[dependabot]

Bumps the npm group with 8 updates in the /web directory:

Package	From	To
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
@types/node	26.6.2	26.6.6
@vitejs/plugin-react	6.1.1	6.2.1
fake-indexeddb	6.2.5	6.2.7
jsdom	30.1.1	31.0.0
oxlint	1.85.0	1.92.0
vite-plugin-pwa	1.3.0	2.0.0

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates @types/node from 26.6.2 to 26.6.6

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.1.1 to 6.2.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.2.1

Fix refreshInclude and refreshExclude options not working (#1543)

Fix mistake from #1516

plugin-react@6.2.0

Add refreshInclude and refreshExclude options (#1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

plugin-react@6.1.2

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.2.1 (2026-11-02)

Fix refreshInclude and refreshExclude options not working (#1543)

Fix mistake from #1516

6.2.0 (2026-11-02)

Add refreshInclude and refreshExclude options (#1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

6.1.2 (2026-10-05)

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Commits

• 29efd1c release: plugin-react@6.2.1 (#1544)
• 22079fa fix(plugin-react): fix new refreshInclude option (#1543)
• d0f7234 release: plugin-react@6.2.0 (#1542)
• 186d1e8 feat(plugin-react): expand @rolldown/plugin-babel peer dep range (#1541)
• a554a33 feat(plugin-react): expand oxc-transform-react peer dep range (#1540)
• ef758ba fix(deps): update all non-major dependencies (#1531)
• 304a92a feat(plugin-react): add refreshInclude and refreshExclude options (#1516)
• b3e9835 fix(deps): update all non-major dependencies (#1517)
• 65a1dd5 fix(deps): update react 19.3.1 (#1509)
• 443be64 chore(deps): update dependency typescript to v7 (#1422)
• Additional commits viewable in compare view

Updates fake-indexeddb from 6.2.5 to 6.2.7

Release notes

Sourced from fake-indexeddb's releases.

v6.2.7

• Improve performance of put and delete for object stores with indexes (#172 by @​jameskfry)

v6.2.6

• Improve performance (#169 by @​jlucaso1)

• Fixed memory leak of finished transasctions (#171 by @​nolanlawson)

Changelog

Sourced from fake-indexeddb's changelog.

6.2.7 (2026-10-29)

• Improve performance of put and delete for object stores with indexes (#172 by @​jameskfry)

6.2.6 (2026-10-16)

• Improve performance (#169 by @​jlucaso1)

• Fixed memory leak of finished transasctions (#171 by @​nolanlawson)

Commits

• 09e7f76 6.2.7
• e1b6b48 Changelog
• f7cf6d8 Merge pull request #172 from jameskfry/perf/delete-index-records
• 0f4e496 Keep the single-key index path allocation-free
• f0f8bc0 Delete index records by index key instead of scanning the whole index
• 8881007 Update for 6.2.6 because the version script didn't automatically run for me s...
• e4b7e01 6.2.6
• e39bf45 Changelog
• d2eb002 Merge pull request #171 from nolanlawson/nolan/mem-leak
• d8a47c5 fix race conditions in the test
• Additional commits viewable in compare view

Updates jsdom from 30.1.1 to 31.0.0

Release notes

Sourced from jsdom's releases.

v31.0.0

Breaking changes

• Changed the optional canvas and image decoding backend from canvas to @napi-rs/canvas. Install @napi-rs/canvas v1.0.13 or later in the v1.x series alongside jsdom; installing canvas alone no longer enables this support. The new backend provides prebuilt Skia binaries on supported platforms, and rendering and encoded image bytes can differ. Projects using native canvas objects or custom font registration should follow the canvas migration guidance. Added WebP serialization through canvas.toDataURL() and canvas.toBlob(). Fixed image loading to wait for decoding before firing load, discard obsolete source requests, avoid refetching when dimensions change, and prevent failed images from drawing stale contents. Fixed canvas context and serialization behavior, including unsupported context types, read-only ctx.canvas, image-drawing exceptions, MIME type and quality normalization, and asynchronous null results from canvas.toBlob() for empty canvases or encoding failures. (@​Brooooooklyn)
• Changed CSS parsing, selector matching, and computed styles to use a new integrated implementation, with substantially expanded support and faster selector queries and repeated style reads. This includes cascade layers, nesting, @scope, custom-property substitution and registration through @property and CSS.registerProperty(), typed attr(), conditional if(), shadow-tree styling with :host, ::slotted(), and ::part(), pseudo-element computed styles, and constructable stylesheets with document.adoptedStyleSheets and shadowRoot.adoptedStyleSheets. Fixed numerous cascade, shorthand, serialization, and default-style issues; computed declarations now stay live across DOM and stylesheet changes. CSS serialization and computed values can differ from previous releases.
• Changed HTML and XML parsing to pause at blocking scripts until their required resources are ready. The JSDOM constructor, JSDOM.fromURL(), and JSDOM.fromFile() can now return partially parsed documents. Wait for DOMContentLoaded for the finished tree, or the window's load event for load-delaying resources, checking document.readyState first in case the event has already fired. XML syntax errors encountered after asynchronous parsing resumes are reported through the virtual console as "xml-parsing" errors.

Other changes

• Added window.reportError(), which dispatches an error event and reports uncanceled errors to the virtual console. (@​sarankumar1325)
• Added element.ariaBrailleLabel and element.ariaBrailleRoleDescription. (@​Kjubikstronk)
• Fixed page-completion load events to fire only on the window. Use window.addEventListener("load", ...) or window.onload instead of listening on the document.
• Fixed document.open(), including implicit calls from document.write(), to clear event listeners and handlers from the document, its descendants, and its window when replacing the input stream.
• Fixed document.write() to process successive writes through the parser's input stream, preserve insertion points across nested scripts, and make completed text immediately visible. Script-created input streams now remain open until document.close().
• Fixed dynamically inserted scripts to respect script.async = false execution order, use their source text and document from preparation time, and avoid executing after adoption into another document. Scripts parsed through inert fragment APIs no longer execute when subsequently inserted.
• Fixed unrelated images, stylesheets, and frames being delayed behind scripts, and resource completion events firing before nested stylesheet imports finish. Cyclic imports no longer prevent completion, and <style> elements in shadow trees now fire load events.
• Fixed window.stop() to cancel pending subresource and XMLHttpRequest requests in descendant frames and suppress completion events for canceled loads, while allowing subsequent requests to proceed.
• Fixed repeated document.close() calls replaying readiness and load events, and incorrect iframe load events when reopening documents from event handlers.
• Fixed memory leaks where pending request interceptor promises retained closed windows, introduced in v28.0.0.
• Fixed focus remaining on elements that become non-focusable after DOM or style changes. Focus now moves asynchronously to the document's viewport, and element.blur() can release it immediately.
• Fixed document.hasFocus() returning false before an element is focused or during focus transitions within the document, including inside frames.
• Fixed \<template> parsing and template.innerHTML serialization in XML documents, including templates with namespace prefixes. (@​b84330808)
• Fixed rect.toJSON() and performance.toJSON() to create their result objects in the method's realm instead of the host Node.js realm.

v30.1.3

• Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
• Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
• Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
• Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
• Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
• Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
• Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
• Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
• Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
• Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
• Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
• Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
• Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
• Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)

v30.1.2

• Updated URLs to support Unicode v18.0.0 in internationalized domain names.
• Reduced package size and memory use for CSS property definitions. (@​scttcper)
• Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
• Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
• Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
• Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
• Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
• Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.

... (truncated)

Commits

• 825fa8e 31.0.0
• 9f2e49a Add ariaBrailleLabel and ariaBrailleRoleDescription
• 4c0a35e Flush text written with document.write()
• fce11d3 Switch canvas support to @​napi-rs/canvas
• 27614bf Fix document.hasFocus() during focus changes
• 627ade2 Implement asynchronous focus fixup
• 8bd17a2 Implement reportError()
• 5ae66cf Update webidl2js and remove IDL workarounds
• ce5a100 Align development scripts and CI
• 9cc717f Adopt ESLint config v6 and oxfmt
• Additional commits viewable in compare view

Updates oxlint from 1.85.0 to 1.92.0

Release notes

Sourced from oxlint's releases.

oxlint v1.92.0

🚀 Features

• 4a52ba2 oxlint: Discover tsrs for type-aware linting (#28751) (camc314)
• b7d2c75 linter/eslint/no-redeclare: Add ignoreDeclarationMerge option (#28816) (Cam McHenry)

🐛 Bug Fixes

• fa66fde oxlint,oxfmt: Resolve Vite+ config root from the config file directory (#28801) (MK (fengmk2))
• 2091564 linter/jsdoc/require-param: Ignore enclosing function JSDoc (#28866) (camc314)
• c6ec50b linter/react/only-export-components: Classify JSX values as non-components (#28761) (camc314)
• 3c051ab linter/vitest/prefer-called-exactly-once-with: Preserve neighboring code in autofix (#28864) (camc314)
• 674b962 linter/eslint/no-misleading-character-class: Use lazy regex for combining marks (#28822) (Sysix)
• 838d339 linter/vitest/prefer-called-exactly-once-with: Avoid panic on non-ASCII text (#28850) (YT)
• 8d24c26 linter/jsx-a11y/aria-role: Allow role={undefined} (#28804) (Abhay Godavarthy)
• a7143bf linter/eslint/no-restricted-imports: Respect allowTypeImports correctly for empty patterns (#28842) (Cam McHenry)
• 3d3a6f4 react-compiler: Ignore callback-local reassignments (#28820) (camc314)
• 0cc6515 linter/unicorn/prefer-type-error: Report throws in unbraced if branches (#28819) (camc314)
• ae43c80 linter/unicorn/prefer-single-call: Remove duplicate fix status (#28763) (Mikhail Baev)
• a8a621a linter/eslint/no-fallthrough: Ignore unreachable exits from infinite loops (#28755) (camc314)
• 7a17a80 linter/eslint/prefer-spread: Report calls on non-member expressions (#28753) (camc314)
• 28442f7 oxlint: Prevent --init from overwriting existing configs (#28754) (camc314)
• 0ae350d linter/unicorn/no-zero-fractions: Preserve exponent case (#28752) (camc314)
• b5b3f3f linter/eslint/no-misleading-character-class: Detect more combining characters (#28733) (Sysix)

⚡ Performance

• 74d50c1 linter: Overlap import graph batches instead of polling on a pool worker (#28323) (Dunqing)

oxlint v1.91.0

🚀 Features

• 004647a track_memory_allocs: Add allocation tracking for linter rules (#28470) (Cam McHenry)
• 419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

🐛 Bug Fixes

• a205cd3 linter/eslint/no-control-regex: Detect raw control characters (#28548) (camc314)
• 7c65777 linter/unicorn/prefer-global-this: Align typeof and worker API handling (#28549) (camc314)
• 987d5f1 linter/unicorn/no-invalid-fetch-options: Avoid treating unknown methods as GET (#28547) (camc314)
• e234dc8 linter/unicorn/no-useless-error-capture-stack-trace: Move to suspicious category (#28545) (camc314)
• b3dc411 linter/typescript/no-non-null-asserted-nullish-coalescing: Move to suspicious category (#28546) (camc314)
• cb64638 regular_expression: Reject incomplete Unicode atom escapes (#28448) (Boshen)
• c67167e linter: Only run React Compiler rules on files with top-level components or hooks (Boshen)
• 4c9d5aa linter: Treat Reanimated shared values as ref-like in React Compiler rules (Boshen)
• 61fe2af linter/react: Ignore impure calls in async components in react/purity (Rahul Kashyap)
• ed7df7d ast/estree: Include comments in TS Program span (#28326) (camc314)
• 31cbe37 linter: Make gitlab fingerprints unique per diagnostic (#28307) (camc314)

⚡ Performance

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.92.0] - 2026-11-06

🚀 Features

• b7d2c75 linter/eslint/no-redeclare: Add ignoreDeclarationMerge option (#28816) (Cam McHenry)

[1.91.0] - 2026-11-02

🚀 Features

• 419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

[1.90.0] - 2026-10-27

🚀 Features

• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

[1.89.0] - 2026-10-19

🐛 Bug Fixes

• 9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (#27699) (camc314)

[1.88.0] - 2026-10-13

🚀 Features

• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

[1.86.0] - 2026-09-28

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

... (truncated)

Commits

• 29daf90 release(apps): oxlint v1.92.0 && oxfmt v0.77.0 (#28906)
• b7d2c75 feat(linter/eslint/no-redeclare): add ignoreDeclarationMerge option (#28816)
• f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
• 419c1b0 feat(linter): add allow and allowPattern options to react/capitalized-calls
• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 831cdf1 feat(oxlint): require mininum oxlint-tsgolint version v7.0.2005 (#28118)
• d1b00f4 feat(linter/typescript): implement no-unsafe-enum-assignment rule (#28117)
• 165c91f feat(linter/typescript/await-thenable): support allowMixedPromiseArrays opt...
• 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
• 9a424c2 fix(oxlint,oxfmt): correct Node.js TypeScript support range (#27699)
• Additional commits viewable in compare view

Updates vite-plugin-pwa from 1.3.0 to 2.0.0

Release notes

Sourced from vite-plugin-pwa's releases.

v2.0.0

v2.0.0 is the next major release.

👉 Changelog

compare changes

🚀 Enhancements

• ⚠️ allow @​vite-pwa/assets-generator ^2.0.0 as a peer dependency (#946)

📖 Documentation

• update breaking change note at readme to 2.0.0 (#953)

🏡 Chore

• replace publish workflow with uppt (#950)
• pin workflows actions (#948)
• update assets generator at the example (#947)

🎉 New Contributors

• Alessio Biancalana (@​dottorblaster)

❤️ Contributors

• Joaquín Sánchez (@​userquin)
• Alessio Biancalana (@​dottorblaster)

Commits

• 35bfa7d v2.0.0 (#952)
• b158525 docs: update breaking change note at readme to 2.0.0 (#953)
• c6fd3c1 chore: replace publish workflow with uppt (#950)
• 3c768c7 chore: pin workflows actions (#948)
• 8158b99 chore: update assets generator at the example (#947)
• 3e1914a feat!: allow @​vite-pwa/assets-generator ^2.0.0 as a peer dependency (#946)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions