chore(deps): Bump the minor-and-patch group across 1 directory with 21 updates

[dependabot]

Bumps the minor-and-patch group with 21 updates in the / directory:

Package	From	To
@peculiar/x509	2.0.0	2.1.0
@tauri-apps/plugin-deep-link	2.4.9	2.4.10
@tauri-apps/plugin-dialog	2.7.2	2.7.3
@tauri-apps/plugin-fs	2.5.1	2.5.2
@tauri-apps/plugin-opener	2.5.4	2.5.5
@tauri-apps/plugin-updater	2.10.1	2.11.0
mysql2	3.24.2	3.24.3
next	16.3.3	16.3.4
next-intl	4.14.1	4.14.2
react-hook-form	7.86.0	7.87.0
undici	8.10.0	8.10.2
zod	4.4.3	4.5.4
@eslint/eslintrc	3.3.6	3.3.7
@next/bundle-analyzer	16.3.3	16.3.4
@types/react-dom	19.2.5	19.2.7
autoprefixer	10.5.4	10.5.5
eslint-config-next	16.3.3	16.3.4
jest	30.5.0	30.5.1
postcss	8.5.26	8.5.28
@opennextjs/cloudflare	1.20.4	1.20.6
wrangler	4.127.1	4.129.0

Updates @peculiar/x509 from 2.0.0 to 2.1.0

Release notes

Sourced from @​peculiar/x509's releases.

v2.1.0

What's Changed

• test: drop access to private X509Crl.tbs getter by @​dotCooCoo in PeculiarVentures/x509#134
• feat(algorithm): register ML-DSA and SLH-DSA AlgorithmProvider handlers (FIPS 204 / FIPS 205) by @​dotCooCoo in PeculiarVentures/x509#135
• fix: add crypto arg to findRevoked by @​hacdias in PeculiarVentures/x509#137
• feat: expose asn1 parse options by @​hacdias in PeculiarVentures/x509#141
• fix: encode CRL revoked serial numbers as positive INTEGERs by @​hacdias in PeculiarVentures/x509#140
• chore: upgrade dependencies and migrate to TypeScript 6 by @​microshine in PeculiarVentures/x509#146
• chore: migrate linting and formatting from ESLint to Oxc by @​microshine in PeculiarVentures/x509#147
• ci: update GitHub Actions and expand package compatibility checks by @​microshine in PeculiarVentures/x509#149

New Contributors

• @​dotCooCoo made their first contribution in PeculiarVentures/x509#134
• @​hacdias made their first contribution in PeculiarVentures/x509#137

Full Changelog: PeculiarVentures/x509@v2.0.0...v2.1.0

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​peculiar/x509 since your current version.

Updates @tauri-apps/plugin-deep-link from 2.4.9 to 2.4.10

Release notes

Sourced from @​tauri-apps/plugin-deep-link's releases.

deep-link-js v2.4.10

[2.4.10]

• db9c5998 (#3531 by @​Legend-Master) Fix missing consumer-rules.pro on Gradle v9.
• 3fb27bf1 (#3504 by @​vasfvitor) adds proper Platform-specific sections to the docs for register, unregister, isRegistered, and onOpenUrl

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-deep-link@2.4.10
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 6.2kB README.md
npm notice 3.6kB dist-js/index.cjs
npm notice 3.1kB dist-js/index.d.ts
npm notice 3.5kB dist-js/index.js
npm notice 802B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-deep-link
npm notice version: 2.4.10
npm notice filename: tauri-apps-plugin-deep-link-2.4.10.tgz
npm notice package size: 4.4 kB
npm notice unpacked size: 18.1 kB
npm notice shasum: 294c255617335d95ac929fd43cf7ea8146418abb
npm notice integrity: sha512-SuXI47ORUzYuw[...]5tSocc47tRXQQ==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2662641995
+ @tauri-apps/plugin-deep-link@2.4.10

deep-link v2.4.10

[2.4.10]

• db9c5998 (#3531 by @​Legend-Master) Fix missing consumer-rules.pro on Gradle v9.
• 3fb27bf1 (#3504 by @​vasfvitor) adds proper Platform-specific sections to the docs for register, unregister, isRegistered, and onOpenUrl

... (truncated)

Commits

• 6aa2854 publish new versions (#3509)
• 9d6d032 chore(deps): update h2 to 0.4.19 (#3556)
• 98f8787 ci: fix typo in workflow permissions
• 1a7b12c ci: add explicit token permissions
• 2f4c85c chore(deps): bump serde_with (#3490)
• c546de0 chore(deps): update dependency rollup to v4.62.5 (#3520)
• db9c599 fix(android): missing consumer-rules.pro (#3531)
• 9c93437 chore(deps): update dependency typescript-eslint to v8.66.0 (#3391)
• 685610a fix(fs): default permissions (#3507)
• f8053e6 docs: cargo features (#3527)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-dialog from 2.7.2 to 2.7.3

Release notes

Sourced from @​tauri-apps/plugin-dialog's releases.

dialog-js v2.7.3

[2.7.3]

• db9c5998 (#3531 by @​Legend-Master) Fix missing consumer-rules.pro on Gradle v9.
• cc9ec9b4 (#3519 by @​purvsinojiya-inventyv) Fix Android save dialog MIME type when a single MIME type is provided.
• f8053e65 (#3527 by @​Legend-Master) Documented Cargo feature flags in each plugin's crate-level documentation.

Dependencies

• Upgraded to fs@2.5.2

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-dialog@2.7.3
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.5kB README.md
npm notice 6.9kB dist-js/index.cjs
npm notice 14.6kB dist-js/index.d.ts
npm notice 6.8kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 657B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-dialog
npm notice version: 2.7.3
npm notice filename: tauri-apps-plugin-dialog-2.7.3.tgz
npm notice package size: 6.7 kB
npm notice unpacked size: 33.3 kB
npm notice shasum: 7e6d375fec8e39d2a90294604a9d77e66c39a072
npm notice integrity: sha512-CRgE+7TP4tvq9[...]oKbMwSI4IEcfA==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2662645358
+ @tauri-apps/plugin-dialog@2.7.3

dialog v2.7.3

[2.7.3]

... (truncated)

Commits

• 6aa2854 publish new versions (#3509)
• 9d6d032 chore(deps): update h2 to 0.4.19 (#3556)
• 98f8787 ci: fix typo in workflow permissions
• 1a7b12c ci: add explicit token permissions
• 2f4c85c chore(deps): bump serde_with (#3490)
• c546de0 chore(deps): update dependency rollup to v4.62.5 (#3520)
• db9c599 fix(android): missing consumer-rules.pro (#3531)
• 9c93437 chore(deps): update dependency typescript-eslint to v8.66.0 (#3391)
• 685610a fix(fs): default permissions (#3507)
• f8053e6 docs: cargo features (#3527)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-fs from 2.5.1 to 2.5.2

Release notes

Sourced from @​tauri-apps/plugin-fs's releases.

fs-js v2.5.2

[2.5.2]

• db9c5998 (#3531 by @​Legend-Master) Fix missing consumer-rules.pro on Gradle v9.
• f8053e65 (#3527 by @​Legend-Master) Documented Cargo feature flags in each plugin's crate-level documentation.
• 685610ae (#3507 by @​Legend-Master) Fix fs:default and fs:read-app-specific-dirs-recursive not giving any command scopes
• 3fb27bf1 (#3504 by @​vasfvitor) Fixed deny-webview-data has no effect, and on Linux, only deny access to the webview data paths instead of the entire $APPLOCALDATA

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-fs@2.5.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.4kB README.md
npm notice 32.8kB dist-js/index.cjs
npm notice 32.6kB dist-js/index.d.ts
npm notice 32.0kB dist-js/index.js
npm notice 697B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-fs
npm notice version: 2.5.2
npm notice filename: tauri-apps-plugin-fs-2.5.2.tgz
npm notice package size: 21.5 kB
npm notice unpacked size: 101.5 kB
npm notice shasum: 262ff39542e50e96f1ee8b6b7d471898736d6609
npm notice integrity: sha512-XXvMSnFiob+G1[...]J5sDsniRyWxlg==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2662643742
+ @tauri-apps/plugin-fs@2.5.2

fs v2.5.2

[2.5.2]

• db9c5998 (#3531 by @​Legend-Master) Fix missing consumer-rules.pro on Gradle v9.
• f8053e65 (#3527 by @​Legend-Master) Documented Cargo feature flags in each plugin's crate-level documentation.
• 685610ae (#3507 by @​Legend-Master) Fix fs:default and fs:read-app-specific-dirs-recursive not giving any command scopes

... (truncated)

Commits

• 6aa2854 publish new versions (#3509)
• 9d6d032 chore(deps): update h2 to 0.4.19 (#3556)
• 98f8787 ci: fix typo in workflow permissions
• 1a7b12c ci: add explicit token permissions
• 2f4c85c chore(deps): bump serde_with (#3490)
• c546de0 chore(deps): update dependency rollup to v4.62.5 (#3520)
• db9c599 fix(android): missing consumer-rules.pro (#3531)
• 9c93437 chore(deps): update dependency typescript-eslint to v8.66.0 (#3391)
• 685610a fix(fs): default permissions (#3507)
• f8053e6 docs: cargo features (#3527)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-opener from 2.5.4 to 2.5.5

Release notes

Sourced from @​tauri-apps/plugin-opener's releases.

opener-js v2.5.5

[2.5.5]

• db9c5998 (#3531 by @​Legend-Master) Fix missing consumer-rules.pro on Gradle v9.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.5.5
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.5.5
npm notice filename: tauri-apps-plugin-opener-2.5.5.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: ef7b9aca07cb3416575e5024b996926c43276b69
npm notice integrity: sha512-xvzGai5aQds8j[...]Fh1MvmDp8QR0g==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2662648628
+ @tauri-apps/plugin-opener@2.5.5

opener v2.5.5

[2.5.5]

• db9c5998 (#3531 by @​Legend-Master) Fix missing consumer-rules.pro on Gradle v9.

... (truncated)

Commits

• 6e2e7e4 publish new versions (#3070)
• 9a2c98f temp: remove updater changefiles
• 4a2ecb6 chore(deps): update rkyv, closes #3196
• 31415ef docs(shell): update example to include Encoding usage in Command::spawn (#3...
• 04b33ea chore(deps): update dependency typescript-eslint to v8.50.1 (#3181)
• 54e21f1 chore(deps): update dependency rollup to v4.54.0 (#3179)
• d528c88 chore(deps): update dependency rollup to v4.53.5 (#3172)
• 69146fa chore(deps): update dependency rollup to v4.53.4 (#3167)
• 9f68f2d chore(deps): update dependency typescript-eslint to v8.50.0 (#3170)
• 3d0d2e0 fix(opener): ignore inAppBrowser on desktop (#3163)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-updater from 2.10.1 to 2.11.0

Release notes

Sourced from @​tauri-apps/plugin-updater's releases.

updater-js v2.11.0

[2.11.0]

• f8053e65 (#3527 by @​Legend-Master) Documented Cargo feature flags in each plugin's crate-level documentation.
• 622f02bf (#3516 by @​Legend-Master) On Windows, returns an error if failed to spawn the installer in install through ShellExecuteW
• ab7489c9 (#3299 by @​Legend-Master) On Windows, add a new option restartAfterInstall/restart_after_install to install an update without the installer re-launching the app
• 2371be83 (#3526 by @​Legend-Master) Added system-proxy (enabled by default) feature flag to control reqwest/system-proxy feature (Use Windows and macOS system proxy settings automatically)

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.11.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 3.2kB dist-js/index.cjs
npm notice 3.1kB dist-js/index.d.ts
npm notice 3.2kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.11.0
npm notice filename: tauri-apps-plugin-updater-2.11.0.tgz
npm notice package size: 3.9 kB
npm notice unpacked size: 14.3 kB
npm notice shasum: e9c012d8afe85ea28adb764ec5965c7bff5657d3
npm notice integrity: sha512-AE36XkOoSna24[...]Hu28LgrsBwIxQ==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2662660526
+ @tauri-apps/plugin-updater@2.11.0

updater v2.11.0

[2.11.0]

• f8053e65 (#3527 by @​Legend-Master) Documented Cargo feature flags in each plugin's crate-level documentation.
• 622f02bf (#3516 by @​Legend-Master) On Windows, returns an error if failed to spawn the installer in install through ShellExecuteW
• ab7489c9 (#3299 by @​Legend-Master) On Windows, add a new option restartAfterInstall/restart_after_install to install an update without the installer re-launching the app

... (truncated)

Commits

• 6aa2854 publish new versions (#3509)
• 9d6d032 chore(deps): update h2 to 0.4.19 (#3556)
• 98f8787 ci: fix typo in workflow permissions
• 1a7b12c ci: add explicit token permissions
• 2f4c85c chore(deps): bump serde_with (#3490)
• c546de0 chore(deps): update dependency rollup to v4.62.5 (#3520)
• db9c599 fix(android): missing consumer-rules.pro (#3531)
• 9c93437 chore(deps): update dependency typescript-eslint to v8.66.0 (#3391)
• 685610a fix(fs): default permissions (#3507)
• f8053e6 docs: cargo features (#3527)
• Additional commits viewable in compare view

Updates mysql2 from 3.24.2 to 3.24.3

Release notes

Sourced from mysql2's releases.

v3.24.3

3.24.3 (2026-09-01)

Bug Fixes

• typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

Changelog

Sourced from mysql2's changelog.

3.24.3 (2026-09-01)

Bug Fixes

• typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

Commits

• 83bda80 chore(master): release 3.24.3 (#4514)
• 6cac974 build(deps): bump lucide-react from 1.35.0 to 1.37.0 in /website (#4520)
• d3f8ceb build(deps-dev): bump @​types/node from 26.3.0 to 26.4.0 in /website (#4519)
• 05993b1 build(deps): bump lucide-react from 1.34.0 to 1.35.0 in /website (#4518)
• 797f38e build(deps-dev): bump @​types/node from 26.3.0 to 26.4.0 (#4517)
• f17babe build(deps-dev): bump @​biomejs/biome from 2.5.10 to 2.5.11 (#4516)
• f4099d5 build(deps-dev): bump rollup from 4.62.5 to 4.63.1 in the rollup group (#4515)
• 1281e1e fix(typings): PoolCluster node events emit a string nodeId (#4513)
• 0957ae4 build(deps-dev): bump @​types/node from 26.2.0 to 26.3.0 (#4510)
• a331feb build(deps-dev): bump @​types/node from 26.2.0 to 26.3.0 in /website (#4511)
• Additional commits viewable in compare view

Updates next from 16.3.3 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

Commits

• 299180d v16.3.4
• 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
• 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
• d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
• 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
• See full diff in compare view

Updates next-intl from 4.14.1 to 4.14.2

Release notes

Sourced from next-intl's releases.

v4.14.2

4.14.2 (2026-09-01)

Bug Fixes

• Allow @eloqnt/* patches to resolve by moving to ^0.1.0 ranges (#2398) (4d18120) – by @​amannn

Changelog

Sourced from next-intl's changelog.

4.14.2 (2026-09-01)

Bug Fixes

• Allow @eloqnt/* patches to resolve by moving to ^0.1.0 ranges (#2398) (4d18120) – by @​amannn

Commits

• 3259beb v4.14.2
• 4d18120 fix: Allow @eloqnt/* patches to resolve by moving to ^0.1.0 ranges (#2398)
• See full diff in compare view

Updates react-hook-form from 7.86.0 to 7.87.0

Release notes

Sourced from react-hook-form's releases.

Version 7.87.0

✨ Features

• Add shouldTouch option to trigger() ([#13671](react-hook-form/react-hook-form#13671))

  setValue already supported shouldTouch; trigger() now does too. This allows you to mark field(s) as touched after manual or programmatic validation, such as validate-on-mount or multi-step form navigation, without needing a setValue workaround:

  // Mark a single field as touched after validating it
  await trigger('firstName', { shouldTouch: true });
  // Mark every mounted field as touched after validating the whole form
  await trigger(undefined, { shouldTouch: true });

• Add OpaqueTypes registry for opaque leaf types ([#13676](react-hook-form/react-hook-form#13676))

  Recursive type helpers (Path, DeepPartial, DeepRequired, FieldErrorsImpl, etc.) previously stopped only at Primitive | BrowserNativeObject. As a result, rich third-party value types such as Dayjs and Decimal could be recursively traversed member-by-member, potentially causing TypeScript to report "Excessive complexity" diagnostics on large form types.

  You can now register a type as an opaque leaf via declaration merging:

  import type { Dayjs } from 'dayjs';
  declare module 'react-hook-form' {
  interface OpaqueTypes {
  dayjs: Dayjs;
  }
  }

  While the registry is empty, types remain identical to the existing behavior. This is purely opt-in.

🐞 Fixes

• Fix inconsistent behavior among useController().field.onChange()-like APIs. ([#13673](react-hook-form/react-hook-form#13673))
• Fix Controller under a null parent submitting undefined instead of a value. ([#13675](react-hook-form/react-hook-form#13675))
• Fix ERR_MODULE_NOT_FOUND when resolving react-hook-form due to a react-server declaration in Next.js builds. ([#13682](react-hook-form/react-hook-form#13682))
• Fix useWatch never reconciling when an Activity subtree is hidden on its first render. ([#13683](react-hook-form/react-hook-form#13683))
• Fix resetField not recomputing isValid for subscribe-only consumers. ([#13684](react-hook-form/react-hook-form#13684))
• Fix generateWatchOutput ignoring defaultValue for an array of names. ([#13686](react-hook-form/react-hook-form#13686))
• Fix useFormState never reconciling when an Activity subtree is hidden on its first render. ([#13687](react-hook-form/react-hook-form#13687))

❤️ Thank You

Thanks to @​giaBaoJS, @​dfedoryshchev, @​Alioth-91, @​Masatoshi0227, @​modosc, and @​bluebill1049 for their contributions! 🎉

Changelog

Sourced from react-hook-form's changelog.

[7.87.0] - 2026-08-30

Added

• shouldTouch option for trigger()
• OpaqueTypes registry for opaque leaf types

Fixed

• Inconsistent behavior among useController().field.onChange()-like APIs
• Controller under a null parent submitting undefined instead of a value
• ERR_MODULE_NOT_FOUND resolving react-hook-form due to a react-server declaration (Next.js builds)
• useWatch never reconciling when an Activity subtree is hidden on its first render
• resetField not recomputing isValid for subscribe-only consumers
• generateWatchOutput ignoring defaultValue for an array of names
• useFormState never reconciling when an Activity subtree is hidden on its first render

Commits

• 29af888 7.87.0
• 1eeab63 🐞 fix(useFormState): never reconciles when an Activity subtree is hidden on i...
• 145441c 🐞 fix(generateWatchOutput): defaultValue is ignored for an array of names (#1...
• 1fb065c 🐞 fix(resetField): isValid not recomputed for subscribe-only consumers (#13684)
• 2f7380e 🧹refactor: use continue instead of return in setFieldValues' hasOwnProper...
• 1b0a314 📖 remove comment
• a457ca7 🐞 fix #13680: useWatch never reconciles when an Activity subtree is hidden on...
• bb3360f 🐞 fix #13681 issue: ERR_MODULE_NOT_FOUND, Can't resolve react-hook-form due t...
• f646948 🪅 feat: add OpaqueTypes registry for opaque leaf types (#13676)
• e17a95c 🧇 chore: scope the lock workflow to issues so its scheduled run can finish (#...
• Additional commits viewable in compare view

Updates undici from 8.10.0 to 8.10.2

Release notes

Sourced from undici's releases.

v8.10.2

⚠️ Security fixes

High severity

• GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.
• GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by 8f5868fb.
• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 4411a238.
• GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.
• GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.
• GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 7aac7f12.
• GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by e905b5b8.

Low severity

• GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by 2be07bf9.
• GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 6d583124.
• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by 0160a719.

What's Changed

• build(deps-dev): bump undici from 6.27.0 to 6.28.0 by @​dependabot[bot] in nodejs/undici#5653
• build(deps-dev): bump jest from 30.4.2 to 30.5.0 by @​dependabot[bot] in nodejs/undici#5750
• build(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.9 by @​dependabot[bot] in nodejs/undici#5752
• build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.9 by @​dependabot[bot] in nodejs/undici#5754
• test(h2): cover stream reset with NGHTTP2_INTERNAL_ERROR by @​zeexzeex in nodejs/undici#5725
• fix(retry): reject invalid resumed responses by @​mcollina in nodejs/undici#5724
• test: make stale-while-revalidate cache update test deterministic by @​mcollina in nodejs/undici#5722
• fix: avoid unbounded recursion in Set-Cookie attribute parser by @​mcollina in

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mydevtools-tech	Ready	Preview	Sep 7, 2026 5:04pm UTC