[dependabot]

Bumps the minor-and-patch group with 17 updates:

Package	From	To
@posthog/react	1.11.2	1.11.3
@streamdown/cjk	1.0.3	1.0.4
@streamdown/math	1.0.2	1.0.3
@streamdown/mermaid	1.0.2	1.0.3
@tauri-apps/api	2.12.0	2.12.1
@tauri-apps/plugin-autostart	2.6.0	2.7.0
@tauri-apps/plugin-opener	2.6.0	2.7.0
@tauri-apps/plugin-updater	2.13.0	2.13.1
lucide-react	1.48.0	1.50.0
posthog-js	1.434.18	1.435.8
streamdown	2.6.0	2.7.0
@tauri-apps/cli	2.12.0	2.12.1
@types/node	24.19.0	24.19.1
vite	8.3.1	8.3.2
@next/mdx	16.3.7	16.3.8
next	16.3.7	16.3.8
eslint-config-next	16.3.7	16.3.8

Updates @posthog/react from 1.11.2 to 1.11.3

Release notes

Sourced from @​posthog/react's releases.

@​posthog/react@​1.11.3

1.11.3

Patch Changes

• #5120 5929eab Thanks @​breken-ai! - PostHogFeature without match shows the fallback when the flag evaluates to false. (2026-09-29)
• Updated dependencies [5929eab]:
  • posthog-js@1.435.1

Changelog

Sourced from @​posthog/react's changelog.

1.11.3

Patch Changes

• #5120 5929eab Thanks @​breken-ai! - PostHogFeature without match shows the fallback when the flag evaluates to false. (2026-09-29)
• Updated dependencies [5929eab]:
  • posthog-js@1.435.1

Commits

• 666d109 chore: update versions and lockfile [version bump]
• 5929eab fix(react): show PostHogFeature fallback when the flag evaluates to false (#5...
• 48cca33 test(browser): strengthen browser and React test coverage (#5123)
• See full diff in compare view

Updates @streamdown/cjk from 1.0.3 to 1.0.4

Release notes

Sourced from @​streamdown/cjk's releases.

@​streamdown/cjk@​1.0.4

Patch Changes

• 8cb3bc7: Re-linkify bare URLs that follow CJK punctuation when splitting GFM autolink literals (e.g. URLs separated by fullwidth semicolons).

Changelog

Sourced from @​streamdown/cjk's changelog.

1.0.4

Patch Changes

• 8cb3bc7: Re-linkify bare URLs that follow CJK punctuation when splitting GFM autolink literals (e.g. URLs separated by fullwidth semicolons).

Commits

• 08da224 Version Packages (#600)
• 8cb3bc7 fix(cjk): re-linkify URLs after CJK punctuation splits (#624)
• 38775ee build(deps): bump the npm_and_yarn group across 2 directories with 5 updates ...
• 3327c18 chore: upgrade minor deps (#589)
• See full diff in compare view

Updates @streamdown/math from 1.0.2 to 1.0.3

Release notes

Sourced from @​streamdown/math's releases.

@​streamdown/math@​1.0.3

Patch Changes

• 0c2efd7: upgrade dependencies

Changelog

Sourced from @​streamdown/math's changelog.

1.0.3

Patch Changes

• 0c2efd7: upgrade dependencies

Commits

• 08da224 Version Packages (#600)
• 38775ee build(deps): bump the npm_and_yarn group across 2 directories with 5 updates ...
• 3327c18 chore: upgrade minor deps (#589)
• 1102f18 Fix all Biome lint and formatting errors
• See full diff in compare view

Updates @streamdown/mermaid from 1.0.2 to 1.0.3

Release notes

Sourced from @​streamdown/mermaid's releases.

@​streamdown/mermaid@​1.0.3

Patch Changes

• 0c2efd7: upgrade dependencies

Changelog

Sourced from @​streamdown/mermaid's changelog.

1.0.3

Patch Changes

• 0c2efd7: upgrade dependencies

Commits

• 08da224 Version Packages (#600)
• 38775ee build(deps): bump the npm_and_yarn group across 2 directories with 5 updates ...
• 3327c18 chore: upgrade minor deps (#589)
• 1102f18 Fix all Biome lint and formatting errors
• See full diff in compare view

Updates @tauri-apps/api from 2.12.0 to 2.12.1

Release notes

Sourced from @​tauri-apps/api's releases.

@​tauri-apps/api v2.12.1

All found vulnerabilities were already reviewed and decided to be ignored
2 ignored: 2 high

[2.12.1]

Bug Fixes

• c9a3cb892 (#16166 by @​FabianLars) The macos-private-api feature flag / macOSPrivateAPI tauri.conf.json value is no longer required to use transparency or fullscreen on macOS.

$ pnpm build && cd ./dist && pnpm publish --access public --loglevel debug --no-git-checks
$ rollup -c --configPlugin typescript
�[36m
�[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts�[22m → �[1m./dist, ./dist�[22m...�[39m
�[32mcreated �[1m./dist, ./dist�[22m in �[1m997ms�[22m�[39m
�[36m
�[1msrc/index.ts�[22m → �[1m../../crates/tauri/scripts/bundle.global.js�[22m...�[39m
�[32mcreated �[1m../../crates/tauri/scripts/bundle.global.js�[22m in �[1m1.5s�[22m�[39m
GET https://run-actions-2-azure-eastus.actions.githubusercontent.com/210//idtoken/dd253aee-436e-8e22-8c02-25aaaa05b17c/69013391-05d6-5397-b35a-e76c0a237b30?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 336ms
📦 @tauri-apps/api@2.12.1 → https://registry.npmjs.org/
GET https://run-actions-2-azure-eastus.actions.githubusercontent.com/210//idtoken/dd253aee-436e-8e22-8c02-25aaaa05b17c/69013391-05d6-5397-b35a-e76c0a237b30?api-version=2.0&audience=sigstore 200 107ms
Signed provenance statement with source and build information
✅ Published package @tauri-apps/api@2.12.1

Commits

• 30da1fd feat(ci): run audit before publishing
• 1aefcf6 fix: pnpm audit
• 026f260 apply version updates (#16150)
• a4dcca8 fix(plugin): skip build script writes on docs.rs builds (#16186)
• f040897 docs: link WRY and TAO to their repositories (#16163)
• c9a3cb8 fix: enable macos private apis regardless of feature flags (#16166)
• 64bfdd9 fix: ignore src-tauri in vite configs (#16165)
• 793f0c4 fix(window): copy WebView2Loader.dll for nightly (#16164)
• d15cf9b fix(bundler): make glob error variants available on all platforms (#16149)
• 447fa9f fix(core): tauri-utils publish
• See full diff in compare view

Updates @tauri-apps/plugin-autostart from 2.6.0 to 2.7.0

Release notes

Sourced from @​tauri-apps/plugin-autostart's releases.

opener-js v2.7.0

[2.7.0]

• ecd3273e (#3480 by @​renovate) Updated windows-rs dependencies:

  • deep-link: updated windows-registry to 0.6 and windows-result to 0.4. The public Error::Windows variant wraps windows_result::Error; applications using this type directly should update their windows-result dependency.
  • opener: updated windows to 0.62. The public Error::Win32Error variant wraps windows::core::Error; applications using this type directly should update their windows dependency.
  • single-instance: updated windows-sys to 0.61
  • updater: updated windows-sys to 0.61

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.7.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.7.0
npm notice filename: tauri-apps-plugin-opener-2.7.0.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: 14d631a70282cbc07b46f4442ba6085d2200f301
npm notice integrity: sha512-mBorYfVKh9Lt7[...]5OHHVmipjuGMw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3005263072
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-opener@2.7.0

opener v2.7.0

[2.7.0]

... (truncated)

Commits

• 51b430b ci: delete .changes/updater-new-bundle-support.md
• fd439b1 Publish New Versions (v2) (#2964)
• 2522b71 fix(deep-link): revert the breaking change introduced by #2928 (#2970)
• 9021a73 chore(deps): update dependency rollup to v4.50.0 (#2966)
• 625bb1c feat(log): re-export the log crate (#2965)
• 6215afe chore(deps): update dependency rollup to v4.49.0 (#2962)
• 8cf8eea feat(updater): inject bundle_type into endpoint url (#2960)
• 509eba8 feat: support message dialogs with 3 buttons (#2641)
• 9ac5fe8 feat(updater): support bundle-specific targets (#2624)
• c247410 chore(deps): update dependency typescript-eslint to v8.41.0 (#2956)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-opener from 2.6.0 to 2.7.0

Release notes

Sourced from @​tauri-apps/plugin-opener's releases.

opener-js v2.7.0

[2.7.0]

• ecd3273e (#3480 by @​renovate) Updated windows-rs dependencies:

  • deep-link: updated windows-registry to 0.6 and windows-result to 0.4. The public Error::Windows variant wraps windows_result::Error; applications using this type directly should update their windows-result dependency.
  • opener: updated windows to 0.62. The public Error::Win32Error variant wraps windows::core::Error; applications using this type directly should update their windows dependency.
  • single-instance: updated windows-sys to 0.61
  • updater: updated windows-sys to 0.61

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.7.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.7.0
npm notice filename: tauri-apps-plugin-opener-2.7.0.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: 14d631a70282cbc07b46f4442ba6085d2200f301
npm notice integrity: sha512-mBorYfVKh9Lt7[...]5OHHVmipjuGMw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3005263072
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-opener@2.7.0

opener v2.7.0

[2.7.0]

... (truncated)

Commits

• 51b430b ci: delete .changes/updater-new-bundle-support.md
• fd439b1 Publish New Versions (v2) (#2964)
• 2522b71 fix(deep-link): revert the breaking change introduced by #2928 (#2970)
• 9021a73 chore(deps): update dependency rollup to v4.50.0 (#2966)
• 625bb1c feat(log): re-export the log crate (#2965)
• 6215afe chore(deps): update dependency rollup to v4.49.0 (#2962)
• 8cf8eea feat(updater): inject bundle_type into endpoint url (#2960)
• 509eba8 feat: support message dialogs with 3 buttons (#2641)
• 9ac5fe8 feat(updater): support bundle-specific targets (#2624)
• c247410 chore(deps): update dependency typescript-eslint to v8.41.0 (#2956)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-updater from 2.13.0 to 2.13.1

Release notes

Sourced from @​tauri-apps/plugin-updater's releases.

updater-js v2.13.1

[2.13.1]

• ecd3273e (#3480 by @​renovate) Updated windows-rs dependencies:

  • deep-link: updated windows-registry to 0.6 and windows-result to 0.4. The public Error::Windows variant wraps windows_result::Error; applications using this type directly should update their windows-result dependency.
  • opener: updated windows to 0.62. The public Error::Win32Error variant wraps windows::core::Error; applications using this type directly should update their windows dependency.
  • single-instance: updated windows-sys to 0.61
  • updater: updated windows-sys to 0.61

• 90b9869e (#3573 by @​renovate) Updated dirs to v7

• 22e286f3 (#3501 by @​renovate) Updated dependency infer to 0.22

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.13.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 6.7kB dist-js/index.cjs
npm notice 7.1kB dist-js/index.d.ts
npm notice 6.6kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.13.1
npm notice filename: tauri-apps-plugin-updater-2.13.1.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 25.1 kB
npm notice shasum: 2ad227ba05293fe34c5c59c0ff8a1cd690c8e9a8
npm notice integrity: sha512-+STDzJ0sdQLIm[...]/AJz0jxysytiw==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3005269671
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-updater@2.13.1

updater v2.13.1

... (truncated)

Commits

• e511284 publish new versions (#3647)
• ce59e96 docs(log): remove unrelated single-instance comment from log readme
• 29130c2 ci: run clippy on all platforms (#3650)
• 4353819 chore: add changefile to re-release plugin-http npm package as 2.8.0 (#3656)
• ec14142 chore(deps): update dependency @​types/node to v24 (#3649)
• 90b9869 chore(deps): update rust crate dirs to v7 (#3573)
• 22e286f chore(deps): update rust crate infer to 0.22 (#3501)
• ecd3273 chore(deps): update windows-rs and webview2 crates (#3480)
• aa2cc64 fix(android): Migrate Gradle scripts to compilerOptions DSL (#3478)
• See full diff in compare view

Updates lucide-react from 1.48.0 to 1.50.0

Release notes

Sourced from lucide-react's releases.

Version 1.50.0

What's Changed

• fix(shared): escape attribute values in buildLucideSvg by @​Saadanjum0 in lucide-icons/lucide#4940
• fix(github/actions): use canonical metadata instructions for PR suggestions by @​karsa-mistmere in lucide-icons/lucide#4910
• fix(icons): replaced nut & nut-off with compliant designs by @​karsa-mistmere in lucide-icons/lucide#4840
• chore(deps-dev): bump @​angular/router from 22.1.7 to 22.2.0 by @​dependabot[bot] in lucide-icons/lucide#4945
• chore(deps): bump next from 16.3.4 to 16.3.6 by @​dependabot[bot] in lucide-icons/lucide#4946
• chore(deps-dev): bump the svelte-deps group with 2 updates by @​dependabot[bot] in lucide-icons/lucide#4918
• test(integrations): add Vue integration fixtures for Vite, Nuxt and Vike by @​ericfennis in lucide-icons/lucide#4882
• feat(svelte): export context subpath by @​vugarbbakhishov-hub in lucide-icons/lucide#4927
• fix(lucide-preact): add Preact v11 compatibility by @​JoviDeCroock in lucide-icons/lucide#4924
• feat(icons): added layout-grid-circles icon by @​karsa-mistmere in lucide-icons/lucide#4567

New Contributors

• @​Saadanjum0 made their first contribution in lucide-icons/lucide#4940
• @​JoviDeCroock made their first contribution in lucide-icons/lucide#4924

Full Changelog: lucide-icons/lucide@1.49.0...1.50.0

Version 1.49.0

What's Changed

• feat(icons): added letters icon by @​karsa-mistmere in lucide-icons/lucide#4779
• fix(packages): declare @types/react as an optional peer dependency by @​unrevised6419 in lucide-icons/lucide#4892
• feat(icons): added bangladeshi-taka icon by @​TanvirMahin24 in lucide-icons/lucide#4869
• feat(icons): added printer-3d icon by @​Azuzula in lucide-icons/lucide#4414

New Contributors

• @​unrevised6419 made their first contribution in lucide-icons/lucide#4892
• @​TanvirMahin24 made their first contribution in lucide-icons/lucide#4869
• @​Azuzula made their first contribution in lucide-icons/lucide#4414

Full Changelog: lucide-icons/lucide@1.48.0...1.49.0

Commits

• e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
• See full diff in compare view

Updates posthog-js from 1.434.18 to 1.435.8

Release notes

Sourced from posthog-js's releases.

posthog-js@1.435.8

1.435.8

Patch Changes

• #5152 2bdc8eb Thanks @​rafaeelaudibert! - Use the new PostHog logo in the survey footer branding (2026-10-02)

posthog-js@1.435.7

1.435.7

Patch Changes

• #5188 8a005ca Thanks @​dustinbyrne! - Preserve shared identity while consent is pending and clear it after shared rejection in cookieless mode. (2026-10-02)

posthog-js@1.435.6

1.435.6

Patch Changes

• #5046 c360da1 Thanks @​luke-belton! - Capture the OpenAI Ads click identifier (oppref) as a campaign parameter, so it is set on events and as $initial_oppref like every other ad click ID. (2026-10-01)

• #5175 c21f14d Thanks @​marandaneto! - Fix cross-subdomain identity continuity when opting in after cookie consent. (2026-10-01)

• Updated dependencies [c360da1]:

  • @​posthog/browser-common@​0.9.1
  • @​posthog/core@​1.55.3

posthog-js@1.435.5

1.435.5

Patch Changes

• #5167 59b93a3 Thanks @​dustinbyrne! - Preserve session attribution and registered properties across initialization and configuration updates when persistence writes are debounced. (2026-09-30)

posthog-js@1.435.4

1.435.4

Patch Changes

• #5158 5c92e83 Thanks @​posthog! - Fix a DataCloneError when session replay records network timing inside a cross-origin iframe. (2026-09-30)

posthog-js@1.435.3

1.435.3

Patch Changes

... (truncated)

Commits

• c9d890a chore: update versions and lockfile [version bump]
• 2bdc8eb fix(surveys): use new PostHog logo in survey footer branding (#5152)
• 2ef9d36 chore: update versions and lockfile [version bump]
• e4672b6 fix(react-native-plugin): require posthog-ios 3.88.2 (#5193)
• a89ab25 chore: update versions and lockfile [version bump]
• 9e42cc2 perf(mcp): skip truncation depths that collapse nothing (#5161)
• ae7c453 chore: update versions and lockfile [version bump]
• 8a005ca fix(browser): preserve shared identity during pending cookieless consent (#5188)
• 041a0ad chore: update versions and lockfile [version bump]
• 80b9e5f perf(mcp): sanitize only the head of a long string that truncation keeps (#5186)
• Additional commits viewable in compare view

Updates streamdown from 2.6.0 to 2.7.0

Release notes

Sourced from streamdown's releases.

streamdown@2.7.0

This release is mostly about streaming speed, plus a few new props and a lot of fixes.

⚡ Performance • Code blocks now highlight only the new lines as they stream, instead of the whole block on every update • Blocks that are already parsed get reused while a document streams, and only block tokens are lexed • Code and table auto-scroll runs once per frame instead of on every chunk • Showing and hiding the caret no longer restyles the whole document, which used to cost tens of ms per toggle on long streams • The code highlight cache now has a size limit (LRU), so memory stays bounded in long sessions • Mermaid diagrams render one at a time while their fence streams, so a growing diagram no longer holds up the stream

✨ New • fallbackComponent: a fallback renderer for tags in allowedTags or HTML tags that have no entry in components • disableAutolinkProtocols: turn off GFM autolinking for specific protocols (e.g. ["mailto"]) • portal: set the container used by Mermaid and table fullscreen and the link safety modal • defaultComponents is now exported, so you can build overrides on top of the built-in renderers • onCopy / onError now work on the default code and Mermaid copy buttons • Incomplete images show a loading skeleton while they stream instead of disappearing

🐛 Fixes • Mermaid diagrams auto-fit their container and text is readable again • A < inside math (e.g. $$ \sum_{j<k} $$) no longer cuts off the rest of the message • Code block buttons can be clicked inside nested scroll containers • Tables copied or downloaded as Markdown keep literal HTML tags and entities • Loose list items no longer get extra spacing from a wrapping <p> • CJK: bare URLs after fullwidth punctuation are linkified again

🧩 remend 1.4.0 • New single-pass scanner that follows CommonMark for code fences and spans: handles ~~~, fences in quotes and lists, CRLF, and multi-backtick spans • Fixes slow (quadratic) healing on input full of delimiters • Identifiers like snake__case no longer create false emphasis • Healing is now idempotent

⚠️ Heads up • @streamdown/code@2.0.0 moves to Shiki v4 and now needs Node 20 or newer • marked is now on v18

Below, you can find the detailed changes.

Minor Changes

• 6b14de4: Add a disableAutolinkProtocols prop to <Streamdown> for disabling GFM autolinking of specific URL protocols (e.g. mailto).

  <Streamdown disableAutolinkProtocols={["mailto"]}>
    {"Contact us at hello@example.com"}
  </Streamdown>

... (truncated)

Changelog

Sourced from streamdown's changelog.

2.7.0

Minor Changes

• 6b14de4: Add a disableAutolinkProtocols prop to <Streamdown> for disabling GFM autolinking of specific URL protocols (e.g. mailto).

  <Streamdown disableAutolinkProtocols={["mailto"]}>
    {"Contact us at hello@example.com"}
  </Streamdown>

  Bare emails and bare URLs whose protocol matches the list (case-insensitive, "mailto" and "mailto:" are equivalent) are unwrapped back to plain text. Explicit markdown links ([text](https://github.com/vercel/streamdown/blob/main/packages/streamdown/url)) are left as links, including when the label reconstructs the URL (e.g. [foo@x.com](https://github.com/vercel/streamdown/blob/main/packages/streamdown/mailto:foo@x.com)). When the prop is omitted, autolinking behavior is completely unchanged.

  Closes #607.

• b1965bb: feat: add fallbackComponent prop for missing map entries / allowedTags

  Adds a new fallbackComponent prop to <Streamdown>. When provided, it is used as a fallback renderer for any HTML tag or allowed custom tag that does not have an explicit entry in the components map:

  <Streamdown
    allowedTags={{ mention: ["user_id"] }}
    fallbackComponent={({ node, children, ...props }) =>
      createElement(node!.tagName, props, children)
    }
  >
    {markdown}
  </Streamdown>

  fallbackComponent applies to custom tags declared via allowedTags (with no explicit component entry) and to standard HTML tags absent from the built-in component set (e.g. <span>, <em>, <div>, <br>). Built-in and explicit components entries always win — this is not a full unstyled mode.

  Refs #543

Patch Changes

• b651249: Give animated word spans a style object instead of a CSS string, so rendering skips parsing a style declaration for every word on every update. createAnimatePlugin still writes CSS strings.
• b651249: Check whether a stream only appended text by comparing a slice of the new input with the previous one instead of calling startsWith, which compared the whole document character by character on every update.
• b651249: Hide the caret after a table or an unfinished code fence by marking the last element instead of changing the container's class and style. Each toggle used to restyle the whole document, which cost tens of milliseconds per flip on long streams.
• c971f42: Wire onCopy and onError through default code and Mermaid copy controls via controls.code.copy and controls.mermaid.copy.
• 4ec5639: Bound the code highlight cache. Results of streaming code blocks are no longer cached (each is superseded by the next update), and finished code blocks are kept in a least-recently-used cache bounded by their size (tokens, lines and characters) and by a limit of 5,000 results. Lookups compare the full code, so blocks that differ only in the middle no longer share tokens. A code block also ignores highlight results for code it has already moved past.
• 16e7e65: Export defaultComponents so custom components overrides can compose Streamdown's built-in renderers (styles, data-streamdown, link safety, code/mermaid/table behavior) instead of reimplementing them.
• 163c63b: fix(code-block): use absolute positioning for action buttons to fix click events in nested scroll containers

... (truncated)

Commits

• 08da224 Version Packages (#600)
• 4ec5639 fix(code): bound the highlight result cache (#639)
• b651249 perf: cut Streamdown main-thread cost while streaming (#635)
• e7a23ef fix(mermaid): pause between renders so a streaming diagram does not hold up t...
• dd71450 chore: port streamdown benchmarks to the vitest 5 API (#629)
• 6b14de4 feat: support disableAutolinkProtocols to opt out of GFM autolinks per protoc...
• 16e7e65 feat: export defaultComponents for Streamdown components customization (#492)
• 38775ee build(deps): bump the npm_and_yarn group across 2 directories with 5 updates ...
• 5504e50 fix: preserve literal HTML in Markdown table exports (#618)
• 5b26c28 perf: lex block tokens only and reuse parsed blocks while streaming (#608)
• Additional commits viewable in compare view

Updates @tauri-apps/cli from 2.12.0 to 2.12.1

Release notes

Sourced from @​tauri-apps/cli's releases.

@​tauri-apps/cli v2.12.1

[2.12.1]

Enhancements

• 64bfdd909 (#16165 by @​Legend-Master) Ignore src-tauri in tauri plugin init example template

Dependencies

• Upgraded to tauri-cli@2.12.1

Commits

• 30da1fd feat(ci): run audit before publishing
• 1aefcf6 fix: pnpm audit
• 026f260 apply version updates (#16150)
• a4dcca8 fix(plugin): skip build script writes on docs.rs builds (#16186)
• f040897 docs: link WRY and TAO to their repositories (#16163)
• c9a3cb8 fix: enable macos private apis regardless of feature flags (#16166)
• 64bfdd9 fix: ignore src-tauri in vite configs (#16165)
• 793f0c4 fix(window): copy WebView2Loader.dll for nightly (#16164)
• d15cf9b fix(bundler): make glob error variants available on all platforms (#16149)
• See full diff in compare view

Updates @types/node from 24.19.0 to 24.19.1

Commits

• See full diff in compare view

Updates vite from 8.3.1 to 8.3.2

Release notes

Sourced from vite's releases.

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) ...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
devian	Ready	Preview	Oct 6, 2026 1:37am UTC

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.