build(deps-dev): Bump @tanstack/react-virtual from 3.14.7 to 3.14.8

[dependabot]

Bumps @tanstack/react-virtual from 3.14.7 to 3.14.8.

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.8

Patch Changes

• #1237 aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after _willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

• Updated dependencies [7ae32b5]:

  • @​tanstack/virtual-core@​3.17.6

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.8

Patch Changes

• #1237 aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after _willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

• Updated dependencies [7ae32b5]:

  • @​tanstack/virtual-core@​3.17.6

Commits

• 32b2f2b ci: Version Packages (#1238)
• aa536e7 fix(react-virtual): grow size container before scroll sync on end-anchored pr...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tanstack/​react-virtual@​3.14.7 ⏵ 3.14.8	+1		+1	+1

View full report

[hermes-exosphere]

✅ Auto-approved: all 10 CI checks passing. Ready to merge.

[hermes-exosphere]

Automated code review started - full review. Results will be posted here.

[hermes-exosphere]

✅ Build & test complete. All CI checks passed:

• build: pass
• docs: pass
• quality: pass
• test (default): pass
• test (hook-log-file): pass
• test (log-debug): pass
• test-e2e: pass
• OSV-Scanner: pass
• Socket Security: pass

[hermes-exosphere]

Automated Code Review

Executive Summary

This PR is a minor dependabot version bump: @tanstack/react-virtual from 3.14.7 to 3.14.8 (semver patch). Only bun.lock was modified -- package.json already has the caret range ^3.14.3 so the version constraint was unchanged. The update brings in one fix: a gap-at-top-of-list bug after end-anchored prepend in directDomUpdates mode. Code quality: no issues found. All 9 CI checks green.

---

Change Architecture

graph TD
    A["@tanstack/react-virtual<br/>^3.14.3 (caret range)"] -->|"lock: 3.14.7 -> 3.14.8"| B["bun.lock"]
    B -->|"transitive: 3.17.5 -> 3.17.6"| C["@tanstack/virtual-core"]
    C --> D[Runtime behaviour]
    style B fill:#87CEEB
    style C fill:#90EE90

Loading

Legend: Modified lockfile | Transitive bump (no direct dependency change)

---

Breaking Changes

No breaking changes detected. The release notes describe one bug fix in directDomUpdates mode (grow container before scroll sync on prepend). The lockfile-only change means only the resolution changed -- the semver range (^3.14.3) already accepted this version.

---

Issues Found

No issues found. This is a clean semver-patch bump with only lockfile changes.

---

Logical / Bug Analysis

Change analysis:

• package.json: Unchanged -- "@tanstack/react-virtual": "^3.14.3" already covers 3.14.8
• bun.lock: Two lines changed:
  • @tanstack/react-virtual: 3.14.7 -> 3.14.8, now depends on @tanstack/virtual-core@3.17.6 (was 3.17.5)
  • @tanstack/virtual-core: 3.17.5 -> 3.17.6 (transitive-only bump)

Risk assessment:

• Semver: patch (3.14.x) -- no API changes, bug fixes only
• Scope: devDependency only (used in dev/build, not production runtime)
• The fix addresses a gap-at-top rendering bug in directDomUpdates mode only -- standard rendering unaffected
• No new dependencies, no removed dependencies

---

Evidence -- Build & Test Results

CI Results (all passed)

OSV-Scanner           pass  14s
Socket Security       pass  5s
Socket PR Alerts      pass  6s
build                 pass  1m9s
docs                  pass  1m54s
quality               pass  1m6s
test (default)        pass  1m8s
test (hook-log-file)  pass  1m24s
test (log-debug)      pass  1m14s
test-e2e              pass  50s

Socket Security Report

Package	Supply Chain	Vulnerability	Quality	Maintenance	License
@tanstack/react-virtual 3.14.7 -> 3.14.8	100 (+1)	100	68 (+1)	97 (+1)	100

All scores improved or stayed at 100. No vulnerabilities introduced.

---

Issue Linkage

No issue linked. This is an automated dependabot PR -- standard for dependency updates.

---

Human Review Feedback

• @Socket-Security[bot]: Supply chain scan showed clean scores across all dimensions (100/100/68/97/100) -- no concerns.
• No human review comments on this PR.

---

Suggestions

• Consider enabling auto-merge for patch-level dependabot PRs to reduce manual review overhead. The project already uses [dependabot-automerge-start] markers in the PR body but they appear commented out.

---

Verdict

VERDICT: APPROVED

---

Automated code review - 2026-07-28 UTC

[hermes-exosphere]

Automated review: Approved. Clean semver-patch dependabot bump. Only bun.lock changed (3.14.7 -> 3.14.8). All 9 CI checks green. No breaking changes.

[hermes-exosphere]

Automated review: Approved. ✅