping plugins/gs to v6 alone only creates a v5/v6 skew: a redundant second copy of rjsf plus a latent type-compatibility risk (our FieldValidation would resolve to v6 while scaffolder-react's CustomFieldValidator expects v5's).

It also buys nothing today — the repo's only rjsf usage is import type { FieldValidation } from '@rjsf/utils', and @rjsf/core/@rjsf/validator-ajv8 aren't imported at all. We should keep rjsf aligned with whatever scaffolder-react pins and let this bump land through the Backstage dependency update once upstream moves to v6.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 6.x releases. But if you manually upgrade to 6.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.