fix(deps): update patch updates group

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@ai-sdk/groq (source)	3.0.30 → 3.0.60
@mantine/core (source)	8.3.17 → 8.3.18
@mantine/dates (source)	8.3.17 → 8.3.18
@mantine/form (source)	8.3.17 → 8.3.18
@mantine/hooks (source)	8.3.17 → 8.3.18
@mantine/notifications (source)	8.3.17 → 8.3.18
@mediapipe/tasks-vision	0.10.32 → 0.10.35
@speechmatics/browser-audio-input (source)	2.0.3 → 2.0.4
@speechmatics/browser-audio-input-react (source)	2.0.3 → 2.0.4
@testing-library/user-event	14.6.1 → 14.6.4
@types/luxon (source)	3.7.1 → 3.7.4
@types/react (source)	19.2.14 → 19.2.18
@types/react-dom (source)	19.2.3 → 19.2.4
@vitest/runner (source)	3.2.4 → 3.2.7
@vitest/snapshot (source)	3.2.4 → 3.2.7
ai (source)	6.0.128 → 6.0.256
jose	6.2.1 → 6.2.9
linkify-react (source)	4.3.2 → 4.3.3
linkifyjs (source)	4.3.2 → 4.3.3
postcss (source)	8.5.8 → 8.5.26
react (source)	19.2.4 → 19.2.8
react-dom (source)	19.2.4 → 19.2.8
vite (source)	7.3.1 → 7.3.6
zustand	5.0.12 → 5.0.15

---

Release Notes

vercel/ai (@​ai-sdk/groq)

v3.0.60

Compare Source

Patch Changes

• Updated dependencies [31205a4]
  • @​ai-sdk/provider-utils@​4.0.46

v3.0.59

Compare Source

Patch Changes

• Updated dependencies [b2a4d5a]
  • @​ai-sdk/provider-utils@​4.0.45

v3.0.58

Compare Source

Patch Changes

• Updated dependencies [2171d15]
  • @​ai-sdk/provider@​3.0.15
  • @​ai-sdk/provider-utils@​4.0.44

v3.0.57

Compare Source

Patch Changes

• Updated dependencies [dab0a08]
  • @​ai-sdk/provider-utils@​4.0.43

v3.0.56

Compare Source

Patch Changes

• Updated dependencies [ee2bf30]
  • @​ai-sdk/provider-utils@​4.0.42

v3.0.55

Compare Source

Patch Changes

• ae2812a: fix(groq): map word timestamps to transcription segments when segment timestamps are unavailable
• cc3269f: Support plain-text responses from Groq transcription models when responseFormat is set to text.

v3.0.54

Compare Source

Patch Changes

• Updated dependencies [9ecdefe]
  • @​ai-sdk/provider-utils@​4.0.41

v3.0.53

Compare Source

Patch Changes

• Updated dependencies [19093fd]
  • @​ai-sdk/provider-utils@​4.0.40

v3.0.52

Compare Source

Patch Changes

• Updated dependencies [06fb54c]
  • @​ai-sdk/provider-utils@​4.0.39

v3.0.51

Compare Source

Patch Changes

• cee7e45: fix (provider/groq): surface prompt cache reads in usage

  convertGroqUsage accepted prompt_tokens_details.cached_tokens but never read it, so cache hits were reported as cacheRead: undefined and the entire prompt was counted as noCache. Groq's implicit prompt caching now surfaces as usage.cachedInputTokens (mapped to cacheRead, subtracted from noCache). Groq has no cache-creation charge, so cacheWrite remains undefined.

v3.0.50

Compare Source

Patch Changes

• Updated dependencies [e1af05f]
  • @​ai-sdk/provider@​3.0.14
  • @​ai-sdk/provider-utils@​4.0.38

v3.0.49

Compare Source

Patch Changes

• bef93ae: fix(security): prevent streaming tool calls from finalizing on parsable partial JSON

  Streaming tool call arguments were finalized using isParsableJson() as a heuristic for completion. If partial accumulated JSON happened to be valid JSON before all chunks arrived, the tool call would be executed with incomplete arguments. Tool call finalization now only occurs in flush() after the stream is fully consumed.

• 327642b: fix: more precise default message for tool execution denial

• Updated dependencies [d559de9]

  • @​ai-sdk/provider-utils@​4.0.37

v3.0.48

Compare Source

Patch Changes

• Updated dependencies [0952964]
  • @​ai-sdk/provider-utils@​4.0.36

v3.0.47

Compare Source

Patch Changes

• Updated dependencies [ea1e95b]
  • @​ai-sdk/provider-utils@​4.0.35

v3.0.46

Compare Source

Patch Changes

• Updated dependencies [fa850e6]
  • @​ai-sdk/provider@​3.0.13
  • @​ai-sdk/provider-utils@​4.0.34

v3.0.45

Compare Source

Patch Changes

• Updated dependencies [b30e43a]
  • @​ai-sdk/provider-utils@​4.0.33

v3.0.44

Compare Source

Patch Changes

• Updated dependencies [f19334d]
  • @​ai-sdk/provider@​3.0.12
  • @​ai-sdk/provider-utils@​4.0.32

v3.0.43

Compare Source

Patch Changes

• 1b40ac7: Publish all packages under the @ai-v6 dist tag.
• Updated dependencies [1b40ac7]
  • @​ai-sdk/provider-utils@​4.0.31
  • @​ai-sdk/provider@​3.0.11

v3.0.42

Compare Source

Patch Changes

• Updated dependencies [779f5cd]
  • @​ai-sdk/provider-utils@​4.0.30

v3.0.41

Patch Changes

• Updated dependencies [bfa5864]
• Updated dependencies [f42aa79]
  • @​ai-sdk/provider-utils@​4.0.29

v3.0.39

Compare Source

Patch Changes

• Updated dependencies [f591416]
  • @​ai-sdk/provider-utils@​4.0.27

v3.0.38

Compare Source

Patch Changes

• Updated dependencies [7beadf0]
  • @​ai-sdk/provider-utils@​4.0.26

v3.0.37

Compare Source

Patch Changes

• a727da4: chore: ensure consistent import handling and avoid import duplicates or cycles
• Updated dependencies [a727da4]
  • @​ai-sdk/provider-utils@​4.0.25
  • @​ai-sdk/provider@​3.0.10

v3.0.36

Compare Source

Patch Changes

• a7f3c72: trigger release for all packages after provenance setup
• Updated dependencies [a7f3c72]
  • @​ai-sdk/provider@​3.0.9
  • @​ai-sdk/provider-utils@​4.0.24

v3.0.35

Compare Source

Patch Changes

• d42076d: Add AI Gateway hint to provider READMEs

v3.0.34

Compare Source

Patch Changes

• Updated dependencies [6247886]
  • @​ai-sdk/provider-utils@​4.0.23

v3.0.33

Compare Source

Patch Changes

• Updated dependencies [0469aed]
  • @​ai-sdk/provider-utils@​4.0.22

v3.0.32

Patch Changes

• cb3ca8f: feat: Groq support for performance service tier

mantinedev/mantine (@​mantine/core)

v8.3.18

Compare Source

This is the last 8.x release. You are welcome to test 9.0 alpha version and provide feedback before its release on March 31 – https://alpha.mantine.dev/changelog/9-0-0/

• [@mantine/core] PasswordInput: Fix styles api props not resolving correctly in theme (#​8716)

testing-library/user-event (@​testing-library/user-event)

v14.6.4

Compare Source

v14.6.3

Compare Source

vitest-dev/vitest (@​vitest/runner)

v3.2.7

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v3]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10679 (b795e)

    View changes on GitHub

v3.2.6

Compare Source

   🐞 Bug Fixes

• Pin last supported vite-node version  -  by @​sheremet-va (16f12)

    View changes on GitHub

v3.2.5

Compare Source

   🚀 Features

• api: Add allowWrite and allowExec options to api [backport to v3]  -  by @​hi-ogawa and Codex in #​10445 (af88b)

   🐞 Bug Fixes

• browser: Disable client cdp API when allowWrite/allowExec: false [backport to v3]  -  by @​hi-ogawa and Codex in #​10456 (385a1)

    View changes on GitHub

panva/jose (jose)

v6.2.9

Compare Source

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

v6.2.8

Compare Source

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Compare Source

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Compare Source

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Compare Source

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #​879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)
• resolve the content encryption algorithm once (98b50ab)
• tighten key property checks (fe0dc3b)
• types: add discriminated JOSE error types (f7f764e)
• types: add JOSE identifier unions and JWK narrowing (2a20f49)
• types: improve key and result inference (cb25e77)
• types: trim published declaration comments (544f179)
• unify base64 decode errors (3a91833)
• validate each token once rather than once per layer (bbdae09)
• write each algorithm identifier once (73d83b5)

v6.2.4

Compare Source

Documentation

• update README.md and SECURITY.md to reflect passed EOL dates (2a84032)

Refactor

• normalize JWK export members from runtime quirks (386a3eb)

v6.2.3

Compare Source

Refactor

• cleanly reject invalid PBES2 p2c (0cdb851)

v6.2.2

Compare Source

Fixes

• reject failed decompression with JWEInvalid error (043b181)

nfrasser/linkifyjs (linkify-react)

v4.3.3

Compare Source

• Fix parsing bugs with some special encoded URLs
• Parsed emails should not include port numbers
• Exact version requirement for interfaces and plugins to avoid incompatibility issues with older versions of linkify core

postcss/postcss (postcss)

v8.5.26

Compare Source

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

v8.5.25

Compare Source

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

v8.5.24

Compare Source

• Preserve the BOM after the processing (by @​hdimer).

v8.5.23

Compare Source

• Do not load source map without opts.from for security reasons.

v8.5.22

Compare Source

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

v8.5.21

Compare Source

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

v8.5.20

Compare Source

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

v8.5.19

Compare Source

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

v8.5.18

Compare Source

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

v8.5.17

Compare Source

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

v8.5.16

Compare Source

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

v8.5.15

Compare Source

• Fixed declaration parsing performance (by @​homanp).

v8.5.14

Compare Source

• Fixed custom syntax regression (by @​43081j).

v8.5.13

Compare Source

• Fixed postcss-scss commend regression.

v8.5.12

Compare Source

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

v8.5.11

Compare Source

• Fixed nested brackets parsing performance (by @​offset).

v8.5.10

Compare Source

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

v8.5.9

Compare Source

• Speed up source map encoding paring in case of the error.

react/react (react)

v19.2.8

Compare Source

v19.2.7

Compare Source

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #​36566)

v19.2.6

Compare Source

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #​36425)

v19.2.5

Compare Source

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #​36236)

react/react (react-dom)

v19.2.8

Compare Source

v19.2.7

Compare Source

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #​36566)

v19.2.6

Compare Source

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #​36425)

v19.2.5

Compare Source

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #​36236)

vitejs/vite (vite)

v7.3.6

Compare Source

Please refer to CHANGELOG.md for details.

v7.3.5

Compare Source

Please refer to CHANGELOG.md for details.

v7.3.3

Compare Source

Please refer to CHANGELOG.md for details.

v7.3.2

Compare Source

Please refer to CHANGELOG.md for details.

pmndrs/zustand (zustand)

v5.0.15

Compare Source

Fix some issues in devtools and persist middleware.

What's Changed

• fix(devtools): correct V8 stack regex when source path contains spaces by @​dai-shi with @​Copilot in #​3531
• fix(persist): clearStorage() should invalidate concurrent async rehydration by @​dai-shi with @​Copilot in #​3555

Full Changelog: pmndrs/zustand@v5.0.14...v5.0.15

v5.0.14

Compare Source

This release fixes a type issue in devtools.

What's Changed

• fix(devtools): improve type inference for Devtools initializer by @​dbritto-dev in #​3511

New Contributors

• @​TheSeydiCharyyev made their first contribution in #​3487
• @​brofrong made their first contribution in #​3496
• @​hyun907 made their first contribution in #​3506

Full Changelog: pmndrs/zustand@v5.0.13...v5.0.14

v5.0.13

Compare Source

This release includes an improvement in the devtools middleware.

What's Changed

• refactor(devtools): remove duplicate module augmentation by @​mahmoodhamdi in #​3443
• fix(devtools): support Firefox/Safari stack format in findCallerName by @​SBolsec in #​3469

New Contributors

• @​mahmoodhamdi made their first contribution in #​3443
• @​FelixEckl-vireq made their first contribution in #​3466
• @​KimHyeongRae0 made their first contribution in #​3471
• @​lstak made their first contribution in #​3483
• @​AlexRixten made their first contribution in #​3474
• @​SBolsec made their first contribution in #​3469

Full Changelog: pmndrs/zustand@v5.0.12...v5.0.13

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.