Bump the core-ui-package-updates group across 1 directory with 12 updates

[dependabot]

Bumps the core-ui-package-updates group with 12 updates in the /airflow-core/src/airflow/ui directory:

Package	From	To
@tanstack/react-query	5.102.3	5.102.8
@xyflow/react	12.11.3	12.11.5
axios	1.19.0	1.20.0
katex	0.18.4	0.18.5
mermaid	11.17.1	11.17.2
react-hook-form	7.86.0	7.87.0
react-router-dom	7.18.2	7.18.3
@tanstack/eslint-plugin-query	5.102.3	5.102.8
@testing-library/react	16.3.2	16.3.3
@types/node	26.3.0	26.4.0
@vitejs/plugin-react	6.1.0	6.1.1
happy-dom	20.11.6	20.12.0

Updates @tanstack/react-query from 5.102.3 to 5.102.8

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.102.8
  • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-next-experimental@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-persist-client@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.102.8
  • @​tanstack/react-query@​5.102.8

@​tanstack/react-query@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.8

@​tanstack/react-query-devtools@​5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.102.7
  • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-next-experimental@​5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-persist-client@​5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.102.7
  • @​tanstack/react-query@​5.102.7

@​tanstack/react-query@​5.102.7

Patch Changes

• Updated dependencies []:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.8

5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.7

5.102.6

Patch Changes

• #11305 ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

• Updated dependencies []:

  • @​tanstack/query-core@​5.102.6

5.102.5

Patch Changes

• Updated dependencies [578e5c2]:
  • @​tanstack/query-core@​5.102.5

5.102.4

Patch Changes

• Updated dependencies [a05df6a]:
  • @​tanstack/query-core@​5.102.4

Commits

• 2969edf ci: Version Packages (#11316)
• 2eb3c7c ci: Version Packages (#11313)
• 714df67 ci: Version Packages (#11306)
• ac2b612 fix(react-query): propagate falsy errors to the error boundary (#11305)
• 1836e61 ci: Version Packages (#11303)
• 51f12db ci: Version Packages (#11294)
• See full diff in compare view

Updates @xyflow/react from 12.11.3 to 12.11.5

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.11.5

Patch Changes

• Updated dependencies [22e0be2]:
  • @​xyflow/system@​0.0.81

@​xyflow/react@​12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

• #5976 3319ef4 - Fix the MiniMap zooming out to include the origin when every node is hidden.

• #5955 965ca70 - Fix MiniMap calling useCallback conditionally for onNodeClick.

Changelog

Sourced from @​xyflow/react's changelog.

12.11.5

Patch Changes

• Updated dependencies [22e0be2]:
  • @​xyflow/system@​0.0.81

12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

• #5976 3319ef4 - Fix the MiniMap zooming out to include the origin when every node is hidden.

• #5955 965ca70 - Fix MiniMap calling useCallback conditionally for onNodeClick.

Commits

• 8f0a5d6 chore(packages): bump
• 286816c chore(packages): bump
• 3319ef4 fix(react): keep minimap bounds at the viewport when all nodes are hidden
• b7186f3 fix(react): minimap still works after reactflow remounts #5971
• d8edc77 Merge pull request #5955 from Jian-Zhang08/fix/minimap-onnodeclick-conditiona...
• 59b1a60 Simplify node click handling in MiniMap component
• 25869f2 chore(system): add attr warning handler
• b04e9d1 chore(system): rename utils isDomNodeVisible
• 31535ef chore(system): add isDomNodeVisible
• bce7475 chore(proOptions): add comments
• Additional commits viewable in compare view

Updates axios from 1.19.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

• HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

• Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

• Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
• Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
• XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
• Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
• Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

• Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
• Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
• Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
• CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​yens1 (#11109)
• @​Sasireddy001 (#11113)
• @​ari-token-security (#11094)
• @​timothyokooboh (#11097)
• @​gi9439041-png (#11119)
• @​Hashim1999164 (#11082)
• @​v-dev-cl (#11091)
• @​r0h1tb (#11118)
• @​ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

Changelog

Sourced from axios's changelog.

Changelog

Commits

• 84a9f3b chore(release): prepare release 1.20.0 (#11152)
• e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
• d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
• 2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
• d19040b fix: harden runtime option handling (#11141)
• e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
• d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
• 2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
• 76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
• ba98559 docs: add ScrapingBee sponsor (#11137)
• Additional commits viewable in compare view

Updates katex from 0.18.4 to 0.18.5

Release notes

Sourced from katex's releases.

v0.18.5

0.18.5 (2026-08-31)

Bug Fixes

• char: accept U+10FFFF (#4265) (6805538), closes #2549

Changelog

Sourced from katex's changelog.

0.18.5 (2026-08-31)

Bug Fixes

• char: accept U+10FFFF (#4265) (6805538), closes #2549

Commits

• 7f46076 chore(release): 0.18.5 [ci skip]
• 6805538 fix(char): accept U+10FFFF (#4265)
• 0df23bb chore(deps): bump github/codeql-action from 4.37.7 to 4.37.8 (#4273)
• bd78fad chore(deps): update dependency commander to v15 (#4271)
• 87d99bb chore(deps): bump github/codeql-action from 4.37.6 to 4.37.7 (#4268)
• a6646b2 chore(deps): bump github/codeql-action from 4.37.4 to 4.37.6 (#4264)
• See full diff in compare view

Updates mermaid from 11.17.1 to 11.17.2

Release notes

Sourced from mermaid's releases.

mermaid@11.17.2

Patch Changes

• #8125 178d7c7 Thanks @​knsv-bot! - fix: restore the edgePaths class on the edge group in rendered SVG, and point the flowchart, block and user journey stylesheets at it

Commits

• dcb694d Version Packages (#8130)
• 178d7c7 fix: restore edgePaths class on the edge group (#8125)
• See full diff in compare view

Updates react-hook-form from 7.86.0 to 7.87.0

Release notes

Sourced from react-hook-form's releases.

Version 7.87.0

✨ Features

• Add shouldTouch option to trigger() ([#13671](react-hook-form/react-hook-form#13671))

  setValue already supported shouldTouch; trigger() now does too. This allows you to mark field(s) as touched after manual or programmatic validation, such as validate-on-mount or multi-step form navigation, without needing a setValue workaround:

  // Mark a single field as touched after validating it
  await trigger('firstName', { shouldTouch: true });
  // Mark every mounted field as touched after validating the whole form
  await trigger(undefined, { shouldTouch: true });

• Add OpaqueTypes registry for opaque leaf types ([#13676](react-hook-form/react-hook-form#13676))

  Recursive type helpers (Path, DeepPartial, DeepRequired, FieldErrorsImpl, etc.) previously stopped only at Primitive | BrowserNativeObject. As a result, rich third-party value types such as Dayjs and Decimal could be recursively traversed member-by-member, potentially causing TypeScript to report "Excessive complexity" diagnostics on large form types.

  You can now register a type as an opaque leaf via declaration merging:

  import type { Dayjs } from 'dayjs';
  declare module 'react-hook-form' {
  interface OpaqueTypes {
  dayjs: Dayjs;
  }
  }

  While the registry is empty, types remain identical to the existing behavior. This is purely opt-in.

🐞 Fixes

• Fix inconsistent behavior among useController().field.onChange()-like APIs. ([#13673](react-hook-form/react-hook-form#13673))
• Fix Controller under a null parent submitting undefined instead of a value. ([#13675](react-hook-form/react-hook-form#13675))
• Fix ERR_MODULE_NOT_FOUND when resolving react-hook-form due to a react-server declaration in Next.js builds. ([#13682](react-hook-form/react-hook-form#13682))
• Fix useWatch never reconciling when an Activity subtree is hidden on its first render. ([#13683](react-hook-form/react-hook-form#13683))
• Fix resetField not recomputing isValid for subscribe-only consumers. ([#13684](react-hook-form/react-hook-form#13684))
• Fix generateWatchOutput ignoring defaultValue for an array of names. ([#13686](react-hook-form/react-hook-form#13686))
• Fix useFormState never reconciling when an Activity subtree is hidden on its first render. ([#13687](react-hook-form/react-hook-form#13687))

❤️ Thank You

Thanks to @​giaBaoJS, @​dfedoryshchev, @​Alioth-91, @​Masatoshi0227, @​modosc, and @​bluebill1049 for their contributions! 🎉

Changelog

Sourced from react-hook-form's changelog.

[7.87.0] - 2026-08-30

Added

• shouldTouch option for trigger()
• OpaqueTypes registry for opaque leaf types

Fixed

• Inconsistent behavior among useController().field.onChange()-like APIs
• Controller under a null parent submitting undefined instead of a value
• ERR_MODULE_NOT_FOUND resolving react-hook-form due to a react-server declaration (Next.js builds)
• useWatch never reconciling when an Activity subtree is hidden on its first render
• resetField not recomputing isValid for subscribe-only consumers
• generateWatchOutput ignoring defaultValue for an array of names
• useFormState never reconciling when an Activity subtree is hidden on its first render

Commits

• 29af888 7.87.0
• 1eeab63 🐞 fix(useFormState): never reconciles when an Activity subtree is hidden on i...
• 145441c 🐞 fix(generateWatchOutput): defaultValue is ignored for an array of names (#1...
• 1fb065c 🐞 fix(resetField): isValid not recomputed for subscribe-only consumers (#13684)
• 2f7380e 🧹refactor: use continue instead of return in setFieldValues' hasOwnProper...
• 1b0a314 📖 remove comment
• a457ca7 🐞 fix #13680: useWatch never reconciles when an Activity subtree is hidden on...
• bb3360f 🐞 fix #13681 issue: ERR_MODULE_NOT_FOUND, Can't resolve react-hook-form due t...
• f646948 🪅 feat: add OpaqueTypes registry for opaque leaf types (#13676)
• e17a95c 🧇 chore: scope the lock workflow to issues so its scheduled run can finish (#...
• Additional commits viewable in compare view

Updates react-router-dom from 7.18.2 to 7.18.3

Changelog

Sourced from react-router-dom's changelog.

v7.18.3

Patch Changes

• Updated dependencies:
  • react-router@7.18.3

Commits

• 23166df Release v7.18.3 (#15424)
• See full diff in compare view

Updates @tanstack/eslint-plugin-query from 5.102.3 to 5.102.8

Release notes

Sourced from @​tanstack/eslint-plugin-query's releases.

@​tanstack/eslint-plugin-query@​5.102.8

No release notes provided.

@​tanstack/eslint-plugin-query@​5.102.7

No release notes provided.

Changelog

Sourced from @​tanstack/eslint-plugin-query's changelog.

5.102.8

5.102.7

5.102.6

5.102.5

5.102.4

Commits

• 2969edf ci: Version Packages (#11316)
• 2eb3c7c ci: Version Packages (#11313)
• 714df67 ci: Version Packages (#11306)
• 1836e61 ci: Version Packages (#11303)
• 51f12db ci: Version Packages (#11294)
• See full diff in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates @types/node from 26.3.0 to 26.4.0

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.1.0 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• See full diff in compare view

Updates happy-dom from 20.11.6 to 20.12.0

Release notes

Sourced from happy-dom's releases.

v20.12.0

🎨 Features

• Adds support for Animation, AnimationTimeline, DocumentTimeline and KeyframeEffect - By @​capricorn86
• Adds support for Element.animate() - By @​capricorn86

v20.11.15

👷‍♂️ Patch fixes

• Fixes issue with upgrading custom element caused by previous release - By @​capricorn86 in task #2331

v20.11.14

👷‍♂️ Patch fixes

• Change prototype of element to the custom element when upgraded to keep the reference - By @​capricorn86 in task #2331
  • The previous solution replaced the element with the custom element and copied it's properties, but this made any reference to the original element invalid

v20.11.13

👷‍♂️ Patch fixes

• Copy event listeners when upgrading a custom element - By @​capricorn86 in task #2329

v20.11.12

👷‍♂️ Patch fixes

• Add check for if the node is still a parent during disconnect - By @​capricorn86 in task #2322

v20.11.11

👷‍♂️ Patch fixes

• Use proxy as parent node in Node.connectedToNode - By @​diegohaz in task #2253

v20.11.10

👷‍♂️ Patch fixes

• Return default validationMessage for built-in constraint violations - By @​mixelburg in task #2187

v20.11.9

👷‍♂️ Patch fixes

• Make sure that the element has been upgraded before invoking reaction callback in custom elements - By @​capricorn86 in task #2317

v20.11.8

👷‍♂️ Patch fixes

• Values pushed or assigned to the adoptedStyleSheet array should be validated - By @​capricorn86 in task #2315

v20.11.7

👷‍♂️ Patch fixes

• The properties Document.adoptedStyleSheets and ShadowRoot.adoptedStyleSheets should validate it's value - By @​capricorn86 in task #2313

Commits

• 4b0af0c feat: Adds support for Element.animate (#2335)
• e1a8af5 fix: #2331 Fixes issue with upgrading custom element caused by previous rel...
• 096317b fix: #2331 Change prototype of element to the custom element when upgraded ...
• 9ff4b47 fix: #2329 Copy event listeners when upgrading a custom element (#2330)
• 3d282e5 fix: #2322 Add check for if the node is still a parent during disconnect (#...
• 64e2c77 fix: #2253 Use proxy as parent node in Node.connectedToNode() (#2254)
• a00ec69 fix: #2319 Removing a child incorrectly calls flow for connecting node (#2321)
• 152b5d8 fix: #2319 Removing a child incorrectly calls flow for connecting node (#2320)
• 1100b9c fix: #2187 Return default validationMessage for built-in constraint violati...
• 1893795 fix: #2317 Make sure that the element has been upgraded before invoking rea...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions