chore(deps): bump the production-dependencies group across 1 directory with 21 updates

[dependabot]

Bumps the production-dependencies group with 21 updates in the / directory:

Package	From	To
@hookform/resolvers	5.8.0	5.9.1
@langchain/core	1.2.7	1.2.10
@langchain/openai	1.5.7	1.5.12
@pinecone-database/pinecone	8.2.0	9.0.0
@sentry/nextjs	10.70.0	10.74.0
@tavily/core	0.7.7	0.7.10
autoprefixer	10.5.4	10.5.6
express-rate-limit	8.6.2	8.7.0
inngest	4.18.1	4.20.0
input-otp	1.4.2	1.5.0
langchain	1.5.8	1.5.11
lucide-react	1.31.0	1.44.0
mongoose	9.9.2	9.10.0
next	16.3.1	16.3.4
posthog-js	1.417.0	1.430.1
react	19.2.8	19.3.0
react-dom	19.2.8	19.3.0
react-hook-form	7.85.0	7.87.0
react-resizable-panels	4.12.2	4.12.4
uuid	14.0.1	14.0.2
zod	4.4.3	4.6.2

Updates @hookform/resolvers from 5.8.0 to 5.9.1

Release notes

Sourced from @​hookform/resolvers's releases.

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

• isNameInFieldArray fails to recognise bracket-notation array paths causing nested errors overwriting (#876) (f18ddfb)

v5.9.0

5.9.0 (2026-08-15)

Features

• update joi to v18 (#873) (c8159ae)

Commits

• f18ddfb fix: isNameInFieldArray fails to recognise bracket-notation array paths causi...
• c8159ae feat: update joi to v18 (#873)
• See full diff in compare view

Updates @langchain/core from 1.2.7 to 1.2.10

Release notes

Sourced from @​langchain/core's releases.

@​langchain/core@​1.2.10

Patch Changes

• #10047 ff1248f Thanks @​afirstenberg! - fix(core): BaseMessage.text use contentBlocks

@​langchain/core@​1.2.9

Patch Changes

• #11402 43e4396 Thanks @​thushanth-bengre-langchain! - Fix ChatVertexAI/ChatGoogle content blocks: include tool_call blocks from message.tool_calls and skip spurious empty text blocks in contentBlocks.

@​langchain/core@​1.2.8

Patch Changes

• #11369 d6ad973 Thanks @​hntrl! - fix(langchain): use unified endpoint for gateway

• #11342 3b0e4c4 Thanks @​thushanth-bengre-langchain! - feat(core): mark errors as retryable or not, and stop retrying the ones that aren't

  Retry middleware retried every failure up to maxRetries, including deterministic ones like a bad API key or an unknown model. Retries also nest, so a single such failure could cost dozens of API calls.

  @langchain/core/errors adds stampRetryable(error, retryable) and getRetryable(error). Marking an error leaves its class and shape untouched, so a provider SDK error can be classified without breaking instanceof. getRetryable returns undefined for errors nobody classified, and both are exported so tool authors can mark their own failures.

  modelRetryMiddleware and toolRetryMiddleware now respect the mark by default, and retries stop as soon as one is found rather than each layer spending its own budget. Aborted calls, context overflow, and oversized payloads are marked non-retryable out of the box. Models accept a per-call maxRetries so a surrounding retry loop can take over.

  Behavior change: errors marked non-retryable now fail on the first attempt. Unclassified errors — including any from third-party integrations or custom tools — retry exactly as before. Pass retryOn: () => true to restore the old default. A custom onFailedAttempt replaces the built-in handler and opts out of marking.

Commits

• a443ab0 chore: version packages (#11591)
• 6165540 chore: exit prerelease (#11595)
• 7129b68 revert(langchain): remove middleware trace policies (#11568) (#11594)
• 702be70 fix(langchain): skip thought text blocks in ProviderStrategy.parse (#11436)
• ff1248f fix(core): BaseMessage.text use contentBlocks (#10047)
• 7d6e1b0 fix(openai): Fix base url deserialization (#11588)
• 2750442 fix(google-common): serialize tool choice modes for Vertex AI (#11266)
• 5c89094 fix(google): thought and thoughtSignature on round trip (#11574)
• 6bd3a18 feat(openai): Support configuration_update for openAI (#11560)
• 56130de chore: version packages (rc) (#11532)
• Additional commits viewable in compare view

Updates @langchain/openai from 1.5.7 to 1.5.12

Release notes

Sourced from @​langchain/openai's releases.

@​langchain/openai@​1.5.12

Patch Changes

• #11560 6bd3a18 Thanks @​thushanth-bengre-langchain! - Support configuration_update content blocks for changing reasoning effort mid-conversation without invalidating the cached prompt prefix.

• #11588 7d6e1b0 Thanks @​jacoblee93! - fix(openai): Fix base url deserialization

• #11534 80c5c93 Thanks @​chiliec! - Route gpt-5.6-sol to the Responses API so function tools work with reasoning.

@​langchain/openai@​1.5.12-rc.0

Patch Changes

• #11534 80c5c93 Thanks @​chiliec! - Route gpt-5.6-sol to the Responses API so function tools work with reasoning.

@​langchain/openai@​1.5.11

Patch Changes

• #11448 53dbfc2 Thanks @​hntrl! - fix(openai): resolve encrypted content with zdr when streaming

  OpenAI recently changed the disposition of encrypted_content to contain the canonical payload on the final done event. Encrypted content also does not need to be a parameter in the include call options in order to propagate.

@​langchain/openai@​1.5.10

Patch Changes

• #11419 c26c87e Thanks @​chiliec! - fix(openai): send content null (not []) for tool-call-only v1 assistant messages

@​langchain/openai@​1.5.9

Patch Changes

• #11399 5c9fdf2 Thanks @​gethin-langchain! - update to v7 openai sdk

• #11403 fe8eec1 Thanks @​thushanth-bengre-langchain! - Drop Gemini-native functionCall content blocks (already carried in tool_calls) when converting messages to Chat Completions API params, fixing requests that fail when a ChatGoogleGenerativeAI message is passed to ChatOpenAI (e.g. a cross-provider handoff in LangGraph).

• #11399 5c9fdf2 Thanks @​gethin-langchain! - Map OpenAI's cache_write_tokens to cache_creation in usage_metadata.input_token_details, mirroring the existing cached_tokens -> cache_read mapping across the Chat Completions and Responses APIs. Previously, prompt cache-write token counts were silently dropped.

@​langchain/openai@​1.5.8

Patch Changes

• #11342 3b0e4c4 Thanks @​thushanth-bengre-langchain! - feat(openai): mark OpenAI provider errors as retryable or not

  Builds on stampRetryable in @langchain/core so the retry middleware can tell a transient failure from a deterministic one. Timeouts and rate limits are marked retryable; aborts, context overflow, invalid tool results, bad credentials, and unknown models non-retryable. Anything else stays unmarked and retries as before.

  Also forwards a per-call maxRetries to the retry loop, so a surrounding retry loop such as modelRetryMiddleware can take over instead of the two multiplying against each other.

  Errors keep their original class, so instanceof against the openai SDK error types is unaffected.

Commits

• a443ab0 chore: version packages (#11591)
• 6165540 chore: exit prerelease (#11595)
• 7129b68 revert(langchain): remove middleware trace policies (#11568) (#11594)
• 702be70 fix(langchain): skip thought text blocks in ProviderStrategy.parse (#11436)
• ff1248f fix(core): BaseMessage.text use contentBlocks (#10047)
• 7d6e1b0 fix(openai): Fix base url deserialization (#11588)
• 2750442 fix(google-common): serialize tool choice modes for Vertex AI (#11266)
• 5c89094 fix(google): thought and thoughtSignature on round trip (#11574)
• 6bd3a18 feat(openai): Support configuration_update for openAI (#11560)
• 56130de chore: version packages (rc) (#11532)
• Additional commits viewable in compare view

Updates @pinecone-database/pinecone from 8.2.0 to 9.0.0

Release notes

Sourced from @​pinecone-database/pinecone's releases.

Release v9.0.0

Pinecone TypeScript SDK v9.0.0

v9 brings schema-based document operations into the main client, adds recurring backup schedules, and targets Pinecone API version 2026-07. It requires Node.js 22 or later.

Classic vector methods such as index.upsert, query, and fetch remain available, and deprecated flat control methods retain supported v8 request shapes. Review the breaking changes below for response-type changes, preview migration, and index-configuration restrictions. The v9 migration guide provides the detailed upgrade reference.

What's new

Work with schema-based documents through the main client

Search documents by vector similarity or full text, return selected fields, and update records by ID or filter through the main client. Use pc.indexes.create to define searchable fields in schema.fields, then access documents through pc.index('my-index').namespace('my-namespace').documents. The accessor provides upsert, search, fetch, update, delete, and list.

For example, create a full-text index and search product descriptions:

import { Pinecone } from '@pinecone-database/pinecone';
const pc = new Pinecone();
await pc.indexes.create({
name: 'product-documents',
schema: {
fields: {
description: { type: 'string', fullTextSearch: {} },
},
},
waitUntilReady: true,
});
const documents = pc.index('product-documents').namespace('catalog').documents;
await documents.upsert({
documents: [
{ _id: 'shoe-1', description: 'Waterproof hiking shoes' },
{ _id: 'shoe-2', description: 'Lightweight running shoes' },
],
});
// Newly written documents may take a moment to become searchable.
const results = await documents.search({
scoreBy: [{ type: 'text', fields: ['description'], query: 'hiking shoes' }],
topK: 5,
includeFields: ['description'],
});
console.log(results.matches);

Document operations replace the pc.preview document methods. Classic vector indexes continue using vector methods, and integrated-embedding indexes use upsertRecords and searchRecords.

Schedule recurring backups

... (truncated)

Commits

• fca1f72 [skip ci] Publish release v9.0.0
• 2d60e31 fix: grant release workflow pull request read permission
• 9a34bfe Merge pull request #172 from pinecone-io/codex/document-search-guides
• f171d4d Merge remote-tracking branch 'origin/main'
• 4447b8d docs: cover document search and backup schedules
• bb6e99f Add TypeScript SDK public sync script
• 3b783ba Merge pull request #171 from pinecone-io/codex/land-legacy-compatibility
• cefaf20 Merge legacy capacity and named option fixes into release candidate
• bfe8c3e Merge pull request #164 from pinecone-io/codex/issue-157
• f350d60 Merge pull request #143 from pinecone-io/codex/legacy-index-response
• Additional commits viewable in compare view

Updates @sentry/nextjs from 10.70.0 to 10.74.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.74.0

• feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)
• fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)
• fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)
• fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)
• fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
• fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)
• fix(v10/core): Resolve MCP capture policy per operation (#23796)
• fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)
• fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)
• fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)
• fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)
• fix(v10/profiling-node): Bump @​sentry/node-cpu-profiler to 2.4.4 (#24238)
• fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)
• fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#23994)
• fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#23998)

• test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#23910)

Work in this release was contributed by @​halillusion and @​zkasuran. Thank you for your contributions!

Bundle size 📦

Path	Size
@​sentry/browser	27.12 KB
@​sentry/browser - with treeshaking flags	25.59 KB
@​sentry/browser (incl. Tracing)	45.53 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.29 KB
@​sentry/browser (incl. Tracing, Profiling)	50.18 KB
@​sentry/browser (incl. Tracing, Replay)	83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	100.82 KB
@​sentry/browser (incl. Feedback)	43.89 KB
@​sentry/browser (incl. sendFeedback)	31.8 KB
@​sentry/browser (incl. FeedbackAsync)	36.82 KB
@​sentry/browser (incl. Metrics)	28.19 KB
@​sentry/browser (incl. Logs)	28.41 KB
@​sentry/browser (incl. Metrics & Logs)	29.09 KB
@​sentry/react	28.89 KB
@​sentry/react (incl. Tracing)	47.74 KB
@​sentry/vue	32.42 KB
@​sentry/vue (incl. Tracing)	47.47 KB
@​sentry/svelte	27.15 KB

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.74.0

• feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)
• fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)
• fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)
• fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)
• fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
• fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)
• fix(v10/core): Resolve MCP capture policy per operation (#23796)
• fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)
• fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)
• fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)
• fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)
• fix(v10/profiling-node): Bump @​sentry/node-cpu-profiler to 2.4.4 (#24238)
• fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)
• fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#23994)
• fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#23998)

• test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#23910)

Work in this release was contributed by @​halillusion and @​zkasuran. Thank you for your contributions!

10.73.0

Important Changes

• feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

  withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.

  // next.config.mjs
  - import { withSentryConfig } from '@sentry/nextjs';
  + import { withSentryConfig } from '@sentry/nextjs/config';

Other Changes

• feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)
• fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)

• test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

... (truncated)

Commits

• ce5009a release: 10.74.0
• 4b24ddd meta(changelog): Update changelog for 10.74.0 (#24252)
• 371ed5d fix(v10/profiling-node): Bump @​sentry/node-cpu-profiler to 2.4.4 (#24238)
• 9f38e48 fix(v10/browser): Set user_agent.original on all spans for consistent filte...
• 264f990 fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entr...
• c89f6e6 fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundl...
• de25dcb fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
• b627037 feat(v10): Streamline isolation scope handling & reset in isolation scopes (#...
• 2ce0ea1 fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute f...
• 3e0eccc fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (...
• Additional commits viewable in compare view

Updates @tavily/core from 0.7.7 to 0.7.10

Commits

• See full diff in compare view

Updates autoprefixer from 10.5.4 to 10.5.6

Release notes

Sourced from autoprefixer's releases.

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

10.5.5

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

Changelog

Sourced from autoprefixer's changelog.

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

10.5.5

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

Commits

• b031690 Release 10.5.6 version
• da65c36 Add warning when Autoprefixer can cover CSS for old Safari
• 604f8d9 Update dependencies
• 54608ca Fix old WebKit gradients with color hints (#1554)
• 7e81fff Release 10.5.5 version
• d9e3531 Update dependencies
• 34b3a3e Fix media query parse performance
• 265521e Remove Cult
• dd80d38 Update EM banner
• See full diff in compare view

Updates express-rate-limit from 8.6.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

Commits

• 48db09e 8.7.0
• dce5871 v8.7.0 changelog
• 2f08044 Add inspect.software health badge (#673)
• a29757c feat: add retryAfter option (#661)
• 146e88b chore: rename license
• 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
• 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
• 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
• 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
• 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
• Additional commits viewable in compare view

Updates inngest from 4.18.1 to 4.20.0

Release notes

Sourced from inngest's releases.

inngest@4.20.0

Minor Changes

• #1672 37813011 Thanks @​jakobevangelista! - Add sandbox snapshot create, list, get, wait, delete, and clone APIs to both the direct client and step.sandbox.

• #1683 3b5ddba5 Thanks @​jakobevangelista! - Add sandbox pause and resume APIs to both the direct client and step.sandbox.

inngest@4.19.0

Minor Changes

• #1701 f4fa1eb8 Thanks @​jakobevangelista! - Wait for newly created sandboxes to reach RUNNING by default, with runningTimeout: false as an explicit opt-out.

Patch Changes

• #1713 f7c49003 Thanks @​KiKoS0! - Route signing-key API requests to the correct branch environment and include SDK identification headers.

• #1700 8f5dceb4 Thanks @​jakobevangelista! - Return captured sandbox command stdout and stderr as UTF-8 strings.

• #1705 28603273 Thanks @​jakobevangelista! - Allow sandbox commands to use executable names and relative paths.

• #1684 dde88e4d Thanks @​jakobevangelista! - Support shell command strings in the experimental sandbox command and managed process APIs.

• #1693 a2cd5b48 Thanks @​scottnuma! - Validate propagated sessions with step.invoke and defer

• #1712 a9975874 Thanks @​jakobevangelista! - Export SandboxCommand from inngest/experimental.

• Updated dependencies [abc4a63f]:

  • @​inngest/ai@​0.1.8

Changelog

Sourced from inngest's changelog.

4.20.0

Minor Changes

• #1672 37813011 Thanks @​jakobevangelista! - Add sandbox snapshot create, list, get, wait, delete, and clone APIs to both the direct client and step.sandbox.

• #1683 3b5ddba5 Thanks @​jakobevangelista! - Add sandbox pause and resume APIs to both the direct client and step.sandbox.

4.19.0

Minor Changes

• #1701 f4fa1eb8 Thanks @​jakobevangelista! - Wait for newly created sandboxes to reach RUNNING by default, with runningTimeout: false as an explicit opt-out.

Patch Changes

• #1713 f7c49003 Thanks @​KiKoS0! - Route signing-key API requests to the correct branch environment and include SDK identification headers.

• #1700 8f5dceb4 Thanks @​jakobevangelista! - Return captured sandbox command stdout and stderr as UTF-8 strings.

• #1705 28603273 Thanks @​jakobevangelista! - Allow sandbox commands to use executable names and relative paths.

• #1684 dde88e4d Thanks @​jakobevangelista! - Support shell command strings in the experimental sandbox command and managed process APIs.

• #1693 a2cd5b48 Thanks @​scottnuma! - Validate propagated sessions with step.invoke and defer

• #1712 a9975874 Thanks @​jakobevangelista! - Export SandboxCommand from inngest/experimental.

• Updated dependencies [abc4a63f]:

  • @​inngest/ai@​0.1.8

Commits

• 8727707 Release @​latest (#1721)
• 3b5ddba feat(sandbox): add pause and resume lifecycle (#1683)
• 3781301 feat(sandbox): add snapshot APIs (#1672)
• 947a244 Release @​latest (#1709)
• 2860327 feat(sandbox): allow non-absolute commands (#1705)
• a997587 fix(sandbox): export SandboxCommand type (#1712)
• f7c4900 fix: send environment on signing-key API requests (#1713)
• dde88e4 feat(sandbox): support shell command strings (#1684)
• f4fa1eb feat(sandbox): wait for running by default (#1701)
• 8f5dceb fix(sandbox): return command output as text (#1700)
• Additional commits viewable in compare view

Updates input-otp from 1.4.2 to 1.5.0

Release notes

Sourced from input-otp's releases.

v1.5.0

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

• fix(input): reserve the password manager badge gutter only where it fits
• fix(input): disable spellcheck by default
• fix(input): feature-detect ResizeObserver before observing
• fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
• fix(input): clear pending synchronization timeouts on unmount
• feat(input): add a nonce prop for Content-Security-Policy support
• fix(input): guard the input reference used by the selectionchange listener
• fix(input): opt the container out of browser translation
• fix(input): report cosmetic CSS rule failures as warnings instead of errors
• docs: document the stable iOS selection behavior and its cosmetic limitation

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

• revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
• revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
• docs: align the mobile and edge-case documentation with the stable candidate
• test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

• fix(input): reserve the password manager badge gutter only where it fits
  • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
• fix(input): disable spellcheck by default
  • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
• fix(input): feature-detect ResizeObserver before observing
  • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
• fix(input): fall back to 16px font-size until --root-height resolves
  • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
• fix(input): clear pending sync timeouts on unmount
  • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
• feat(input): add nonce prop
  • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
• fix(input): use the guarded input reference inside the selectionchange listener
  • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
• fix(input): opt the container out of browser translation
  • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.
• fix(input): log CSS rule insertion failures as warnings, not errors
  • Some environments reject individual cosmetic selectors (:autofill in older Android WebViews, for instance). Nothing breaks when that happens, but the console.error was captured by Sentry and similar tools as if the application had failed. Same message, warning level.
• chore(types): narrow onComplete to (value: string) => unknown

... (truncated)

Changelog

Sourced from input-otp's changelog.

[1.5.0]

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

• fix(input): reserve the password manager badge gutter only where it fits
• fix(input): disable spellcheck by default
• fix(input): feature-detect ResizeObserver before observing
• fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
• fix(input): clear pending synchronization timeouts on unmount
• feat(input): add a nonce prop for Content-Security-Policy support
• fix(input): guard the input reference used by the selectionchange listener
• fix(input): opt the container out of browser translation
• fix(input): report cosmetic CSS rule failures as warnings instead of errors
• docs: document the stable iOS selection behavior and its cosmetic limitation

[1.5.0-beta.2]

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

• revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
• revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
• docs: align the mobile and edge-case documentation with the stable candidate
• test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

[1.5.0-beta.1]

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

[1.5.0-beta.0]

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

• fix(input): reserve the password ma...

  Description has been truncated

[dependabot]

Assignees

The following users could not be added as assignees: vectorMindsAI. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.