chore(deps): bump the npm group across 1 directory with 50 updates

[dependabot]

Bumps the npm group with 50 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.1	2.5.7
@types/node	26.0.1	26.2.0
@typescript-eslint/parser	8.62.1	8.66.0
eslint	10.6.0	10.8.1
tsx	4.22.4	4.23.11
turbo	2.10.1	2.10.9
typescript	6.0.3	7.0.2
mutation-testing-metrics	3.8.0	3.9.0
xstate	5.32.2	5.32.5
pure-rand	6.1.0	8.4.2
@electric-sql/pglite	0.5.3	0.5.4
@electric-sql/pglite-socket	0.2.6	0.2.7
@testcontainers/postgresql	12.0.4	12.1.0
@opentelemetry/exporter-metrics-otlp-http	0.219.0	0.221.0
@opentelemetry/exporter-trace-otlp-http	0.219.0	0.221.0
@opentelemetry/instrumentation-http	0.219.0	0.221.0
@opentelemetry/resources	2.8.0	2.10.0
@opentelemetry/sdk-metrics	2.8.0	2.10.0
@opentelemetry/sdk-node	0.219.0	0.221.0
@opentelemetry/sdk-trace-base	2.8.0	2.10.0
@opentelemetry/sdk-trace-node	2.8.0	2.10.0
@opentelemetry/semantic-conventions	1.41.1	1.43.0
fastify	5.9.0	5.11.3
@asyncapi/parser	3.6.0	3.6.3
@pact-foundation/pact	17.0.0	17.1.0
@playwright/test	1.61.1	1.62.1
@fastify/websocket	11.2.0	11.3.0
jose	6.2.3	6.2.8
ws	8.21.0	8.21.3
react	19.2.7	19.2.8
@types/react	19.2.17	19.2.18
react-dom	19.2.7	19.2.8
@types/react-dom	19.2.3	19.2.4
react-router-dom	7.18.1	7.18.2
@size-limit/file	12.1.0	13.0.3
@storybook/addon-a11y	10.4.6	10.5.7
@storybook/addon-vitest	10.4.6	10.5.7
@storybook/react-vite	10.4.6	10.5.7
@tailwindcss/vite	4.3.2	4.3.3
@vitejs/plugin-react	6.0.3	6.0.5
@vitest/browser	4.1.9	4.1.10
@vitest/browser-playwright	4.1.9	4.1.10
size-limit	12.1.0	13.0.3
storybook	10.4.6	10.5.7
tailwindcss	4.3.2	4.3.3
vite	8.1.1	8.2.1
@vitest/coverage-v8	4.1.9	4.1.10
fast-check	4.8.0	4.9.0
undici	8.5.0	8.10.0
vitest	4.1.9	4.1.10

Updates @biomejs/biome from 2.5.1 to 2.5.7

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.7

2.5.7

Patch Changes

• #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

• #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

• #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

• #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

• #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

  ├── biome.json
  └── subdirectory
      ├── biome.json
      └── lib.js
  

  biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

  Now, the nested configuration is correctly picked up and applied.

  In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

• #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

  The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

  declare function schedule(handler: () => void): string;
  declare function schedule(handler: () => Promise<void>): string | undefined;
  schedule(async () => {}) ?? "fallback";

  The following code is also now invalid, because map(() => 42) returns 42:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.7

Patch Changes

• #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

• #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

• #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

• #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

• #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

  ├── biome.json
  └── subdirectory
      ├── biome.json
      └── lib.js
  

  biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

  Now, the nested configuration is correctly picked up and applied.

  In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

• #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

  The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

  declare function schedule(handler: () => void): string;
  declare function schedule(handler: () => Promise<void>): string | undefined;
  schedule(async () => {}) ?? "fallback";

  The following code is also now invalid, because map(() => 42) returns 42:

  type Mapper<T> = () => T;
  declare function map<T>(mapper: Mapper<T>): T;

... (truncated)

Commits

• 191d051 ci: release (#11119)
• 9847e68 feat(lint): add noNonScalableViewport rule (#11168)
• e63354c feat(lint): add noExtendNative nursery rule (#11136)
• 2fa0a62 docs: rework CLI (#11134)
• e007143 feat(lint): add nursery rule noTailwindArbitraryValue (#10094)
• c171b3b feat(lint): add ignoreIfStatements option to useNullishCoalescing (#10822)
• 1139f1c ci: release (#11022)
• 781d68d feat(lint/js): add noRestrictedProperties (#9806)
• 412a0e9 ci: release (#10948)
• b3b12b3 feat(lint): add noNegationInEqualityCheck rule (#10915)
• Additional commits viewable in compare view

Updates @types/node from 26.0.1 to 26.2.0

Commits

• See full diff in compare view

Updates @typescript-eslint/parser from 8.62.1 to 8.66.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.66.0

8.66.0 (2026-08-03)

🚀 Features

• typescript-estree: handle import.defer() as ImportExpression (#12609)

🩹 Fixes

• eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)
• eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
• eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
• eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
• eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
• website: list onUnsupportedTypeScriptVersion in parser options (#12585)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kirk Waiblinger @​kirkwaiblinger
• Steffen Schroeder
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

• add warning when TS 7 is detected (#12529)
• eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
• eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
• parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
• typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

• eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
• eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• Serhii Leniv @​Serhii-Leniv

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.66.0 (2026-08-03)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.65.0 (2026-07-20)

🚀 Features

• add warning when TS 7 is detected (#12529)
• parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.64.0 (2026-07-13)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• e51b11b chore(release): publish 8.66.0
• 63ba81b chore(release): publish 8.65.0
• eaf4576 feat: add warning when TS 7 is detected (#12529)
• d8f1044 feat(parser): add onUnsupportedTypeScriptVersion option to error on unsupport...
• 0d06406 chore: add attw validation to repo (#12437)
• c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
• 414d9ab chore(release): publish 8.64.0
• 290cf6c chore(release): publish 8.63.0
• See full diff in compare view

Updates eslint from 10.6.0 to 10.8.1

Release notes

Sourced from eslint's releases.

v10.8.1

Bug Fixes

• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
• 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
• 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
• 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
• 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

• 7d0cbf8 docs: Update README (GitHub Actions Bot)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
• 678c90b docs: Update README (GitHub Actions Bot)
• 8a10424 docs: Update README (GitHub Actions Bot)
• 69bb948 docs: Update README (GitHub Actions Bot)

Chores

• 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)
• 5611035 test: add error locations info to no-void (#21185) (Lee Daeun)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])
• f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)
• 1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)
• d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)
• 65a6519 chore: add allowScripts field to package.json (#21092) (GiHoon Noh)
• 22e5256 ci: add triage:no label to Dependabot PRs (#21141) (lumir)
• 55c9038 ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])
• 7280e78 chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])
• eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#21156) (Francesco Trotta)
• 60a178d chore: update ecosystem plugins (#21150) (ESLint Bot)
• f9f61dc test: add error locations to no-unreachable (#21151) (JIYEON)
• d086293 test: add error locations to no-undef (#21147) (JIYEON)
• cc01b67 test: add error locations to no-useless-catch (#21144) (devoil)
• 688e75e chore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)
• 7c1e175 test: add error locations to require-await (#21145) (Grit)
• 588a26d test: add error locations to no-extra-label (#21139) (dongkyu lee)
• 059aa89 test: add error locations to no-useless-concat (#21140) (dongkyu lee)
• 5a452a8 test: add error locations to no-const-assign (#21138) (dongkyu lee)

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

... (truncated)

Commits

• c049dc3 10.8.1
• a3f7826 Build: changelog update for 10.8.1
• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173)
• 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196)
• 7d0cbf8 docs: Update README
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191)
• 5611035 test: add error locations info to no-void (#21185)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176)
• f131c03 chore: improve ecosystem test failure reporting (#20937)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183)
• Additional commits viewable in compare view

Updates tsx from 4.22.4 to 4.23.11

Release notes

Sourced from tsx's releases.

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

4.23.8 (2026-08-05)

Bug Fixes

• preserve package subpath resolution (be1315e)
• preserve typeless ESM dependency exports (70dfc5e)

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• be1315e fix: preserve package subpath resolution
• 5efba41 docs: organize transform backend research
• Additional commits viewable in compare view

Updates turbo from 2.10.1 to 2.10.9

Release notes

Sourced from turbo's releases.

Turborepo v2.10.9

What's Changed

Changelog

• chore: Release Turborepo 2.10.8 by @​github-actions[bot] in vercel/turborepo#13626
• perf: Walk literal-prefix tree globs without wax compilation by @​charpeni in vercel/turborepo#13522
• fix: Accept semver ranges in devEngines.packageManager.version by @​bangseongbeom in vercel/turborepo#13623
• docs: Explain affected package invalidation reasons by @​ghoullier in vercel/turborepo#13594
• perf(lockfiles): Borrow field-name scalars in the pnpm fast parser by @​anthonyshew in vercel/turborepo#13648
• perf(repository): Avoid discarded alias allocation in Relationship by @​anthonyshew in vercel/turborepo#13650
• perf(lockfiles): Drop redundant human_name clone for pnpm v7/v9 by @​anthonyshew in vercel/turborepo#13649
• perf: Index workspace nodes by name in project_relationships by @​anthonyshew in vercel/turborepo#13647
• perf: Share resolution identity lists across identical workspace closures by @​anthonyshew in vercel/turborepo#13641
• docs: Fix duplicated word in runtime dependencies guide summary by @​anthonyshew in vercel/turborepo#13630
• refactor: Remove turborepo-lsp dependency on turborepo-lib by @​anthonyshew in vercel/turborepo#13631
• perf: Index Bun nested lockfile entries by name for fallback resolution by @​anthonyshew in vercel/turborepo#13633
• perf: Memoize framework inference per package during task hashing by @​anthonyshew in vercel/turborepo#13634
• perf: Avoid materializing transient declarations in external_dependencies by @​anthonyshew in vercel/turborepo#13646
• perf: Enable shared closure DP for npm and yarn1 lockfiles by @​anthonyshew in vercel/turborepo#13635
• perf: Parse pnpm explicit-key entries in the lockfile fast path by @​anthonyshew in vercel/turborepo#13640
• perf: Parallelize resolution fingerprint hashing by @​anthonyshew in vercel/turborepo#13642
• perf: Build resolution identity lists in parallel by @​anthonyshew in vercel/turborepo#13643
• perf: Intern resolution identities as Arc<str> across closures by @​anthonyshew in vercel/turborepo#13645
• fix: Compose affected tasks with package filters by @​anthonyshew in vercel/turborepo#13656
• docs: Explain worktree cache path isolation by @​anthonyshew in vercel/turborepo#13657
• fix: Upgrade brace-expansion to 5.0.9 by @​anthonyshew in vercel/turborepo#13658
• docs: Correct verified inaccuracies in the Turborepo Agent Skill by @​charpeni in vercel/turborepo#13644
• chore: Update Next.js to 16.3.0 by @​anthonyshew in vercel/turborepo#13659
• fix: Don't use eprintln! in the panic hook by @​molofsky in vercel/turborepo#13637
• fix: Invalidate only when Git ignore sources change by @​smasato in vercel/turborepo#13632
• docs: Update Geistdocs to 1.19.4 by @​christopherkindl in vercel/turborepo#13680
• docs: Exclude Turborepo from its own OSS products menu by @​christopherkindl in vercel/turborepo#13681
• docs: Use the geistdocs Turborepo logo in the navbar by @​christopherkindl in vercel/turborepo#13682
• docs: Update redirected vercel.com/nextjs.org links to current targets by @​molebox in vercel/turborepo#13685
• refactor: Generalize native command arguments by @​anthonyshew in vercel/turborepo#13664
• refactor: Move native contracts to tasks by @​anthonyshew in vercel/turborepo#13665
• docs: Fix loadTransformers reference in turbo-codemod README by @​latent-9 in vercel/turborepo#13683
• refactor: Model native task execution explicitly by @​anthonyshew in vercel/turborepo#13666
• feat: Compose aggregate native task dependencies by @​anthonyshew in vercel/turborepo#13667
• fix: Respect aggregate task overrides by @​anthonyshew in vercel/turborepo#13668
• test: Stabilize watch task inputs regression test by @​anthonyshew in vercel/turborepo#13686
• feat: Parse Python quality tool declarations by @​anthonyshew in vercel/turborepo#13669
• feat: Resolve Python quality plans by @​anthonyshew in vercel/turborepo#13670
• refactor: Extract uv native task specs by @​anthonyshew in vercel/turborepo#13671
• feat: Synthesize Python quality tasks by @​anthonyshew in vercel/turborepo#13672
• test: Cover Python quality task commands by @​anthonyshew in vercel/turborepo#13673
• feat: Hash Python quality task inputs by @​anthonyshew in vercel/turborepo#13674
• test: Cover Python quality task graph by @​anthonyshew in vercel/turborepo#13675
• chore: Release Turborepo 2.10.9-canary.1 by @​github-actions[bot] in vercel/turborepo#13687

... (truncated)

Commits

• 33237d4 publish 2.10.9 to registry
• 3b0e57f fix: Prevent Windows process cleanup PID reuse (#13695)
• efe4e1b fix: Prune Bun wildcard workspace dev dependencies (#13694)
• a98e5cd docs: Document dependency-driven Python tasks (#13676)
• c09a92f chore: Release Turborepo 2.10.9-canary.1 (#13687)
• 09bd548 test: Cover Python quality task graph (#13675)
• 3584a5f feat: Hash Python quality task inputs (#13674)
• 0d43ff3 test: Cover Python quality task commands (#13673)
• 94708ad feat: Synthesize Python quality tasks (#13672)
• e14f04e refactor: Extract uv native task specs (#13671)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates mutation-testing-metrics from 3.8.0 to 3.9.0

Release notes

Sourced from mutation-testing-metrics's releases.

v3.9.0

3.9.0 (2026-07-27)

Bug Fixes

• deps: update dependency eslint-plugin-simple-import-sort to v14 (#4271) (25c52f5)

Features

• elements: render ANSI escape codes in the mutant drawer (#4264) (0c93866), closes #2925

v3.8.4

3.8.4 (2026-07-06)

Performance Improvements

• multiple performance improvements to rendering and calculating scores (#4246) (083117c)

v3.8.3

3.8.3 (2026-06-05)

Note: Version bump only for package root

Changelog

Sourced from mutation-testing-metrics's changelog.

3.9.0 (2026-07-27)

Note: Version bump only for package mutation-testing-metrics

3.8.4 (2026-07-06)

Performance Improvements

• multiple performance improvements to rendering and calculating scores (#4246) (083117c)

Commits

• 00aa7bd v3.9.0
• 4aa02dd chore(deps): update playwright monorepo to v1.62.0 (#4283)
• bac7aac v3.8.4
• 083117c perf: multiple performance improvements to rendering and calculating scores (...
• 7c71b1b chore(deps): update dependency prettier to v3.9.4 (#4244)
• See full diff in compare view

Updates xstate from 5.32.2 to 5.32.5

Release notes

Sourced from xstate's releases.

xstate@5.32.5

Patch Changes

• #5603 345e04c Thanks @​xianjianlf2! - Sending an event to a stopped actor no longer throws when the event contains unserializable data (e.g. circular references). Previously, the development-only warning that an event was sent to a stopped actor used JSON.stringify on the event, which could throw and mask the intended warning. The warning is now emitted safely regardless of the event's contents.

xstate@5.32.4

Patch Changes

• #5589 e913eeb Thanks @​spokodev! - Fixed a bug where targeting a history state that is a direct child of a parallel state would silently do nothing when that parallel state had not been visited yet and the history state had no default target. The machine now enters the parallel state's initial configuration, matching the behavior of history states inside compound states.

  const machine = createMachine({
    initial: 'off',
    states: {
      off: { on: { GO: 'on.hist' } },
      on: {
        type: 'parallel',
        states: {
          regA: { initial: 'a1', states: { a1: {}, a2: {} } },
          regB: { initial: 'b1', states: { b1: {}, b2: {} } },
          hist: { type: 'history', history: 'deep' }
        }
      }
    }
  });
  const actor = createActor(machine).start();
  actor.send({ type: 'GO' });
  actor.getSnapshot().value; // { on: { regA: 'a1', regB: 'b1' } }

xstate@5.32.3

Patch Changes

• #5575

[github-actions]

🔒 This PR edits an invariant source

It changes a single-source-of-truth definition — a Zod contract, a formal spec, or a
falsifiable-claim / detection-matrix manifest. Each one derives the enforcement below it:
DB constraints, runtime validators, generated OpenAPI, property generators, bound assertions.
Weakening one quietly weakens every check downstream — the exact failure mode this guard exists
to catch.

Per ADR-0024 / AGENTS.md this is a deliberate change: it needs an ADR and a Code Owner
sign-off (you can't self-approve it), not a quiet edit to turn a red check green.

Files

packages/contracts/package.json

[github-actions]

🔒 This PR edits an invariant source

It changes a single-source-of-truth definition — a Zod contract, a formal spec, or a
falsifiable-claim / detection-matrix manifest. Each one derives the enforcement below it:
DB constraints, runtime validators, generated OpenAPI, property generators, bound assertions.
Weakening one quietly weakens every check downstream — the exact failure mode this guard exists
to catch.

Per ADR-0024 / AGENTS.md this is a deliberate change: it needs an ADR and a Code Owner
sign-off (you can't self-approve it), not a quiet edit to turn a red check green.

Files

packages/contracts/package.json

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.