Bump the production-dependencies group across 1 directory with 9 updates by dependabot[bot] · Pull Request #11 · 0-AI-UG/open-cli-deployment

dependabot · 2026-09-16T16:48:29Z

Bumps the production-dependencies group with 9 updates in the / directory:

Package	From	To
@simplewebauthn/browser	`13.3.0`	`14.0.0`
@simplewebauthn/server	`13.3.0`	`14.0.2`
date-fns	`4.1.0`	`4.4.0`
jose	`6.2.2`	`6.2.12`
lucide-react	`1.7.0`	`1.47.0`
react	`19.2.4`	`19.3.0`
react-dom	`19.2.4`	`19.3.0`
tailwind-merge	`3.5.0`	`3.7.0`
zod	`4.4.3`	`4.6.5`

Updates @simplewebauthn/browser from 13.3.0 to 14.0.0

Release notes

Sourced from @simplewebauthn/browser's releases.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @agektmr)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

[server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

[server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

[server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

[server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

[browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

v13.3.3

Changes:

[server] Updated MDS blob signature verification to support more algorithms (#788)

[server] Updated MetadataService to know about the new FIDO MDS blob trust anchor certificate (#789)

v13.3.2

This update fixes a CVSS v4 Low (2.0) security vulnerability identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

[server] Fixed an issue with verifyRegistrationResponse() allowing a maliciously-crafted attestation statement's x5c to contain a self-signed "root certificate" instead of chaining back to an RP-specified trust anchor (GHSA-6hxq-p678-4hr2)

v13.3.1

Changes:

... (truncated)

Changelog

Sourced from @simplewebauthn/browser's changelog.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info

... (truncated)

Commits

3e2dc0c Update version to v14.0.0
618c0e9 Merge v14.0.0 milestone to master (#792)
See full diff in compare view

Updates @simplewebauthn/server from 13.3.0 to 14.0.2

Release notes

Sourced from @simplewebauthn/server's releases.

v14.0.2

This update fixes a CVSS v3 Moderate (5.4) security vulnerability identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

[server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh)

v14.0.1

[server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

[browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @agektmr)

[server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

[server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

[server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

[server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

[server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

[browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

v13.3.3

Changes:

[server] Updated MDS blob signature verification to support more algorithms (#788)

[server] Updated MetadataService to know about the new FIDO MDS blob trust anchor certificate (#789)

... (truncated)

Changelog

Sourced from @simplewebauthn/server's changelog.

v14.0.2

This update fixes a CVSS v3 Moderate (5.4 / 10) and a CVSS v3 Moderate (6.3 / 10) security vulnerabilities identified in @simplewebauthn/server. See the security advisory linked below for more information.

Changes:

[server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh, GHSA-j3h4-m3m2-7p7j)

v14.0.1

Changes:

[server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785,

... (truncated)

Commits

21f99a2 Update server version to v14.0.2
f03758a Merge commit from fork
0bfdc3b Update server version to v14.0.1
4831ce2 Fix X.509 parsing to support PQC use in attestation statements (#800)
3e2dc0c Update version to v14.0.0
618c0e9 Merge v14.0.0 milestone to master (#792)
4b189bd Update server version to 13.3.3
05db595 Add GlobalSign Root R46 to FIDO MDS default root certs (#789)
9bf80bf Use JWT header alg when verifying MDS blob (#788)
84656ff Update version to 13.3.2
Additional commits viewable in compare view

Updates date-fns from 4.1.0 to 4.4.0

Release notes

Sourced from date-fns's releases.

v4.4.0

This release revisits the approach to CDN usage and introduces a new package, @date-fns/cdn and deprecates the date-fns CDN scripts. It allowed reducing the zipped package size from 5.83 MB down to 3.96 MB without introducing any breaking changes.

In v5.0.0-alpha.0 where CDN scripts are completely removed from date-fns the change is more significant and brings the zipped package size down to 2.89 MB.

It is just the first step in optimizing the package size. Expect further size reduction in the future v4 and v5 versions.

Changed

DEPRECATED: The date-fns CDN scripts are now deprecated and will be removed in the next major release. Please switch to the new @date-fns/cdn package for CDN usage.

Removed CDN source maps to reduce the package size. If you rely on them, please switch to the new @date-fns/cdn package that still includes them.

v4.3.0

Kudos to @ImRodry and @puneetdixit200 for their contributions.

Fixed

Fixed missing modularized optimization fallback (for Next.js and others). See #4193.

Fixed pt locale first day of week to be Sunday. See #4195 by @ImRodry.

Fixed zh-CN, zh-HK, and zh-TW locale month parsing for October, November, and December. See #4194 by @puneetdixit200.

v4.2.1

Fixed

Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.

Commits

cd53d25 Promote to v4.4.0
d948ec1 Preserve but deprecate CDN versions for v4, set up v5 with polyfills
ee65753 Add root mise :format task
9f5bdf5 Add positional argument to test/smoke.sh script
651ead6 Split CDN bundles into separate @date-fns/cdn package
224c1a2 Deprecate type tests as attw hangs on date-fns package
7bb2842 Switch PACKAGE_OUTPUT_PATH to --dist flag in the package build script
b6ad5ac Add flags to control package build script
424a783 Fix docs release after moving to monorepo setup
f95bcf1 (docs): Add missing tsx dependency
Additional commits viewable in compare view

Updates jose from 6.2.2 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (78637bd)

normalize jwks selection metadata once (fd3ae3f)

use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

render subpath indexes as tables (94589ee)

shorten API index descriptions (681482f)

Refactor

model JWE key management modes (e01dda6)

types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (78637bd)

normalize jwks selection metadata once (fd3ae3f)

use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

render subpath indexes as tables (94589ee)

shorten API index descriptions (681482f)

Refactor

model JWE key management modes (e01dda6)

types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits

505a55b chore(release): 6.2.12
7bc9a33 perf: encode single-signature JWS input once
78637bd perf: normalize General JWE shared headers once
bf5138b perf: deduplicate pending jwks key imports
b23a6f3 perf: use native encoding for larger ASCII strings
fd3ae3f perf: normalize jwks selection metadata once
6925d43 perf: avoid copying AES-GCM output
be62530 docs: clarify and shorten public API guidance
1b41312 build: preserve README when generation fails
0b51829 build: check tree-shaking for every public binding
Additional commits viewable in compare view

Updates lucide-react from 1.7.0 to 1.47.0

Release notes

Sourced from lucide-react's releases.

Version 1.47.0

What's Changed

feat(icons): add lambda icon by @UbaidUllah9962 in lucide-icons/lucide#4017

feat(icons): delegated faucet icon from lab by @karsa-mistmere in lucide-icons/lucide#4764

feat(icons): added door-closed-package icon by @karsa-mistmere in lucide-icons/lucide#4814

feat(icons): added 'nepali-rupee' icon by @sarajdhakal in lucide-icons/lucide#4608

feat(icons): added tube-lotion icon by @AlecRust in lucide-icons/lucide#4029

feat(icons): Added cupcake icon by @briz123 in lucide-icons/lucide#3000

feat(icons): added square-dashed-x icon by @EthanHazel in lucide-icons/lucide#4535

feat(icons): add rotate-cw-clock icon by @gkkconan in lucide-icons/lucide#3979

fix(icons): remove path from save-off by @HPRILLER in lucide-icons/lucide#4848

fix(icons): changed calendar-chevrons-right by @karsa-mistmere in lucide-icons/lucide#4865

fix(icons): changed broccoli icon by @jguddas in lucide-icons/lucide#4871

feat(icons): added square-dashed-plus by @psjdev in lucide-icons/lucide#4849

New Contributors

@UbaidUllah9962 made their first contribution in lucide-icons/lucide#4017

@sarajdhakal made their first contribution in lucide-icons/lucide#4608

@AlecRust made their first contribution in lucide-icons/lucide#4029

@gkkconan made their first contribution in lucide-icons/lucide#3979

@HPRILLER made their first contribution in lucide-icons/lucide#4848

@psjdev made their first contribution in lucide-icons/lucide#4849

Full Changelog: lucide-icons/lucide@1.46.0...1.47.0

Version 1.46.0

What's Changed

feat(icons): Added new icons: clef-g, clef-f and clef-c by @rrod497 in lucide-icons/lucide#4083

chore(deps-dev): bump astro from 7.3.0 to 7.3.2 in the astro-deps group by @dependabot[bot] in lucide-icons/lucide#4860

feat(icons): added monitor-pc icon by @karsa-mistmere in lucide-icons/lucide#4791

Full Changelog: lucide-icons/lucide@1.45.0...1.46.0

Version 1.45.0

What's Changed

feat(icons): added calendar-chevrons-right icon by @AlexandrePhilibert in lucide-icons/lucide#3565

feat(icons): added building-complex-plus icon by @tylerkade in lucide-icons/lucide#4758

feat(icons): add hourglass-cog icon by @lazerg in lucide-icons/lucide#4635

feat(icons): added mouth & mouth-off by @karsa-mistmere in lucide-icons/lucide#4787

feat(icons): added iv-bag icon by @karsa-mistmere in lucide-icons/lucide#4821

fix(icons): changed lectern icon by @UsamaKhan in lucide-icons/lucide#2925

feat(icons): add layout-arrow-right and layout-arrow-down by @samuelalake in lucide-icons/lucide#4541

feat(icons): added park icon by @skajosborn in lucide-icons/lucide#3177

fix(icons): changed album, book-marked, folder-bookmark icons by @karsa-mistmere in lucide-icons/lucide#3043

fix(icons): correct misspelled tags by @decknamec in lucide-icons/lucide#4836

feat(icons): added houses icon by @danielbayley in lucide-icons/lucide#3241

feat(icons): added notebook-dot icon by @elenakovelskikh in lucide-icons/lucide#3228

feat(icons): add messages-circle icon by @Mirazstudio-offical in lucide-icons/lucide#4754

feat(icons): added plant-pot icon by @vqh2602 in lucide-icons/lucide#3122

... (truncated)

Commits

94e4cb9 chore(dependencies): Update dependencies (#4806)
99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
0f8d48b test(packages): updates unit test snapshots with face-slightly-smiling (#4676)
f229f83 chore(depedencies): Update dependencies (#4553)
5ff536e ci(release.yml): Fix workflow and remove version scripts in package scripts...
07c885e fix(docs): fix zephyr-cloud URL in readmes
50d8af5 docs(readme): Update readme files (#4320)
653e44b feat(packages): use .mjs for ESM bundles (#4285)
7623e23 feat(docs): add Zephyr Cloud to Hero Backers tier & rework updateSponsors scr...
See full diff in compare view

Updates react from 19.2.4 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545,

Bumps the production-dependencies group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@simplewebauthn/browser](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/browser) | `13.3.0` | `14.0.0` | | [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server) | `13.3.0` | `14.0.2` | | [date-fns](https://github.com/date-fns/date-fns) | `4.1.0` | `4.4.0` | | [jose](https://github.com/panva/jose) | `6.2.2` | `6.2.12` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.7.0` | `1.47.0` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.4` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.3.0` | | [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.5.0` | `3.7.0` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.5` | Updates `@simplewebauthn/browser` from 13.3.0 to 14.0.0 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.0/packages/browser) Updates `@simplewebauthn/server` from 13.3.0 to 14.0.2 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.2/packages/server) Updates `date-fns` from 4.1.0 to 4.4.0 - [Release notes](https://github.com/date-fns/date-fns/releases) - [Commits](date-fns/date-fns@v4.1.0...v4.4.0) Updates `jose` from 6.2.2 to 6.2.12 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.2...v6.2.12) Updates `lucide-react` from 1.7.0 to 1.47.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.47.0/packages/lucide-react) Updates `react` from 19.2.4 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `react-dom` from 19.2.4 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `tailwind-merge` from 3.5.0 to 3.7.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge) Updates `zod` from 4.4.3 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.6.5) --- updated-dependencies: - dependency-name: "@simplewebauthn/browser" dependency-version: 14.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@simplewebauthn/server" dependency-version: 14.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: date-fns dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: jose dependency-version: 6.2.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: lucide-react dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: tailwind-merge dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: zod dependency-version: 4.6.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 16, 2026

dependabot Bot changed the title ~~Bump the production-dependencies group with 9 updates~~ Bump the production-dependencies group across 1 directory with 9 updates Sep 16, 2026

dependabot Bot force-pushed the dependabot/bun/production-dependencies-cbf38dd0b2 branch from 7c0eae2 to bd7c084 Compare September 16, 2026 20:37

dependabot Bot force-pushed the dependabot/bun/production-dependencies-cbf38dd0b2 branch from bd7c084 to 092ef6e Compare September 23, 2026 04:44

Navigation Menu

Bump the production-dependencies group across 1 directory with 9 updates - #11

Bump the production-dependencies group across 1 directory with 9 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-dependencies-cbf38dd0b2

dependabot Bot commented on behalf of github Sep 16, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v14.0.0 - The one after they go quantum

Breaking Changes

v13.3.3

v13.3.2

v13.3.1

v14.0.0 - The one after they go quantum

v14.0.2

v14.0.1

v14.0.0 - The one after they go quantum

Breaking Changes

v13.3.3

v14.0.2

v14.0.1

v14.0.0 - The one after they go quantum

v4.4.0

Changed

v4.3.0

Fixed

v4.2.1

Fixed

v4.2.0

Changed

v6.2.12

Documentation

Refactor

Performance

v6.2.11

Documentation

Refactor

v6.2.10

Fixes

6.2.12 (2026-09-05)

Documentation

Refactor

Performance

6.2.11 (2026-09-04)

Documentation

Refactor

6.2.10 (2026-08-21)

Fixes

Version 1.47.0

What's Changed

New Contributors

Version 1.46.0

What's Changed

Version 1.45.0

What's Changed

19.3.0 (September 9, 2026)

New React Features

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 16, 2026 •

edited

Loading