chore(deps): bump the npm-minor-patch group across 1 directory with 19 updates

[dependabot]

Bumps the npm-minor-patch group with 19 updates in the / directory:

Package	From	To
@modelcontextprotocol/client	2.0.0-alpha.2	2.1.0
@modelcontextprotocol/node	2.0.0-alpha.2	2.1.0
@modelcontextprotocol/server	2.0.0-alpha.2	2.1.0
lucide-react	1.18.0	1.48.0
react	19.2.7	19.3.0
@types/react	19.2.17	19.3.0
react-dom	19.2.7	19.3.0
@types/react-dom	19.2.3	19.3.0
zod	4.4.3	4.6.5
@playwright/test	1.61.1	1.63.0
@testing-library/react	16.3.2	16.3.3
@types/react	19.2.17	19.3.0
@types/react-dom	19.2.3	19.3.0
@vitejs/plugin-react	6.0.2	6.1.1
eslint	10.5.0	10.11.0
playwright	1.61.1	1.63.0
supertest	7.2.2	7.3.0
@types/supertest	7.2.0	7.2.1
tsx	4.22.4	4.23.15
typescript-eslint	8.61.1	8.70.1
vite	8.0.16	8.3.1

Updates @modelcontextprotocol/client from 2.0.0-alpha.2 to 2.1.0

Release notes

Sourced from @​modelcontextprotocol/client's releases.

@​modelcontextprotocol/client@​2.1.0

Minor Changes

• #2629 dcc0102 Thanks @​gbshankar! - Add DPoP (RFC 9449 / SEP-1932) sender-constrained access token support to the client.
  • Opt in by implementing OAuthClientProvider.dpop() returning a DpopSession (new, along with generateDpopKeyPair, accessTokenHash, isDpopNonceChallenge). auth() / exchangeAuthorization / refreshAuthorization / fetchToken then sign a DPoP proof into token requests (retrying once on an authorization-server use_dpop_nonce challenge, with client authentication re-applied per attempt), and StreamableHTTPClientTransport, SSEClientTransport and withOAuth present a token_type: "DPoP" access token as Authorization: DPoP <token> plus a fresh per-request proof, retry a resource-server use_dpop_nonce challenge once, and pick up a DPoP-Nonce delivered on any response. Tokens the AS issued as Bearer are still presented as Bearer.
  • DPoP is applied at the fetch layer: the transports wrap their resource-server fetch (including a caller-supplied fetch / eventSourceInit.fetch) with the new withDpopFromProvider(provider) middleware, so proofs are always bound to the request actually sent. withDpop(session, getToken) is exported for callers that manage tokens themselves (e.g. alongside a minimal AuthProvider); the AuthProvider interface itself is unchanged.
  • auth() now recovers from invalid_dpop_proof on refresh (e.g. a refresh token bound to a key that is no longer held) by discarding the tokens and re-authorizing, like invalid_grant. OAuthErrorCode gains InvalidDpopProof and UseDpopNonce; extractWWWAuthenticateParams recognizes the DPoP challenge scheme; OAuthMetadataSchema gains dpop_signing_alg_values_supported.

Patch Changes

• #2726 6fa4227 Thanks @​LuckTerence! - SdkError and SdkHttpError accept standard ErrorOptions as an optional fourth constructor argument and forward it to Error, so a wrapped error is reachable through the standard Error.cause chain. Version-negotiation probe failures (SdkErrorCode.EraNegotiationFailed) now use it: the underlying TypeError: fetch failed and the DNS or socket error beneath it surface via error.cause, so pino, Sentry, and util.inspect render ENOTFOUND / ECONNREFUSED / ETIMEDOUT instead of stopping at the SdkError (#2657). The previous error.data.cause slot is still populated for compatibility but is deprecated and slated for removal; read error.cause instead.

• #2654 03842cd Thanks @​pshah19! - Treat request id 0 as a real id. Two guards tested a RequestId for truthiness, so the legal JSON-RPC ids 0 and '' were read as absent. Id 0 is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first sampling/createMessage, elicitation/create, or roots/list a server sends.

  • notifications/cancelled carrying id 0 was ignored, and the in-flight handler ran to completion with its AbortSignal never fired.
  • A notification sent with relatedRequestId: 0 wrongly passed the debounce gate (for methods opted into debouncedNotificationMethods). Because the pending set is keyed by method alone, a second such notification in the same tick was silently dropped rather than sent.

  Absent is now the only value that means "no id".

• #2043 c4248a9 Thanks @​ChrisJr404! - On Windows, stdio servers spawned by StdioClientTransport now also inherit COMSPEC, PATHEXT, PROGRAMDATA, PROGRAMFILES(X86), PROGRAMW6432, and WINDIR (added to DEFAULT_INHERITED_ENV_VARS). Programs a server launches can depend on them: PowerShell finds no native executables without PATHEXT, and Windows OpenSSH exits 255 without ProgramData.

• #2668 3e90449 Thanks @​KKonstantinov! - Stop sending notifications/cancelled for the initialize handshake. The spec is explicit that a client MUST NOT attempt to cancel its initialize request, but the outbound cancel path fired for any in-flight request: aborting the AbortSignal passed to connect(), or letting the handshake hit its timeout, put a forbidden cancellation on the wire naming the initialize request id.

  The local behaviour is unchanged — the caller's promise still rejects with the same abort/timeout error, and connect() still tears the connection down. Only the wire notification is suppressed. Every other method keeps the existing cancellation path.

• #2475 b654261 Thanks @​sanjibani! - StreamableHTTPClientTransport and SSEClientTransport now give their transport-managed headers precedence over same-named entries in requestInit.headers: Authorization when authProvider yields a token, mcp-protocol-version, and (Streamable HTTP) mcp-session-id. Header names compare case-insensitively and every HeadersInit form is covered (plain object, tuple array, Headers instance). Previously the caller-supplied value won, so a static Authorization placeholder (e.g. an env-var API key) kept overriding the OAuth token even after the provider obtained one and the fallback-to-OAuth flow never completed; a Headers instance or lowercase key produced a combined Bearer <fresh>, Bearer <stale> value instead. A configured Authorization is still sent while the provider has no token, and other configured headers pass through unchanged. Closes #2208.

• #2581 5119ee7 Thanks @​hugosmoreira! - Preserve the exact OAuth resource indicator from protected resource metadata when building authorization and token requests. Previously a pathless resource such as https://example.com was normalized to https://example.com/ via URL.href, which breaks authorization servers that require the resource parameter to match the published value exactly (Microsoft Entra ID rejects it with AADSTS9010010). The exported OAuth helpers (startAuthorization, exchangeAuthorization, refreshAuthorization, fetchToken, executeTokenRequest) now also accept a string for resource; selectResourceURL still returns a URL, and a provider's validateResourceURL result is used unchanged. Fixes #1968.

• 3924de9 - Let saveTokens failures surface after a successful token refresh. In auth(), one try wrapped both refreshAuthorization() and the provider.saveTokens() that persists its result, and the catch deliberately swallows anything that is not an OAuthError — plus ServerError — so that a failed refresh falls through to a fresh authorization request. A persistence error thrown by the provider landed in that same branch: it was discarded with no log and no rethrow, and auth() continued to startAuthorization() and returned 'REDIRECT'.

  Against an authorization server that rotates refresh tokens (the OAuth 2.1 default, and Keycloak's) this loses credentials rather than merely hiding an error. The exchange has already succeeded server-side, so the old refresh token is invalidated at the moment the new one is issued; dropping the new token set leaves nothing usable on either side. On a headless or CLI client, where redirectToAuthorization is typically a no-op, the fallthrough is silent and the client is left with stale tokens and no indication of why.

  The try/catch now covers only refreshAuthorization(). Persisting the result happens after it, on an unguarded path, so a provider's I/O error propagates to the caller.

  Refresh-request failures keep their existing control flow exactly: a ServerError or an unknown error still falls through to a new authorization flow, a non-ServerError OAuthError is still rethrown, and InsecureTokenEndpointError is still surfaced. The SEP-2352 issuer stamp written with the refreshed tokens is unchanged.

... (truncated)

Commits

• 9517506 Version Packages (#2808)
• 6a05402 fix(server): close StdioServerTransport when stdin ends or closes (#2494)
• c4248a9 fix(client): add missing Windows env vars to DEFAULT_INHERITED_ENV_VARS (#2043)
• 0b403f0 chore(changesets): only bump peer dependents when out of range (#2819)
• 6032170 feat(server): add request-time OAuth scope challenges (#1624)
• b654261 fix(client): let OAuth-derived Authorization override caller-supplied header ...
• 5ecc791 fix(codemod): only count real module specifiers in project-type inference (#2...
• 5119ee7 fix: preserve exact OAuth resource indicators (#2581)
• 6fa4227 fix(client): surface underlying network error via Error.cause on probe failur...
• dcc0102 feat(client): add DPoP (RFC 9449) sender-constrained token support (#2629)
• Additional commits viewable in compare view

Updates @modelcontextprotocol/node from 2.0.0-alpha.2 to 2.1.0

Release notes

Sourced from @​modelcontextprotocol/node's releases.

@​modelcontextprotocol/node@​2.1.0

Minor Changes

• #1624 6032170 Thanks @​SamMorrowDrums! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient_scope response. requireScopes provides a small helper for static all-of checks.

  createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient_scope challenge before handler execution or SSE setup. The preflight is active whenever a registered primitive carries a scopeChallenge callback — there is no handler- or transport-level configuration. The challenge's WWW-Authenticate header is built by the same formatter as the bearer-auth 401/403 answers, and its resource_metadata parameter is derived from the verified AuthInfo: requireBearerAuth / verifyBearerToken now stamp their configured resourceMetadataUrl onto the AuthInfo they return (new optional AuthInfo.resourceMetadataUrl field), with a fallback to the well-known location for an HTTP(S) RFC 8707 resource identifier; the parameter is omitted when neither is available.

Patch Changes

• #2698 7b781ed Thanks @​maxisbey! - Read Streamable HTTP request bodies with a size limit. Every SDK-owned body read — WebStandardStreamableHTTPServerTransport (and the Node transport built on it), createMcpHandler, toNodeHandler, and createMcpHonoApp's JSON pre-parse — now stops at 4 MiB by default (the limit the legacy SSE transport already uses; the Express adapter and stdio bound their reads too) and answers 413 Payload Too Large before anything is parsed. toWebRequest (when it reads the Node stream itself) now rejects once the body exceeds the limit with an error whose name is 'RequestBodyTooLargeError' and status is 413, and toNodeHandler answers that with 413; hand-wired callers of toWebRequest should handle the rejection or pass a pre-parsed body, and isLegacyRequest reports such a request as non-legacy so the modern handler answers it. JSON-RPC batch arrays are limited to 100 messages; a longer batch is answered 400 / -32600 and none of it is dispatched.

  The limit is configurable with a new maxRequestBodySize option (bytes, default DEFAULT_MAX_REQUEST_BODY_SIZE = 4 MiB, exported from @modelcontextprotocol/server) on WebStandardStreamableHTTPServerTransportOptions, CreateMcpHandlerOptions (forwarded to its stateless legacy leg; isLegacyRequest and legacyStatelessFallback take the same option), CreateMcpHonoAppOptions, and ToNodeHandlerOptions / ToWebRequestOptions (the adapter's bound applies before the handler's, so raise both). The bounded reader is exported as readRequestBody for adapter authors. Hosts that pre-parse the body and pass it as parsedBody skip the SDK's read and its size limit entirely; the batch bound applies either way.

  createMcpHonoApp and createMcpExpressApp now run their Host/Origin validation before the JSON body parser, so a request from a disallowed Host or Origin with an invalid JSON body is answered 403 rather than 400, and its body is not read.

• Updated dependencies [6fa4227, 03842cd, 3e90449, 7b781ed, 75dc7ea, 6032170, 6a05402, 70de0c8]:

  • @​modelcontextprotocol/server@​2.1.0

... (truncated)

Commits

• 9517506 Version Packages (#2808)
• 6a05402 fix(server): close StdioServerTransport when stdin ends or closes (#2494)
• c4248a9 fix(client): add missing Windows env vars to DEFAULT_INHERITED_ENV_VARS (#2043)
• 0b403f0 chore(changesets): only bump peer dependents when out of range (#2819)
• 6032170 feat(server): add request-time OAuth scope challenges (#1624)
• b654261 fix(client): let OAuth-derived Authorization override caller-supplied header ...
• 5ecc791 fix(codemod): only count real module specifiers in project-type inference (#2...
• 5119ee7 fix: preserve exact OAuth resource indicators (#2581)
• 6fa4227 fix(client): surface underlying network error via Error.cause on probe failur...
• dcc0102 feat(client): add DPoP (RFC 9449) sender-constrained token support (#2629)
• Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.0.0-alpha.2 to 2.1.0

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.1.0

Patch Changes

• Updated dependencies [dcc0102]:
  • @​modelcontextprotocol/core@​2.1.0

@​modelcontextprotocol/server@​2.1.0

Minor Changes

• #1624 6032170 Thanks @​SamMorrowDrums! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient_scope response. requireScopes provides a small helper for static all-of checks.

  createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient_scope challenge before handler execution or SSE setup. The preflight is active whenever a registered primitive carries a scopeChallenge callback — there is no handler- or transport-level configuration. The challenge's WWW-Authenticate header is built by the same formatter as the bearer-auth 401/403 answers, and its resource_metadata parameter is derived from the verified AuthInfo: requireBearerAuth / verifyBearerToken now stamp their configured resourceMetadataUrl onto the AuthInfo they return (new optional AuthInfo.resourceMetadataUrl field), with a fallback to the well-known location for an HTTP(S) RFC 8707 resource identifier; the parameter is omitted when neither is available.

Patch Changes

• #2726 6fa4227 Thanks @​LuckTerence! - SdkError and SdkHttpError accept standard ErrorOptions as an optional fourth constructor argument and forward it to Error, so a wrapped error is reachable through the standard Error.cause chain. Version-negotiation probe failures (SdkErrorCode.EraNegotiationFailed) now use it: the underlying TypeError: fetch failed and the DNS or socket error beneath it surface via error.cause, so pino, Sentry, and util.inspect render ENOTFOUND / ECONNREFUSED / ETIMEDOUT instead of stopping at the SdkError (#2657). The previous error.data.cause slot is still populated for compatibility but is deprecated and slated for removal; read error.cause instead.

• #2654 03842cd Thanks @​pshah19! - Treat request id 0 as a real id. Two guards tested a RequestId for truthiness, so the legal JSON-RPC ids 0 and '' were read as absent. Id 0 is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first sampling/createMessage, elicitation/create, or roots/list a server sends.

  • notifications/cancelled carrying id 0 was ignored, and the in-flight handler ran to completion with its AbortSignal never fired.
  • A notification sent with relatedRequestId: 0 wrongly passed the debounce gate (for methods opted into debouncedNotificationMethods). Because the pending set is keyed by method alone, a second such notification in the same tick was silently dropped rather than sent.

  Absent is now the only value that means "no id".

• #2668 3e90449 Thanks @​KKonstantinov! - Stop sending notifications/cancelled for the initialize handshake. The spec is explicit that a client MUST NOT attempt to cancel its initialize request, but the outbound cancel path fired for any in-flight request: aborting the AbortSignal passed to connect(), or letting the handshake hit its timeout, put a forbidden cancellation on the wire naming the initialize request id.

  The local behaviour is unchanged — the caller's promise still rejects with the same abort/timeout error, and connect() still tears the connection down. Only the wire notification is suppressed. Every other method keeps the existing cancellation path.

• #2698 7b781ed Thanks @​maxisbey! - Read Streamable HTTP request bodies with a size limit. Every SDK-owned body read — WebStandardStreamableHTTPServerTransport (and the Node transport built on it), createMcpHandler, toNodeHandler, and createMcpHonoApp's JSON pre-parse — now stops at 4 MiB by default (the limit the legacy SSE transport already uses; the Express adapter and stdio bound their reads too) and answers 413 Payload Too Large before anything is parsed. toWebRequest (when it reads the Node stream itself) now rejects once the body exceeds the limit with an error whose name is 'RequestBodyTooLargeError' and status is 413, and toNodeHandler answers that with 413; hand-wired callers of toWebRequest should handle the rejection or pass a pre-parsed body, and isLegacyRequest reports such a request as non-legacy

... (truncated)

Commits

• 9517506 Version Packages (#2808)
• 6a05402 fix(server): close StdioServerTransport when stdin ends or closes (#2494)
• c4248a9 fix(client): add missing Windows env vars to DEFAULT_INHERITED_ENV_VARS (#2043)
• 0b403f0 chore(changesets): only bump peer dependents when out of range (#2819)
• 6032170 feat(server): add request-time OAuth scope challenges (#1624)
• b654261 fix(client): let OAuth-derived Authorization override caller-supplied header ...
• 5ecc791 fix(codemod): only count real module specifiers in project-type inference (#2...
• 5119ee7 fix: preserve exact OAuth resource indicators (#2581)
• 6fa4227 fix(client): surface underlying network error via Error.cause on probe failur...
• dcc0102 feat(client): add DPoP (RFC 9449) sender-constrained token support (#2629)
• Additional commits viewable in compare view

Updates lucide-react from 1.18.0 to 1.48.0

Release notes

Sourced from lucide-react's releases.

Version 1.48.0

What's Changed

• feat(icons): added briefcase-plus icon by @​tylerkade in lucide-icons/lucide#4757
• feat(icons): added square-sparkles icon by @​nananecy in lucide-icons/lucide#3610
• feat(icons): added line-dot-left-horizontal icon by @​nathan-de-pachtere in lucide-icons/lucide#3855
• fix(packages/svelte,solid): fix shared type imports in Solid and Svelte by @​karsa-mistmere in lucide-icons/lucide#4846
• chore(deps-dev): bump react-native from 0.76.9 to 0.87.1 in the react-native-deps group across 1 directory by @​dependabot[bot] in lucide-icons/lucide#4673
• feat(packages): export __iconNode data across framework packages by @​lx3133584 in lucide-icons/lucide#4761
• fix(icons): Tweak card-sim chip by @​danielbayley in lucide-icons/lucide#3649
• feat(icons): added line-dot-top-vertical icon by @​nathan-de-pachtere in lucide-icons/lucide#3856
• feat(icons): added line-dot-bottom-vertical icon by @​nathan-de-pachtere in lucide-icons/lucide#3857
• fix(packages/react-native): pass testID to the rendered Svg element by @​OlegBezr in lucide-icons/lucide#4881
• chore(@​lucide/vue): Fix types @lucide/vue package and added workflow for it. by @​ericfennis in lucide-icons/lucide#4883
• test(packages/shared): cover buildLucideIconForReact by @​vugarbbakhishov-hub in lucide-icons/lucide#4872
• feat(site): Better icon detail page and add unreleased flag by @​ericfennis in lucide-icons/lucide#4877
• fix(icons): changed map-pinned icon by @​jguddas in lucide-icons/lucide#4880
• fix(icons): changed mail-pen by @​karsa-mistmere in lucide-icons/lucide#4899
• chore(deps-dev): bump the angular-deps group across 1 directory with 14 updates by @​dependabot[bot] in lucide-icons/lucide#4895
• chore(deps): bump the vue-deps group with 3 updates by @​dependabot[bot] in lucide-icons/lucide#4893
• chore(typchecking): More typecheck jobs for all packages by @​ericfennis in lucide-icons/lucide#4885
• feat(icons): add house-cog icon by @​ajaxjiang96 in lucide-icons/lucide#4904

New Contributors

• @​nananecy made their first contribution in lucide-icons/lucide#3610
• @​OlegBezr made their first contribution in lucide-icons/lucide#4881
• @​vugarbbakhishov-hub made their first contribution in lucide-icons/lucide#4872
• @​ajaxjiang96 made their first contribution in lucide-icons/lucide#4904

Full Changelog: lucide-icons/lucide@1.47.0...1.48.0

Version 1.47.0

What's Changed

• feat(icons): add lambda icon by @​UbaidUllah9962 in lucide-icons/lucide#4017
• feat(icons): delegated faucet icon from lab by @​karsa-mistmere in lucide-icons/lucide#4764
• feat(icons): added door-closed-package icon by @​karsa-mistmere in lucide-icons/lucide#4814
• feat(icons): added 'nepali-rupee' icon by @​sarajdhakal in lucide-icons/lucide#4608
• feat(icons): added tube-lotion icon by @​AlecRust in lucide-icons/lucide#4029
• feat(icons): Added cupcake icon by @​briz123 in lucide-icons/lucide#3000
• feat(icons): added square-dashed-x icon by @​EthanHazel in lucide-icons/lucide#4535
• feat(icons): add rotate-cw-clock icon by @​gkkconan in lucide-icons/lucide#3979
• fix(icons): remove path from save-off by @​HPRILLER in lucide-icons/lucide#4848
• fix(icons): changed calendar-chevrons-right by @​karsa-mistmere in lucide-icons/lucide#4865
• fix(icons): changed broccoli icon by @​jguddas in lucide-icons/lucide#4871
• feat(icons): added square-dashed-plus by @​psjdev in lucide-icons/lucide#4849

New Contributors

• @​UbaidUllah9962 made their first contribution in lucide-icons/lucide#4017
• @​sarajdhakal made their first contribution in lucide-icons/lucide#4608
• @​AlecRust made their first contribution in lucide-icons/lucide#4029
• @​gkkconan made their first contribution in lucide-icons/lucide#3979

... (truncated)

Commits

• f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
• 94e4cb9 chore(dependencies): Update dependencies (#4806)
• 99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
• 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
• 0f8d48b test(packages): updates unit test snapshots with face-slightly-smiling (#4676)
• f229f83 chore(depedencies): Update dependencies (#4553)
• 5ff536e ci(release.yml): Fix workflow and remove version scripts in package scripts...
• See full diff in compare view

Updates react from 19.2.7 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent meta...

    Description has been truncated

[dependabot]

Labels

The following labels could not be found: security. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.