chore(deps): Bump the minor-and-patch group across 1 directory with 23 updates

[dependabot]

Bumps the minor-and-patch group with 23 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.4	2.5.10
@node-rs/argon2	2.0.2	2.1.0
js-yaml	5.2.1	5.3.0
undici	8.7.0	8.10.0
@types/node	26.1.1	26.2.0
tsx	4.23.1	4.23.12
vitest	4.1.10	4.1.11
@hookform/resolvers	5.4.0	5.9.1
@tanstack/react-query	5.101.2	5.102.2
@tanstack/react-router	1.170.18	1.170.32
lucide-react	1.24.0	1.33.0
react	19.2.7	19.2.8
@types/react	19.2.17	19.2.18
react-dom	19.2.7	19.2.8
@types/react-dom	19.2.3	19.2.5
react-hook-form	7.81.0	7.86.0
sonner	2.0.7	2.0.8
@playwright/test	1.61.1	1.62.1
@tailwindcss/vite	4.3.2	4.3.3
@testing-library/user-event	14.6.1	14.6.6
@vitejs/plugin-react	6.0.3	6.1.0
tailwindcss	4.3.2	4.3.3
vite	8.1.4	8.2.2

Updates @biomejs/biome from 2.5.4 to 2.5.10

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.10

2.5.10

Patch Changes

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

  <div /* block comment */ class="something"></div>
  <Component /* c */ client:load />

• #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

• #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

  <div>{/* a note */}</div>
  <div class={/* a note */}>x</div>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

  <div>{/* block comment */ x}</div>
  <div>{/* only a comment */}</div>

• #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

  <>
    <p>a</p>
  </>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

  ---
  const a = "</script>";
  // </script> in a comment
  ---

• #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.10

Patch Changes

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

  <div /* block comment */ class="something"></div>
  <Component /* c */ client:load />

• #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

• #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

  <div>{/* a note */}</div>
  <div class={/* a note */}>x</div>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

  <div>{/* block comment */ x}</div>
  <div>{/* only a comment */}</div>

• #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

  <>
    <p>a</p>
  </>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

  ---
  const a = "</script>";
  // </script> in a comment
  ---

• #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

  <!-- c -->

... (truncated)

Commits

• 05797b1 ci: release (#11450)
• 5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• e65f07e feat(lint): nursery useControlLabel (#11312)
• ba8aa18 feat(lint): add useTailwindShorthandClasses (#10312)
• 6b8f09c ci: release (#11236)
• 23c0369 feat(lint): nursery noInvalidPropertyInitValue (#11187)
• Additional commits viewable in compare view

Updates @node-rs/argon2 from 2.0.2 to 2.1.0

Commits

• 3b28965 chore(release): publish
• 64b9227 chore(deps): lock file maintenance (#1182)
• b0ea4a0 perf(argon2): simdutf8, crate PHC decode, argon2-rust 1.1 (#1189)
• 2b8b617 feat(argon2): switch backend to argon2-rust (#1188)
• 05156db chore(deps): update rust crate jsonwebtoken to v11 (#1177)
• 1933745 chore: upgrade all npm deps (#1187)
• 317e00e chore(deps): update cross-platform-actions/action action to v1.4.0 (#1185)
• 284ee70 chore(deps): update dependency oxfmt to ^0.63.0 (#1186)
• 54d5564 chore(deps): update dependency oxfmt to ^0.62.0 (#1183)
• 23aad38 chore(deps): update yarn to v4.18.0 (#1180)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​node-rs/argon2 since your current version.

Updates js-yaml from 5.2.1 to 5.3.0

Changelog

Sourced from js-yaml's changelog.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

• Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.
• Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

Deprecated

• Deprecated flat constant exports. Use grouped ones instead.

Removed

• Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

• Validate << sequence items at merge time, so aliased merge sources are checked too.
• Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

[5.2.3] - 2026-08-01

Fixed

• Prevent prototype fallback when resolving tags and mapping entries, #782.
• Resolve !!timestamp years 0000-0099 correctly, #775.
• Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
• Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

[5.2.2] - 2026-07-24

Fixed

• Quote flow scalars where a colon precedes a flow indicator, #773.

Security

• Avoid exponential parsing time for nested flow sequence pairs.

Commits

• 04db458 5.3.0 released
• 22ce0a0 Changelog update
• fae37b8 fix: << outside a mapping key no longer leaks the internal merge symbol
• b62ef83 fix: validate << sequence items at merge time, so aliased sources are check...
• cc665ec docs: review and update annotations
• 2aa24a6 Changelog update
• eec6902 Restore deprecated parser constant exports
• 03397ac Move throwErrorAt to YAMLException as throwAt
• d9dd2c7 docs: new condensed theme
• 0f898e6 docs: annotation tweaks
• Additional commits viewable in compare view

Updates undici from 8.7.0 to 8.10.0

Release notes

Sourced from undici's releases.

v8.10.0

What's Changed

• feat: namespace h2 options by @​metcoder95 in nodejs/undici#5498
• test: update WPT expectations by @​mcollina in nodejs/undici#5587
• test: add cache/dedupe + dns re-dispatch integration tests by @​GiHoon1123 in nodejs/undici#5535
• fix(websocket): support process.unref by @​mcollina in nodejs/undici#5578
• fix(h2): ensure every request settles by @​mcollina in nodejs/undici#5603
• fix(readable): consume a body whose end has already been emitted by @​marko1olo in nodejs/undici#5617
• fix(retry): skip the content-length checkpoint for HEAD and for a 206 without content-range by @​marko1olo in nodejs/undici#5610
• fix: revert idle socket validation to setTimeout(0) to prevent stall on idle event loop by @​marceli1404 in nodejs/undici#5606
• fix(env-http-proxy-agent): match bare IPv6 addresses in no_proxy by @​marko1olo in nodejs/undici#5623
• test: handle aggregate balanced pool errors by @​marko1olo in nodejs/undici#5377
• fix(readable): keep body bytes that arrive after setEncoding() by @​mcollina in nodejs/undici#5620
• fix(socks5): evict unused origin pools by @​Kkartik14 in nodejs/undici#5595
• fix: skip deduplication for upgrade requests by @​Ram-blip in nodejs/undici#5593
• fix(retry): forward informational responses by @​mcollina in nodejs/undici#5625
• fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by @​marko1olo in nodejs/undici#5619
• fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin by @​marko1olo in nodejs/undici#5628
• build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bot] in nodejs/undici#5633
• build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 by @​dependabot[bot] in nodejs/undici#5634
• build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in nodejs/undici#5636
• fix(mock): emit request body lifecycle hooks by @​marko1olo in nodejs/undici#5367
• fix(h2): detach upgrade close handler after GOAWAY by @​pacocartones in nodejs/undici#5641
• fix: retry refused HTTP/2 streams by @​mcollina in nodejs/undici#5598
• fix: preserve DNS origin hostname on sockets by @​cyphercodes in nodejs/undici#5577

New Contributors

• @​marceli1404 made their first contribution in nodejs/undici#5606
• @​Kkartik14 made their first contribution in nodejs/undici#5595
• @​pacocartones made their first contribution in nodejs/undici#5641
• @​cyphercodes made their first contribution in nodejs/undici#5577

Full Changelog: nodejs/undici@v8.9.0...v8.10.0

v8.9.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

... (truncated)

Commits

• c8d80e6 Bumped v8.10.0 (#5644)
• 66923b4 fix: preserve DNS origin hostname on sockets (#5577)
• 3926499 fix: retry refused HTTP/2 streams (#5598)
• 73d6e9e fix(h2): detach upgrade close handler after GOAWAY (#5641)
• b111adb fix(mock): emit request body lifecycle hooks (#5367)
• ae4a3e3 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#5636)
• ec3fbf1 build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 (#5634)
• 2151720 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#5633)
• b96a116 fix(interceptors): allow interceptors without opts.origin (#5628)
• a18ef2d fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView r...
• Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.2.0

Commits

• See full diff in compare view

Updates tsx from 4.23.1 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Updates @hookform/resolvers from 5.4.0 to 5.9.1

Release notes

Sourced from @​hookform/resolvers's releases.

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

• isNameInFieldArray fails to recognise bracket-notation array paths causing nested errors overwriting (#876) (f18ddfb)

v5.9.0

5.9.0 (2026-08-15)

Features

• update joi to v18 (#873) (c8159ae)

v5.8.0

5.8.0 (2026-08-13)

Features

• support Vest 6 (a5100ab)

v5.7.1

5.7.1 (2026-08-02)

Bug Fixes

• ata-validator peer dependency version (#871) (827f20b)

v5.7.0

5.7.0 (2026-08-02)

Features

• support vine v4 (#867) (4cfba18)

v5.6.0

5.6.0 (2026-08-01)

Features

• improve all resovlers drops validation errors for special root field names (b011a5f)

v5.5.8

5.5.8 (2026-08-01)

... (truncated)

Commits

• f18ddfb fix: isNameInFieldArray fails to recognise bracket-notation array paths causi...
• c8159ae feat: update joi to v18 (#873)
• a5100ab feat: support Vest 6
• 28ec539 fix(vest)!: support Vest 6 (#874)
• 827f20b fix: ata-validator peer dependency version (#871)
• 4cfba18 feat: support vine v4 (#867)
• 58d2e2d remove dead image
• b011a5f feat: improve all resovlers drops validation errors for special root field names
• 5483a03 improve all resolvers (#870)
• 2f28787 fix: Zod resolver drops validation errors for special root field names (#869)
• Additional commits viewable in compare view

Updates @tanstack/react-query from 5.101.2 to 5.102.2

Changelog

Sourced from @​tanstack/react-query's changelog.

5.102.2

Patch Changes

• Updated dependencies [80fbf73]:
  • @​tanstack/query-core@​5.102.2

5.102.1

Patch Changes

• Updated dependencies [134890d]:
  • @​tanstack/query-core@​5.102.1

5.102.0

Minor Changes

• #10668 e674826 - react-query: update usePrefetchQuery and usePrefetchInfiniteQuery to use queryClient.query and queryClient.infiniteQuery

Patch Changes

• #11245 37127db - revert: remove NoInfer from useQuery return types

• #10373 6e3d521 - fix(types): propagate generic type parameters to useMutationState select callback

• #11224 294d4e6 - Fix queryOptions and infiniteQueryOptions return types so exported inferred options can be emitted in declaration files without leaking internal data tag symbols.

• #11147 cb6c9d3 - Default TData of UseInfiniteQueryOptions and UseSuspenseInfiniteQueryOptions to InfiniteData<TQueryFnData> so it matches the hook generics.

• #8737 2215bb0 - fix: make mutation variables optional when undefined extends TVariables

• #11221 1ef4208 - Remove experimental render-time prefetching and the promise property from query results.

• #11228 fb6c3fa - Avoid emitting a runtime import for React Query's type-only exports.

• #11130 8834267 - fix(react-query): don't show optimistic fetching for unsubscribed useQueries

• #11233 b866a95 - remove unused experimental_beforeQuery and experimental_afterQuery hooks

• #11144 e546d03 - fix: remove placeholderData from suspense infinite query

• Updated dependencies [34f7cee, b4368c4, 5bb089d, ba4650c, 294d4e6, 1f631b3, 01a02bf, 18c1c1e, 5448063, 2215bb0, 1ef4208, 5981771, 4a9bef6, bef4bc7, 9656dc4, 326aaf1, 3e83601, c6fc17c]:

  • @​tanstack/query-core@​5.102.0

5.101.4

Patch Changes

• Updated dependencies []:

... (truncated)

Commits

• 388bbaf ci: Version Packages (#11265)
• bc423b3 ci: Version Packages (#11261)
• be1352b test(*): add adapter-level type coverage for optional undefinable mutate vari...
• 5743468 ci: Version Packages (#11206)
• 2215bb0 fix(query-core): make MutateFunction optional undefinable-variables (#8737)
• d156adc test: transition tests (#11246)
• 37127db fix/11018 (#11245)
• e674826 React: update usePrefetchQuery to use new methods, plus react adaptor tests a...
• 8834267 fix(react-query): keep unsubscribed useQueries idle (#11130)
• 1ef4208 ref: remove experimental_prefetchInRender (#11221)
• Additional commits viewable in compare view

Updates @tanstack/react-router from 1.170.18 to 1.170.32

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.32

Patch Changes

• #8130 cb281d7 - preserve context during reloads

• Updated dependencies [fa65287, cb281d7]:

  • @​tanstack/router-core@​1.171.27

@​tanstack/react-router@​1.170.31

Patch Changes

• Updated dependencies [3e016ac]:
  • @​tanstack/router-core@​1.171.26

@​tanstack/react-router@​1.170.30

Patch Changes

• #8084 5d3785d - preserve pending UI across retained routes

• #8068 f75cada - direct export of CatchBoundary class component, remove function wrapper

• Updated dependencies [5d3785d, 63d2cc9]:

  • @​tanstack/router-core@​1.171.25

Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.32

Patch Changes

• #8130 cb281d7 - preserve context during reloads

• Updated dependencies [fa65287, cb281d7]:

  • @​tanstack/router-core@​1.171.27

1.170.31

Patch Changes

• Updated dependencies [3e016ac]:
  • @​tanstack/router-core@​1.171.26

1.170.30

Patch Changes

• #8084 5d3785d - preserve pending UI across retained routes

• #8068 f75cada - direct export of CatchBoundary class component, remove function wrapper

• Updated dependencies [5d3785d, 63d2cc9]:

  • @​tanstack/router-core@​1.171.25

1.170.29

Patch Changes

• #8073 0fdf9ff - inline isCtrlKey inside Link component for byte shaving

• Updated dependencies [4c89b15, cf6ab17, bdaf73a]:

  • @​tanstack/router-core@​1.171.24

1.170.28

Patch Changes

• #8055 0c25a7b - Avoid wrapping root components that may render the HTML document in a Suspense boundary during SSR and hydration.

• #8054 31882c7 - Reuse resolved lazy route components when revisiting code-split routes, preventing unnecessary pending UI.

• Updated dependencies [31882c7]:

  • @​tanstack/router-core@​1.171.23

1.170.27

Patch Changes

... (truncated)

Commits

• a5a5bac ci: Version Packages (#8133)
• cb281d7 fix(router-core): preserve context during reloads (#8130)
• 4fcbcde ci: Version Packages (#8119)
• a78f2af ci: Version Packages (#8079)
• 63d2cc9 fix(router-core): remove navigation rollback (#8092)
• 5d3785d fix(router-core): preserve pending UI across retained routes (#8084)
• f97188f chore: localize package dependencies (#8078)
• f75cada perf(react-router): direct export of CatchBoundary class component, remove fu...
• 11dfc93 ci: Version Packages (#8075)
• 0fdf9ff perf: inline isCtrlK...

  Description has been truncated