build(deps): bump the js-deps group across 1 directory with 22 updates

[dependabot]

Bumps the js-deps group with 22 updates in the / directory:

Package	From	To
@radix-ui/react-slot	1.3.0	1.3.3
@scalar/api-reference-react	0.9.58	0.9.70
eslint-config-next	16.2.10	16.3.5
next	16.2.11	16.3.5
next-intl	4.13.2	4.14.5
postcss	8.5.19	8.5.28
react	19.2.7	19.3.0
@types/react	19.2.17	19.3.0
react-dom	19.2.7	19.3.0
@types/react-dom	19.2.3	19.3.0
recharts	3.9.2	3.10.1
tailwind-merge	3.6.0	3.7.0
ws	8.21.1	8.21.3
zod	4.4.3	4.6.5
zustand	5.0.14	5.0.15
@playwright/test	1.61.1	1.63.0
@testing-library/dom	10.4.1	10.4.2
@testing-library/react	16.3.2	16.3.3
@types/node	26.1.1	26.6.2
@types/react	19.2.17	19.3.0
@types/react-dom	19.2.3	19.3.0
@vitejs/plugin-react	6.0.3	6.1.1
fast-check	4.9.0	4.10.2
vite	8.1.5	8.3.0

Updates @radix-ui/react-slot from 1.3.0 to 1.3.3

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.3.2, 1.3.3

• Reverted breaking changes that caused compatibility issues with React Server Components.

1.3.1

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4

Commits

• See full diff in compare view

Updates @scalar/api-reference-react from 0.9.58 to 0.9.70

Changelog

Sourced from @​scalar/api-reference-react's changelog.

0.9.70

0.9.69

0.9.68

0.9.67

0.9.66

0.9.65

Patch Changes

• #9941: Republish every package through npm trusted publishing. No functional changes.

0.9.64

0.9.63

0.9.62

0.9.61

0.9.60

0.9.59

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​scalar/api-reference-react since your current version.

Updates eslint-config-next from 16.2.10 to 16.3.5

Release notes

Sourced from eslint-config-next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
• next/image: Reject empty images when reading/writing to the disk cache (#98186)
• Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
• Add CSP nonce to script tags of loading and template files (#98403)
• Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653

... (truncated)

Commits

• ca2c75e v16.3.5
• 299180d v16.3.4
• a9a1cb7 v16.3.3
• d0ac882 v16.3.2
• 3d32eb8 v16.3.1
• d73f562 v16.3.0
• 4fd843f v16.3.0-canary.107
• 9480f7f v16.3.0-canary.106
• a8dcd25 v16.3.0-canary.105
• 38f0cde v16.3.0-canary.104
• Additional commits viewable in compare view

Updates next from 16.2.11 to 16.3.5

Release notes

Sourced from next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
• next/image: Reject empty images when reading/writing to the disk cache (#98186)
• Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
• Add CSP nonce to script tags of loading and template files (#98403)
• Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653

... (truncated)

Commits

• ca2c75e v16.3.5
• 14fb290 [backport] Fix use cache prerender signal retention (#98448)
• 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
• 4b56cee [16.3.x] Backport docs fixes (#98317)
• 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
• 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
• 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
• d9eac96 [16.3.x] next/image: skip 0-byte entries when initializing disk LRU cache (#9...
• 84b35fe [test] Fix 16.3 deploy test assertions (#98133)
• 14f9c1a [16.3.x][ci] Run flake detection and new deploy tests when merged and on back...
• Additional commits viewable in compare view

Updates next-intl from 4.13.2 to 4.14.5

Release notes

Sourced from next-intl's releases.

v4.14.5

4.14.5 (2026-09-14)

Bug Fixes

• Avoid reading the pathname in useRouter and Link to work better with Cache Components (#2415) (ed97a92) – by @​amannn

v4.14.4

4.14.4 (2026-09-11)

Bug Fixes

• Improve base path detection for setting a cookie (#2410) (f04681d) – by @​soroush5

v4.14.3

4.14.3 (2026-09-10)

Bug Fixes

• Keep $ patterns in route param values literally (#2406) (a97b35e) – by @​soroush5

v4.14.2

4.14.2 (2026-09-01)

Bug Fixes

• Allow @eloqnt/* patches to resolve by moving to ^0.1.0 ranges (#2398) (4d18120) – by @​amannn

v4.14.1

4.14.1 (2026-08-28)

Bug Fixes

• Unbreak experimental.messages without a messages.sourceLocale (#2395) (67fca94) – by @​amannn

v4.14.0

4.14.0 (2026-08-27)

Features

• useExtracted improvements (#2346) (4ccf3b8) – by @​amannn

⚠️ If you're using useExtracted and the po format, this requires an update to your messages.

Please see amannn/next-intl#2393 for details and an upgrade prompt.

v4.13.7

4.13.7 (2026-08-17)

... (truncated)

Changelog

Sourced from next-intl's changelog.

4.14.5 (2026-09-14)

Bug Fixes

• Avoid reading the pathname in useRouter and Link to work better with Cache Components (#2415) (ed97a92) – by @​amannn

4.14.4 (2026-09-11)

Bug Fixes

• Improve base path detection for setting a cookie (#2410) (f04681d) – by @​soroush5

4.14.3 (2026-09-10)

Bug Fixes

• Keep $ patterns in route param values literally (#2406) (a97b35e) – by @​soroush5

4.14.2 (2026-09-01)

Bug Fixes

• Allow @eloqnt/* patches to resolve by moving to ^0.1.0 ranges (#2398) (4d18120) – by @​amannn

4.14.1 (2026-08-28)

Bug Fixes

• Unbreak experimental.messages without a messages.sourceLocale (#2395) (67fca94) – by @​amannn

4.14.0 (2026-08-27)

Features

• useExtracted improvements (#2346) (4ccf3b8) – by @​amannn

4.13.7 (2026-08-17)

Bug Fixes

• Pin @swc/core to a range that is compatible with the extractor plugin (#2389) (a37d8aa) – by @​amannn

4.13.6 (2026-08-10)

Bug Fixes

• Deprecate requestLocale param of getRequestConfig (#2380) (ae770af) – by @​amannn

4.13.5 (2026-08-04)

... (truncated)

Commits

• 7691fca v4.14.5
• ed97a92 fix: Avoid reading the pathname in useRouter and Link to work better with...
• 8267c8f v4.14.4
• f04681d fix: Improve base path detection for setting a cookie (#2410)
• e9b1637 v4.14.3
• a97b35e fix: Keep $ patterns in route param values literally (#2406)
• ddb378d docs: Lint messages with @eloqnt/cli in example-app-router (#2403)
• a388bd5 docs: Add a "Lint your messages" section to the README (#2404)
• 3259beb v4.14.2
• 4d18120 fix: Allow @eloqnt/* patches to resolve by moving to ^0.1.0 ranges (#2398)
• Additional commits viewable in compare view

Updates postcss from 8.5.19 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

Changelog

Sourced from postcss's changelog.

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

Commits

• e544bff Release 8.5.28 version
• f8fc252 Typo
• 5039fd7 Add missed release notes
• ae40ca4 Release 8.5.27 version
• 62b1626 Fix linter
• 1dba938 Update dependencies
• 3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
• 6d23bc3 Fix link
• 508e997 Add GitHub Sponsors link
• e993739 Add CodeRabbit sponsor (#2145)
• Additional commits viewable in compare view

Updates react from 19.2.7 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (

[github-actions]

📸 Screenshot Drift Check

This PR modifies UI source files. Please verify whether the README screenshots need refreshing:

• Any updated screenshot was captured from a disposable demo database
• Every visible name, value, identifier, path, and notification is synthetic
• Browser chrome and embedded image metadata contain no account or device data

Changed UI files

public/fonts/README.md
public/fonts/fa-brands-400.eot
public/fonts/fa-brands-400.svg
public/fonts/fa-brands-400.ttf
public/fonts/fa-brands-400.woff
public/fonts/fa-brands-400.woff2
public/fonts/fa-regular-400.eot
public/fonts/fa-regular-400.svg
public/fonts/fa-regular-400.ttf
public/fonts/fa-regular-400.woff

See docs/SCREENSHOT-GUIDE.md for instructions on capturing and optimising screenshots.

This comment is posted automatically and can be dismissed if no visual changes occurred.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.