chore(web)(deps): bump the dependencies group across 1 directory with 22 updates by dependabot[bot] · Pull Request #107 · RISHII7/echo

dependabot · 2026-11-02T03:38:59Z

Bumps the dependencies group with 22 updates in the /apps/web directory:

Package	From	To
@base-ui/react	`1.6.0`	`1.9.0`
@clerk/nextjs	`7.5.12`	`7.9.22`
@convex-dev/agent	`0.1.16`	`0.7.9`
@hookform/resolvers	`5.4.0`	`5.9.2`
@sentry/nextjs	`10.63.0`	`10.78.0`
@shadcn/react	`0.2.0`	`0.3.1`
bowser	`2.14.1`	`2.15.0`
convex	`1.25.4`	`1.48.0`
countries-and-timezones	`3.9.0`	`3.11.0`
input-otp	`1.4.2`	`1.5.0`
jotai	`2.20.1`	`2.20.3`
lucide-react	`0.475.0`	`0.577.0`
next	`16.2.6`	`16.4.3`
react	`19.2.4`	`19.3.1`
@types/react	`19.2.17`	`19.3.0`
react-day-picker	`10.0.1`	`10.0.2`
react-dom	`19.2.4`	`19.3.1`
@types/react-dom	`19.2.3`	`19.3.0`
react-hook-form	`7.81.0`	`7.91.0`
recharts	`3.8.0`	`3.10.1`
sonner	`2.0.7`	`2.0.8`
zod	`3.25.67`	`3.25.76`

Updates @base-ui/react from 1.6.0 to 1.9.0

Release notes

Sourced from @base-ui/react's releases.

v1.9.0

General changes

Export CssVariables and DataAttributes types (#5243) by @superhooman

Fix stale focused field state (#5345) by @atomiks

Fix animation waits retaining detached elements (#5719) by @flaviendelangle

Keep item registration in sync when items change under Strict Mode (#5862) by @atomiks

Avoid re-rendering inactive triggers on open and close (#5865) by @atomiks

Accordion

Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @cpruijsen

Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @atomiks

Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @aarongarciah

Alert Dialog

Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @michaldudak

Autocomplete

Fix autoHighlight for asynchronous results (#5818) by @atomiks

Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @atomiks

Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @michaldudak

Checkbox

Prefer aria-label over associated labels (#5787) by @atomiks

Collapsible

Apply the native disabled attribute to <Collapsible.Trigger> when using native buttons (#5607) by @atomiks

Finish closing when the render function removes the panel (#5890) by @michaldudak

Restore animations when a removed panel reopens (#5891) by @michaldudak

Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @aarongarciah

Combobox

Fix stale chip focus after returning to the input (#5879) by @mdm317

Fix autoHighlight for asynchronous results (#5818) by @atomiks

Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @michaldudak

Fix label focus in Shadow DOM (#5871) by @lyzno1

Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @atomiks

Reset typeahead state when closing without moving focus (#5816) by @mdm317

Accept readonly arrays for multiple values (#5710) by @MonstraG

Share item indicator implementation (#5728) by @flaviendelangle

Improve mount performance of large lists (#5819) by @atomiks

Combine item store subscriptions (#5863) by @atomiks

Dialog

... (truncated)

Changelog

Sourced from @base-ui/react's changelog.

v1.9.0

Oct 9, 2026

General changes

Export CssVariables and DataAttributes types (#5243) by @superhooman

Fix stale focused field state (#5345) by @atomiks

Fix animation waits retaining detached elements (#5719) by @flaviendelangle

Keep item registration in sync when items change under Strict Mode (#5862) by @atomiks

Avoid re-rendering inactive triggers on open and close (#5865) by @atomiks

Accordion

Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @cpruijsen

Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @atomiks

Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @aarongarciah

Alert Dialog

Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @michaldudak

Autocomplete

Fix autoHighlight for asynchronous results (#5818) by @atomiks

Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @atomiks

Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @michaldudak

Checkbox

Prefer aria-label over associated labels (#5787) by @atomiks

Collapsible

Apply the native disabled attribute to <Collapsible.Trigger> when using native buttons (#5607) by @atomiks

Finish closing when the render function removes the panel (#5890) by @michaldudak

Restore animations when a removed panel reopens (#5891) by @michaldudak

Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @aarongarciah

Combobox

Fix stale chip focus after returning to the input (#5879) by @mdm317

Fix autoHighlight for asynchronous results (#5818) by @atomiks

Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @michaldudak

Fix label focus in Shadow DOM (#5871) by @lyzno1

Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @atomiks

Reset typeahead state when closing without moving focus (#5816) by @mdm317

Accept readonly arrays for multiple values (#5710) by @MonstraG

... (truncated)

Commits

ad7ecda [release] v1.9.0 (#5906)
3296de3 [drawer] Avoid retaining unmounted drawers in DrawerProvider (#5921)
69c33b4 [drawer] Fix deferred touch swipes leaving the popup (#5922)
51b70db [menu] Strip internal filter components from public types (#5923)
8d8b98c [menu] Ignore filter input edits while the menu animates out (#5911)
aeba3eb [combobox][menu][select] Revert highlightItem imperative action (#5910)
ec6bf32 [field][select][combobox][slider] Fall back to the owner document when lookin...
1f112a5 [popups] Avoid re-rendering inactive triggers on open and close (#5865)
bc53db6 [fieldset] Await render in Legend disabled-state test (#5909)
147092e [test] Strengthen tests, add test lint rules and share copied suites (#5892)
Additional commits viewable in compare view

Updates @clerk/nextjs from 7.5.12 to 7.9.22

Release notes

Sourced from @clerk/nextjs's releases.

@clerk/nextjs@7.9.22

Patch Changes

Updated dependencies [4ce996f]:

@clerk/shared@4.43.0

@clerk/backend@3.26.4

@clerk/react@6.18.3

@clerk/nextjs@7.9.21

Patch Changes

Updated dependencies [d005fee, 0a6e367, cf9c897]:

@clerk/backend@3.26.3

@clerk/shared@4.42.0

@clerk/react@6.18.2

@clerk/nextjs@7.9.19

Patch Changes

Updated dependencies [49c8afd]:

@clerk/backend@3.26.1

Changelog

Sourced from @clerk/nextjs's changelog.

7.9.22

Patch Changes

Updated dependencies [4ce996f]:

@clerk/shared@4.43.0

@clerk/backend@3.26.4

@clerk/react@6.18.3

7.9.21

Patch Changes

Updated dependencies [d005fee, 0a6e367, cf9c897]:

@clerk/backend@3.26.3

@clerk/shared@4.42.0

@clerk/react@6.18.2

7.9.20

Patch Changes

Updated dependencies [8c3739d, 0334b05]:

@clerk/shared@4.41.1

@clerk/react@6.18.1

@clerk/backend@3.26.2

7.9.19

Patch Changes

Updated dependencies [49c8afd]:

@clerk/backend@3.26.1

7.9.18

Patch Changes

Fix the return type of auth.protect() when a predicate is passed together with the token option. The result is now typed from the accepted token types, so auth.protect(() => true, { token: 'api_key' }) resolves to the API key auth object instead of a session auth object. (#10211) by @wobsoriano

Updated dependencies [85dec02, b799bad, e5cfdff]:

@clerk/backend@3.26.0

@clerk/shared@4.41.0

@clerk/react@6.18.0

7.9.17

Patch Changes

Updated dependencies [57aeba8]:

... (truncated)

Commits

870b9a7 ci(repo): Version packages (#10464)
8b0048f chore(repo): Update dependency next to v15.5.24 [SECURITY] (#10057)
3fa3ad1 ci(repo): Version packages (#10393)
8b9403b ci(repo): Version packages (#10347)
80b0813 ci(repo): Version packages (#10315)
ec91b9b ci(repo): Version packages (#10283)
0eb5e97 fix(nextjs): infer auth.protect() predicate return type from the token option...
0c7e63b ci(repo): Version packages (#10274)
01da4b4 ci(repo): Version packages (#10234)
9079455 ci(repo): Version packages (#10210)
Additional commits viewable in compare view

Updates @convex-dev/agent from 0.1.16 to 0.7.9

Changelog

Sourced from @convex-dev/agent's changelog.

0.7.9

Uses built-in pagination instead of the paginator for listing threads by userId, as well as listing files and embeddings. Impact: If a user is currently paginating, their cursor will not be valid and their paginated query will reset to the first page. Also, if you called listThreadsByUserId, getFilesToDelete, or paginate vectors from a query that already makes another pagination call, it will now fail, since each query is only allowed one built-in .paginate call currently.

Fix TS2590 when constructing Agent or calling startGeneration with large model (#424) catalogs or model id unions (#414, #417)

Pass embedding providerMetadata to usageHandler (#393)

Require ai 7.0.129 or later. Before 7.0.119 a provider error before the first chunk failed the action with an unhandled rejection (#387), and before 7.0.129 approvals dropped provider options

Don't leave a failed delta write or stream cleanup as an unhandled rejection (#366)

Fix useUIMessages and useThreadMessages freezing when a page ends partway through a message (#395)

Run approved tools when excludeToolMessages is set: listMessages with upToAndIncludingMessageId keeps that order's tool messages (#409, #427)

0.7.8

Fix answering a tool approval after an earlier approval in the same thread (#404)

0.7.7

Enforce that the stream being synced matches the thread ID associated with the request. (#398)

0.7.6

Bounds listDeltas by bytes (#375)

Fixes peer dependencies and updates types to match convex 1.46

0.7.5

Allow tool approvals to be handled atomically and more robust (#367)

0.7.4

Run agent queries and mutations inline in workflow steps (#279, #394)

Deprecate agent.createThreadMutation() in favor of createThread (#279)

Split the playground API so actions can run in "use node" (#373)

Read the whole delta log when materializing a failed stream (#370)

Bound async stream deletion by bytes (#369)

Honor cloneThread batch options and drop dangling parent ids (#371)

Drop the unused refcount index on files (#380)

... (truncated)

Commits

2d33210 0.7.9
8af8980 fix(component): keep the continued order's tool messages with excludeToolMess...
12b01da fix(react): assemble messages by order across pages and streams (#395)
560fd77 fix: avoid TS2590 in startGeneration and agent.start args (#424)
f6965b9 fix(streaming): handle background delta stream rejections (#366)
e805c48 fix(deps): require ai 7.0.129 so a failed first request leaks no rejection (#...
e9fa70b Remove claim that mutations can't store files (#421)
2405f03 Use built-in pagination instead of paginator (#408)
942a1a9 feat(example): add an assistant-ui chat interface (#407)
eda442d fix: pass embedding providerMetadata to usageHandler (#393)
Additional commits viewable in compare view

Updates @hookform/resolvers from 5.4.0 to 5.9.2

Release notes

Sourced from @hookform/resolvers's releases.

v5.9.2

5.9.2 (2026-10-17)

Bug Fixes

ajv: preserve escaped field names in validation errors (#879) (71e6052)

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

isNameInFieldArray fails to recognise bracket-notation array paths causing nested errors overwriting (#876) (f18ddfb)

v5.9.0

5.9.0 (2026-08-15)

Features

update joi to v18 (#873) (c8159ae)

v5.8.0

5.8.0 (2026-08-13)

Features

support Vest 6 (a5100ab)

v5.7.1

5.7.1 (2026-08-02)

Bug Fixes

ata-validator peer dependency version (#871) (827f20b)

v5.7.0

5.7.0 (2026-08-02)

Features

support vine v4 (#867) (4cfba18)

v5.6.0

5.6.0 (2026-08-01)

... (truncated)

Commits

71e6052 fix(ajv): preserve escaped field names in validation errors (#879)
8d088d4 chore(deps): bump ata-validator to ^1.23.0 (#877)
f18ddfb fix: isNameInFieldArray fails to recognise bracket-notation array paths causi...
c8159ae feat: update joi to v18 (#873)
a5100ab feat: support Vest 6
28ec539 fix(vest)!: support Vest 6 (#874)
827f20b fix: ata-validator peer dependency version (#871)
4cfba18 feat: support vine v4 (#867)
58d2e2d remove dead image
b011a5f feat: improve all resovlers drops validation errors for special root field names
Additional commits viewable in compare view

Updates @sentry/nextjs from 10.63.0 to 10.78.0

Release notes

Sourced from @sentry/nextjs's releases.

10.78.0

feat(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)

fix(v10/core): Drop sampled-out errors before they take a promise buffer slot (#25753)

fix(v10/core): Stop sending client reports for breadcrumbs (#25752)

fix(v10/core): Use trace_metric data category for metrics rate limits and client reports (#25612)

fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js version helper (#25730)

Bundle size 📦

Path Size

@sentry/browser 27.64 KB

@sentry/browser - with treeshaking flags 26.12 KB

@sentry/browser (incl. Tracing) 46.2 KB

@sentry/browser (incl. Tracing + Span Streaming) 47.96 KB

@sentry/browser (incl. Tracing, Profiling) 50.87 KB

@sentry/browser (incl. Tracing, Replay) 84.73 KB

@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 74.6 KB

@sentry/browser (incl. Tracing, Replay with Canvas) 89.33 KB

@sentry/browser (incl. Tracing, Replay, Feedback) 101.65 KB

@sentry/browser (incl. Feedback) 44.42 KB

@sentry/browser (incl. sendFeedback) 32.34 KB

@sentry/browser (incl. FeedbackAsync) 37.34 KB

@sentry/browser (incl. Metrics) 28.7 KB

@sentry/browser (incl. Logs) 28.94 KB

@sentry/browser (incl. Metrics & Logs) 29.6 KB

@sentry/react 29.42 KB

@sentry/react (incl. Tracing) 48.46 KB

@sentry/vue 33.39 KB

@sentry/vue (incl. Tracing) 48.52 KB

@sentry/svelte 27.66 KB

CDN Bundle 30 KB

CDN Bundle (incl. Tracing) 48.13 KB

CDN Bundle (incl. Logs, Metrics) 31.56 KB

CDN Bundle (incl. Tracing, Logs, Metrics) 49.42 KB

CDN Bundle (incl. Replay, Logs, Metrics) 70.13 KB

CDN Bundle (incl. Tracing, Replay) 84.97 KB

CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 86.24 KB

CDN Bundle (incl. Tracing, Replay, Feedback) 90.65 KB

CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 91.9 KB

CDN Bundle - uncompressed 89.11 KB

CDN Bundle (incl. Tracing) - uncompressed 145.03 KB

CDN Bundle (incl. Logs, Metrics) - uncompressed 93.71 KB

CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 148.92 KB

CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 216.26 KB

CDN Bundle (incl. Tracing, Replay) - uncompressed 262.18 KB

CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 266.05 KB

CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 275.56 KB

CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 279.42 KB

@sentry/nextjs (client) 51.06 KB

... (truncated)

Changelog

Sourced from @sentry/nextjs's changelog.

10.78.0

feat(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)

fix(v10/core): Drop sampled-out errors before they take a promise buffer slot (#25753)

fix(v10/core): Stop sending client reports for breadcrumbs (#25752)

fix(v10/core): Use trace_metric data category for metrics rate limits and client reports (#25612)

fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js version helper (#25730)

10.77.1

Important Changes
feat(v10/nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25559)

The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:
// app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
export { POST } from '@sentry/nextjs/tunnel';
The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

With the handler, tunnel requests go through your middleware. If your middleware blocks unauthenticated requests, exclude the tunnel route in its matcher.

Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.
feat(v10/nextjs): Send tunnel route requests with credentials: 'omit' (#25561)

With tunnelRoute and no tunnel route handler, @sentry/nextjs now sends events from the browser with credentials: 'omit', because the tunnel route does not need cookies. If a layer in front of your app checks cookies before it lets requests through (for example Vercel Deployment Protection), you can send them again in your browser Sentry.init call:
// instrumentation-client.ts
Sentry.init({
  transportOptions: { fetchOptions: { credentials: 'same-origin' } },
});
fix(v10/deps)!: Limit @opentelemetry/api to <1.10.0 and the OpenTelemetry SDK to <3.0.0 (#25715)

Breaking change

If your app uses @opentelemetry/api 1.10.0 or OpenTelemetry SDK v3 together with v10 of the Sentry SDK, you must stay on @opentelemetry/api below 1.10.0 and OpenTelemetry SDK v2, or upgrade to v11.

@opentelemetry/api 1.10.0 only works with OpenTelemetry SDK v3 (@opentelemetry/core 3.x, @opentelemetry/instrumentation 0.300.x). The SDK v2 packages that v10 uses only support @opentelemetry/api below 1.10.0, and SDK v3 needs Node.js 22.15.0 or newer, while v10 supports Node.js 18 and newer. For this reason, v10 now limits @opentelemetry/api to <1.10.0, and the @opentelemetry/instrumentation and @opentelemetry/exporter-trace-otlp-http peer dependencies of @sentry/node-core to <0.300.0.

If your app depends on @opentelemetry/api directly, use a version below 1.10.0 (for example ~1.9.1). With 1.10.0, your app and the Sentry SDK use different copies of the API, and the OpenTelemetry calls of your app do not see the tracer provider of the Sentry SDK.

To use @opentelemetry/api 1.10.0 and OpenTelemetry SDK v3, upgrade to v11 of the Sentry SDK. For the upgrade steps, see the migration guide.

... (truncated)

Commits

5f277de release: 10.78.0
a4cc5f9 meta(changelog): Update changelog for 10.78.0 (#25831)
e4ea7fd fix(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)
26744d3 fix(v10/core): Drop sampled-out errors before they take a promise buffer slot...
3c8e1d7 fix(v10/core): Stop sending client reports for breadcrumbs (#25752)
0664050 fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js vers...
76defeb fix(v10/core): Use trace_metric data category for metrics rate limits and c...
e2fa5ba meta(changelog): Merge 10.77.0 into 10.77.1 because 10.77.0 was not released ...
bb2bb52 fix(v10/astro): defer to @sentry/cloudflare/vite on Cloudflare Workers (#25...
65d23eb fix(v10/elysia): Set SDK metadata on the options passed to init (#25486)
Additional commits viewable in compare view

Updates @shadcn/react from 0.2.0 to 0.3.1

Release notes

Sourced from @shadcn/react's releases.

@shadcn/react@0.3.1

Patch Changes

#11720 503a3a57aec9a3817e37f90aa0817b1fabd284d0 Thanks @shadcn! - Set data-pending-scroll on the MessageScroller root and viewport until defaultScrollPosition ("end" or "last-anchor") is applied, so the viewport can be hidden and a server-rendered transcript does not flash the top of the thread on reload.

@shadcn/react@0.3.0

Minor Changes

#11414 3e54530e31020e2277df03490a30a08e3bc1792b Thanks @shadcn! - Add the Questionnaire primitive for multi-step questions, freeform answers, validation, and keyboard navigation.

@shadcn/react@0.2.1

Patch Changes

#11106 f6a26478547c7057aeda82516666dc3473dc39bd Thanks @shadcn! - Fix MessageScroller autoScroll around anchored turns: the anchor hold now hands off to follow-output once the streamed reply fills the viewport, content growth outrunning the frame-coalesced resize handler no longer releases follow-output, and the scroll button no longer flickers while follow-output closes the gap a streamed chunk just opened.

#11100 dd6ce77cf1606eee2839368a97cc35417f763232 Thanks @shadcn! - Fix MessageScroller abandoning a newly appended scrollAnchor placement when autoScroll is enabled, so the anchored turn holds at the reading line while the reply streams.

#11085 628e427231ca4bb7f586a69f99fe7809749a53e2 Thanks @devnomic! - Fix MessageScroller firing "ResizeObserver loop completed with undelivered notifications" during streamed content growth by coalescing ResizeObserver callbacks into requestAnimationFrame.

Changelog

Sourced from @shadcn/react's changelog.

0.3.1

Patch Changes

#11720 503a3a57aec9a3817e37f90aa0817b1fabd284d0 Thanks @shadcn! - Set data-pending-scroll on the MessageScroller root and viewport until defaultScrollPosition ("end" or "last-anchor") is applied, so the viewport can be hidden and a server-rendered transcript does not flash the top of the thread on reload.

0.3.0

Minor Changes

#11414 3e54530e31020e2277df03490a30a08e3bc1792b Thanks @shadcn! - Add the Questionnaire primitive for multi-step questions, freeform answers, validation, and keyboard navigation.

0.2.1

Patch Changes

#11106 f6a26478547c7057aeda82516666dc3473dc39bd Thanks @shadcn! - Fix MessageScroller autoScroll around anchored turns: the anchor hold now hands off to follow-output once the streamed reply fills the viewport, content growth outrunning the frame-coalesced resize handler no longer releases follow-output, and the scroll button no longer flickers while follow-output closes the gap a streamed chunk just opened.

#11100 dd6ce77cf1606eee2839368a97cc35417f763232 Thanks @shadcn! - Fix MessageScroller abandoning a newly appended scrollAnchor placement when autoScroll is enabled, so the anchored turn holds at the reading line while the reply streams.

#11085 628e427231ca4bb7f586a69f99fe7809749a53e2 Thanks @devnomic! - Fix MessageScroller firing "ResizeObserver loop completed with undelivered notifications" during streamed content growth by coalescing ResizeObserver callbacks into requestAnimationFrame.

Commits

63c1308 chore(release): version packages (#11714)
503a3a5 fix(react): hide MessageScroller until the opening position applies (#11720)
b1c580c chore(release): version packages (#11374)
3e54530 feat: questionnaire (#11414)
5e800ca chore(release): version packages (#11099)
f6a2647 fix(react): follow the live edge after an anchored reply fills the viewport (...
dd6ce77 fix(react): hold newly appended scroll anchors while autoScroll is enabled (#...
628e427 fix(message-scroller): avoid ResizeObserver loop error by coalescing resize h...
See full diff in compare view

Updates bowser from 2.14.1 to 2.15.0

Release notes

Sourced from bowser's releases.

v2.15.0

Security

fix: polynomial ReDoS in the Firefox-on-iPad user-agent rule (GHSA-f9xq-72p3-q9fv). A crafted User-Agent could block the Node.js event loop for seconds per Bowser.parse() call. Thanks to @0xma1ware for the report.

fix: four more polynomial ReDoS patterns (Linespider, SlackBot and the generic fallback rule), found by CodeQL (#630).

Worth knowing before upgrading

New detections change reported browser names. HeyTap, Vivo and Ladybird users are now reported under their own names instead of Chrome, and Motorola Edge phones are no longer reported as Microsoft Edge. Dashboards that group by browser name will shift.

Bowser is now a dual package. require('bowser') still returns the same UMD build. import now resolves to a real ES module that also offers parse, getParser, BROWSER_MAP, ENGINE_MAP, OS_MAP and PLATFORMS_MAP as named exports. All published file paths still resolve.

bundled.js is ~11 KB larger gzipped (37 → 48 KB). It now uses current core-js 3 polyfills, whose fuller spec compliance makes them larger; it covers the same features as before. If you already ship polyfills, use es5.js (unchanged at ~7.5 KB gzipped) or the ES module build instead.

Changes

perf: trim bundled.js to the 2.14.1 polyfill set, fix stale docs @naorpeled (#635)

fix: expose the constant maps on the ESM namespace @lancedikson (#642)

fix: keep ESM consumers on ES5, enable tree-shaking, trim bundled.js @naorpeled (#634)

fix: bundled.js is not ES5 — restore ES5 output and guard it @naorpeled (#632)

fix: restore ES5 output for bundled.js, close exports-map gaps, and cover all build artifacts @naorpeled (#631)

fix: resolve open GitHub security findings @naorpeled (#630)

Dual packaging, without breaking existing consumers @naorpeled (#628)

feat: add Ladybird browser support @gmta (#627)

feat: add support for HeyTap Browser and Vivo Browser identification @mrswapnilsahu (#621)

fix: prevent Motorola Edge devices from being misidentified as Microsoft Edge @naorpeled (#612)

feat: add copyright comment to bundle @naorpeled (#605)

Add the ability to use an array of versions in Parser.satisfies() @Stas-tolpekin (#466)

Commits

56be01d perf: trim bundled.js to the 2.14.1 polyfill set, fix stale docs (#635)
6ad397e fix: expose the constant maps on the ESM namespace (#642)
459d9ea Merge commit from fork
fd55680...
Description has been truncated

… 22 updates Bumps the dependencies group with 22 updates in the /apps/web directory: | Package | From | To | | --- | --- | --- | | [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.6.0` | `1.9.0` | | [@clerk/nextjs](https://github.com/clerk/javascript/tree/HEAD/packages/nextjs) | `7.5.12` | `7.9.22` | | [@convex-dev/agent](https://github.com/convex/agent) | `0.1.16` | `0.7.9` | | [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.4.0` | `5.9.2` | | [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.63.0` | `10.78.0` | | [@shadcn/react](https://github.com/shadcn-ui/ui/tree/HEAD/packages/react) | `0.2.0` | `0.3.1` | | [bowser](https://github.com/bowser-js/bowser) | `2.14.1` | `2.15.0` | | [convex](https://github.com/convex/convex-backend/tree/HEAD/npm-packages/convex) | `1.25.4` | `1.48.0` | | [countries-and-timezones](https://github.com/manuelmhtr/countries-and-timezones) | `3.9.0` | `3.11.0` | | [input-otp](https://github.com/guilhermerodz/input-otp/tree/HEAD/packages/input-otp) | `1.4.2` | `1.5.0` | | [jotai](https://github.com/pmndrs/jotai) | `2.20.1` | `2.20.3` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.475.0` | `0.577.0` | | [next](https://github.com/vercel/next.js) | `16.2.6` | `16.4.3` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.4` | `19.3.1` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.3.0` | | [react-day-picker](https://github.com/gpbl/react-day-picker/tree/HEAD/packages/react-day-picker) | `10.0.1` | `10.0.2` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.3.1` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.3.0` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.81.0` | `7.91.0` | | [recharts](https://github.com/recharts/recharts) | `3.8.0` | `3.10.1` | | [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` | | [zod](https://github.com/colinhacks/zod) | `3.25.67` | `3.25.76` | Updates `@base-ui/react` from 1.6.0 to 1.9.0 - [Release notes](https://github.com/mui/base-ui/releases) - [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md) - [Commits](https://github.com/mui/base-ui/commits/v1.9.0/packages/react) Updates `@clerk/nextjs` from 7.5.12 to 7.9.22 - [Release notes](https://github.com/clerk/javascript/releases) - [Changelog](https://github.com/clerk/javascript/blob/main/packages/nextjs/CHANGELOG.md) - [Commits](https://github.com/clerk/javascript/commits/@clerk/nextjs@7.9.22/packages/nextjs) Updates `@convex-dev/agent` from 0.1.16 to 0.7.9 - [Changelog](https://github.com/convex/agent/blob/main/CHANGELOG.md) - [Commits](convex/agent@v0.1.16...v0.7.9) Updates `@hookform/resolvers` from 5.4.0 to 5.9.2 - [Release notes](https://github.com/react-hook-form/resolvers/releases) - [Commits](react-hook-form/resolvers@v5.4.0...v5.9.2) Updates `@sentry/nextjs` from 10.63.0 to 10.78.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.78.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.63.0...10.78.0) Updates `@shadcn/react` from 0.2.0 to 0.3.1 - [Release notes](https://github.com/shadcn-ui/ui/releases) - [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/react/CHANGELOG.md) - [Commits](https://github.com/shadcn-ui/ui/commits/@shadcn/react@0.3.1/packages/react) Updates `bowser` from 2.14.1 to 2.15.0 - [Release notes](https://github.com/bowser-js/bowser/releases) - [Changelog](https://github.com/bowser-js/bowser/blob/master/CHANGELOG.md) - [Commits](bowser-js/bowser@v2.14.1...v2.15.0) Updates `convex` from 1.25.4 to 1.48.0 - [Release notes](https://github.com/convex/convex-backend/releases) - [Changelog](https://github.com/convex/convex-backend/blob/main/npm-packages/convex/CHANGELOG.md) - [Commits](https://github.com/convex/convex-backend/commits/HEAD/npm-packages/convex) Updates `countries-and-timezones` from 3.9.0 to 3.11.0 - [Release notes](https://github.com/manuelmhtr/countries-and-timezones/releases) - [Changelog](https://github.com/manuelmhtr/countries-and-timezones/blob/dev/CHANGELOG.md) - [Commits](manuelmhtr/countries-and-timezones@v3.9.0...v3.11.0) Updates `input-otp` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/guilhermerodz/input-otp/releases) - [Changelog](https://github.com/guilhermerodz/input-otp/blob/master/CHANGELOG.md) - [Commits](https://github.com/guilhermerodz/input-otp/commits/v1.5.0/packages/input-otp) Updates `jotai` from 2.20.1 to 2.20.3 - [Release notes](https://github.com/pmndrs/jotai/releases) - [Commits](pmndrs/jotai@v2.20.1...v2.20.3) Updates `lucide-react` from 0.475.0 to 0.577.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react) Updates `next` from 16.2.6 to 16.4.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.6...v16.4.3) Updates `react` from 19.2.4 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `@types/react` from 19.2.17 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-day-picker` from 10.0.1 to 10.0.2 - [Release notes](https://github.com/gpbl/react-day-picker/releases) - [Changelog](https://github.com/gpbl/react-day-picker/blob/main/packages/react-day-picker/CHANGELOG.md) - [Commits](https://github.com/gpbl/react-day-picker/commits/v10.0.2/packages/react-day-picker) Updates `react-dom` from 19.2.4 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `@types/react-dom` from 19.2.3 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `react-hook-form` from 7.81.0 to 7.91.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](react-hook-form/react-hook-form@v7.81.0...v7.91.0) Updates `recharts` from 3.8.0 to 3.10.1 - [Release notes](https://github.com/recharts/recharts/releases) - [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md) - [Commits](recharts/recharts@v3.8.0...v3.10.1) Updates `sonner` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/emilkowalski/sonner/releases) - [Commits](emilkowalski/sonner@v2.0.7...v2.0.8) Updates `zod` from 3.25.67 to 3.25.76 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.67...v3.25.76) --- updated-dependencies: - dependency-name: "@base-ui/react" dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@clerk/nextjs" dependency-version: 7.9.22 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@convex-dev/agent" dependency-version: 0.7.9 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@hookform/resolvers" dependency-version: 5.9.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@sentry/nextjs" dependency-version: 10.78.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@shadcn/react" dependency-version: 0.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: bowser dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: convex dependency-version: 1.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: countries-and-timezones dependency-version: 3.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: input-otp dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: jotai dependency-version: 2.20.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: lucide-react dependency-version: 0.577.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: next dependency-version: 16.4.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: react-day-picker dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@types/react-dom" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: react-hook-form dependency-version: 7.91.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: recharts dependency-version: 3.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: sonner dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: zod dependency-version: 3.25.76 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-11-02T03:39:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
echo	Error		Nov 2, 2026 3:39am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
echo-widget	Skipped		Nov 2, 2026 3:39am UTC

coderabbitai · 2026-11-02T03:39:08Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 18960bb3-a30f-48a5-a27d-7d7b6f19ac84

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

dependabot Bot added the app:web Relates to apps/web label Nov 2, 2026

dependabot Bot requested a review from RISHII7 as a code owner November 2, 2026 03:39

dependabot Bot added automated Created automatically by a bot dependencies Pull requests that update a dependency file labels Nov 2, 2026

vercel Bot temporarily deployed to Preview – echo-widget November 2, 2026 03:39 Inactive

vercel Bot had a problem deploying to Preview – echo November 2, 2026 03:39 Failure

Navigation Menu

Repository navigation

chore(web)(deps): bump the dependencies group across 1 directory with 22 updates - #107

chore(web)(deps): bump the dependencies group across 1 directory with 22 updates#107
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/web/dependencies-89bfeb4949

dependabot Bot commented on behalf of github Nov 2, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 2, 2026

Review skipped

Uh oh!

This branch had an error being deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Path	Size
`@sentry/browser`	27.64 KB
`@sentry/browser` - with treeshaking flags	26.12 KB
`@sentry/browser` (incl. Tracing)	46.2 KB
`@sentry/browser` (incl. Tracing + Span Streaming)	47.96 KB
`@sentry/browser` (incl. Tracing, Profiling)	50.87 KB
`@sentry/browser` (incl. Tracing, Replay)	84.73 KB
`@sentry/browser` (incl. Tracing, Replay) - with treeshaking flags	74.6 KB
`@sentry/browser` (incl. Tracing, Replay with Canvas)	89.33 KB
`@sentry/browser` (incl. Tracing, Replay, Feedback)	101.65 KB
`@sentry/browser` (incl. Feedback)	44.42 KB
`@sentry/browser` (incl. sendFeedback)	32.34 KB
`@sentry/browser` (incl. FeedbackAsync)	37.34 KB
`@sentry/browser` (incl. Metrics)	28.7 KB
`@sentry/browser` (incl. Logs)	28.94 KB
`@sentry/browser` (incl. Metrics & Logs)	29.6 KB
`@sentry/react`	29.42 KB
`@sentry/react` (incl. Tracing)	48.46 KB
`@sentry/vue`	33.39 KB
`@sentry/vue` (incl. Tracing)	48.52 KB
`@sentry/svelte`	27.66 KB
CDN Bundle	30 KB
CDN Bundle (incl. Tracing)	48.13 KB
CDN Bundle (incl. Logs, Metrics)	31.56 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	49.42 KB
CDN Bundle (incl. Replay, Logs, Metrics)	70.13 KB
CDN Bundle (incl. Tracing, Replay)	84.97 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	86.24 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	90.65 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	91.9 KB
CDN Bundle - uncompressed	89.11 KB
CDN Bundle (incl. Tracing) - uncompressed	145.03 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed	93.71 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	148.92 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	216.26 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	262.18 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	266.05 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	275.56 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	279.42 KB
`@sentry/nextjs` (client)	51.06 KB

Conversation

dependabot Bot commented on behalf of github Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.9.0

General changes

Accordion

Alert Dialog

Autocomplete

Checkbox

Collapsible

Combobox

Dialog

v1.9.0

General changes

Accordion

Alert Dialog

Autocomplete

Checkbox

Collapsible

Combobox

@​clerk/nextjs@​7.9.22

Patch Changes

@​clerk/nextjs@​7.9.21

Patch Changes

@​clerk/nextjs@​7.9.19

Patch Changes

7.9.22

Patch Changes

7.9.21

Patch Changes

7.9.20

Patch Changes

7.9.19

Patch Changes

7.9.18

Patch Changes

7.9.17

Patch Changes

0.7.9

0.7.8

0.7.7

0.7.6

0.7.5

0.7.4

v5.9.2

5.9.2 (2026-10-17)

Bug Fixes

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

v5.9.0

5.9.0 (2026-08-15)

Features

v5.8.0

5.8.0 (2026-08-13)

Features

v5.7.1

5.7.1 (2026-08-02)

Bug Fixes

v5.7.0

5.7.0 (2026-08-02)

Features

v5.6.0

5.6.0 (2026-08-01)

10.78.0

Bundle size 📦

10.78.0

10.77.1

Important Changes

@​shadcn/react@​0.3.1

Patch Changes

@​shadcn/react@​0.3.0

Minor Changes

@​shadcn/react@​0.2.1

Patch Changes

0.3.1

Patch Changes

0.3.0

Minor Changes

0.2.1

dependabot Bot commented on behalf of github Nov 2, 2026 •

edited

Loading

`@clerk/nextjs@7`.9.22

`@clerk/nextjs@7`.9.21

`@clerk/nextjs@7`.9.19

`@shadcn/react@0`.3.1

`@shadcn/react@0`.3.0

`@shadcn/react@0`.2.1

vercel Bot commented Nov 2, 2026 •

edited

Loading