chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@ai-sdk/react (source)	4.0.40 → 4.0.50			dependencies	patch	4.0.54 (+3)
@datadog/browser-rum (source)	7.6.1 → 7.7.0			dependencies	minor
@datadog/browser-rum-react (source)	7.6.1 → 7.7.0			dependencies	minor
@harperfast/agent-tools (source)	1.2.2 → 1.2.3			dependencies	patch
@harperfast/skills (source)	1.11.0 → 1.11.1			dependencies	patch	1.12.1 (+1)
@hookform/resolvers (source)	5.4.0 → 5.6.0			dependencies	minor	5.7.1 (+1)
@playwright/test (source)	1.61.1 → 1.62.1			devDependencies	minor
@radix-ui/react-accordion (source)	1.2.18 → 1.2.20			dependencies	patch
@radix-ui/react-alert-dialog (source)	1.1.21 → 1.1.23			dependencies	patch
@radix-ui/react-context-menu (source)	2.3.5 → 2.3.7			dependencies	patch
@radix-ui/react-dialog (source)	1.1.21 → 1.1.23			dependencies	patch
@radix-ui/react-dropdown-menu (source)	2.1.22 → 2.1.24			dependencies	patch
@radix-ui/react-label (source)	2.1.13 → 2.1.15			dependencies	patch
@radix-ui/react-navigation-menu (source)	1.2.20 → 1.2.22			dependencies	patch
@radix-ui/react-radio-group (source)	1.4.5 → 1.4.7			dependencies	patch
@radix-ui/react-scroll-area (source)	1.2.16 → 1.2.18			dependencies	patch
@radix-ui/react-select (source)	2.3.5 → 2.3.7			dependencies	patch
@radix-ui/react-separator (source)	1.1.13 → 1.1.15			dependencies	patch
@radix-ui/react-slot (source)	1.3.1 → 1.3.3			dependencies	patch
@radix-ui/react-switch (source)	1.3.5 → 1.3.7			dependencies	patch
@radix-ui/react-tabs (source)	1.1.19 → 1.1.21			dependencies	patch
@radix-ui/react-toggle (source)	1.1.16 → 1.1.18			dependencies	patch
@radix-ui/react-tooltip (source)	1.2.14 → 1.2.16			dependencies	patch
@stripe/stripe-js (source)	9.12.0 → 9.12.1			dependencies	patch	9.13.0
@types/react (source)	19.2.17 → 19.2.18			devDependencies	patch
@types/react-dom (source)	19.2.3 → 19.2.4			devDependencies	patch
@vitejs/plugin-react (source)	6.0.4 → 6.0.5			devDependencies	patch
ai (source)	7.0.37 → 7.0.47			dependencies	patch	7.0.51 (+3)
axios (source)	1.18.1 → 1.19.0			dependencies	minor
create-harper (source)	1.10.12 → 1.11.2			dependencies	minor	1.11.3
harper (source)	5.1.23 → 5.2.0			devDependencies	minor
lucide-react (source)	1.26.0 → 1.28.0			dependencies	minor
motion	12.42.2 → 12.43.0			dependencies	minor
node (source)	24.18.0 → 24.18.1				patch	v24.19.0
node (source)	24.18.0-bookworm → 24.18.1-bookworm			final	patch	24.19.0
oxlint (source)	1.75.0 → 1.76.0			devDependencies	minor	1.77.0
pnpm (source)	11.17.0 → 11.19.0			packageManager	minor	11.20.0
pnpm (source)	11.13.1 → 11.19.0			packageManager	minor	11.20.0
react-dropzone	19.1.1 → 19.2.0			dependencies	minor	19.3.0
react-hook-form (source)	7.82.0 → 7.84.0			dependencies	minor
recharts	3.10.0 → 3.10.1			dependencies	patch
vite (source)	8.1.5 → 8.2.0			devDependencies	minor

---

Release Notes

vercel/ai (@​ai-sdk/react)

v4.0.50

Compare Source

Patch Changes

• Updated dependencies [5fc7da5]
• Updated dependencies [93b2acd]
  • @​ai-sdk/provider-utils@​5.0.18
  • ai@​7.0.47
  • @​ai-sdk/mcp@​2.0.22

v4.0.49

Compare Source

Patch Changes

• ai@​7.0.46

v4.0.48

Compare Source

Patch Changes

• Updated dependencies [d6ce0ee]
• Updated dependencies [fa95504]
• Updated dependencies [349afe7]
  • ai@​7.0.45
  • @​ai-sdk/provider-utils@​5.0.17
  • @​ai-sdk/mcp@​2.0.21

v4.0.47

Compare Source

Patch Changes

• Updated dependencies [015acb4]
  • ai@​7.0.44

v4.0.46

Compare Source

Patch Changes

• Updated dependencies [d8210b6]
• Updated dependencies [b192878]
• Updated dependencies [97f0565]
  • @​ai-sdk/provider-utils@​5.0.16
  • ai@​7.0.43
  • @​ai-sdk/mcp@​2.0.20

v4.0.45

Compare Source

Patch Changes

• Updated dependencies [1659cd5]
• Updated dependencies [60f97f6]
• Updated dependencies [6a5bdff]
• Updated dependencies [6de2ec1]
  • @​ai-sdk/provider-utils@​5.0.15
  • ai@​7.0.42
  • @​ai-sdk/mcp@​2.0.19

v4.0.44

Compare Source

Patch Changes

• Updated dependencies [2e2224b]
  • ai@​7.0.41

v4.0.43

Compare Source

Patch Changes

• Updated dependencies [c3782a6]
  • ai@​7.0.40

v4.0.42

Compare Source

Patch Changes

• Updated dependencies [0c464d9]
• Updated dependencies [09a52cb]
• Updated dependencies [c49380c]
  • @​ai-sdk/provider-utils@​5.0.14
  • ai@​7.0.39
  • @​ai-sdk/mcp@​2.0.18

v4.0.41

Compare Source

Patch Changes

• Updated dependencies [7bd6bdd]
• Updated dependencies [1e2f324]
  • ai@​7.0.38
  • @​ai-sdk/provider@​4.0.4
  • @​ai-sdk/mcp@​2.0.17
  • @​ai-sdk/provider-utils@​5.0.13

DataDog/browser-sdk (@​datadog/browser-rum)

v7.7.0

Compare Source

Public Changes:

• ✨ Add a version-agnostic React Router entry point (#​4918)
• ✨ Shopify Integration - implement dedicated bundle (#​4878)
• ✨ Add a version-agnostic Vue Router entry point (#​4910)
• ✨ Enable WebSocket resource tracking behind a beta option (#​4882)
• 📝 [Salesforce Docs] Align with Tile docs (#​4904)

Internal Changes:

• ♻️ [js-core] Schema-driven configuration validation across browser-core, browser-logs, and browser-rum-core (#​4798)
• 🔧 Make Salesforce test apps use rum-salesforce bundle. (#​4893)
• 🔊 Add SDK_NAME to telemetry (#​4888)

HarperFast/agent-tools (@​harperfast/agent-tools)

v1.2.3

Compare Source

Bug Fixes

• release: pin conventionalcommits preset to v9 and align release-note sections (d9e9c49)

Dependency Updates

• deps: update actions/setup-node action to v7 (ee1411c)
• deps: update all non-major dependencies (3e8010d)
• deps: update dependency @​semantic-release/git to v11 (1b3aab3)

HarperFast/skills (@​harperfast/skills)

v1.11.1

Compare Source

Bug Fixes

• release: consolidate release config so all commit types surface in notes (c71a709)

react-hook-form/resolvers (@​hookform/resolvers)

v5.6.0

Compare Source

v5.5.8

Compare Source

Bug Fixes

• Zod resolver drops validation errors for special root field names (#​869) (2f28787)

v5.5.7

Compare Source

v5.5.6

Compare Source

v5.5.5

Compare Source

Bug Fixes

• yup resolver overrides ref property in errors object with validation metadata when using checkbox input (#​863) (0f70063)

v5.5.4

Compare Source

Bug Fixes

• AJV Resolver - When ajv schema contains default for certain properties, getValues() returns the form data with properties overwritten (#​862) (c4b6aab)

v5.5.3

Compare Source

Bug Fixes

• Conditional/dynamic schema resolution no longer working (#​861) (f8d6533)

v5.5.2

Compare Source

v5.5.1

Compare Source

Bug Fixes

• [zod v4][zod resolver] error on nested discriminated unions (#​858) (4d01d01)

v5.5.0

Compare Source

Features

• typescript 6 & upgrade lib dev deps (#​856) (9968959)

v5.4.3

Compare Source

Bug Fixes

• Zod resolver does not respect union error (#​855) (4e56b2b)

v5.4.2

Compare Source

Bug Fixes

• preserve standard schema root errors (#​853) (08f25e9)

• fix #​842 zodResolver() type overload fails with Zod v4.3.x due to branded version mismatch (https://redirect.github.com/react-hook-form/resolvers/pull/852[)](a21e723)
• fix #​844 yupResolver: Control incompatible with optional fields when passed to custom component (https://redirect.github.com/react-hook-form/resolvers/pull/851[)](b7bb3f9)

v5.4.1

Compare Source

Bug Fixes

• declare validation libraries as optional peerDependencies (#​850) (d5e5134)

microsoft/playwright (@​playwright/test)

v1.62.1

Compare Source

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a

gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

• New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.

Actions

• New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.

Network

• New apiResponse.timing() returns resource timing information for an API response.

Evaluation

• New locator.waitForFunction() waits until a function — called with the matching element — returns a truthy value.
• page.evaluate() and related methods now accept functions as evaluate arguments.
• page.addInitScript() / browserContext.addInitScript() now accept functions as init-script arguments.

Command line & MCP

• Playwright now bundles the Playwright MCP server and playwright-cli, runnable via npx playwright mcp and npx playwright cli.

Reporters

• The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:

// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});

Announcements

• ⚠️ Debian 11 is not supported anymore.

Browser Versions

• Chromium 151.0.7922.34
• Mozilla Firefox 153.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 151
• Microsoft Edge 151

radix-ui/primitives (@​radix-ui/react-accordion)

v1.2.20

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-collapsible@1.1.20, @radix-ui/react-collection@1.1.15, @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-direction@1.1.4, @radix-ui/react-id@1.1.4, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6

v1.2.19

• Updated dependencies: @radix-ui/react-collection@1.1.14, @radix-ui/react-primitive@2.1.9, @radix-ui/react-collapsible@1.1.19

radix-ui/primitives (@​radix-ui/react-alert-dialog)

v1.1.23

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-dialog@1.1.23, @radix-ui/react-primitive@2.1.10

v1.1.22

• Updated dependencies: @radix-ui/react-dialog@1.1.22, @radix-ui/react-primitive@2.1.9

radix-ui/primitives (@​radix-ui/react-context-menu)

v2.3.7

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-context@1.2.2, @radix-ui/react-menu@2.1.24, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6

v2.3.6

• Updated dependencies: @radix-ui/react-menu@2.1.23, @radix-ui/react-primitive@2.1.9

radix-ui/primitives (@​radix-ui/react-dialog)

v1.1.23

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-focus-guards@1.1.6, @radix-ui/react-focus-scope@1.1.16, @radix-ui/react-id@1.1.4, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4

v1.1.22

• Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-focus-scope@1.1.15, @radix-ui/react-portal@1.1.16

radix-ui/primitives (@​radix-ui/react-dropdown-menu)

v2.1.24

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-id@1.1.4, @radix-ui/react-menu@2.1.24, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6

v2.1.23

• Updated dependencies: @radix-ui/react-menu@2.1.23, @radix-ui/react-primitive@2.1.9

radix-ui/primitives (@​radix-ui/react-label)

v2.1.15

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-primitive@2.1.10

v2.1.14

• Updated dependencies: @radix-ui/react-primitive@2.1.9

radix-ui/primitives (@​radix-ui/react-navigation-menu)

v1.2.22

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-collection@1.1.15, @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-direction@1.1.4, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-id@1.1.4, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-callback-ref@1.1.4, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4, @radix-ui/react-use-previous@1.1.4, @radix-ui/react-visually-hidden@1.2.11

v1.2.21

• Updated dependencies: @radix-ui/react-collection@1.1.14, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-visually-hidden@1.2.10

radix-ui/primitives (@​radix-ui/react-radio-group)

v1.4.7

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-direction@1.1.4, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-roving-focus@1.1.19, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-size@1.1.4

v1.4.6

• Updated dependencies: @radix-ui/react-primitive@2.1.9, @radix-ui/react-roving-focus@1.1.18

radix-ui/primitives (@​radix-ui/react-scroll-area)

v1.2.18

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-direction@1.1.4, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-callback-ref@1.1.4, @radix-ui/react-use-layout-effect@1.1.4

v1.2.17

• Updated dependencies: @radix-ui/react-primitive@2.1.9

radix-ui/primitives (@​radix-ui/react-select)

v2.3.7

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-collection@1.1.15, @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-direction@1.1.4, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-focus-guards@1.1.6, @radix-ui/react-focus-scope@1.1.16, @radix-ui/react-id@1.1.4, @radix-ui/react-popper@1.3.7, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-callback-ref@1.1.4, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4, @radix-ui/react-use-previous@1.1.4, @radix-ui/react-visually-hidden@1.2.11

v2.3.6

• Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-collection@1.1.14, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-focus-scope@1.1.15, @radix-ui/react-popper@1.3.6, @radix-ui/react-portal@1.1.16, @radix-ui/react-visually-hidden@1.2.10

radix-ui/primitives (@​radix-ui/react-separator)

v1.1.15

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-primitive@2.1.10

v1.1.14

• Updated dependencies: @radix-ui/react-primitive@2.1.9

radix-ui/primitives (@​radix-ui/react-slot)

v1.3.3

• Reverted breaking changes that caused compatibility issues with React Server Components.

v1.3.2

• Reverted breaking changes that caused compatibility issues with React Server Components.

radix-ui/primitives (@​radix-ui/react-switch)

v1.3.7

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-size@1.1.4

v1.3.6

• Updated dependencies: @radix-ui/react-primitive@2.1.9

radix-ui/primitives (@​radix-ui/react-tabs)

v1.1.21

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-context@1.2.2, @radix-ui/react-direction@1.1.4, @radix-ui/react-id@1.1.4, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-roving-focus@1.1.19, @radix-ui/react-use-controllable-state@1.2.6

v1.1.20

• Updated dependencies: @radix-ui/react-primitive@2.1.9, @radix-ui/react-roving-focus@1.1.18

radix-ui/primitives (@​radix-ui/react-toggle)

v1.1.18

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6

v1.1.17

• Updated dependencies: @radix-ui/react-primitive@2.1.9

radix-ui/primitives (@​radix-ui/react-tooltip)

v1.2.16

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-id@1.1.4, @radix-ui/react-popper@1.3.7, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4, @radix-ui/react-visually-hidden@1.2.11

v1.2.15

• Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-popper@1.3.6, @radix-ui/react-portal@1.1.16, @radix-ui/react-visually-hidden@1.2.10

stripe/stripe-js (@​stripe/stripe-js)

v9.12.1

Compare Source

Changed

• Bump brace-expansion from 1.1.11 to 1.1.16 in /examples/parcel (#​953)

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.0.5

Compare Source

Fixed the react compiler preset filter to be linear (#​1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#​1349). The filter was changed to be linear to avoid that.

vercel/ai (ai)

v7.0.47

Compare Source

Patch Changes

• Updated dependencies [5fc7da5]
• Updated dependencies [93b2acd]
  • @​ai-sdk/provider-utils@​5.0.18
  • @​ai-sdk/gateway@​4.0.36

v7.0.46

Compare Source

Patch Changes

• Updated dependencies [4f2e064]
  • @​ai-sdk/gateway@​4.0.35

v7.0.45

Compare Source

Patch Changes

• d6ce0ee: feat(ai): support experimental_toolCallers in streamText
• fa95504: feat(ai): support experimental tool callers in ToolLoopAgent
• 349afe7: Warn when generateText receives streaming-only firstChunkMs or chunkMs timeout settings.
• Updated dependencies [fa95504]
  • @​ai-sdk/provider-utils@​5.0.17

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: e2e/pnpm-lock.yaml

✓ Lockfile passes supply-chain policies (verified 1s ago)
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 4, reused 0, downloaded 0, added 0
Progress: resolved 27, reused 0, downloaded 0, added 0
Progress: resolved 31, reused 0, downloaded 0, added 0
[ERR_PNPM_STRICT_MIN_RELEASE_AGE_REQUIRES_SAVE] minimumReleaseAgeStrict cannot be combined with --no-save: approval would require writing to minimumReleaseAgeExclude in pnpm-workspace.yaml, which --no-save prevents.

Drop --no-save so the exclude list can be persisted, or set minimumReleaseAgeStrict: false to let the install proceed without prompting (the lockfile would still trigger the auto-collect on the next normal install).

[DavidCockerill]

Requesting changes — this needs a code fix rather than a rebase, and there's a security bump inside it that shouldn't wait on that.

The batch isn't validated. Verify PR fails at Type-check, so none of the other 41 bumps were exercised. axios 1.18.1 → 1.19.0 breaks TypedAxios extends Axios — TS2430 at src/config/typedAxios.ts:5; axios widened the generic parameters on its public declarations so the interface extension no longer satisfies the base. renovate/artifacts is also failing.

There's an unremarked security release in here — Node 24.18.1, 11 CVEs, 3 High. Details in the thread; it's currently gated behind an unrelated axios type error, which is the wrong dependency.

Two further axios 1.19.0 changes are runtime-affecting rather than dev-only, worth checking once it compiles: sync request-interceptor dispatch semantics changed (axios#11071 — we install interceptors in installApiUnauthorizedRedirect.ts and getInstanceClient.ts), and repeated trailing slashes are now stripped when combining baseURL (axios#11038 — useEntityRestURL.ts massages baseURL itself). @datadog/browser-rum 7.6.1 → 7.7.0 also ships to browsers.

The good news: no stealth majors (nothing on a 0.x line) and no range widening — 40 of 42 are lockfile-only inside existing carets, with only the harper exact pin and packageManager moving in package.json. And axios raising the form-data floor for GHSA-hmw2-7cc7-3qxx is already covered by the form-data ^4.0.6 override.

Minor and unrelated: e2e/package.json moves packageManager to pnpm 11.19.0 while e2e/Dockerfile still pre-bakes corepack prepare pnpm@11.13.1, which defeats that image's reproducibility intent.

— Reviewed by DAIvid (Claude Opus 5)

[DavidCockerill]

Worth splitting this one out rather than letting it sit behind the axios break.

Node 24.18.0 → 24.18.1 (here and in e2e/Dockerfile) is an upstream security release — 11 CVEs, 3 High: CVE-2026-56846 and CVE-2026-56848 (http2), CVE-2026-58043 (permission model), plus an undici bump to 7.29.0. Renovate labels it a plain "patch", so nothing in the PR surfaces that.

As batched it can't land until typedAxios.ts is fixed. A standalone PR for the Node pin would land today.