[dependabot]

Bumps the npm-production group with 24 updates in the / directory:

Package	From	To
@streamdown/math	1.0.2	1.0.3
agent-browser	0.26.0	0.39.1
@assistant-ui/react	0.14.24	0.15.29
@assistant-ui/react-streamdown	0.3.5	0.3.20
@fontsource-variable/inter	5.2.8	5.3.0
@fontsource-variable/jetbrains-mono	5.2.8	5.3.0
@fontsource-variable/noto-sans-sc	5.2.10	5.3.1
@fontsource/poppins	5.2.7	5.3.0
@tabler/icons-react	3.44.0	3.49.0
@tailwindcss/vite	4.3.2	4.3.3
@tanstack/react-query	5.101.2	5.104.3
@tanstack/react-virtual	3.14.5	3.14.20
ignore	7.0.5	7.0.12
katex	0.16.47	0.19.0
nanostores	1.4.0	1.5.5
radix-ui	1.6.1	1.8.1
react	19.2.7	19.3.1
react-dom	19.2.7	19.3.1
react-router-dom	7.18.2	7.18.4
react-shiki	0.9.3	0.11.2
streamdown	2.5.0	2.7.0
tailwind-merge	3.6.0	3.7.0
tailwindcss	4.3.2	4.3.3
tw-shimmer	0.4.11	0.4.14

Updates @streamdown/math from 1.0.2 to 1.0.3

Release notes

Sourced from @​streamdown/math's releases.

@​streamdown/math@​1.0.3

Patch Changes

• 0c2efd7: upgrade dependencies

Changelog

Sourced from @​streamdown/math's changelog.

1.0.3

Patch Changes

• 0c2efd7: upgrade dependencies

Commits

• 08da224 Version Packages (#600)
• 38775ee build(deps): bump the npm_and_yarn group across 2 directories with 5 updates ...
• 3327c18 chore: upgrade minor deps (#589)
• 1102f18 Fix all Biome lint and formatting errors
• See full diff in compare view

Updates agent-browser from 0.26.0 to 0.39.1

Changelog

Sourced from agent-browser's changelog.

0.39.1

Bug Fixes

• Fixed duplicate command execution after a lost daemon response so mutating and launch commands are no longer retried after any request bytes have been sent. CLI JSON and MCP responses report outcome_unknown so callers can inspect the result before retrying; read-only commands and failures before sending retain their retries (#2085)

Contributors

• @​Railly
• @​rotemb-wond

0.39.0

New Features

• Added an experimental Obscura engine (--engine obscura), launched and cleaned up locally like Chrome with bounded startup and CLI/MCP support. Obscura still has accessibility and rendering gaps, so review the engine page before choosing it (#1876)
• Added private CA trust for CLI HTTPS requests so read, install, upgrade and doctor work behind TLS inspection. --ca-cert now applies to them on every platform, the new --use-system-ca uses the operating system trust store, and SSL_CERT_FILE is a fallback. Certificate verification always stays on (#2006)

Bug Fixes

• Fixed selector-scoped snapshots (snapshot -s) so elements under ignored wrappers are no longer printed twice and shadow root content of a selected custom element is no longer dropped (#2043)
• Fixed --auto-connect to wait up to 30s while Chrome 144+ shows the remote-debugging prompt, so it no longer opens repeated prompts or fails with "No running Chrome instance found" (#2026)
• Fixed daemon responsiveness during long commands so it keeps accepting connections, including close, while a command holds the state lock, and a SIGTERM sent in that window is no longer lost (#2059)

Documentation

• Migrated the docs site to Geistdocs (#1887)

Contributors

• @​NamanSatish
• @​Railly
• @​SGavrl
• @​SUSINDRAREDDY
• @​godtail
• @​jadenfix
• @​niieani

0.38.2

Bug Fixes

• Fixed auth vault login to pick usable controls when hidden duplicates exist, and to bind credential entry to the selected field so replaced fields or redirected focus are rejected before submitting (#2014)
• Fixed chat mode to allow webmcp, skills, and other top-level browser commands, so the model uses page WebMCP tools instead of falling back to eval (#2015)
• Fixed Kernel profiles so KERNEL_PROFILE_NAME sessions send the profile as an object instead of failing with a 400, and added KERNEL_PROFILE_SAVE_CHANGES to opt into saving changes back (#2004)
• Fixed Chrome freezing after launch by draining its stderr for the browser's lifetime, so a full log pipe no longer blocks the browser (#2003)
• Fixed Browser Use by switching to Cloud V4, which creates, attaches to, and stops the same browser with bounded timeouts (#1879)
• Fixed Vercel Sandbox shared memory detection by measuring /dev/shm capacity and adding --disable-dev-shm-usage below 256 MiB, so Chrome no longer terminates renderers on the undersized mount (#1890)

... (truncated)

Commits

• 1165952 Prepare v0.39.1 release (#2105)
• d957091 fix(cli): don't re-send a command after it reached the daemon (#2085)
• 44af398 Prepare v0.39.0 release (#2058)
• 0207911 feat(cli): trust private CAs in CLI HTTPS requests (#2006)
• 98e8c79 test(docs): drop migration-only content snapshot checks (#2057)
• f7c8b07 fix(daemon): keep accepting connections while a command holds the state lock ...
• 6d3e22c docs: migrate to Geistdocs (#1887)
• efee389 fix(cdp): give auto-connect time to approve the remote-debugging prompt (#2026)
• 1b1a683 feat(engine): add experimental Obscura support (#1876)
• 526157c fix(snapshot): stop selector-scoped snapshots duplicating and dropping elemen...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for agent-browser since your current version.

Updates @assistant-ui/react from 0.14.24 to 0.15.29

Release notes

Sourced from @​assistant-ui/react's releases.

@​assistant-ui/react@​0.15.29

Patch Changes

• #9613 6e17b3a - fix: preserve pending attachment selections when unrelated assistant scopes change (@​Kinfe123)

• #9602 c696c16 - fix: ignore an attachment picker's selection after the active thread changes, keeping files out of the replacement conversation. (@​Kinfe123)

• #9753 14eec8a - A run that starts while focus is in a field outside the thread no longer moves focus into the composer, and a composer that already has focus keeps its selection. (@​okisdev)

• #9586 2eb0447 - feat: add OpenAIRealtimeVoiceAdapter for direct browser voice sessions with streamed transcripts, typed input, mute controls, and cancellable WebRTC setup. (@​Kinfe123)

• #9768 c71326f - Clear frame tools and pending calls when the iframe document changes or reloads. (@​okisdev)

• #9747 b4558a5 - useAssistantFrameHost disposes the host when its iframe is removed from the page, so the frame's tools leave the model context and its pending calls reject right away, and it serves a new iframe mounted into the same ref. (@​okisdev)

• #9252 1371e4f - Handle sparse MCP Apps message content without scanning array holes. (@​rupic-app)

• Updated dependencies [b78a043, fe13206, 8289dd1, e09563a, b88d62d, 5588bfb, d6e8a0c, fe7179d, c71326f, 55d065c, 61aaccf, 43c9c7c, 75abfbe, 12dfc85, 1091bbc, 01225b9, d2f04ca, 6537c5f, 2217804, 7ba7c54, cd5fd6c, 5197671, 04c5d36]:

  • @​assistant-ui/core@​0.3.29
  • assistant-stream@0.3.52
  • @​assistant-ui/store@​0.3.21

@​assistant-ui/react-langgraph@​0.14.35

Patch Changes

• #9399 5860856 - Remove optimistic messages when a stream fails before its first event. (@​rupic-app)

• #9444 bd1b197 - fix(react-langgraph): restore chained operations and plain sends that fail before their first chunk (@​okisdev)

• #9415 ad8aa2a - Restore the original thread state when an edit or reload fails before its first event. (@​rupic-app)

• Updated dependencies [1f77925, a12da09, dbfdd0a, 140988a, f2963d3, 7745f91, 2bf54c5, 1fb6eb0, 8cb0b97, 6c7c7b2, de2f5a9, c31385e, d02fac2, 05462a5, 2627294, fdbf0a2, 7bff761, 7139acd, 2091bcf, 7f3d804]:

  • @​assistant-ui/core@​0.3.28
  • @​assistant-ui/store@​0.3.20
  • assistant-stream@0.3.51

@​assistant-ui/react@​0.15.28

Patch Changes

• #9323 2be98de - fix(react): render an inert composer's inert attribute on React 18, so the cancel focus loop skips it as it does on React 19 (@​okisdev)
• Updated dependencies [c157aee, 2c1963a, afb9ad2, efbf028, 8b49f28, 4e86339, 28dc601]:
  • @​assistant-ui/core@​0.3.27
  • safe-content-frame@0.0.34
  • assistant-stream@0.3.50
  • @​assistant-ui/tap@​0.9.23

@​assistant-ui/react@​0.15.27

Patch Changes

• #9171 6528ee3 - Guard the composer input example against IME confirmation Enter. (@​rupic-app)

• #9166 b86d6cd - Block typing, attachments, sends, and message editing while a thread is disabled. (@​rupic-app)

... (truncated)

Changelog

Sourced from @​assistant-ui/react's changelog.

0.15.29

Patch Changes

• #9613 6e17b3a - fix: preserve pending attachment selections when unrelated assistant scopes change (@​Kinfe123)

• #9602 c696c16 - fix: ignore an attachment picker's selection after the active thread changes, keeping files out of the replacement conversation. (@​Kinfe123)

• #9753 14eec8a - A run that starts while focus is in a field outside the thread no longer moves focus into the composer, and a composer that already has focus keeps its selection. (@​okisdev)

• #9586 2eb0447 - feat: add OpenAIRealtimeVoiceAdapter for direct browser voice sessions with streamed transcripts, typed input, mute controls, and cancellable WebRTC setup. (@​Kinfe123)

• #9768 c71326f - Clear frame tools and pending calls when the iframe document changes or reloads. (@​okisdev)

• #9747 b4558a5 - useAssistantFrameHost disposes the host when its iframe is removed from the page, so the frame's tools leave the model context and its pending calls reject right away, and it serves a new iframe mounted into the same ref. (@​okisdev)

• #9252 1371e4f - Handle sparse MCP Apps message content without scanning array holes. (@​rupic-app)

• Updated dependencies [b78a043, fe13206, 8289dd1, e09563a, b88d62d, 5588bfb, d6e8a0c, fe7179d, c71326f, 55d065c, 61aaccf, 43c9c7c, 75abfbe, 12dfc85, 1091bbc, 01225b9, d2f04ca, 6537c5f, 2217804, 7ba7c54, cd5fd6c, 5197671, 04c5d36]:

  • @​assistant-ui/core@​0.3.29
  • assistant-stream@0.3.52
  • @​assistant-ui/store@​0.3.21

0.15.28

Patch Changes

• #9323 2be98de - fix(react): render an inert composer's inert attribute on React 18, so the cancel focus loop skips it as it does on React 19 (@​okisdev)
• Updated dependencies [c157aee, 2c1963a, afb9ad2, efbf028, 8b49f28, 4e86339, 28dc601]:
  • @​assistant-ui/core@​0.3.27
  • safe-content-frame@0.0.34
  • assistant-stream@0.3.50
  • @​assistant-ui/tap@​0.9.23

0.15.27

Patch Changes

• #9171 6528ee3 - Guard the composer input example against IME confirmation Enter. (@​rupic-app)

• #9166 b86d6cd - Block typing, attachments, sends, and message editing while a thread is disabled. (@​rupic-app)

• #9247 664f2df - fix(react): pass an MCP App's ui/initialize params to onInitialized as McpAppInitializeParams, including the display modes the app declares (@​rupic-app)

• Updated dependencies [2c10bb1, 16afd50, b86d6cd, 96fd2a2, 2b3e0d3]:

  • assistant-cloud@0.2.7
  • @​assistant-ui/core@​0.3.26
  • @​assistant-ui/store@​0.3.19

0.15.26

Patch Changes

... (truncated)

Commits

• a46d663 chore: update versions (#9549)
• c71326f fix(core): tell a reloaded frame document from the one it replaced (#9768)
• 14eec8a fix(react): only focus the composer on run start when focus is free or inside...
• b4558a5 fix(react): dispose a frame host when its iframe is removed (#9747)
• 2eb0447 feat(react): connect voice directly to OpenAI Realtime (#9586)
• 1371e4f fix(mcp-apps): handle sparse ui/message content (#9252)
• 6e17b3a fix(react): preserve attachment picks across unrelated scope changes (#9613)
• c696c16 fix(react): discard file selections after switching threads (#9602)
• 9e2e69d chore: update versions (#9270)
• 2be98de fix(react): render an inert composer's inert attribute on React 18 (#9323)
• Additional commits viewable in compare view

Updates @assistant-ui/react-streamdown from 0.3.5 to 0.3.20

Release notes

Sourced from @​assistant-ui/react-streamdown's releases.

@​assistant-ui/react-streamdown@​0.3.20

Patch Changes

• #8875 3aff80b - serve the preprocess helpers from one source: @assistant-ui/react-markdown/preprocess is a new subpath, and @assistant-ui/react-streamdown re-exports the same functions instead of carrying a copy (@​okisdev)

• #8973 8e4852c - chore: maintenance update with no changes to runtime behavior. (@​Kinfe123)

• #7074 df4d532 - fix: type every PluginConfig slot with its streamdown plugin interface instead of unknown (@​ShobhitPatra)

• #8897 dff60b2 - render StreamdownTextPrimitive through a single memoized body component (@​okisdev)

• Updated dependencies [9ea0271, c306b56, 3aff80b, 0a3ca24, ce74db7, c46e1a2]:

  • @​assistant-ui/react-markdown@​0.14.20

Changelog

Sourced from @​assistant-ui/react-streamdown's changelog.

0.3.20

Patch Changes

• #8875 3aff80b - serve the preprocess helpers from one source: @assistant-ui/react-markdown/preprocess is a new subpath, and @assistant-ui/react-streamdown re-exports the same functions instead of carrying a copy (@​okisdev)

• #8973 8e4852c - chore: maintenance update with no changes to runtime behavior. (@​Kinfe123)

• #7074 df4d532 - fix: type every PluginConfig slot with its streamdown plugin interface instead of unknown (@​ShobhitPatra)

• #8897 dff60b2 - render StreamdownTextPrimitive through a single memoized body component (@​okisdev)

• Updated dependencies [9ea0271, c306b56, 3aff80b, 0a3ca24, ce74db7, c46e1a2]:

  • @​assistant-ui/react-markdown@​0.14.20

0.3.19

Patch Changes

• #8507 098c140 - chore: update dependencies (@​Yonom)

• #8725 4f0f4f5 - require streamdown 2.7 and remend 1.4, and keep the tail-bounded remend repair in step with remend 1.4's code spans, so a comparison after an escaped backtick still gets escaped (@​okisdev)

• Updated dependencies [098c140]:

  • @​assistant-ui/react-markdown@​0.14.19

0.3.18

Patch Changes

• #8562 b48b05d - preserve currency and math delimiters inside html blocks during preprocessing. (@​okisdev)

• #8564 92f42ee - preserve raw html bodies inside list and blockquote containers during streaming repair. (@​okisdev)

• #8563 31970dc - keep comparison escapes within each line without splitting settled prose or slowing down on blank lines. (@​okisdev)

• Updated dependencies [b48b05d]:

  • @​assistant-ui/react-markdown@​0.14.18

0.3.17

Patch Changes

• #7746 05a1f0d - fix: fail the build when emitted output imports an undeclared package (@​okisdev)

  aui-build kept package imports external without checking them against the manifest, so emitted JavaScript or declarations could import a package a consumer cannot resolve. A build now allows only the package's own name, its declared dependencies, peers and optional dependencies (with a @types/* package standing in for the module it types), its imports map and node builtins. tsdown's deps.onlyImport covers import statements; a pass over the finished declarations covers the two shapes it does not visit, an inline import("pkg").Type and a /// <reference types="pkg" /> directive.

  Test helpers, testUtils modules and benches under src are no longer build entries. They were unreachable through every exports map and carried vitest and ink-testing-library imports into published output.

  @assistant-ui/react-streamdown declares remark-rehype, whose Options type it re-exports as RemarkRehypeOptions.

• #8012 e721183 - fix: stop applying streaming tail repair after a message finishes. (@​Kinfe123)

... (truncated)

Commits

• d90bf23 chore: update versions (#8856)
• 0a3ca24 chore: update dependencies (#8833)
• 8e4852c refactor(streamdown): remove unused plugin defaults (#8973)
• 8e5124c ci: fail coverage that drops below each package's vitest thresholds (#8600)
• df4d532 fix(react-streamdown): type PluginConfig slots with the streamdown plugin int...
• dff60b2 refactor(react-streamdown): render through a single memoized body (#8897)
• 3aff80b refactor: serve the markdown preprocess helpers from react-markdown only (#8875)
• 19709f5 ci: report vitest coverage for changed packages (#8599)
• 274836a chore: update versions (#8687)
• 4f0f4f5 fix(react-streamdown): follow remend 1.4 and streamdown 2.7 (#8725)
• Additional commits viewable in compare view

Updates @fontsource-variable/inter from 5.2.8 to 5.3.0

Commits

• See full diff in compare view

Updates @fontsource-variable/jetbrains-mono from 5.2.8 to 5.3.0

Commits

• See full diff in compare view

Updates @fontsource-variable/noto-sans-sc from 5.2.10 to 5.3.1

Commits

• See full diff in compare view

Updates @fontsource/poppins from 5.2.7 to 5.3.0

Commits

• See full diff in compare view

Updates @tabler/icons-react from 3.44.0 to 3.49.0

Release notes

Sourced from @​tabler/icons-react's releases.

Release 3.49.0

18 new icons:

• outline/alphabet-chinese
• outline/alphabet-devanagari
• outline/alphabet-ethiopic
• outline/alphabet-georgian
• outline/alphabet-japanese
• outline/blob-dashed
• outline/circle-heart
• outline/circle-pause
• outline/circle-play
• outline/circle-stop
• outline/file-lock
• outline/folder-lock
• outline/lens-concave
• outline/lens-convex
• outline/memory
• outline/square-dashed-top-solid
• outline/square-dashed-x
• outline/triangle-dashed

Fixes and improvements

• Add alphabet, arabic, typography and character tags to alphabet-arabic (#1643)
• Match brand-instagram size to other square brand icons (#1615)
• Fix square-dashed icon drawn as a solid square (#1614)
• Redraw square-dashed and table-dashed icons (#1640)
• Add squircle tag to all square-rounded icons (#1641)
• Webfont: Fix filled home webfont glyph having zero width in Chrome (#1616)
• Webfont: Fix sass and style fields in package.json to point to dist/, and stop publishing the intermediate SVG fonts, which the CSS never referenced (#1633)
• Webfont: Make webfont builds reproducible, so font files no longer change between builds of the same icons (#1624)
• Webfont: Drop the unused svgtofont dependency (#1620)
• Astro, Preact, React, React Native, SolidJS, Vue: Stop publishing source maps, which made up about 70% of the package size (#1634)
• Svelte, Svelte Runes: Add default export conditions and document per-icon imports (#1630)
• React Native: Stop passing extra props (testID, style, onPress, …) to every node of the icon, only the root Svg gets them. title is now exposed to screen readers via accessibility props (#1628)

Release 3.48.0

18 new icons:

• outline/duplicate
• outline/folder-ai
• outline/folder-sparkle
• outline/git-branch-check
• outline/git-branch-x

... (truncated)

Changelog

Sourced from @​tabler/icons-react's changelog.

3.49.0

Patch Changes

• #1634 9fba485 - Stop publishing source maps, which made up about 70% of the package size
• Updated dependencies [c3ca84f, c3ca84f, c3ca84f, c3ca84f, c3ca84f]:
  • @​tabler/icons@​3.49.0

Commits

• 009744c Release (#1647)
• 9659394 Run Angular tests in CI, add React Native tests and lint Vue, Svelte and Astr...
• 1d8fd55 Add ESLint and Prettier checks and clean up .build/helpers.mjs (#1623)
• 4a4054d Speed up declaration bundling for JS framework packages (#1618)
• 0239805 Release 3.48.0
• 87e7c39 Release 3.47.0
• bbb9bdb Run tests in CI, fix ReactSVG type rot, add type and RSC guards (#1579)
• 45a7ca8 Remove trailing space from the icon class attribute (#1582)
• 55f87a7 Refresh package READMEs: fix wrong props, broken links and inconsistent struc...
• 8ac7d81 Release 3.46.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tabler/icons-react since your current version.

Updates @tailwindcss/vite from 4.3.2 to 4.3.3

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.3

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
• Ensure CSS nesting is handl...

  Description has been truncated