deps: bump the desktop-minor-and-patch group across 1 directory with 49 updates

[dependabot]

Bumps the desktop-minor-and-patch group with 49 updates in the / directory:

Package	From	To
@radix-ui/react-accordion	1.2.20	1.2.21
@radix-ui/react-alert-dialog	1.1.23	1.1.24
@radix-ui/react-aspect-ratio	1.1.15	1.1.16
@radix-ui/react-avatar	1.2.6	1.2.7
@radix-ui/react-checkbox	1.3.11	1.3.12
@radix-ui/react-collapsible	1.1.20	1.1.21
@radix-ui/react-context-menu	2.3.7	2.3.8
@radix-ui/react-dialog	1.1.23	1.2.0
@radix-ui/react-dropdown-menu	2.1.24	2.1.25
@radix-ui/react-hover-card	1.1.23	1.1.24
@radix-ui/react-label	2.1.15	2.1.16
@radix-ui/react-menubar	1.1.24	1.1.25
@radix-ui/react-navigation-menu	1.2.22	1.3.0
@radix-ui/react-popover	1.1.23	1.2.0
@radix-ui/react-progress	1.1.16	1.1.17
@radix-ui/react-radio-group	1.4.7	1.4.8
@radix-ui/react-scroll-area	1.2.18	1.3.0
@radix-ui/react-select	2.3.7	2.3.8
@radix-ui/react-separator	1.1.15	1.1.16
@radix-ui/react-slider	1.4.7	1.5.0
@radix-ui/react-slot	1.3.3	1.4.0
@radix-ui/react-switch	1.3.7	1.3.8
@radix-ui/react-tabs	1.1.21	1.1.22
@radix-ui/react-toggle	1.1.18	1.1.19
@radix-ui/react-toggle-group	1.1.19	1.1.20
@radix-ui/react-tooltip	1.2.16	1.3.0
@tanstack/react-query	5.101.4	5.104.1
input-otp	1.4.2	1.5.0
jose	6.2.5	6.2.12
react-hook-form	7.83.0	7.89.0
react-router-dom	7.18.2	7.18.4
sonner	2.0.7	2.0.8
tailwind-merge	3.6.0	3.7.0
uuid	14.0.1	14.0.2
@electron/notarize	3.1.1	3.1.2
@playwright/test	1.62.1	1.64.0
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.7
@types/node	26.1.2	26.6.4
@vitejs/plugin-react	6.0.5	6.1.2
@vitest/coverage-v8	4.1.10	4.1.11
autoprefixer	10.5.4	10.6.1
baseline-browser-mapping	2.11.8	2.11.28
eslint-plugin-react-refresh	0.5.3	0.5.7
globals	17.8.0	17.13.0
postcss	8.5.25	8.5.29
vite	8.2.0	8.3.4
vitest	4.1.10	4.1.11
wait-on	9.1.0	9.5.1

Updates @radix-ui/react-accordion from 1.2.20 to 1.2.21

Changelog

Sourced from @​radix-ui/react-accordion's changelog.

1.2.21

• Updated dependencies: @radix-ui/react-collapsible@1.1.21, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-alert-dialog from 1.1.23 to 1.1.24

Changelog

Sourced from @​radix-ui/react-alert-dialog's changelog.

1.1.24

• Updated dependencies: @radix-ui/react-dialog@1.2.0, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-aspect-ratio from 1.1.15 to 1.1.16

Changelog

Sourced from @​radix-ui/react-aspect-ratio's changelog.

1.1.16

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-avatar from 1.2.6 to 1.2.7

Changelog

Sourced from @​radix-ui/react-avatar's changelog.

1.2.7

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-checkbox from 1.3.11 to 1.3.12

Changelog

Sourced from @​radix-ui/react-checkbox's changelog.

1.3.12

• Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-collapsible from 1.1.20 to 1.1.21

Changelog

Sourced from @​radix-ui/react-collapsible's changelog.

1.1.21

• Updated dependencies: @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-context-menu from 2.3.7 to 2.3.8

Changelog

Sourced from @​radix-ui/react-context-menu's changelog.

2.3.8

• Updated dependencies: @radix-ui/react-menu@2.1.25, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.23 to 1.2.0

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.2.0

• Added support for multiple aria-describedby attributes.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @radix-ui/react-dropdown-menu from 2.1.24 to 2.1.25

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.1.25

• Updated dependencies: @radix-ui/react-menu@2.1.25, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-hover-card from 1.1.23 to 1.1.24

Changelog

Sourced from @​radix-ui/react-hover-card's changelog.

1.1.24

• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @radix-ui/react-label from 2.1.15 to 2.1.16

Changelog

Sourced from @​radix-ui/react-label's changelog.

2.1.16

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-menubar from 1.1.24 to 1.1.25

Changelog

Sourced from @​radix-ui/react-menubar's changelog.

1.1.25

• Updated dependencies: @radix-ui/react-menu@2.1.25, @radix-ui/react-roving-focus@1.1.20, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-navigation-menu from 1.2.22 to 1.3.0

Changelog

Sourced from @​radix-ui/react-navigation-menu's changelog.

1.3.0

• Added a disableToggle prop to NavigationMenu.Sub.
  • true: Clicking the trigger of an already-open submenu item keeps it open. This is the default and matches existing behavior.
  • false: Clicking the trigger of a submenu item toggles it open or closed.
• Added an activationMode prop to NavigationMenu.Root and NavigationMenu.Sub.
  • "automatic": Hovering or focusing a trigger opens its item, and moving away from the trigger closes it after a short delay. This is the default and matches existing behavior.
  • "manual": Pointer entry and focus never open an item. The item opens when its trigger is clicked.
  • When activationMode is omitted on NavigationMenu.Sub, it inherits the value from the parent NavigationMenu.Root, so setting "manual" on the root also applies to submenus unless a submenu opts back in to "automatic".
• Fixed a bug where a submenu's defaultValue was reset when an external element was focused before the menu opened.
• Fixed a bug where NavigationMenu.Viewport discarded its children and rendered the active content in their place. The active content is now rendered inside the consumer's element alongside any children it already had.
• Updated dependencies: @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-popover from 1.1.23 to 1.2.0

Changelog

Sourced from @​radix-ui/react-popover's changelog.

1.2.0

• Added Popover.Title and Popover.Description parts that provide accessible names and descriptions for popover content.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @radix-ui/react-progress from 1.1.16 to 1.1.17

Changelog

Sourced from @​radix-ui/react-progress's changelog.

1.1.17

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-radio-group from 1.4.7 to 1.4.8

Changelog

Sourced from @​radix-ui/react-radio-group's changelog.

1.4.8

• Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-roving-focus@1.1.20, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-scroll-area from 1.2.18 to 1.3.0

Changelog

Sourced from @​radix-ui/react-scroll-area's changelog.

1.3.0

• Added a ScrollArea.Content part so consumers can own the wrapper element implicitly rendered by ScrollArea.Viewport. Pass disableImplicitContentElement to the viewport and render ScrollArea.Content as its child.

  <ScrollArea.Root>
    <ScrollArea.Viewport disableImplicitContentElement>
      <ScrollArea.Content>{children}</ScrollArea.Content>
    </ScrollArea.Viewport>
    <ScrollArea.Scrollbar>
      <ScrollArea.Thumb />
    </ScrollArea.Scrollbar>
  </ScrollArea.Root>

  In the next major release, the viewport will no longer render this element implicitly. We recommend migrating to this API now for a smoother upgrade.

• Fixed a bug where asChild on ScrollArea.Viewport merged props onto the implicit content element instead of the consumer's element.

• Updated dependencies: @radix-ui/react-slot@1.4.0, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-select from 2.3.7 to 2.3.8

Changelog

Sourced from @​radix-ui/react-select's changelog.

2.3.8

• Fixed a bug where internal event handlers were still called on disabled Select.Item elements. Consumer-provided event handlers still run, but Radix's own selection logic no longer fires for disabled items.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-separator from 1.1.15 to 1.1.16

Changelog

Sourced from @​radix-ui/react-separator's changelog.

1.1.16

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-slider from 1.4.7 to 1.5.0

Changelog

Sourced from @​radix-ui/react-slider's changelog.

1.5.0

• Added a preserveThumbOrder prop to Slider that prevents thumbs from crossing over one another. When enabled, each thumb is constrained to the values of its neighbors instead of swapping positions when dragged past them.
• Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @radix-ui/react-slot from 1.3.3 to 1.4.0

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.4.0

• Added support for multiple aria-describedby attributes.
• Fixed compatibility issues with React Server Components.

Commits

• See full diff in compare view

Updates @radix-ui/react-switch from 1.3.7 to 1.3.8

Changelog

Sourced from @​radix-ui/react-switch's changelog.

1.3.8

• Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-tabs from 1.1.21 to 1.1.22

Changelog

Sourced from @​radix-ui/react-tabs's changelog.

1.1.22

• Fixed a bug where a focused element inside Tabs.Content did not fire a blur event before the tab switched. Tabs.Trigger now moves focus before the tab's state change.
• Updated dependencies: @radix-ui/react-roving-focus@1.1.20, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-toggle from 1.1.18 to 1.1.19

Changelog

Sourced from @​radix-ui/react-toggle's changelog.

1.1.19

• Updated dependencies: @radix-ui/react-primitive@2.1.11

Commits

• See full diff in compare view

Updates @radix-ui/react-toggle-group from 1.1.19 to 1.1.20

Changelog

Sourced from @​radix-ui/react-toggle-group's changelog.

1.1.20

• Updated dependencies: @radix-ui/react-roving-focus@1.1.20, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-toggle@1.1.19

Commits

• See full diff in compare view

Updates @radix-ui/react-tooltip from 1.2.16 to 1.3.0

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.3.0

• Added support for multiple aria-describedby attributes.
• Updated dependencies: @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18

Commits

• See full diff in compare view

Updates @tanstack/react-query from 5.101.4 to 5.104.1

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.1

Patch Changes

• Updated dependencies [ec060b6]:
  • @​tanstack/query-devtools@​5.104.1
  • @​tanstack/react-query@​5.104.1

@​tanstack/react-query-next-experimental@​5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.1

@​tanstack/react-query-persist-client@​5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.104.1
  • @​tanstack/react-query@​5.104.1

@​tanstack/react-query@​5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.104.1

@​tanstack/react-query-devtools@​5.104.0

Minor Changes

• #11650 5279b05 - Build projects with Vite 8

Patch Changes

• Updated dependencies [5279b05]:
  • @​tanstack/query-devtools@​5.104.0
  • @​tanstack/react-query@​5.104.0

@​tanstack/react-query-next-experimental@​5.104.0

Minor Changes

• #11650 5279b05 - Build projects with Vite 8

Patch Changes

• Updated dependencies [5279b05]:
  • @​tanstack/react-query@​5.104.0

@​tanstack/react-query-persist-client@​5.104.0

Minor Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.104.1

5.104.0

Minor Changes

• #11650 5279b05 - Build projects with Vite 8

Patch Changes

• Updated dependencies [5279b05]:
  • @​tanstack/query-core@​5.104.0

5.103.3

Patch Changes

• #11647 1c9693e - fix(codemods): avoid copying unnecessary files from codemods project
• Updated dependencies []:
  • @​tanstack/query-core@​5.103.3

5.103.2

Patch Changes

• Updated dependencies [8a28904]:
  • @​tanstack/query-core@​5.103.2

5.103.1

Patch Changes

• Updated dependencies [8330b2f, 3212966]:
  • @​tanstack/query-core@​5.103.1

5.103.0

Patch Changes

• Updated dependencies [e57f816, fdae2ce, a1119e5, cbf77bf]:
  • @​tanstack/query-core@​5.103.0

5.102.8

Patch Changes

... (truncated)

Commits

• 29859ae ci: Version Packages (#11806)
• 339e09f chore(*): manage 'react' eslint plugins with pnpm 'catalog' (#11781)
• 0a57279 test({react,preact,solid,angular}-query/mutationOptions): fix 'mutationOpt1' ...
• c51bb62 chore(*): declare '@​eslint-react/eslint-plugin' in the react packages and exa...
• a914613 chore(*): declare 'eslint-plugin-react-hooks' in the react packages that use ...
• d99c84b chore(*): update '@​eslint-react/eslint-plugin' to v5 and apply its 'recommend...
• fd96529 chore(*): update 'eslint-plugin-react-hooks' to v7 and use its stable 'recomm...
• e878990 chore(*): manage 'react' packages with pnpm 'catalog' (#11712)
• 2e1ad64 chore(*): declare 'npm-run-all2' once in the root 'package.json' like other s...
• c1de23a chore(*): manage 'typescript' with pnpm 'catalog' and declare it in each pack...
• Additional commits viewable in compare view

Updates input-otp from 1.4.2 to 1.5.0

Release notes

Sourced from input-otp's releases.

v1.5.0

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

• fix(input): reserve the password manager badge gutter only where it fits
• fix(input): disable spellcheck by default
• fix(input): feature-detect ResizeObserver before observing
• fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
• fix(input): clear pending synchronization timeouts on unmount
• feat(input): add a nonce prop for Content-Security-Policy support
• fix(input): guard the input reference used by the selectionchange listener
• fix(input): opt the container out of browser translation
• fix(input): report cosmetic CSS rule failures as warnings instead of errors
• docs: document the stable iOS selection behavior and its cosmetic limitation

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

• revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
• revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
• docs: align the mobile and edge-case documentation with the stable candidate
• test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

• fix(input): reserve the password manager badge gutter only where it fits
  • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
• fix(input): disable spellcheck by default
  • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
• fix(input): feature-detect ResizeObserver before observing
  • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
• fix(input): fall back to 16px font-size until --root-height resolves
  • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
• fix(input): clear pending sync timeouts on unmount
  • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
• feat(input): add nonce prop
  • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
• fix(input): use the guarded input reference inside the selectionchange listener
  • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
• fix(input): opt the container out of browser translation
  • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.
• fix(input): log CSS rule insertion failures as warnings, not errors
  • Some environments reject individual cosmetic selectors (:autofill in older Android WebViews, for instance). Nothing breaks when that happens, but the console.error was captured by Sentry and similar tools as if the application had failed. Same message, warning level.
• chore(types): narrow onComplete to (value: string) => unknown

... (truncated)

Changelog

Sourced from input-otp's changelog.

[1.5.0]

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

• fix(input): reserve the password manager badge gutter only where it fits
• fix(input): disable spellcheck by default
• fix(input): feature-detect ResizeObserver before observing
• fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
• fix(input): clear pending synchronization timeouts on unmount
• feat(input): add a nonce prop for Content-Security-Policy support
• fix(input): guard the input reference used by the selectionchange listener
• fix(input): opt the container out of browser translation
• fix(input): report cosmetic CSS rule failures as warnings instead of errors
• docs: document the stable iOS selection behavior and its cosmetic limitation

[1.5.0-beta.2]

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

• revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
• revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
• docs: align the mobile and edge-case documentation with the stable candidate
• test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

[1.5.0-beta.1]

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

[1.5.0-beta.0]

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

• fix(input): reserve the password manager badge gutter only where it fits
  • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
• fix(input): disable spellcheck by default
  • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
• fix(input): feature-detect ResizeObserver before observing
  • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
• fix(input): fall back to 16px font-size until --root-height resolves
  • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
• fix(input): clear pending sync timeouts on unmount
  • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
• feat(input): add nonce prop
  • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
• fix(input): use the guarded input reference inside the selectionchange listener
  • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
• fix(input): opt the container out of browser translation
  • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for input-otp since your current version.

Updates jose from 6.2.5 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits

• 505a55b chore(release): 6.2.12
• 7bc9a33 perf: encode single-signature JWS input once
• 78637bd perf: normalize General JWE shared headers once
• bf5138b perf: deduplicate pending jwks key imports
• b23a6f3 perf: use native encoding for larger ASCII strings
• fd3ae3f perf: normalize jwks selection metadata once
• 6925d43 perf: avoid copying AES-GCM output
• be62530 docs: clarify and shorten public API guidance
• 1b41312 build: preserve README when generation fails
• 0b51829 build: check tree-shaking for every public binding
• Additional commits viewable in compare view

Updates react-hook-form from 7.83.0 to 7.89.0

Release notes

Sourced from react-hook-form's releases.

Version 7.89.0

🐞 Fixes

• Fix form state select option (#13784)
• Remove duplicate default value field (#13783)
• Fix validateField skipping refs without setCustomValidity under native validation (#13782)
• Fix form-level validation using a stale validate function (#13777)
• Fix useFieldArray touched fields handling (#13776)
• Fix pending delayError timers for nested paths (#13775)
• Fix getValues extracting unmarked field array entries (#13773)
• Fix field array touched state not being re-indexed when unsubscribed (#13772)
• Fix nested delayError timers remaining when a parent validates clean (#13771)
• Fix nested delayError timers remaining after resetField() resets a parent (#13769)
• Fix stale field array root errors after an operation satisfies the validation rule (

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.