[dependabot]

Bumps the minor-and-patch group with 29 updates in the / directory:

Package	From	To
@radix-ui/react-avatar	1.2.6	1.3.1
@radix-ui/react-dialog	1.1.23	1.3.1
@radix-ui/react-dropdown-menu	2.1.24	2.2.1
@radix-ui/react-label	2.1.15	2.1.17
@radix-ui/react-select	2.3.7	2.4.1
@radix-ui/react-slot	1.3.3	1.5.0
@radix-ui/react-tooltip	1.2.16	1.4.1
@tanstack/react-query	5.103.2	5.105.0
@tiptap/extension-placeholder	3.31.3	3.32.1
@tiptap/react	3.31.3	3.32.1
@tiptap/starter-kit	3.31.3	3.32.1
drizzle-orm	0.45.3	0.45.4
hono	4.13.9	4.13.14
lucide-react	1.48.0	1.64.0
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
react-router-dom	7.18.4	7.18.5
zod	4.6.5	4.6.7
@cloudflare/vite-plugin	1.60.0	1.66.0
@cloudflare/vitest-pool-workers	0.22.0	0.23.0
@cloudflare/workers-types	5.20260925.1	5.20261030.1
@playwright/test	1.63.0	1.64.1
eslint	10.11.0	10.13.0
jsdom	30.1.1	30.1.3
prettier	3.9.9	3.9.10
typescript-eslint	8.70.1	8.72.1
vite	8.3.1	8.3.5
vitest	4.1.11	4.1.12
wrangler	4.139.0	4.154.0

Updates @radix-ui/react-avatar from 1.2.6 to 1.3.1

Changelog

Sourced from @​radix-ui/react-avatar's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-callback-ref@1.1.5

1.2.7

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.23 to 1.3.1

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0

1.2.0

• Added support for multiple aria-describedby attributes.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @radix-ui/react-dropdown-menu from 2.1.24 to 2.2.1

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.2.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-menu@2.2.1

2.2.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-menu@2.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

2.1.25

• Updated dependencies: @radix-ui/react-menu@2.1.25, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-label from 2.1.15 to 2.1.17

Changelog

Sourced from @​radix-ui/react-label's changelog.

2.1.17

• Updated dependencies: @radix-ui/react-primitive@2.2.0

2.1.16

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-select from 2.3.7 to 2.4.1

Changelog

Sourced from @​radix-ui/react-select's changelog.

2.4.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

2.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
• Fixed content alignment when all items are disabled.
• Fixed a bug where updating a Select value programmatically while inside a <form> would dispatch a click event from the hidden bubble select that propagated to ancestor onClick handlers.
• Fixed a bug resulting from incorrect tree-shaking in SWC-minified code.
• Updated dependencies: @radix-ui/react-collection@1.2.0, @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-direction@1.2.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0, @radix-ui/react-use-callback-ref@1.1.5, @radix-ui/react-visually-hidden@1.2.13

2.3.8

• Fixed a bug where internal event handlers were still called on disabled Select.Item elements. Consumer-provided event handlers still run, but Radix's own selection logic no longer fires for disabled items.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-slot from 1.3.3 to 1.5.0

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.5.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed Slot throwing when an asChild child is a lazy reference whose resolved value is itself a lazy reference.

1.4.0

• Added support for multiple aria-describedby attributes.
• Fixed compatibility issues with React Server Components.

Commits

• See full diff in compare view

Updates @radix-ui/react-tooltip from 1.2.16 to 1.4.1

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.4.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.4.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Fixed a bug where tabbing away from a focusable tooltip trigger nested in a modal popover moved focus to the popover's root instead of the next element in the popover.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0, @radix-ui/react-visually-hidden@1.2.13

1.3.0

• Added support for multiple aria-describedby attributes.
• Updated dependencies: @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @tanstack/react-query from 5.103.2 to 5.105.0

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-next-experimental@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-persist-client@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

@​tanstack/react-query-devtools@​5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5
  • @​tanstack/query-devtools@​5.104.5

@​tanstack/react-query-next-experimental@​5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5

@​tanstack/react-query-persist-client@​5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5
  • @​tanstack/query-persist-client-core@​5.104.5

@​tanstack/react-query@​5.104.5

Patch Changes

• #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

5.104.5

Patch Changes

• #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
• Updated dependencies [f608f93]:
  • @​tanstack/query-core@​5.104.5

5.104.4

Patch Changes

• #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [1fee044, fce89dd]:

  • @​tanstack/query-core@​5.104.4

5.104.3

Patch Changes

• Updated dependencies [0f15bc9]:
  • @​tanstack/query-core@​5.104.3

5.104.2

Patch Changes

• Updated dependencies [03e8c39]:
  • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.104.1

5.104.0

Minor Changes

... (truncated)

Commits

• 5cc606e ci: Version Packages (#12301)
• 14cc330 style(packages): write durations in 'count * unit * 1000' order (#12382)
• d7c0418 chore(react-query/{useQuery,useInfiniteQuery}): remove the unused '@​eslint-re...
• aa3e26b chore(react-query/{HydrationBoundary,utils}): explain why 'react-hooks-js/ref...
• b2801aa test(react-query/useMutation): assert that the mutation settles in the cache ...
• 43636c4 test(react-query/useMutation): wait for the mutation to settle after unmount ...
• 1eed9d9 chore(*): explain why 'vitest-js/valid-expect' is disabled for the 'expectTyp...
• 6bdeb13 test(*/useQuery): rename the 'throwOnError' callback parameter to 'err' to av...
• 86b9f20 test(*/useMutationState): rename the built 'mutation' to 'existingMutation' t...
• d09972b test(*): rename the 'queryKey' test helper to 'createKey' since it creates ke...
• Additional commits viewable in compare view

Updates @tiptap/extension-placeholder from 3.31.3 to 3.32.1

Release notes

Sourced from @​tiptap/extension-placeholder's releases.

v3.32.0

@​tiptap/markdown

Patch Changes

• A literal ! directly before a link is now escaped when serializing to Markdown, so the link is no longer parsed back as an image.

@​tiptap/pm

Patch Changes

• Update ProseMirror dependencies to their latest versions.

@​tiptap/react

Patch Changes

• Fix useEditorState overflowing the stack when a selector returns a value with circular references, such as editor.state after one stored mark replaces another.

@​tiptap/core

Minor Changes

• Add the schemaSpec editor option to use an external ProseMirror schema structure with local extension behavior.

Patch Changes

• Fix list toggling between list types that use different item nodes. Nested lists are recursively converted when the target item schema supports nesting, and flattened into sibling items when it does not.

@​tiptap/y-tiptap

Patch Changes

• Keep relative text and node positions attached through structural edits, node moves, and undo or redo across collaborating clients.

• Improve TypeScript definitions for document synchronization, shared cursors, undo, redo, and document conversions.

• Improve collaboration performance and keep comments, highlights, caret positions, and remote caret details intact during remote edits.

• Preserve shared content when a client cannot display its nodes or marks, and pause that client's editing until compatible content is available.

  Headless document creation rejects empty content when the schema requires child nodes.

@​tiptap/extension-collaboration

Patch Changes

• Keep collaborative editing, cursor presence, and drag handles compatible with the updated @tiptap/y-tiptap binding.

@​tiptap/extension-collaboration-caret

Patch Changes

... (truncated)

Commits

• See full diff in compare view

Updates @tiptap/react from 3.31.3 to 3.32.1

Release notes

Sourced from @​tiptap/react's releases.

v3.32.0

@​tiptap/markdown

Patch Changes

• A literal ! directly before a link is now escaped when serializing to Markdown, so the link is no longer parsed back as an image.

@​tiptap/pm

Patch Changes

• Update ProseMirror dependencies to their latest versions.

@​tiptap/react

Patch Changes

• Fix useEditorState overflowing the stack when a selector returns a value with circular references, such as editor.state after one stored mark replaces another.

@​tiptap/core

Minor Changes

• Add the schemaSpec editor option to use an external ProseMirror schema structure with local extension behavior.

Patch Changes

• Fix list toggling between list types that use different item nodes. Nested lists are recursively converted when the target item schema supports nesting, and flattened into sibling items when it does not.

@​tiptap/y-tiptap

Patch Changes

• Keep relative text and node positions attached through structural edits, node moves, and undo or redo across collaborating clients.

• Improve TypeScript definitions for document synchronization, shared cursors, undo, redo, and document conversions.

• Improve collaboration performance and keep comments, highlights, caret positions, and remote caret details intact during remote edits.

• Preserve shared content when a client cannot display its nodes or marks, and pause that client's editing until compatible content is available.

  Headless document creation rejects empty content when the schema requires child nodes.

@​tiptap/extension-collaboration

Patch Changes

• Keep collaborative editing, cursor presence, and drag handles compatible with the updated @tiptap/y-tiptap binding.

@​tiptap/extension-collaboration-caret

Patch Changes

... (truncated)

Commits

• See full diff in compare view

Updates @tiptap/starter-kit from 3.31.3 to 3.32.1

Release notes

Sourced from @​tiptap/starter-kit's releases.

v3.32.0

@​tiptap/markdown

Patch Changes

• A literal ! directly before a link is now escaped when serializing to Markdown, so the link is no longer parsed back as an image.

@​tiptap/pm

Patch Changes

• Update ProseMirror dependencies to their latest versions.

@​tiptap/react

Patch Changes

• Fix useEditorState overflowing the stack when a selector returns a value with circular references, such as editor.state after one stored mark replaces another.

@​tiptap/core

Minor Changes

• Add the schemaSpec editor option to use an external ProseMirror schema structure with local extension behavior.

Patch Changes

• Fix list toggling between list types that use different item nodes. Nested lists are recursively converted when the target item schema supports nesting, and flattened into sibling items when it does not.

@​tiptap/y-tiptap

Patch Changes

• Keep relative text and node positions attached through structural edits, node moves, and undo or redo across collaborating clients.

• Improve TypeScript definitions for document synchronization, shared cursors, undo, redo, and document conversions.

• Improve collaboration performance and keep comments, highlights, caret positions, and remote caret details intact during remote edits.

• Preserve shared content when a client cannot display its nodes or marks, and pause that client's editing until compatible content is available.

  Headless document creation rejects empty content when the schema requires child nodes.

@​tiptap/extension-collaboration

Patch Changes

• Keep collaborative editing, cursor presence, and drag handles compatible with the updated @tiptap/y-tiptap binding.

@​tiptap/extension-collaboration-caret

Patch Changes

... (truncated)

Commits

• See full diff in compare view

Updates drizzle-orm from 0.45.3 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

• Fixed postgres-js not using prepared queries on explicit .prepare(name)

Commits

• eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
• See full diff in compare view

Updates hono from 4.13.9 to 4.13.14

Release notes

Sourced from hono's releases.

v4.13.14

What's Changed

• docs(contributing): ask for issues instead of RPs honojs/hono#5526
• docs(readme): sync the contributing list with CONTRIBUTING.md honojs/hono#5527
• fix(adapters): accept Hono v5 prereleases in the hono peer range honojs/hono#5537
• chore: unified oxfmt and oxlint config honojs/hono#5518
• docs(readme): remove the deepwiki badge honojs/hono#5548
• fix(serve-static): only serve GET and HEAD requests honojs/hono#5514
• fix(build): keep barrel imports in the bundled d.ts honojs/hono#5557
• fix(jsx): preserve self-closing void elements in cloneElement honojs/hono#5314
• fix(css): keep "//" inside an unquoted url() when minifying honojs/hono#5450
• fix(css): keep the descendant combinator before a pseudo-class when minifying honojs/hono#5451
• fix(serve-static): respect q-values in Accept-Encoding for precompressed files honojs/hono#5436
• fix(helper/route): match regex params in basePath() the same way as the router honojs/hono#5498
• fix(trie-router): keep first value for duplicate path params honojs/hono#5423
• fix(hono-base): disallow getPath when strict is false honojs/hono#5563
• fix(css): Fix multiline CSS handling in style replacement honojs/hono#5405
• feat(bearer-auth): allow MessageFunction to return a Response honojs/hono#5269
• fix(utils/url): preserve encoded duplicate query order honojs/hono#5495

Full Changelog: honojs/hono@v4.13.13...v4.13.14

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
• docs(request): fix jsdoc comments for some getters in honojs/hono#5445
• fix(jsx): allow JSXNode function component results in honojs/hono#5476

... (truncated)

Commits

• bac5c4a 4.13.14
• eb78eca fix(utils/url): preserve encoded duplicate query order (#5495)
• 06a45bc feat(bearer-auth): allow MessageFunction to return a Response (#5269)
• 5ca49b0 fix(css): Fix multiline CSS handling in style replacement (#5405)
• e9c0107 fix(hono-base): disallow getPath when strict is false (#5563)
• 08807ce fix(trie-router): keep first value for duplicate path params (#5422) (#5423)
• e77c7c8 fix(helper/route): match regex params in basePath() the same way as the route...
• d54720d fix(serve-static): respect q-values in Accept-Encoding for precompressed file...
• ae401f0 fix(css): keep the descendant combinator before a pseudo-class when minifying...
• 2013fed fix(css): keep "//" inside an unquoted url() when minifying (#5450)
• Additional commits viewable in compare view

Updates lucide-react from 1.48.0 to 1.64.0

Release notes

Sourced from lucide-react's releases.

Version 1.64.0

What's Changed

• chore(docs|site): Remove Plausible, add tracking events and privacy statement by @​ericfennis in lucide-icons/lucide#5092
• feat(icons): added square-kanban-plus icon by @​KesleyDavid in lucide-icons/lucide#4688
• feat(icons): added letter-b, letter-c, letter-d and 21 more icons by @​karsa-mistmere in lucide-icons/lucide#4743
• feat(icons): added numbers icon by @​karsa-mistmere in lucide-icons/lucide#4778
• feat(icons): added circle-letter-a, circle-letter-b, circle-letter-c and 46 more icons by @​karsa-mistmere in lucide-icons/lucide#4744
• feat(icons): added new Letters & digits category by @​karsa-mistmere in lucide-icons/lucide#5095
• fix(icons): align Unicode currency icon cap heights with other typographic icons by @​karsa-mistmere in lucide-icons/lucide#4926
• ci(claude-review): add Claude PR review workflow by @​ericfennis in lucide-icons/lucide#5097
• fix(icons): remove bracket from square-letter-d.svg by @​ericfennis in lucide-icons/lucide#5101

New Contributors

• @​KesleyDavid made their first contribution in lucide-icons/lucide#4688

Full Changelog: lucide-icons/lucide@1.63.0...1.64.0

Version 1.63.0

What's Changed

• fix(lucide-react): ignore stale DynamicIcon loads after the name changes by @​mkantautas in lucide-icons/lucide#5060
• feat(icons): added calendar-arrow-left, calendar-arrow-right icons by @​ryck in lucide-icons/lucide#5080
• feat(icons): added siren-off icon by @​Xougui in lucide-icons/lucide#5046
• feat(icons): added square-chevrons-down, square-chevrons-left, square-chevrons-right and 1 more icons by @​ypotti in lucide-icons/lucide#5054
• feat(icons): added archive-arrow-down icon by @​bduffany in lucide-icons/lucide#4854
• feat(icons): added chart-radar icon by @​Nitero in lucide-icons/lucide#4979
• feat(icons): added user-round-shield icon by @​DrashtiC07 in lucide-icons/lucide#5044
• feat(icons): added database-cog icon by @​PrimeTestLab in lucide-icons/lucide#5016
• feat(icons): added laser icon by @​kotaindah55 in lucide-icons/lucide#5023
• fix(icons): renamed archive-restore to archive-arrow-up by @​karsa-mistmere in lucide-icons/lucide#5089
• feat(icons): added chart-quadrant icon by @​Nitero in lucide-icons/lucide#4981
• feat(icons): added boxes-linked icon by @​ericfennis in lucide-icons/lucide#5087
• chore(metadata): Align use-cases with metadata guidelines by @​ericfennis in lucide-icons/lucide#5081
• feat(icons): added earbuds-off, earbuds icons by @​rrod497 in lucide-icons/lucide#5088

New Contributors

• @​mkantautas made their first contribution in lucide-icons/lucide#5060
• @​PrimeTestLab made their first contribution in lucide-icons/lucide#5016
• @​kotaindah55 made their first contribution in lucide-icons/lucide#5023

Full Changelog: lucide-icons/lucide@1.62.0...1.63.0

Version 1.62.0

What's Changed

• chore(packages): Update sponsors by @​ericfennis in lucide-icons/lucide#5034
• ci(metadata-suggestions): Improve suggest metadata action by @​ericfennis in lucide-icons/lucide#5061
• chore(deps-dev): bump markdown-it from 15.0.1 to 15.0.3 by @​dependabot[bot] in lucide-icons/lucide#5051
• fix(build-icons): support Windows paths in dynamic imports for template and metadata by @​grzdev in lucide-icons/lucide#5058
• feat(docs): add OpenPanel analytics alongside Plausible by @​ericfennis in lucide-icons/lucide#5063
• ci(metadata-suggestions): run on every PR update with cached suggestions by @​ericfennis in lucide-icons/lucide#5062
• test(lucide): add tests for replaceElement and edge cases by @​grzdev in lucide-icons/lucide#5059

... (truncated)

Commits

• e8f86fc fix(lucide-react): ignore stale DynamicIcon loads after the name changes (#5060)
• 6657faa chore(deps-dev): bump vite from 8.3.2 to 8.3.3 (#5052)
• 1802f33 feat(lucide-react): add package exports for per-icon imports without changing...
• 20aef31 chore(packages): Update sponsors (#5034)
• fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
• 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
• 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
• 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
• 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
• e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
• See full diff in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates react-router-dom from 7.18.4 to 7.18.5

Changelog

Sourced from react-router-dom's changelog.

v7.18.5

Patch Changes

• Updated dependencies:
  • react-router@7.18.5

Commits

• 1ad93b4 Release v7.18.5 (#15705)
• See full diff in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

• b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

• b500a2e 4.6.7
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.60.0 to 1.66.0

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.66.0

Minor Changes

• #16539 046db08 Thanks @​petebacondarwin! - Update the development registry to use the canonical Cloudflare path

  Upgrade Miniflare to 5.20261023.1-beta and Wrangler to 4.154.0. Vite plugin v1 now uses CLOUDFLARE_DEV_REGISTRY_PATH or <Cloudflare config directory>/dev-registry/v5 for Worker discovery. MINIFLARE_REGISTRY_PATH is no longer read. When mixing Vite and Wrangler development sessions, set the same CLOUDFLARE_DEV_REGISTRY_PATH for both because Wrangler retains its legacy default.

• #16407 9ec1101 Thanks @​petebacondarwin! - Support remote Hyperdrive bindings in Vite plugin v1 development and preview

  Set remote: true on a Hyperdrive binding in wrangler.jsonc to connect to its deployed configuration without a local database connection string. The retained remote proxy exposes the binding's connection string and socket streams, and remote session cleanup preserves startup errors and shares one disposal attempt.

Patch Changes

• #16542 ef573d4 Thanks @​petebacondarwin! - Preserve machine-readable error properties from remote bindings

  Enable enhanced error serialization on the remote proxy Worker used by Vite plugin v1. Combined with Miniflare 5.20261023.1-beta, remote binding errors retain properties such as code and numericCode so Worker code can handle them without parsing error messages.

• #16480 ccaa34a Thanks @​petebacondarwin! - Prevent malformed token-exchange responses from crashing remote binding startup

  Update the Undici dependency bundled from the retained remote-bindings package to 7.30.1. Responses with excessive content encodings now reject without a later unhandled stream error when the server closes the connection early.

• #16502 6f2eda1 Thanks @​petebacondarwin! - Update the retained asset configuration validator to Zod 4.6.6

  The Vite plugin validates _headers and _redirects through its private workers-shared package. Update that bundled copy to address excessive memory consumption when validating oversized collections.

• #16444 79678c4 Thanks @​petebacondarwin! - Update Vite plugin v1 to the October 23 Workers runtime

  Use Miniflare 5.20261023.0-beta and the matching Wrangler release for local development and preview. Align bundled helpers and Workers types with this runtime, and use 2026-10-23 as the fallback compatibility date when none is configured. The runtime and helper updates also prevent malformed HTTP responses with excessive content encodings from causing unhandled stream errors. The published helpers also update their bundled Zod validator and fix Windows keyring setup for remote-binding credentials when the configuration path contains spaces.

• #16479 1d5354b Thanks @​petebacondarwin! - Treat cloudflare:durable-objects as a built-in runtime module

  Workers can import retryable() from cloudflare:durable-objects to mark Durable Object methods as safe to retry. The plugin now leaves that import for the runtime to resolve, as it does for cloudflare:workers, instead of trying to resolve it as a package.

• #16493 4ce6176 Thanks @...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.