build(deps): bump the minor-and-patch group with 23 updates

[dependabot]

Bumps the minor-and-patch group with 23 updates:

Package	From	To
@trycua/cua-driver	0.20.0	0.28.2
posthog-js	1.415.6	1.434.0
react	19.2.8	19.3.0
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.4	19.3.0
tailwind-merge	3.6.0	3.7.0
yaml	2.9.0	2.9.1
zod	4.4.3	4.6.5
@oxlint/plugins	1.80.0	1.83.0
@types/node	26.2.0	26.6.1
electron	44.2.0	44.4.2
oxlint	1.80.0	1.83.0
typebox	1.3.7	1.3.33
wrangler	4.123.0	4.134.0
cnfast	0.1.0	0.2.0
fumadocs-core	16.14.5	16.15.11
fumadocs-mdx	15.3.0	15.4.1
next	16.3.3	16.3.5
postcss	8.5.26	8.5.28
@cloudflare/workers-types	5.20260825.1	5.20260918.1
better-auth	1.7.1	1.7.5
@cloudflare/vitest-plugin	1.0.0	1.1.12

Updates @trycua/cua-driver from 0.20.0 to 0.28.2

Release notes

Sourced from @​trycua/cua-driver's releases.

cua-driver-rs: v0.28.2

Cua Driver 0.28.2

Summary

This release includes 4 fixes.

Fixes

• preserve semantic Hyprland AX scrolling. (#3820)
• unify desktop snapshot identity and payload ownership. (#3616)
• capture macOS desktops without relying on PATH. (#3755)
• route background text through Hyprland input. (#3877)

Contributors

This release contains maintainer changes only.

Install

macOS and Linux:

/bin/bash -c "$(curl -fsSL https://cua.ai/driver/install.sh)"

Windows:

irm https://cua.ai/driver/install.ps1 | iex

Cua Driver ships universal macOS binaries, x86_64 and arm64 Windows builds, and Linux preview builds. Release assets also include tag-pinned installer and uninstaller scripts.

Why GitHub says “Pre-release”

GitHub's label is used only to keep this monorepo's repository-wide “Latest” pointer from switching between independently released products. A plain Cua Driver SemVer is a stable release; npm and PyPI publish it on their normal stable channels, and the installers resolve the versioned cua-driver-rs-v* releases directly.

SHA256 Checksums

c3b4423dd4290f65f03579013f2c350e5a08b03458c9ae34ac4904865ec3f833  _install-rust.sh
448fbf0f9b6ca13dc0bdd3adb0f0f8432293abb0519efd2fe77be90e816e6539  checksums.txt
818ddefa0fa8ba2ec9cba837c7aa634a4b064221c748752cf49c5b08e2c94e8c  cua-driver-rs-0.28.2-darwin-arm64.tar.gz
</tr></table> 

... (truncated)

Commits

• fc18825 chore(main): release cua-driver-rs 0.28.2 (#3821)
• 2d8eb12 ci: make macOS E2E log filenames artifact-safe (#3893)
• 42d764b fix(cua-driver): route background text through Hyprland input (#3877)
• 14dd8cf docs(sandbox): drop the unreleased notice from the OSWorld on Fleet guide (#3...
• 6be0aae chore(main): release sandbox 0.8.0 (#3840)
• 5fcd673 fix(ci): validate attribution configuration changes against their ancestor (#...
• d740aa8 docs: add Codex native Computer Use Windows Fleet guide (#3865)
• 05a0358 feat(growth): restore daily reporting and campaign attribution (#7832)
• 1c554ed test(cua-driver): isolate uninstall autostart process discovery (#3854)
• db8ba21 feat(sandbox): OSWorld disks on Fleet via agent_type="osworld" + "Run OSWorld...
• Additional commits viewable in compare view

Updates posthog-js from 1.415.6 to 1.434.0

Release notes

Sourced from posthog-js's releases.

posthog-js@1.434.0

1.434.0

Minor Changes

• #5014 5e86154 Thanks @​pauldambra! - Rename the metrics.network default attributes to the OTel HTTP client semantic conventions: http.request.method, server.address, server.port, url.scheme, url.template, http.response.status_code and error.type replace method, host, path and status_class. (2026-09-17)

Patch Changes

• Updated dependencies [5e86154]:
  • @​posthog/types@​1.412.2

posthog-js@1.433.10

1.433.10

Patch Changes

• #4960 c8e53fa Thanks @​posthog! - Log a console warning when session replay stops capturing canvas frames (browser without OffscreenCanvas, a CSP that blocks blob: workers, or a failing canvasCapture.maskRegionsFn), and stop changing WebGL and WebGPU canvas settings when canvas capture fails to start (2026-09-17)

• #4977 0257a29 Thanks @​lucasheriques! - Share survey choice and question shuffling between web and React Native through surveys core. Use Fisher-Yates for web questions, preserve Other-last choice ordering, and avoid mutating configured choices. (2026-09-17)

• Updated dependencies [0257a29]:

  • @​posthog/core@​1.54.4

posthog-js@1.433.9

1.433.9

Patch Changes

• #5007 c3043f4 Thanks @​marandaneto! - Add a session diagnostic when stale replay configuration cannot be refreshed, without changing recording behavior. (2026-09-17)

posthog-js@1.433.8

1.433.8

Patch Changes

• #4709 c1d1faf Thanks @​posthog! - Prefer synchronous compression for events captured with send_instantly, including the initial $pageview, to avoid delaying request dispatch on asynchronous compression. (2026-09-17)

posthog-js@1.433.7

1.433.7

Patch Changes

• #4979 c767b98 Thanks @​darkopia! - fix(surveys): keep URL prefill working when localStorage is unavailable, such as on a page with an opaque origin or in private browsing (2026-09-16)
• Updated dependencies [2828b6b]:

... (truncated)

Commits

• 90c7afb chore: update versions and lockfile [version bump]
• 5e86154 feat(metrics): use OTel attribute names for network request durations (#5014)
• 3fb8954 chore: update versions and lockfile [version bump]
• be40430 chore(mcp): enable model capture and conversation correlation by default (#4924)
• d5123fc chore: update versions and lockfile [version bump]
• 614e508 fix(react-native): compose source maps after Babel transforms (#5006)
• 63944c7 chore: update versions and lockfile [version bump]
• c8e53fa fix(replay): make canvas capture failures self-diagnosable (#4960)
• 0257a29 refactor(surveys): share shuffling across web and React Native (#4977)
• 63f55dc chore: update versions and lockfile [version bump]
• Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #37113)
• Only remove properties from Host Singletons on release (@​gnoff #37112)

... (truncated)

Commits

• 2dc7da7 [test] Bump Jest to 30.4 (#37382)
• 4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
• dbc3750 Update required references to GitHub repo (#36752)
• 900ae09 [flow] Bump flow to v0.317.0 (#36701)
• fbb1370 [flow] Bump flow to v0.307.1 (#36199)
• 56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
• 74568e8 [Flight] Transport AggregateErrors.errors (#36156)
• e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
• db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
• 3e1abcc [tests] Require exact error messages in assertConsole helpers (#35497)
• Additional commits viewable in compare view

Updates @types/react from 19.2.18 to 19.3.0

Commits

• See full diff in compare view

Updates react-dom from 19.2.8 to 19.3.0

Release notes

Sourced from react-dom's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (<...

    Description has been truncated