Skip to content

chore(deps): Bump the js-minor-patch group across 1 directory with 25 updates - #118

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/js-minor-patch-b27767ec88
Open

chore(deps): Bump the js-minor-patch group across 1 directory with 25 updates#118
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/js-minor-patch-b27767ec88

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown

Bumps the js-minor-patch group with 25 updates in the /frontend directory:

Package From To
@duar-auth/js 1.4.1 1.5.2
@duar-auth/nextjs 1.4.1 1.5.2
@duar-auth/react 1.4.1 1.5.2
@hookform/resolvers 5.9.1 5.9.2
@tabler/icons-react 3.46.0 3.49.0
@tanstack/react-query 5.102.3 5.104.5
@tanstack/react-virtual 3.14.10 3.14.22
ketcher-core 3.17.2 3.18.0
ketcher-react 3.17.2 3.18.0
ketcher-standalone 3.17.2 3.18.0
lucide-react 0.525.0 0.577.0
next 16.3.8 16.4.3
radix-ui 1.6.7 1.8.1
react 19.2.8 19.3.1
@types/react 19.2.18 19.3.0
react-d3-tree 3.6.6 3.6.7
react-dom 19.2.8 19.3.1
@types/react-dom 19.2.5 19.3.0
react-hook-form 7.86.0 7.91.0
react-resizable-panels 4.12.3 4.14.8
tailwind-merge 3.6.0 3.7.0
zustand 5.0.15 5.0.16
@testing-library/dom 10.4.1 10.4.2
@testing-library/react 16.3.2 16.3.3
@types/node 22.20.1 22.20.5
@types/react 19.2.18 19.3.0
@types/react-dom 19.2.5 19.3.0

Updates @duar-auth/js from 1.4.1 to 1.5.2

Changelog

Sourced from @​duar-auth/js's changelog.

[1.5.2] - 2026-10-19 — Strict TLS certificates for Redis

Fixed

  • make setup generates TLS certs that pass strict X.509 verification: the CA carries keyUsage, the server cert keyUsage, extendedKeyUsage and an authority key identifier. The recipe lives in scripts/gen-tls-certs.sh, which also checks its output with openssl verify -x509_strict. Existing certs are not regenerated; see the 1.5.0 breaking change for how to check and reissue them.
  • service: when Redis fails at startup, the error names the cause (e.g. Redis is unreachable — … (SSLCertVerificationError: certificate verify failed: …)), so a rejected certificate no longer looks like a network outage. The dev-mode warning carries it too.

Added

  • CI: a job generates the setup certs and verifies them strictly, on every push and weekly.

[1.5.1] - 2026-10-19 — Group shares in AuthZ mode

Fixed

  • service: authz tokens minted by /authz/resolve carry a groups claim (the user's group ids in the token's workspace), as access tokens do. Resources shared with a group now resolve for AuthZ-mode callers on /permissions/check and /permissions/accessible; before, only direct user shares did. Group membership changes apply from the next minted authz token. Minting adds one query; the check path adds none.
  • Python SDK: AuthzMiddleware fills AuthenticatedUser.groups from the claim.
  • JS SDK: authzTokenToUser fills DuarUser.groups from the claim.

Upgrade the service and the SDKs together: an older service mints tokens without the claim, and an older SDK ignores it.

[1.5.0] - 2026-10-19 — Duar MCP

Breaking changes

  • Redis over TLS with REDIS_TLS_VERIFY=required needs certificates that pass strict X.509 checks. The service image moved to Python 3.14, whose default TLS context verifies strictly (since 3.13): the CA must carry a keyUsage extension and the server cert an authority key identifier. Certs made by make setup before 1.5.2 have neither, so the service refuses to start with Refusing to start: … Redis is unreachable, even though Redis is up. Check with openssl verify -x509_strict -CAfile keys/tls/ca.crt keys/tls/server.crt (must print OK). To fix, reissue with ./scripts/gen-tls-certs.sh (1.5.2+) and restart Postgres, Redis and Duar; see Deployment. Postgres connections (ssl=require) encrypt without verifying, so they are unaffected.

Added

  • Duar MCP (Python SDK, pip install "duar-auth[mcp]"): duar_auth.mcp.mount_mcp(app, mcp, duar) serves a FastMCP server at /mcp/ inside an AuthZ-mode app (Duar(mode="authz", auto_resolve=True, idp_provider=...), protected with duar.protect(app), FastMCP(..., mask_error_details=True), stateless HTTP). Every tool call needs an authenticated Duar user and runs with that user's own permissions. Tools tagged AGENT_GATED also need a grant on the action mcp:<service_name>.<tool>, checked live on every call and fail-closed, so a revoked grant applies on the next call. Gated tools are registered as Duar actions at startup. Grant them by adding the action to a workspace role. See docs/sdk/mcp.md.
  • Python SDK: Duar.request_auth(request) returns the RequestAuth for a request the Duar middleware authenticated, for code outside FastAPI dependencies (e.g. inside an MCP tool). forward_headers(request) returns the headers that call another first-party app as the current user (IdP token + verified X-Workspace-Id).
  • service: rate-limit tier RATE_LIMIT_TOOL_CHECK (default 600/minute) on POST /roles/check-action and POST /permissions/check, keyed per calling app + user. Shown in the admin Settings panel.
  • service: GET /admin/actions/insights accepts action_prefix and service_name to scope usage and the allowed/denied trend.
  • admin: Duar MCP console: apps serving gated tools, each app's tools and grant actions, and a tool-call audit (allowed/denied over 7/30/90 days).
  • admin: dashboard auto-refreshes every 30 seconds (toggle).
  • SECURITY.md: supported versions (the latest release only) and private vulnerability reporting through GitHub, acknowledged within 5 working days.
  • CI: the Trivy dependency and image scans also run weekly and on manual dispatch, so CVEs published between pushes surface without a commit. Dependabot now covers uv, npm (admin, JS SDKs) and Docker base images alongside GitHub Actions, weekly, with minor and patch updates grouped.
  • Lint: ruff's bandit rules (S) are enabled for the service and the Python SDK. S101 is ignored, test fixtures may hold placeholder tokens, and each remaining hit carries an inline reason.

Changed

  • Behavior change: /roles/check-action and /permissions/check are limited per calling app + user (RATE_LIMIT_TOOL_CHECK, 600/min) instead of the per-IP default (120/min) and aggregate tiers. All users of one app no longer share its server's IP bucket, and one app's traffic for a user can't throttle that user in other apps. Like the other decorated tiers, these routes are not throttled before authentication; put edge rate limiting in front of Duar.
  • Behavior change: SELF_SERVE_MAX_WORKSPACES_PER_USER defaults to 3 (was 1). Set it explicitly to keep the old cap.
  • service: a denied check-action records at most one action_denied activity event per user, workspace, app and action every 5 minutes, so an agent retrying a tool it has no grant for doesn't flood the activity log. If Redis is unavailable every denial is recorded.
  • Python SDK: RoleClient, PermissionClient and AuthzClient keep working when reused across event loops (e.g. asyncio.run(...) at startup, then the server's loop), and closing them on a different loop no longer fails. RoleClient._client and PermissionClient._client are now read-only properties.
  • admin: refreshed UI (compact brand, page headers without record counts, rounded favicon).
  • admin image: nginx now sends X-Frame-Options: DENY, Permissions-Policy (camera, microphone, geolocation off) and Content-Security-Policy: frame-ancestors 'none', matching the service's own response headers. Built with node:26-alpine and Vite 8.
  • service image: python:3.14-alpine, without the unused global pip/setuptools.

Fixed

  • service image: the container healthcheck probes 127.0.0.1, so the container reports healthy (Alpine resolved localhost to IPv6 only, while the server listens on IPv4).

... (truncated)

Commits
  • 88226e1 chore: bump all packages to 1.5.2
  • 8c38e0e chore: bump all packages to 1.5.1
  • 29c035b fix: include workspace groups in authz tokens (#76)
  • 3812973 chore: bump all packages to 1.5.0
  • f7a96d9 build(sdks): vitest 5 with paired @​vitest/coverage-v8 5
  • 3189d23 build(deps): bump esbuild and tsup in /sdks (#41)
  • 2499a8c build(sdks): vitest 4 (+coverage-v8 4) and Next 16 dev/test target (#34)
  • 43f1069 build(deps): bump the minor-and-patch group across 2 directories with 18 upda...
  • d0c6621 test(js): wait for the cross-tab logout instead of one tick
  • 198a707 chore: bump all packages to 1.4.3
  • Additional commits viewable in compare view

Updates @duar-auth/nextjs from 1.4.1 to 1.5.2

Changelog

Sourced from @​duar-auth/nextjs's changelog.

[1.5.2] - 2026-10-19 — Strict TLS certificates for Redis

Fixed

  • make setup generates TLS certs that pass strict X.509 verification: the CA carries keyUsage, the server cert keyUsage, extendedKeyUsage and an authority key identifier. The recipe lives in scripts/gen-tls-certs.sh, which also checks its output with openssl verify -x509_strict. Existing certs are not regenerated; see the 1.5.0 breaking change for how to check and reissue them.
  • service: when Redis fails at startup, the error names the cause (e.g. Redis is unreachable — … (SSLCertVerificationError: certificate verify failed: …)), so a rejected certificate no longer looks like a network outage. The dev-mode warning carries it too.

Added

  • CI: a job generates the setup certs and verifies them strictly, on every push and weekly.

[1.5.1] - 2026-10-19 — Group shares in AuthZ mode

Fixed

  • service: authz tokens minted by /authz/resolve carry a groups claim (the user's group ids in the token's workspace), as access tokens do. Resources shared with a group now resolve for AuthZ-mode callers on /permissions/check and /permissions/accessible; before, only direct user shares did. Group membership changes apply from the next minted authz token. Minting adds one query; the check path adds none.
  • Python SDK: AuthzMiddleware fills AuthenticatedUser.groups from the claim.
  • JS SDK: authzTokenToUser fills DuarUser.groups from the claim.

Upgrade the service and the SDKs together: an older service mints tokens without the claim, and an older SDK ignores it.

[1.5.0] - 2026-10-19 — Duar MCP

Breaking changes

  • Redis over TLS with REDIS_TLS_VERIFY=required needs certificates that pass strict X.509 checks. The service image moved to Python 3.14, whose default TLS context verifies strictly (since 3.13): the CA must carry a keyUsage extension and the server cert an authority key identifier. Certs made by make setup before 1.5.2 have neither, so the service refuses to start with Refusing to start: … Redis is unreachable, even though Redis is up. Check with openssl verify -x509_strict -CAfile keys/tls/ca.crt keys/tls/server.crt (must print OK). To fix, reissue with ./scripts/gen-tls-certs.sh (1.5.2+) and restart Postgres, Redis and Duar; see Deployment. Postgres connections (ssl=require) encrypt without verifying, so they are unaffected.

Added

  • Duar MCP (Python SDK, pip install "duar-auth[mcp]"): duar_auth.mcp.mount_mcp(app, mcp, duar) serves a FastMCP server at /mcp/ inside an AuthZ-mode app (Duar(mode="authz", auto_resolve=True, idp_provider=...), protected with duar.protect(app), FastMCP(..., mask_error_details=True), stateless HTTP). Every tool call needs an authenticated Duar user and runs with that user's own permissions. Tools tagged AGENT_GATED also need a grant on the action mcp:<service_name>.<tool>, checked live on every call and fail-closed, so a revoked grant applies on the next call. Gated tools are registered as Duar actions at startup. Grant them by adding the action to a workspace role. See docs/sdk/mcp.md.
  • Python SDK: Duar.request_auth(request) returns the RequestAuth for a request the Duar middleware authenticated, for code outside FastAPI dependencies (e.g. inside an MCP tool). forward_headers(request) returns the headers that call another first-party app as the current user (IdP token + verified X-Workspace-Id).
  • service: rate-limit tier RATE_LIMIT_TOOL_CHECK (default 600/minute) on POST /roles/check-action and POST /permissions/check, keyed per calling app + user. Shown in the admin Settings panel.
  • service: GET /admin/actions/insights accepts action_prefix and service_name to scope usage and the allowed/denied trend.
  • admin: Duar MCP console: apps serving gated tools, each app's tools and grant actions, and a tool-call audit (allowed/denied over 7/30/90 days).
  • admin: dashboard auto-refreshes every 30 seconds (toggle).
  • SECURITY.md: supported versions (the latest release only) and private vulnerability reporting through GitHub, acknowledged within 5 working days.
  • CI: the Trivy dependency and image scans also run weekly and on manual dispatch, so CVEs published between pushes surface without a commit. Dependabot now covers uv, npm (admin, JS SDKs) and Docker base images alongside GitHub Actions, weekly, with minor and patch updates grouped.
  • Lint: ruff's bandit rules (S) are enabled for the service and the Python SDK. S101 is ignored, test fixtures may hold placeholder tokens, and each remaining hit carries an inline reason.

Changed

  • Behavior change: /roles/check-action and /permissions/check are limited per calling app + user (RATE_LIMIT_TOOL_CHECK, 600/min) instead of the per-IP default (120/min) and aggregate tiers. All users of one app no longer share its server's IP bucket, and one app's traffic for a user can't throttle that user in other apps. Like the other decorated tiers, these routes are not throttled before authentication; put edge rate limiting in front of Duar.
  • Behavior change: SELF_SERVE_MAX_WORKSPACES_PER_USER defaults to 3 (was 1). Set it explicitly to keep the old cap.
  • service: a denied check-action records at most one action_denied activity event per user, workspace, app and action every 5 minutes, so an agent retrying a tool it has no grant for doesn't flood the activity log. If Redis is unavailable every denial is recorded.
  • Python SDK: RoleClient, PermissionClient and AuthzClient keep working when reused across event loops (e.g. asyncio.run(...) at startup, then the server's loop), and closing them on a different loop no longer fails. RoleClient._client and PermissionClient._client are now read-only properties.
  • admin: refreshed UI (compact brand, page headers without record counts, rounded favicon).
  • admin image: nginx now sends X-Frame-Options: DENY, Permissions-Policy (camera, microphone, geolocation off) and Content-Security-Policy: frame-ancestors 'none', matching the service's own response headers. Built with node:26-alpine and Vite 8.
  • service image: python:3.14-alpine, without the unused global pip/setuptools.

Fixed

  • service image: the container healthcheck probes 127.0.0.1, so the container reports healthy (Alpine resolved localhost to IPv6 only, while the server listens on IPv4).

... (truncated)

Commits
  • 88226e1 chore: bump all packages to 1.5.2
  • 8c38e0e chore: bump all packages to 1.5.1
  • 3812973 chore: bump all packages to 1.5.0
  • f7a96d9 build(sdks): vitest 5 with paired @​vitest/coverage-v8 5
  • 3189d23 build(deps): bump esbuild and tsup in /sdks (#41)
  • 2499a8c build(sdks): vitest 4 (+coverage-v8 4) and Next 16 dev/test target (#34)
  • 43f1069 build(deps): bump the minor-and-patch group across 2 directories with 18 upda...
  • 198a707 chore: bump all packages to 1.4.3
  • cf803c9 chore: bump all packages to 1.4.2
  • See full diff in compare view

Updates @duar-auth/react from 1.4.1 to 1.5.2

Changelog

Sourced from @​duar-auth/react's changelog.

[1.5.2] - 2026-10-19 — Strict TLS certificates for Redis

Fixed

  • make setup generates TLS certs that pass strict X.509 verification: the CA carries keyUsage, the server cert keyUsage, extendedKeyUsage and an authority key identifier. The recipe lives in scripts/gen-tls-certs.sh, which also checks its output with openssl verify -x509_strict. Existing certs are not regenerated; see the 1.5.0 breaking change for how to check and reissue them.
  • service: when Redis fails at startup, the error names the cause (e.g. Redis is unreachable — … (SSLCertVerificationError: certificate verify failed: …)), so a rejected certificate no longer looks like a network outage. The dev-mode warning carries it too.

Added

  • CI: a job generates the setup certs and verifies them strictly, on every push and weekly.

[1.5.1] - 2026-10-19 — Group shares in AuthZ mode

Fixed

  • service: authz tokens minted by /authz/resolve carry a groups claim (the user's group ids in the token's workspace), as access tokens do. Resources shared with a group now resolve for AuthZ-mode callers on /permissions/check and /permissions/accessible; before, only direct user shares did. Group membership changes apply from the next minted authz token. Minting adds one query; the check path adds none.
  • Python SDK: AuthzMiddleware fills AuthenticatedUser.groups from the claim.
  • JS SDK: authzTokenToUser fills DuarUser.groups from the claim.

Upgrade the service and the SDKs together: an older service mints tokens without the claim, and an older SDK ignores it.

[1.5.0] - 2026-10-19 — Duar MCP

Breaking changes

  • Redis over TLS with REDIS_TLS_VERIFY=required needs certificates that pass strict X.509 checks. The service image moved to Python 3.14, whose default TLS context verifies strictly (since 3.13): the CA must carry a keyUsage extension and the server cert an authority key identifier. Certs made by make setup before 1.5.2 have neither, so the service refuses to start with Refusing to start: … Redis is unreachable, even though Redis is up. Check with openssl verify -x509_strict -CAfile keys/tls/ca.crt keys/tls/server.crt (must print OK). To fix, reissue with ./scripts/gen-tls-certs.sh (1.5.2+) and restart Postgres, Redis and Duar; see Deployment. Postgres connections (ssl=require) encrypt without verifying, so they are unaffected.

Added

  • Duar MCP (Python SDK, pip install "duar-auth[mcp]"): duar_auth.mcp.mount_mcp(app, mcp, duar) serves a FastMCP server at /mcp/ inside an AuthZ-mode app (Duar(mode="authz", auto_resolve=True, idp_provider=...), protected with duar.protect(app), FastMCP(..., mask_error_details=True), stateless HTTP). Every tool call needs an authenticated Duar user and runs with that user's own permissions. Tools tagged AGENT_GATED also need a grant on the action mcp:<service_name>.<tool>, checked live on every call and fail-closed, so a revoked grant applies on the next call. Gated tools are registered as Duar actions at startup. Grant them by adding the action to a workspace role. See docs/sdk/mcp.md.
  • Python SDK: Duar.request_auth(request) returns the RequestAuth for a request the Duar middleware authenticated, for code outside FastAPI dependencies (e.g. inside an MCP tool). forward_headers(request) returns the headers that call another first-party app as the current user (IdP token + verified X-Workspace-Id).
  • service: rate-limit tier RATE_LIMIT_TOOL_CHECK (default 600/minute) on POST /roles/check-action and POST /permissions/check, keyed per calling app + user. Shown in the admin Settings panel.
  • service: GET /admin/actions/insights accepts action_prefix and service_name to scope usage and the allowed/denied trend.
  • admin: Duar MCP console: apps serving gated tools, each app's tools and grant actions, and a tool-call audit (allowed/denied over 7/30/90 days).
  • admin: dashboard auto-refreshes every 30 seconds (toggle).
  • SECURITY.md: supported versions (the latest release only) and private vulnerability reporting through GitHub, acknowledged within 5 working days.
  • CI: the Trivy dependency and image scans also run weekly and on manual dispatch, so CVEs published between pushes surface without a commit. Dependabot now covers uv, npm (admin, JS SDKs) and Docker base images alongside GitHub Actions, weekly, with minor and patch updates grouped.
  • Lint: ruff's bandit rules (S) are enabled for the service and the Python SDK. S101 is ignored, test fixtures may hold placeholder tokens, and each remaining hit carries an inline reason.

Changed

  • Behavior change: /roles/check-action and /permissions/check are limited per calling app + user (RATE_LIMIT_TOOL_CHECK, 600/min) instead of the per-IP default (120/min) and aggregate tiers. All users of one app no longer share its server's IP bucket, and one app's traffic for a user can't throttle that user in other apps. Like the other decorated tiers, these routes are not throttled before authentication; put edge rate limiting in front of Duar.
  • Behavior change: SELF_SERVE_MAX_WORKSPACES_PER_USER defaults to 3 (was 1). Set it explicitly to keep the old cap.
  • service: a denied check-action records at most one action_denied activity event per user, workspace, app and action every 5 minutes, so an agent retrying a tool it has no grant for doesn't flood the activity log. If Redis is unavailable every denial is recorded.
  • Python SDK: RoleClient, PermissionClient and AuthzClient keep working when reused across event loops (e.g. asyncio.run(...) at startup, then the server's loop), and closing them on a different loop no longer fails. RoleClient._client and PermissionClient._client are now read-only properties.
  • admin: refreshed UI (compact brand, page headers without record counts, rounded favicon).
  • admin image: nginx now sends X-Frame-Options: DENY, Permissions-Policy (camera, microphone, geolocation off) and Content-Security-Policy: frame-ancestors 'none', matching the service's own response headers. Built with node:26-alpine and Vite 8.
  • service image: python:3.14-alpine, without the unused global pip/setuptools.

Fixed

  • service image: the container healthcheck probes 127.0.0.1, so the container reports healthy (Alpine resolved localhost to IPv6 only, while the server listens on IPv4).

... (truncated)

Commits
  • 88226e1 chore: bump all packages to 1.5.2
  • 8c38e0e chore: bump all packages to 1.5.1
  • 3812973 chore: bump all packages to 1.5.0
  • f7a96d9 build(sdks): vitest 5 with paired @​vitest/coverage-v8 5
  • 3189d23 build(deps): bump esbuild and tsup in /sdks (#41)
  • 2499a8c build(sdks): vitest 4 (+coverage-v8 4) and Next 16 dev/test target (#34)
  • 43f1069 build(deps): bump the minor-and-patch group across 2 directories with 18 upda...
  • 198a707 chore: bump all packages to 1.4.3
  • cf803c9 chore: bump all packages to 1.4.2
  • See full diff in compare view

Updates @hookform/resolvers from 5.9.1 to 5.9.2

Release notes

Sourced from @​hookform/resolvers's releases.

v5.9.2

5.9.2 (2026-10-17)

Bug Fixes

  • ajv: preserve escaped field names in validation errors (#879) (71e6052)
Commits

Updates @tabler/icons-react from 3.46.0 to 3.49.0

Release notes

Sourced from @​tabler/icons-react's releases.

Release 3.49.0

18 new icons:

  • outline/alphabet-chinese
  • outline/alphabet-devanagari
  • outline/alphabet-ethiopic
  • outline/alphabet-georgian
  • outline/alphabet-japanese
  • outline/blob-dashed
  • outline/circle-heart
  • outline/circle-pause
  • outline/circle-play
  • outline/circle-stop
  • outline/file-lock
  • outline/folder-lock
  • outline/lens-concave
  • outline/lens-convex
  • outline/memory
  • outline/square-dashed-top-solid
  • outline/square-dashed-x
  • outline/triangle-dashed

Fixes and improvements

  • Add alphabet, arabic, typography and character tags to alphabet-arabic (#1643)
  • Match brand-instagram size to other square brand icons (#1615)
  • Fix square-dashed icon drawn as a solid square (#1614)
  • Redraw square-dashed and table-dashed icons (#1640)
  • Add squircle tag to all square-rounded icons (#1641)
  • Webfont: Fix filled home webfont glyph having zero width in Chrome (#1616)
  • Webfont: Fix sass and style fields in package.json to point to dist/, and stop publishing the intermediate SVG fonts, which the CSS never referenced (#1633)
  • Webfont: Make webfont builds reproducible, so font files no longer change between builds of the same icons (#1624)
  • Webfont: Drop the unused svgtofont dependency (#1620)
  • Astro, Preact, React, React Native, SolidJS, Vue: Stop publishing source maps, which made up about 70% of the package size (#1634)
  • Svelte, Svelte Runes: Add default export conditions and document per-icon imports (#1630)
  • React Native: Stop passing extra props (testID, style, onPress, …) to every node of the icon, only the root Svg gets them. title is now exposed to screen readers via accessibility props (#1628)

Release 3.48.0

18 new icons:

  • outline/duplicate
  • outline/folder-ai
  • outline/folder-sparkle
  • outline/git-branch-check
  • outline/git-branch-x

... (truncated)

Changelog

Sourced from @​tabler/icons-react's changelog.

3.49.0

Patch Changes

Commits
  • 009744c Release (#1647)
  • 9659394 Run Angular tests in CI, add React Native tests and lint Vue, Svelte and Astr...
  • 1d8fd55 Add ESLint and Prettier checks and clean up .build/helpers.mjs (#1623)
  • 4a4054d Speed up declaration bundling for JS framework packages (#1618)
  • 0239805 Release 3.48.0
  • 87e7c39 Release 3.47.0
  • bbb9bdb Run tests in CI, fix ReactSVG type rot, add type and RSC guards (#1579)
  • 45a7ca8 Remove trailing space from the icon class attribute (#1582)
  • 55f87a7 Refresh package READMEs: fix wrong props, broken links and inconsistent struc...
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tabler/icons-react since your current version.


Updates @tanstack/react-query from 5.102.3 to 5.104.5

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5
    • @​tanstack/query-devtools@​5.104.5

@​tanstack/react-query-next-experimental@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5

@​tanstack/react-query-persist-client@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5
    • @​tanstack/query-persist-client-core@​5.104.5

@​tanstack/react-query@​5.104.5

Patch Changes

  • #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
  • Updated dependencies [f608f93]:
    • @​tanstack/query-core@​5.104.5

@​tanstack/react-query-devtools@​5.104.4

Patch Changes

  • #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

  • Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

    • @​tanstack/query-devtools@​5.104.4
    • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-next-experimental@​5.104.4

Patch Changes

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
  • Updated dependencies [c208861, a108398]:
    • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-persist-client@​5.104.4

Patch Changes

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
  • Updated dependencies [c208861, a108398]:
    • @​tanstack/react-query@​5.104.4

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.5

Patch Changes

  • #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
  • Updated dependencies [f608f93]:
    • @​tanstack/query-core@​5.104.5

5.104.4

Patch Changes

  • #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

  • #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

  • Updated dependencies [1fee044, fce89dd]:

    • @​tanstack/query-core@​5.104.4

5.104.3

Patch Changes

  • Updated dependencies [0f15bc9]:
    • @​tanstack/query-core@​5.104.3

5.104.2

Patch Changes

  • Updated dependencies [03e8c39]:
    • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.104.1

5.104.0

Minor Changes

Patch Changes

  • Updated dependencies [5279b05]:
    • @​tanstack/query-core@​5.104.0

... (truncated)

Commits

Updates @tanstack/react-virtual from 3.14.10 to 3.14.22

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.22

Patch Changes

@​tanstack/react-virtual@​3.14.21

Patch Changes

  • Updated dependencies [05bb4d3]:
    • @​tanstack/virtual-core@​3.19.6

@​tanstack/react-virtual@​3.14.20

Patch Changes

@​tanstack/react-virtual@​3.14.19

Patch Changes

  • Updated dependencies [269e8ed]:
    • @​tanstack/virtual-core@​3.19.4

@​tanstack/react-virtual@​3.14.18

Patch Changes

  • Updated dependencies [f211d3a]:
    • @​tanstack/virtual-core@​3.19.3

@​tanstack/react-virtual@​3.14.17

Patch Changes

@​tanstack/react-virtual@​3.14.16

Patch Changes

@​tanstack/react-virtual@​3.14.15

Patch Changes

@​tanstack/react-virtual@​3.14.14

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.22

Patch Changes

3.14.21

Patch Changes

  • Updated dependencies [05bb4d3]:
    • @​tanstack/virtual-core@​3.19.6

3.14.20

Patch Changes

3.14.19

Patch Changes

  • Updated dependencies [269e8ed]:
    • @​tanstack/virtual-core@​3.19.4

3.14.18

Patch Changes

  • Updated dependencies [f211d3a]:
    • @​tanstack/virtual-core@​3.19.3

3.14.17

Patch Changes

3.14.16

Patch Changes

3.14.15

... (truncated)

Commits
  • c462c61 ci: Version Packages (#1336)
  • 28ff2ca ci: Version Packages (#1333)
  • 4296ac2 ci: Version Packages (#1323)
  • 9c762fe fix(virtual-core): finish the iOS scroll-correction plan and simplify the scr...
  • 4a1a4fd fix(virtual-core): defer iOS scroll corrections only for touch-driven scrolls...
  • 4f9636e ci: Version Packages (#1322)
  • 676a098 ci: Version Packages (#1317)
  • 7c20899 ci: Version Packages (#1315)
  • cb510cb refactor(virtual-core): describe an in-flight scroll command by one phase (#1...
  • 46f73fb ci: Version Packages (

@dependabot
chore(deps): Bump the js-minor-patch group across 1 directory with 25…
199b76f 
… updates

Bumps the js-minor-patch group with 25 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [@duar-auth/js](https://github.com/sidxz/duar/tree/HEAD/sdks/js) | `1.4.1` | `1.5.2` |
| [@duar-auth/nextjs](https://github.com/sidxz/duar/tree/HEAD/sdks/nextjs) | `1.4.1` | `1.5.2` |
| [@duar-auth/react](https://github.com/sidxz/duar/tree/HEAD/sdks/react) | `1.4.1` | `1.5.2` |
| [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.9.1` | `5.9.2` |
| [@tabler/icons-react](https://github.com/tabler/tabler-icons/tree/HEAD/packages/icons-react) | `3.46.0` | `3.49.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.102.3` | `5.104.5` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.22` |
| [ketcher-core](https://github.com/epam/ketcher/tree/HEAD/packages/ketcher-core) | `3.17.2` | `3.18.0` |
| [ketcher-react](https://github.com/epam/ketcher/tree/HEAD/packages/ketcher-react) | `3.17.2` | `3.18.0` |
| [ketcher-standalone](https://github.com/epam/ketcher/tree/HEAD/packages/ketcher-standalone) | `3.17.2` | `3.18.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.525.0` | `0.577.0` |
| [next](https://github.com/vercel/next.js) | `16.3.8` | `16.4.3` |
| [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.7` | `1.8.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.1` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [react-d3-tree](https://github.com/bkrem/react-d3-tree) | `3.6.6` | `3.6.7` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.1` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.3.0` |
| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.86.0` | `7.91.0` |
| [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels) | `4.12.3` | `4.14.8` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.15` | `5.0.16` |
| [@testing-library/dom](https://github.com/testing-library/dom-testing-library) | `10.4.1` | `10.4.2` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.20.1` | `22.20.5` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.3.0` |



Updates `@duar-auth/js` from 1.4.1 to 1.5.2
- [Changelog](https://github.com/sidxz/duar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sidxz/duar/commits/sdk-v1.5.2/sdks/js)

Updates `@duar-auth/nextjs` from 1.4.1 to 1.5.2
- [Changelog](https://github.com/sidxz/duar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sidxz/duar/commits/sdk-v1.5.2/sdks/nextjs)

Updates `@duar-auth/react` from 1.4.1 to 1.5.2
- [Changelog](https://github.com/sidxz/duar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sidxz/duar/commits/sdk-v1.5.2/sdks/react)

Updates `@hookform/resolvers` from 5.9.1 to 5.9.2
- [Release notes](https://github.com/react-hook-form/resolvers/releases)
- [Commits](react-hook-form/resolvers@v5.9.1...v5.9.2)

Updates `@tabler/icons-react` from 3.46.0 to 3.49.0
- [Release notes](https://github.com/tabler/tabler-icons/releases)
- [Changelog](https://github.com/tabler/tabler-icons/blob/main/packages/icons-react/CHANGELOG.md)
- [Commits](https://github.com/tabler/tabler-icons/commits/v3.49.0/packages/icons-react)

Updates `@tanstack/react-query` from 5.102.3 to 5.104.5
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.5/packages/react-query)

Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.22
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.22/packages/react-virtual)

Updates `ketcher-core` from 3.17.2 to 3.18.0
- [Release notes](https://github.com/epam/ketcher/releases)
- [Commits](https://github.com/epam/ketcher/commits/v3.18.0/packages/ketcher-core)

Updates `ketcher-react` from 3.17.2 to 3.18.0
- [Release notes](https://github.com/epam/ketcher/releases)
- [Commits](https://github.com/epam/ketcher/commits/v3.18.0/packages/ketcher-react)

Updates `ketcher-standalone` from 3.17.2 to 3.18.0
- [Release notes](https://github.com/epam/ketcher/releases)
- [Commits](https://github.com/epam/ketcher/commits/v3.18.0/packages/ketcher-standalone)

Updates `lucide-react` from 0.525.0 to 0.577.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react)

Updates `next` from 16.3.8 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.8...v16.4.3)

Updates `radix-ui` from 1.6.7 to 1.8.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/radix-ui)

Updates `react` from 19.2.8 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-d3-tree` from 3.6.6 to 3.6.7
- [Release notes](https://github.com/bkrem/react-d3-tree/releases)
- [Commits](bkrem/react-d3-tree@v3.6.6...v3.6.7)

Updates `react-dom` from 19.2.8 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@types/react-dom` from 19.2.5 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-hook-form` from 7.86.0 to 7.91.0
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.86.0...v7.91.0)

Updates `react-resizable-panels` from 4.12.3 to 4.14.8
- [Release notes](https://github.com/bvaughn/react-resizable-panels/releases)
- [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md)
- [Commits](bvaughn/react-resizable-panels@4.12.3...4.14.8)

Updates `tailwind-merge` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge)

Updates `zustand` from 5.0.15 to 5.0.16
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.15...v5.0.16)

Updates `@testing-library/dom` from 10.4.1 to 10.4.2
- [Release notes](https://github.com/testing-library/dom-testing-library/releases)
- [Changelog](https://github.com/testing-library/dom-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/dom-testing-library@v10.4.1...v10.4.2)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

Updates `@types/node` from 22.20.1 to 22.20.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.5 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

---
updated-dependencies:
- dependency-name: "@duar-auth/js"
  dependency-version: 1.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: "@duar-auth/nextjs"
  dependency-version: 1.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: "@duar-auth/react"
  dependency-version: 1.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: "@hookform/resolvers"
  dependency-version: 5.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: "@tabler/icons-react"
  dependency-version: 3.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.104.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: ketcher-core
  dependency-version: 3.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: ketcher-react
  dependency-version: 3.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: ketcher-standalone
  dependency-version: 3.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: lucide-react
  dependency-version: 0.577.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: next
  dependency-version: 16.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: radix-ui
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: react-d3-tree
  dependency-version: 3.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: react-hook-form
  dependency-version: 7.91.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: react-resizable-panels
  dependency-version: 4.14.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: tailwind-merge
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: zustand
  dependency-version: 5.0.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: "@testing-library/dom"
  dependency-version: 10.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: "@types/node"
  dependency-version: 22.20.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants