chore(deps): bump the minor-and-patch group across 1 directory with 44 updates

[dependabot]

Bumps the minor-and-patch group with 42 updates in the /web directory:

Package	From	To
@aws-sdk/client-s3	3.1018.0	3.1050.0
@aws-sdk/s3-request-presigner	3.1018.0	3.1050.0
@codemirror/autocomplete	6.20.1	6.20.2
@codemirror/language	6.12.2	6.12.3
@codemirror/lint	6.9.5	6.9.6
@codemirror/search	6.6.0	6.7.0
@jupyterlab/services	7.5.6	7.5.7
@react-three/fiber	9.5.0	9.6.1
@tanstack/react-virtual	3.13.23	3.13.24
@webcontainer/api	1.6.1	1.6.4
ag-grid-community	35.1.0	35.3.0
ag-grid-react	35.1.0	35.3.0
codemirror-lang-latex	0.2.0	0.4.1
date-fns	4.1.0	4.2.1
dompurify	3.3.3	3.4.5
framer-motion	12.38.0	12.39.0
immer	11.1.4	11.1.8
katex	0.16.43	0.16.47
lucide-react	1.6.0	1.16.0
next	16.2.1	16.2.6
openai	6.32.0	6.38.0
plotly.js-dist-min	3.4.0	3.5.1
react	19.2.4	19.2.6
@types/react	19.2.14	19.2.15
react-dom	19.2.4	19.2.6
react-icons	5.5.0	5.6.0
tailwind-merge	3.5.0	3.6.0
three	0.183.2	0.184.0
ws	8.20.0	8.20.1
zod	4.3.6	4.4.3
zustand	5.0.12	5.0.13
@playwright/test	1.58.2	1.60.0
@tailwindcss/postcss	4.2.1	4.3.0
@types/node	25.5.0	25.9.1
dotenv	17.3.1	17.4.2
eslint	10.0.3	10.4.0
eslint-config-next	16.2.1	16.2.6
jsdom	29.0.1	29.1.1
prettier	3.8.1	3.8.3
prettier-plugin-tailwindcss	0.7.2	0.8.0
tsx	4.21.0	4.22.3
vitest	4.1.2	4.1.7

Updates @aws-sdk/client-s3 from 3.1018.0 to 3.1050.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1050.0

3.1050.0(2026-05-19)

New Features

• clients: update client endpoints as of 2026-05-19 (9a5e6f03)
• client-sagemaker: Add support for ml.p5.4xlarge and ml.p5en.48xlarge instances on SageMaker Notebook Instances Platform. (73a3e28f)
• client-grafana: Introduce degraded workspace status as a possible Amazon Managed Grafana workspace status, and a new field named degraded workspace reason which informs customers why the workspace is degraded in the DescribeWorkspace API response. (af49cb81)
• client-rtbfabric: This release is to deprecate 'inboundLinksCount' field in GetResponderGateway response and introduce the new field 'linksRequestedCount' to replace it. (3c9765e3)
• client-devops-agent: Added a new serviceType mcpserversigv4 service and association. This provides feature to register MCP sigv4 authorization based MCPs (84e18e58)
• client-guardduty: Adding support for exposure and vulnerability context from AWS Security Hub in GuardDuty Extended Threat Detection attack sequence findings. (de2356de)
• client-bedrock-agentcore: Add RetryableConflictException (HTTP 409) to InvokeAgentRuntime and StopRuntimeSession to prevent orphaned VMs during concurrent session access. The SDK automatically retries this exception with backoff. Enforcement is not yet active and will be enabled in a future service update. (239af13e)

Tests

• lib-storage: speed up lib-storage e2e tests by reducing permutations (#8028) (273afd4e)

---

For list of updated packages, view updated-packages.md in assets-3.1050.0.zip

v3.1049.0

3.1049.0(2026-05-18)

Documentation Changes

• client-evs: Amazon EVS now supports up to 32 hosts per EVS environment, increasing the previous host limit to allow a larger scale of VMware workload deployments and reduce operational overhead. (34718dc5)

New Features

• clients: update client endpoints as of 2026-05-18 (a5f4e2a2)
• client-ec2: Amazon VPC IP Address Manager (IPAM) now supports tags on IPAM pool allocations, enabling all standard tagging features for allocations including tag-on-create. (0ac6d448)
• client-accessanalyzer: Services manage service-linked analyzers through dedicated APIs - CreateServiceLinkedAnalyzer and DeleteServiceLinkedAnalyzer that separate service-linked specific operations from customer-managed operations. It also shows up in ListAnalyzers and GetAnalyzer responses. (fdfcbe80)
• client-ecs: Amazon ECS now supports Pause lifecycle hooks for service deployments, allowing customers to automatically pause deployments at specified stages and use the new ContinueServiceDeployment API to continue or roll back with confidence. (8437bd6c)
• client-connect: Amazon Connect Cases now supports SLA durations of up to 2 years (1,051,200 minutes), increased from the previous maximum of 90 days (129,600 minutes). This enables you to track long-running service level agreements for cases that require extended resolution timelines. (045e1382)
• client-ivs: Adds support for up to 3 mediaTailorPlaybackConfiguration objects in an ad configuration resource (e7a59d85)
• client-quicksight: Support for dataset enrichment and geo spatial in new data preparation experience (c3036698)

Bug Fixes

• core/protocols: make error namespace removal unconditional in JSON RPC (#8031) (7cee4f27)
• client-sts: update imports to new module locations (#8025) (be183b6d)

---

For list of updated packages, view updated-packages.md in assets-3.1049.0.zip

v3.1048.0

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1050.0 (2026-05-19)

Note: Version bump only for package @​aws-sdk/client-s3

3.1049.0 (2026-05-18)

Bug Fixes

• client-sts: update imports to new module locations (#8025) (be183b6)

3.1048.0 (2026-05-15)

Note: Version bump only for package @​aws-sdk/client-s3

3.1047.0 (2026-05-14)

Note: Version bump only for package @​aws-sdk/client-s3

3.1046.0 (2026-05-14)

Note: Version bump only for package @​aws-sdk/client-s3

3.1045.0 (2026-05-07)

Note: Version bump only for package @​aws-sdk/client-s3

... (truncated)

Commits

• bdc9fc6 Publish v3.1050.0
• 04d52f3 Publish v3.1049.0
• be183b6 fix(client-sts): update imports to new module locations (#8025)
• 313813d Publish v3.1048.0
• 1af9047 chore(codegen): updated import sources for aws-sdk core (#8015)
• eabae7d chore(codegen): sync for browser bundle fixes (#8022)
• 8edb907 Publish v3.1047.0
• a664335 Publish v3.1046.0
• 9ce20f6 chore(codegen): dependency version bump (#8008)
• acffbf9 chore: update smithy/core imports (#7979)
• Additional commits viewable in compare view

Updates @aws-sdk/s3-request-presigner from 3.1018.0 to 3.1050.0

Release notes

Sourced from @​aws-sdk/s3-request-presigner's releases.

v3.1050.0

3.1050.0(2026-05-19)

New Features

• clients: update client endpoints as of 2026-05-19 (9a5e6f03)
• client-sagemaker: Add support for ml.p5.4xlarge and ml.p5en.48xlarge instances on SageMaker Notebook Instances Platform. (73a3e28f)
• client-grafana: Introduce degraded workspace status as a possible Amazon Managed Grafana workspace status, and a new field named degraded workspace reason which informs customers why the workspace is degraded in the DescribeWorkspace API response. (af49cb81)
• client-rtbfabric: This release is to deprecate 'inboundLinksCount' field in GetResponderGateway response and introduce the new field 'linksRequestedCount' to replace it. (3c9765e3)
• client-devops-agent: Added a new serviceType mcpserversigv4 service and association. This provides feature to register MCP sigv4 authorization based MCPs (84e18e58)
• client-guardduty: Adding support for exposure and vulnerability context from AWS Security Hub in GuardDuty Extended Threat Detection attack sequence findings. (de2356de)
• client-bedrock-agentcore: Add RetryableConflictException (HTTP 409) to InvokeAgentRuntime and StopRuntimeSession to prevent orphaned VMs during concurrent session access. The SDK automatically retries this exception with backoff. Enforcement is not yet active and will be enabled in a future service update. (239af13e)

Tests

• lib-storage: speed up lib-storage e2e tests by reducing permutations (#8028) (273afd4e)

---

For list of updated packages, view updated-packages.md in assets-3.1050.0.zip

v3.1049.0

3.1049.0(2026-05-18)

Documentation Changes

• client-evs: Amazon EVS now supports up to 32 hosts per EVS environment, increasing the previous host limit to allow a larger scale of VMware workload deployments and reduce operational overhead. (34718dc5)

New Features

• clients: update client endpoints as of 2026-05-18 (a5f4e2a2)
• client-ec2: Amazon VPC IP Address Manager (IPAM) now supports tags on IPAM pool allocations, enabling all standard tagging features for allocations including tag-on-create. (0ac6d448)
• client-accessanalyzer: Services manage service-linked analyzers through dedicated APIs - CreateServiceLinkedAnalyzer and DeleteServiceLinkedAnalyzer that separate service-linked specific operations from customer-managed operations. It also shows up in ListAnalyzers and GetAnalyzer responses. (fdfcbe80)
• client-ecs: Amazon ECS now supports Pause lifecycle hooks for service deployments, allowing customers to automatically pause deployments at specified stages and use the new ContinueServiceDeployment API to continue or roll back with confidence. (8437bd6c)
• client-connect: Amazon Connect Cases now supports SLA durations of up to 2 years (1,051,200 minutes), increased from the previous maximum of 90 days (129,600 minutes). This enables you to track long-running service level agreements for cases that require extended resolution timelines. (045e1382)
• client-ivs: Adds support for up to 3 mediaTailorPlaybackConfiguration objects in an ad configuration resource (e7a59d85)
• client-quicksight: Support for dataset enrichment and geo spatial in new data preparation experience (c3036698)

Bug Fixes

• core/protocols: make error namespace removal unconditional in JSON RPC (#8031) (7cee4f27)
• client-sts: update imports to new module locations (#8025) (be183b6d)

---

For list of updated packages, view updated-packages.md in assets-3.1049.0.zip

v3.1048.0

... (truncated)

Changelog

Sourced from @​aws-sdk/s3-request-presigner's changelog.

3.1050.0 (2026-05-19)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1049.0 (2026-05-18)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1048.0 (2026-05-15)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1047.0 (2026-05-14)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1046.0 (2026-05-14)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1045.0 (2026-05-07)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1044.0 (2026-05-06)

... (truncated)

Commits

• bdc9fc6 Publish v3.1050.0
• 04d52f3 Publish v3.1049.0
• 313813d Publish v3.1048.0
• 901b75a chore(packages): update import paths (#8024)
• eabae7d chore(codegen): sync for browser bundle fixes (#8022)
• 8edb907 Publish v3.1047.0
• a664335 Publish v3.1046.0
• 6a0f061 chore(core/util): migrate minor utility functions to core (#8007)
• 9ce20f6 chore(codegen): dependency version bump (#8008)
• acffbf9 chore: update smithy/core imports (#7979)
• Additional commits viewable in compare view

Updates @codemirror/autocomplete from 6.20.1 to 6.20.2

Commits

• See full diff in compare view

Updates @codemirror/language from 6.12.2 to 6.12.3

Changelog

Sourced from @​codemirror/language's changelog.

6.12.3 (2026-03-25)

Bug fixes

Fix a crash in bracketMatching when composing at end of document.

Commits

• f5af31e Mark version 6.12.3
• 371c9ba Fix bogus bracket highlighting being generated at end of document
• 9531899 Remove duplicated slash in forum url in README
• 2f4e701 Fix forum link in readme
• See full diff in compare view

Updates @codemirror/lint from 6.9.5 to 6.9.6

Commits

• See full diff in compare view

Updates @codemirror/search from 6.6.0 to 6.7.0

Commits

• See full diff in compare view

Updates @codemirror/view from 6.40.0 to 6.43.0

Changelog

Sourced from @​codemirror/view's changelog.

6.41.0 (2026-04-01)

Bug fixes

Fix an issue where EditorView.posAtCoords could incorrectly return a position near a higher element on the line, in mixed-font-size lines.

Expand the workaround for the Webkit bug that causes nonexistent selections to stay visible to be active on non-Safari Webkit browsers.

New features

The new EditorView.cursorScrollMargin facet can now be used to configure the extra space used when scrolling the cursor into view.

Commits

• See full diff in compare view

Updates @jupyterlab/services from 7.5.6 to 7.5.7

Commits

• f514041 [ci skip] Publish 4.5.7
• 66fe9ad Backport PR #18652 on branch 4.5.x (Video and Audio Content Providers: Fix Ju...
• f4455fa Fix syntax for Python 3.9 on 4.5.x branch (#18817)
• d2322b5 Backport PR #18819 on branch 4.5.x (Fix linting issue) (#18820)
• 5d9cb8c Merge commit from fork
• 1de120b Merge commit from fork
• 6926100 Backport PR #18808 on branch 4.5.x (Fix notebook hang when dropping cells) (#...
• 67e6e88 Backport PR #18647 on branch 4.5.x (Update default font family to honor macOS...
• bf21eb9 Backport PR #18747 on branch 4.5.x (Fix Contextual Help keyboard shortcut rel...
• 73cafa5 Backport PR #18788 on branch 4.5.x (Fix name of option for extension manager ...
• Additional commits viewable in compare view

Updates @react-three/fiber from 9.5.0 to 9.6.1

Release notes

Sourced from @​react-three/fiber's releases.

v9.6.1

What's Changed

• fix: Seamlessly transfer interactivity state when swapping instances (#3743) by @​notrabs in pmndrs/react-three-fiber#3744

Full Changelog: pmndrs/react-three-fiber@v9.6.0...v9.6.1

v9.6.0 - Sunset X

Ever tried using <shaderMaterial uniforms={{ time: { value: time } }} /> and ran into immediate issues with desync? No more.

The uniforms objects on ShaderMaterial and its derivatives now have a stable reference. Objects passed into uniforms will instead copy into it. This is the same as behavior for math structures that have copy such as position, rotation, quaternion, etc. and ends up simplifying using the raw JSX where utilities were often introduced before.

Why does this matter?

1. Improves HMR. Even if you memoize the uniforms object it will still regenerate and desync Three. Now this won't happen. But also it makes compatibility with React compiler more complete with its auto-memoization.

2. Allows for inline uniform props and even prop uniforms directly on the material piercing.

<shaderMaterial
  vertexShader={vertexShader}
  fragmentShader={fragmentShader}
  // The uniforms object has a stable reference so objects can be safely merged in
  uniforms={{ 
    uTime: { value: 0 }, 
    uColor: { value: new THREE.Color('hotpink') } 
  }}
  // Individual uniforms can also be safely updated with pierce notation
  uniforms-uColor-value={hovered ? 'royalblue' : 'hotpink'}
/>

Documentation can be found here: https://r3f.docs.pmnd.rs/api/objects#shader-material-uniforms

And an example can be found here: https://github.com/pmndrs/react-three-fiber/blob/master/example/src/demos/ShaderMaterial.tsx

What's Changed

• fix: Fix broken link on "Performance pitfalls" documentation page by @​simonKristensen in pmndrs/react-three-fiber#3700
• fix: uniforms have stable refs for ShaderMaterial by @​krispya in pmndrs/react-three-fiber#3715
• docs: fix typos and documentation consistency by @​NssGourav in pmndrs/react-three-fiber#3709

New Contributors

• @​simonKristensen made their first contribution in pmndrs/react-three-fiber#3700
• @​NssGourav made their first contribution in pmndrs/react-three-fiber#3709

Full Changelog: pmndrs/react-three-fiber@v9.5.0...v9.6.0

Commits

• 2a52874 RELEASING: Releasing 1 package(s)
• b645741 docs(changeset): fix: Seamlessly transfer interactivity state when swapping i...
• 119668f fix: Seamlessly transfer interactivity state when swapping instances (#3744)
• 943a37e Merge pull request #3738 from pmndrs:chore/simplify-shadermaterial-demo
• 1be9504 chore: Add uniform piercing test
• 4df10c0 chore: Simplify ShaderMaterial demo
• 877c839 chore: Move ShaderMaterial uniform notes to objects out of pitfalls (#3734)
• 47d30ba chore: Move ShaderMaterial uniform notes to objects out of pitfalls
• ece1a3f RELEASING: Releasing 1 package(s)
• 26e4716 docs(changeset): Fix uniforms refs so they remain stable for ShaderMaterial
• Additional commits viewable in compare view

Updates @tanstack/react-virtual from 3.13.23 to 3.13.24

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.13.24

Patch Changes

• Updated dependencies [97a204d]:
  • @​tanstack/virtual-core@​3.14.0

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.13.24

Patch Changes

• Updated dependencies [97a204d]:
  • @​tanstack/virtual-core@​3.14.0

Commits

• c3d4cd4 ci: Version Packages (#1157)
• See full diff in compare view

Updates @webcontainer/api from 1.6.1 to 1.6.4

Commits

• See full diff in compare view

Updates ag-grid-community from 35.1.0 to 35.3.0

Release notes

Sourced from ag-grid-community's releases.

v35.3.0

https://www.ag-grid.com/changelog/?fixVersion=35.3.0

v35.2.1

https://www.ag-grid.com/changelog/?fixVersion=35.2.1

v35.2.0

https://www.ag-grid.com/changelog/?fixVersion=35.2.0

Commits

• edb08db Release 35.3.0 Prep
• 857b880 AG-3390 - Update enterprise licenses (#13739)
• 0631983 Release 35.3.0 Prep
• 7afb572 RTI-3345 Docs review Getting Started (#13735)
• 2fb5a33 RTI-3347 Columns Docs Review (#13737)
• 33c62d7 [RTI-3346] Fix broken links to renamed SSRM grouping section (#13741)
• 531ec41 RTI-3326 Improve Doc Examples (#13731)
• 533cfac Docs review: grid-size and ag-grid-design-system (#13738)
• 4df05d9 Fix SSRM documentation inaccuracies found during technical review (#13736)
• 3c8fd18 Release 35.3.0 Prep
• Additional commits viewable in compare view

Updates ag-grid-react from 35.1.0 to 35.3.0

Release notes

Sourced from ag-grid-react's releases.

v35.3.0

https://www.ag-grid.com/changelog/?fixVersion=35.3.0

v35.2.1

https://www.ag-grid.com/changelog/?fixVersion=35.2.1

v35.2.0

https://www.ag-grid.com/changelog/?fixVersion=35.2.0

Commits

• edb08db Release 35.3.0 Prep
• 857b880 AG-3390 - Update enterprise licenses (#13739)
• 0631983 Release 35.3.0 Prep
• 7afb572 RTI-3345 Docs review Getting Started (#13735)
• 2fb5a33 RTI-3347 Columns Docs Review (#13737)
• 33c62d7 [RTI-3346] Fix broken links to renamed SSRM grouping section (#13741)
• 531ec41 RTI-3326 Improve Doc Examples (#13731)
• 533cfac Docs review: grid-size and ag-grid-design-system (#13738)
• 4df05d9 Fix SSRM documentation inaccuracies found during technical review (#13736)
• 3c8fd18 Release 35.3.0 Prep
• Additional commits viewable in compare view

Updates codemirror-lang-latex from 0.2.0 to 0.4.1

Commits

• See full diff in compare view

Updates date-fns from 4.1.0 to 4.2.1

Release notes

Sourced from date-fns's releases.

v4.2.1

Fixed

• Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

• Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.

Changelog

Sourced from date-fns's changelog.

v4.2.1 - 2026-05-19

Fixed

• Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0 - 2026-05-18

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

• Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.

Commits

• 87635a8 Fix missing type definitions, promote to v4.2.1 (closed #4190)
• 3d4ca4b Update browserslist
• 562c485 Promote to v4.2.0
• 3709c02 Make steps into the Temporal-first future
• 07592b9 Upgrade Node.js types, upgrade TypeScript
• 09ece22 Upgrade Vitest
• c37c22e Set up Oxfmt as the default formatter
• d40bb80 Upgrade mise setup
• dd66398 Fix tz tests workflow
• ef962f8 Adjust smoke tests
• Additional commits viewable in compare view

Updates dompurify from 3.3.3 to 3.4.5

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.5

• Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @​KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

DOMPurify 3.4.4

• Added the selectedcontent element to default allow-list, thanks @​lukewarlow
• Added the command and commandfor attributes to default allowed-list, thanks @​lukewarlow
• Added better template scrubbing for IN_PLACE operations, thanks @​DEMON1A
• Added stronger checks for cross-realm windows, thanks @​DEMON1A & @​fg0x0
• Updated demo website and made sure it uses the latest from main
• Updated existing workflows, fuzzer, dependabot, etc., added more tests
• Bumped several dependencies where possible

🚨 This release had been flagged as deprecated, please use DOMPurify 3.4.5 instead 🚨

DOMPurify 3.4.3

• Fixed an issue with handling of nested Shadow DOM trees, thanks @​fishjojo1
• Fixed the template regexes to be more robust against ReDoS attacks, thanks @​aleung27
• Updated the node iteration code to catch more Shadow DOM related issues
• Updated Playwright and added Node 26 to test matrix
• Updated existing workflows, fuzzer, release signing, etc., added more tests
• Bumped several dependencies where possible

DOMPurify 3.4.2

• Fixed an issue with URI validation on attributes allowed via ADD_ATTR callback, thanks @​nelstrom
• Fixed an issue with source maps referring to non-existing files, thanks @​cmdcolin
• Updated existing workflows, fuzzer, release signing, etc., added more tests
• Bumped several dependencies where possible

DOMPurify 3.4.1

• Fixed an issue with on-handler stripping for HTML-spec-reserved custom element names (font-face, color-profile, missing-glyph, font-face-src, font-face-uri, font-face-format, font-face-name) under permissive CUSTOM_ELEMENT_HANDLING
• Fixed a case-sensitivity gap in the annotation-xml check that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML mode
• Fixed SANITIZE_NAMED_PROPS repeatedly prefixing already-prefixed id and name values on subsequent sanitization
• Fixed the IN_PLACE root-node check to explicitly guard against non-string nodeName (DOM-clobbering robustness)
• Removed a duplicate slot entry from the default HTML attribute allow-list
• Strengthened the fast-check fuzz harness with explicit XSS invariants, an expanded seed-payload corpus, an additional idempotence property for SANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fire
• Added regression and pinning tests covering the above fixes and two accepted-behavior contracts (SAFE_FOR_TEMPLATES greedy scrub, hook-added attribute handling)
• Extended CodeQL analysis to run on 3.x and 2.x maintenance branches

DOMPurify 3.4.0

Most relevant changes:

• Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @​kodareef5
• Fixed several minor problems and typos regarding MathML attributes, thanks @​DavidOliver
• Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @​1Jesper1
• Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @​bencalif
• Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @​trace37labs
• Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @​eddieran
• Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @​christos-eth

... (truncated)

Commits

• 011b0c7 release: 3.4.5 (#1382)
• 5817ad9 release: 3.4.4 (#1374)
• 520edb0 release: 3.4.3 (#1352)
• 6f67fd3 Sync/3.4.2 (#1322)
• 5b0cdbb chore: merge main into 3.x for 3.4.1 release (#1301)
• 09f5911 test: added three more browsers to test setup (OSX, mobile)
• 5b16e0b Getting 3.x branch ready for 3.4.0 release (#1250)
• See full diff in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates framer-motion from 12.38.0 to 12.39.0

Changelog

Sourced from framer-motion's changelog.

[12.39.0] 2026-05-18

Added

• Support for repeatType and repeatDelay in animation sequences.

Fixed

• Variants: Re-run keyframe animations when switching between variant labels even when they share identical keyframe arrays.
• Drag: Preserve in-flight motion value animations across React 19 reorder unmount/remount so dragSnapToOrigin no longer leaves the drag transform stranded after a layout swap.
• LazyMotion: Share React contexts between the framer-motion and framer-motion/m (and therefore motion/react and motion/react-m) CJS bundles so that <m.div> from the /m subpath picks up features loaded by <LazyMotion> from the main entry point.
• useScroll: Support hydrating target and container refs from anywhere in the tree.
• Drag: Gesture no longer starts from incorrect start point when rendered inside <AnimatePresence initial={false} />.
• Drag: dragConstraints, when set as viewport-relative ref, no longer break on scroll.§
• Updated visualElement hydration order.
• useAnimate: Now respects skipAnimations.
• AnimatePresence: Fix object-form initial values not applied on re-entry after exit completes.
• scroll: Fixed callback progress when tracking an element.
• useScroll: Fix hardware acceleration when tracking an element.

Commits

• b607391 v12.39.0
• cd53178 Updating changelog
• bd07642 Merge pull request #3716 from motiondivision/worktree-fix-issue-3315
• 3f053b6 Merge branch 'main' into worktree-fix-issue-3315
• f434c42 Merge pull request #3718 from motiondivision/dependabot/npm_and_yarn/next-15....
• 5973dfb Merge pull request #3722 from motiondivision/worktree-fix-issue-2829
• cfccb03 fix(drag): Refresh root scroll before measuring ref constraints
• 16aa417 Updating changelog
• 5d627a4 Merge pull request #3720 from motiondivision/worktree-fix-issue-2831
• 63cf0d0 Merge pull request #3721 from motiondivision/worktree-fix-issue-2833
• Additional commits viewable in compare view

Updates immer from 11.1.4 to 11.1.8

Release notes

Sourced from immer's releases.

v11.1.8

11.1.8 (2026-05-08)

Bug Fixes

• update current and original typings to assert draft value is unwrapped (#1236) (bf2d154)

v11.1.7

11.1.7 (2026-05-06)

Bug Fixes

• improve higher order type inference for WritableDraft (#1205) (7390d6c)

v11.1.6

11.1.6 (2026-05-04)

Bug Fixes

• remove invalid curried producer type (#1216) (b40b04f)

v11.1.5

11.1.5 (2026-05-04)

Bug Fixes

• handle nested proxies after spreading and inserting into an array (d3bc436)

Commits

• bf2d154 fix: update current and original typings to assert draft value is unwrapped (...
• 7390d6c fix: improve higher order type inference for WritableDraft (#1205)
• 5155a33 chore: regression tests for fixed issue #916 (#1215)
• b67db83 chore(deps): bump postcss from 8.4.31 to 8.5.13 in /website (#1233)
• b40b04f fix: remove invalid curried producer type (#1216)
• 4f1a96f chore(deps-dev): bump lodash from 4.17.21 to 4.18.1 (#1225)
• 3b6c372 chore(deps): bump brace-expansion from 1.1.12 to 1.1.14 in /website (#1234)
• 229c8fb chore(deps): bump lodash from 4.17.21 to 4.18.1 in /website (#1223)
• 48f239c chore(deps): bump lodash from 4.17.21 to 4.18.1 in /website (#1223)
• 64bd3a7 chore(deps-dev): bump immutable from 3.8.2 to 3.8.3 (#1214)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for immer since your current version.

Updates katex from 0.16.43 to 0.16.47

Release notes

Sourced from katex's releases.

v0.16.47

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.