fix(deps): update dependency @testing-library/user-event (14.6.6 → 14.6.7)

[its-miso]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@testing-library/user-event	14.6.6 → 14.6.7

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

testing-library/user-event (@​testing-library/user-event)

v14.6.7

Compare Source

Bug Fixes

• normalize DataTransfer format aliases (#​1326) (1e0020b)
• feature: Add iframe support for user.keyboard typing (#​1275) (1e0020b)

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

Recommendation

Approve. This is a lockfile-only patch bump of @testing-library/user-event from 14.6.6 to 14.6.7, a patch release with no public API removals. All required CI gates passed on the PR commit, the underlying changes are scoped to DataTransfer format normalization and iframe focus handling, and CI coverage validates the test suite against the bumped package.

Change-by-change findings

• package-lock.json (only file modified): Three lines changed — version string (14.6.6 → 14.6.7), resolved tarball URL, and the integrity hash. No other transitive package was disturbed, and package.json was not touched, so the direct dependency declaration is unaffected. The engines constraint and dev-only flag remain unchanged.
• @testing-library/user-event 14.6.6 → 14.6.7 upstream: Two commits in the patch range. (1) fix: normalize DataTransfer format aliases — adds spec-compliant ASCII-lowercase normalization and text/url shorthand expansion in the DataTransfer stub's setData, getData, clearData, and add paths. (2) feat: Add iframe support for user.keyboard typing — getActiveElement now recurses into a focused <iframe>'s contentDocument so keyboard input is dispatched to the iframe's focused element rather than the host document. Both are additive bug-fix/feature work inside the package; neither changes exported function signatures or removes anything from the public surface.

Sources

• Upstream compare between the two versions on testing-library/user-event, summarizing both fixes and their affected files (src/utils/dataTransfer/DataTransfer.ts, src/utils/focus/getActiveElement.ts).
• v14.6.7 release page on testing-library/user-event for the patch's canonical summary.
• Repository history showing prior identical bumps (14.6.5 → 14.6.6, the previous fix(deps) PR) were handled the same way and merged cleanly.

Required Checks

• Check for breaking API changes in updated dependencies. Verified. The 14.6.6 → 14.6.7 diff (two commits) modifies only internal helpers in src/utils/dataTransfer/DataTransfer.ts (adds toAsciiLowercase/normalizeFormat and threads the normalized value through existing setData/getData/clearData/add paths) and adds an iframe-focus branch to getActiveElement. No public exports are added, renamed, or removed; no signatures change. Behavior shifts are confined to the package's DataTransfer stub (format alias normalization, now spec-conformant) and keyboard focus traversal into focused <iframe> content — neither alters the API surface Dispatch consumes. Risk of breakage for Dispatch's existing tests is low and would manifest as test changes, not runtime failures, because user-event is a dev-only test utility (no production code paths). This is not a HOST-PLATFORM-coupled bump: the changed manifest pins no host/peer platform version, so the host-platform compatibility-matrix step does not apply.
• Run full test suite after upgrade. Verified by CI. The PR's head commit (a8954a130b0f2d974f3c86321b16baf3bbea0013) has terminal-status CI with all checks green, including Tests, Coverage, Lint, Typecheck, Build, npm audit, smoke, both Docker Build jobs, Database migrations, and Database integration. The CI runs against the bumped package-lock, so the suite is exercised post-upgrade, not against the old pin. No post-merge run is required to satisfy this check.

Tool Harness Findings

The harness issued no tool calls, so no extra signals beyond the corpus. CI results above are authoritative evidence that the suite passed against the bumped lockfile.

Standards Compliance

AGENTS.md does not define conventions specific to dependency bump PRs beyond the general code standards (no secrets in commits, lint/typecheck must pass CI). This PR touches only package-lock.json and the contributing .github/workflows/ci.yaml and image workflow remain unaffected. Lint, typecheck, tests, and the security advisory gate (npm audit) all passed in CI, which is the practical enforcement of those standards for a dep bump. No standards violation observed.