[dependabot]

Bumps the production-dependencies group with 30 updates in the / directory:

Package	From	To
@testing-library/user-event	14.6.1	14.6.8
react	19.2.7	19.3.1
react-dom	19.2.7	19.3.1
@modelcontextprotocol/sdk	1.30.0	1.32.2
lucide-react	1.23.0	1.66.0
monaco-editor	0.55.1	0.57.0
next	16.3.6	16.4.3
recharts	3.9.2	3.10.1
zod	4.4.3	4.6.7
autoprefixer	10.5.2	10.6.2
@stylexjs/stylex	0.19.0	0.19.1
@stylexjs/babel-plugin	0.19.0	0.19.1
@stylexjs/postcss-plugin	0.19.0	0.19.1
vite	8.1.3	8.3.5
react-router-dom	7.18.4	7.18.5
unplugin	3.3.0	3.7.0
vega	6.2.0	6.4.0
vega-datasets	3.2.1	3.3.1
vega-lite	6.4.3	6.5.0
browserslist	4.28.4	4.29.5
lightningcss	1.32.0	1.33.0
ignore	7.0.5	7.0.14
jscodeshift	17.3.0	17.4.0
linkedom	0.18.14	0.18.15
postcss	8.5.25	8.5.32
postcss-selector-parser	7.1.6	7.1.7
recast	0.23.21	0.24.0
@testing-library/react	16.3.2	16.3.3
esbuild	0.28.1	0.28.2
prettier	3.9.4	3.9.10

Updates @testing-library/user-event from 14.6.1 to 14.6.8

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.8

14.6.8 (2026-10-13)

Bug Fixes

• treat programmatic null input values as empty string (#1329) (1951eb7)

v14.6.7

14.6.7 (2026-09-02)

Bug Fixes

• normalize DataTransfer format aliases (#1326) (1e0020b)
• feature: Add iframe support for user.keyboard typing (#1275) (1e0020b)

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

• default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

• tab retargeting if focus moved during keydown (#1296) (43efda7)

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

• keyboard event repeat property (#1312) (d7e80e3)

v14.6.3

14.6.3 (2026-08-03)

Bug Fixes

• release: manually release a patch version (#1321) (1d18b1f), closes #1317

v14.6.2

... (truncated)

Commits

• 1951eb7 fix: treat programmatic null input values as empty string (#1329)
• 1e0020b fix: normalize DataTransfer format aliases (#1326)
• d4b0593 feature: Add iframe support for user.keyboard typing (#1275)
• 71a5475 fix: default pointer event pointerType to empty string instead of the string ...
• 43efda7 fix: tab retargeting if focus moved during keydown (#1296)
• d7e80e3 fix: keyboard event repeat property (#1312)
• 43d8e6c ci: remove broken npm backfill step (#1322)
• 1d18b1f fix(release): manually release a patch version (#1321)
• 232f3e6 docs: add migration note and clean up README badges (#1320)
• 83e2b22 ci: remove deprecated CodeSandbox CI (#1318)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/user-event since your current version.

Updates react from 19.2.7 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #37113)
• Only remove properties from Host Singletons on release (@​gnoff #37112)

... (truncated)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• 2dc7da7 [test] Bump Jest to 30.4 (#37382)
• 4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
• dbc3750 Update required references to GitHub repo (#36752)
• 900ae09 [flow] Bump flow to v0.317.0 (#36701)
• fbb1370 [flow] Bump flow to v0.307.1 (#36199)
• 56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
• 74568e8 [Flight] Transport AggregateErrors.errors (#36156)
• e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
• db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
• Additional commits viewable in compare view

Updates react-dom from 19.2.7 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)

... (truncated)

Changelog

Sourced from react-dom's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651,

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
astryx	Error		Nov 8, 2026 6:57pm UTC

[astracat-bot]

AI review status for this pull request.

Review status	Updated
🟡 Reviewed (for maintainers only)	Nov 8, 2026, 7:10 PM UTC

[github-actions]

PR Analysis Report

🔎 Preview · 1760475

❌ The preview failed to build; see Vercel's comment.

Package size: measured; main has no measurement of the merge base to compare yet.

API changes: none in this pull request

Committed API report behind this build: cli 29 rows, core 35 rows, theme-butter 1 row, theme-y2k 1 row; run pnpm api:report.

Wide change (shared styles: packages/themes/butter/package.json, packages/themes/chocolate/package.json, packages/themes/gothic/package.json, and 4 more): add ci:run-visual, ci:run-a11y or ci:run-rtl to run them.

Current run: CI concluded failure; parts of this report may be missing.

---

_{Generated by PR Enrichment workflow | View full report}

[astracat-bot]

Changes requested: this dependency group fails several required checks and would raise a published peer range, so it needs follow-up commits before it can merge.

• @astryxdesign/build declares its optional vite peer as catalog:, so the catalog bump to ^8.3.5 would publish a higher floor than the current ^8.1.3, and an npm app on vite 8.2.x that upgrades the build package alone then fails with ERESOLVE; give the peer a literal ^8.1.3 range.
• The catalog moves the apps, the CLI and test-utils to @stylexjs/stylex 0.19.1 while Core, Lab, Charts and Richtext stay on 0.19.0, and the two copies fail typecheck (375 errors) and the docsite build; re-resolve the lockfile to a single StyleX version without changing Core's ^0.19.0 peer.
• Six core UI tests (the disabled and busy typed-text cases in DateInput.test.tsx and three cases in layerClickBoundary.test.tsx) pass on main and fail here under React 19.3.1, Testing Library 16.3.3 and user-event 14.6.8; find which update breaks them and fix it or hold it back.
• packages/cli moves its exact recast pin to 0.24.0 while the shadcn override stays at 0.23.21, and source-variants.test.mjs fails on that pin; keep 0.23.21, or move both pins together in a separate change.
• The dependency ranges of @astryxdesign/build, @astryxdesign/cli and the seven published themes change without a Changeset, so the required Changeset coverage check fails; add a [fix] Changeset that names those packages.

Splitting the React and Testing Library updates out of this group would let the remaining bumps land once the other four items are fixed.

[Automated review]

[astracat-bot]

packages/build/package.json declares its optional peer as "vite": "catalog:", so this line becomes the published peer range: ^8.1.3 today, ^8.3.5 after this change. An npm app on vite 8.1.3 to 8.3.4 that upgrades @astryxdesign/build alone then fails with ERESOLVE. Give the build package a literal "vite": "^8.1.3" peer so the workspace catalog can move on its own.

[astracat-bot]

This moves the catalog: consumers (apps, CLI, test-utils) to StyleX 0.19.1. Core, Lab, Charts and Richtext declare StyleX only as peers, so the lockfile keeps them on 0.19.0. The two copies fail typecheck with 375 StyleXStyles errors and break the docsite build. Re-resolve the lockfile so every importer gets one StyleX version, and keep Core's ^0.19.0 peer as it is.

[astracat-bot]

The shadcn@4.19.0>recast: 0.23.21 override in pnpm-workspace.yaml exists to keep this pin aligned with the stock shadcn printer, and packages/cli/authoring/shadcn/source-variants.test.mjs:89 asserts 0.23.21, so the required test check now fails. Keep 0.23.21 here, or move both pins together in a separate change.

[astracat-bot]

Changes requested: after the rebase this dependency group still raises a published peer range and fails required checks, so it needs follow-up commits before it can merge.

• @astryxdesign/build declares its optional vite peer as catalog:, so the catalog bump to ^8.3.5 would publish a higher floor than the released ^8.1.3, and an npm app on vite 8.2.x that upgrades the build package alone then fails with ERESOLVE; give the peer a literal ^8.1.3 range.
• The catalog moves the apps, the CLI, the build package and test-utils to @stylexjs/stylex 0.19.1 while Core, Lab, Charts and Richtext stay on 0.19.0, and the two copies fail the typecheck (376 errors) and the docsite build; re-resolve the lockfile to one StyleX version without changing Core's ^0.19.0 peer.
• Six core UI tests in DateInput.test.tsx and layerClickBoundary.test.tsx fail because user-event 14.6.8 resolves @testing-library/dom 10.4.2 while Core's Testing Library keeps 10.4.1, and with one copy all 164 pass on React 19.3.1; re-resolve the lockfile (for example pnpm dedupe) so one @testing-library/dom serves both.
• packages/cli moves its exact recast pin to 0.24.0 while the shadcn override stays at 0.23.21, so source-variants.test.mjs fails; keep 0.23.21, or move both pins together in a separate change.
• The dependency ranges of @astryxdesign/build, @astryxdesign/cli and the seven published themes change without a Changeset, so the required Changeset coverage check fails; add a [fix] Changeset that names those packages.

The redrawn calendar icon in every theme comes from lucide-react 1.66.0 and needs no change.

[Automated review]

[astracat-bot]

Root @testing-library/user-event 14.6.8 resolves @testing-library/dom 10.4.2, while Core's @testing-library/react 16.3.3 keeps 10.4.1, so user-event's events bypass the copy Testing Library configured and six core UI tests in DateInput.test.tsx and layerClickBoundary.test.tsx fail. With Core pointed at the 10.4.2 copy, all 164 pass on React 19.3.1. Re-resolve the lockfile (for example pnpm dedupe) so one @testing-library/dom serves both.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.