deps(client)(deps): bump the all-client-deps group across 1 directory with 28 updates

[dependabot]

Bumps the all-client-deps group with 27 updates in the /client directory:

Package	From	To
@hookform/resolvers	5.4.0	5.5.7
axios	1.18.0	1.18.1
i18next	26.3.1	26.3.6
i18next-http-backend	4.0.0	4.0.1
lucide-react	1.21.0	1.27.0
react	19.2.7	19.2.8
react-dom	19.2.7	19.2.8
react-hook-form	7.80.0	7.83.0
react-i18next	17.0.8	17.0.11
react-is	19.2.7	19.2.8
react-router-dom	7.18.0	7.18.2
recharts	3.8.1	3.10.1
@eslint/js	9.39.4	9.39.5
@storybook/addon-a11y	10.4.6	10.5.5
@storybook/addon-docs	10.4.6	10.5.5
@storybook/react-vite	10.4.6	10.5.5
@testing-library/jest-dom	6.9.1	7.0.0
@vitejs/plugin-react	6.0.2	6.0.4
autoprefixer	10.5.0	10.5.4
eslint	9.39.4	9.39.5
globals	17.6.0	17.8.0
jsdom	29.1.1	30.0.1
postcss	8.5.15	8.5.25
prettier	3.8.4	3.9.6
prettier-plugin-tailwindcss	0.8.0	0.8.1
vite	8.0.16	8.1.5
vitest	4.1.9	4.1.10

Updates @hookform/resolvers from 5.4.0 to 5.5.7

Release notes

Sourced from @​hookform/resolvers's releases.

v5.5.7

5.5.7 (2026-07-26)

Bug Fixes

• npm install fails with ERESOLVE conflict between @​hookform/resolvers@​5.4.3 and valibot versions (#865) (722ef6e)

v5.5.6

5.5.6 (2026-07-26)

Bug Fixes

• module not found when importing zodResolver under Zod v3 (#864) (8df10b0)

v5.5.5

5.5.5 (2026-07-26)

Bug Fixes

• yup resolver overrides ref property in errors object with validation metadata when using checkbox input (#863) (0f70063)

v5.5.4

5.5.4 (2026-07-26)

Bug Fixes

• AJV Resolver - When ajv schema contains default for certain properties, getValues() returns the form data with properties overwritten (#862) (c4b6aab)

v5.5.3

5.5.3 (2026-07-26)

Bug Fixes

• Conditional/dynamic schema resolution no longer working (#861) (f8d6533)

v5.5.2

5.5.2 (2026-07-26)

Bug Fixes

• Zod v4 locale and global error customization not picked up (#860) (2126efc)

v5.5.1

5.5.1 (2026-07-25)

... (truncated)

Commits

• 722ef6e fix: npm install fails with ERESOLVE conflict between @​hookform/resolvers@​5.4...
• 8df10b0 fix: module not found when importing zodResolver under Zod v3 (#864)
• 75f2dcd close #773
• 0d2bdbf close #664
• 0f70063 fix: yup resolver overrides ref property in errors object with validation met...
• c4b6aab fix: AJV Resolver - When ajv schema contains default for certain properties, ...
• e2a8d16 close #760
• f8d6533 fix: Conditional/dynamic schema resolution no longer working (#861)
• 2126efc fix: Zod v4 locale and global error customization not picked up (#860)
• 0721f88 add unit test (#859)
• Additional commits viewable in compare view

Updates axios from 1.18.0 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

• AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
• Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
• Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
• AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

• Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

• Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​webdevelopersrinu (#10913)
• @​sijie-Z (#10993)
• @​bartlomieju (#11023)
• @​JSap0914 (#11019)

Full Changelog

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)

... (truncated)

Commits

• a209bfb chore(release): prepare release 1.18.1 (#11027)
• fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
• 40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
• a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
• cf1306a docs: add Deno to install instructions (#11023)
• b32880a fix: incorrect use of error (#11021)
• 1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
• 30499d6 fix: various runtime crashes and type definition mismatches (#10959)
• 20ce9c4 fix(http): defer env proxy handling to Node (#10942)
• e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
• Additional commits viewable in compare view

Updates i18next from 26.3.1 to 26.3.6

Release notes

Sourced from i18next's releases.

v26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

Changelog

Sourced from i18next's changelog.

26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @​manus-use for the responsible disclosure.

26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

Commits

• e1c60d4 26.3.6
• 04da43e fix: allow typescript 7 in optional peerDependencies range (react-i18next#1927)
• 8eed4ac build
• 573ae73 26.3.5
• cc54b05 docs(changelog): 26.3.5 — multiline $t() options, replace mutation, escaped-l...
• 3180d67 fix: skip interpolation of placeholders inside escaped values (#2442)
• d16f5a2 fix: stop mutating the passed replace object when returning details (#2441)
• bed56c1 fix: parse $t() nesting options block that spans multiple lines (#2440)
• c19e458 docs(changelog): link GHSA advisory for deepExtend fix
• 7bb87d0 docs(changelog): reference security advisory for deepExtend fix
• Additional commits viewable in compare view

Updates i18next-http-backend from 4.0.0 to 4.0.1

Changelog

Sourced from i18next-http-backend's changelog.

4.0.1

• fix: allow @ in ns values so scoped-package-style namespace names such as @organization/package-name fetch correctly again (#191). 3.0.6 relaxed the ns check for / but left @ in the shared denylist. In the URL path position @ is a plain RFC 3986 pchar with no structural meaning; it stays blocked for lng, where it marks the userinfo/authority boundary. Every other pattern from the 3.0.5 advisory (.., \, %, ?, #, whitespace, control chars, prototype keys, oversized inputs) remains blocked for both keys.

Commits

• 5658217 4.0.1
• 2b2e771 fix: allow @ in ns values for scoped-package-style namespaces
• 64c1105 Bump next from 16.2.6 to 16.2.11 in /example/next (#190)
• 7be00f7 Remove deprecated baseUrl from tsconfig to fix Deno CI type check
• 8eeafa2 README: mention npx i18next-cli localize as the zero-to-localized path
• 37df2ff Bump i18next-http-backend from 3.0.1 to 3.0.5 in /example/node (#187)
• 175e327 Bump next from 16.2.3 to 16.2.6 in /example/next (#186)
• b74344c Fix typo in Locize advice section ('backed' → 'backend')
• 5521246 Modernize locize.com URLs and refresh UTM tags
• See full diff in compare view

Updates lucide-react from 1.21.0 to 1.27.0

Release notes

Sourced from lucide-react's releases.

Version 1.27.0

What's Changed

• feat(icons): removed brand names from tags & revised brand stopwords by @​karsa-mistmere in lucide-icons/lucide#4575
• fix(docs): Fix site build by @​ericfennis in lucide-icons/lucide#4582
• fix(icons): optimised square-scissors icons by @​karsa-mistmere in lucide-icons/lucide#4581
• fix(packages/angular): add more supported attributes for SVG nodes by @​karsa-mistmere in lucide-icons/lucide#4570
• feat(icons): added pending-cw icon by @​NielsLazaroms in lucide-icons/lucide#4439
• fix(icons): changed zap and zap-off icons by @​kapowaz in lucide-icons/lucide#4536
• feat(icons): add square-off icon by @​october-learns in lucide-icons/lucide#4496
• chore(deps-dev): bump astro from 6.4.8 to 7.1.0 by @​dependabot[bot] in lucide-icons/lucide#4572
• fix(icons): changed toolbox icon by @​karsa-mistmere in lucide-icons/lucide#4571
• feat(icons): add scan-square by @​samuelalake in lucide-icons/lucide#4550
• feat(icons): added user-shield icon by @​MArtytraM99 in lucide-icons/lucide#3099
• feat(icons): added mosque icon by @​iskepr in lucide-icons/lucide#4494
• fix(request-review): Remove pull_request_target by @​ericfennis in lucide-icons/lucide#4593
• fix(icons): changed feather icon by @​karsa-mistmere in lucide-icons/lucide#4584
• feat(ci): added custom prettier plugin for icon SVG files by @​karsa-mistmere in lucide-icons/lucide#4576
• ci(ci.yml): Remove concurrency in ci.yml by @​ericfennis in lucide-icons/lucide#4595
• fix(icons): changed barrel icon by @​karsa-mistmere in lucide-icons/lucide#4592
• feat(lab): Migrate lab to main repo. by @​ericfennis in lucide-icons/lucide#4521
• fix(icons): changed trophy icon by @​karsa-mistmere in lucide-icons/lucide#4591
• feat(analytics): add utm source and medium by @​jguddas in lucide-icons/lucide#4596
• feat(docs): Add lab requirement in pull_request_template.md by @​danielbayley in lucide-icons/lucide#3651
• feat(icons): replaces podcast icon with new mic-* icons by @​karsa-mistmere in lucide-icons/lucide#4583
• feat(icons): add layout-freeform by @​samuelalake in lucide-icons/lucide#4543

New Contributors

• @​NielsLazaroms made their first contribution in lucide-icons/lucide#4439
• @​kapowaz made their first contribution in lucide-icons/lucide#4536
• @​october-learns made their first contribution in lucide-icons/lucide#4496
• @​samuelalake made their first contribution in lucide-icons/lucide#4550
• @​iskepr made their first contribution in lucide-icons/lucide#4494

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

Version 1.26.0

What's Changed

• fix(docs): fix home page package links & accessible labels by @​karsa-mistmere in lucide-icons/lucide#4540
• fix(icons): changed columns-3-cog icon by @​kamilasw in lucide-icons/lucide#4578
• fix(icons): extended metadata of ad icon by @​karsa-mistmere in lucide-icons/lucide#4579
• fix(icons): changed book-open icons by @​karsa-mistmere in lucide-icons/lucide#4565
• feat(icons): added shield-keyhole icon by @​karsa-mistmere in lucide-icons/lucide#4580

New Contributors

• @​kamilasw made their first contribution in lucide-icons/lucide#4578

Full Changelog: lucide-icons/lucide@1.25.0...1.26.0

Version 1.25.0

What's Changed

... (truncated)

Commits

• f229f83 chore(depedencies): Update dependencies (#4553)
• See full diff in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-hook-form from 7.80.0 to 7.83.0

Release notes

Sourced from react-hook-form's releases.

Version 7.83.0

⚡ Improvements

• enhance getEventValue to handle file inputs (#13289)
• type perf: improve TypeScript performance with a hard cap at 10 levels of recursive type depth (#13529)
• type perf: improve type performance (#13528)

🐞 Fixes

• fix: clear internal errors state on argument-less clearErrors() (#13613)
• fix: preserve dirtyFields reference stability (#13612)
• fix: old checkbox/radio elements polluting internal field state (#13080)
• fix(useController): re-subscribe onChange/onBlur when control changes (#13603)
• fix(types): allow validation messages to be defined even if their related value is undefined (#13287)

Thanks to @​candymask0712, @​wanxiankai, @​bluebill1049, @​EduardF1, @​johnstrand, and @​in-ch for their contributions! 🎉

Version 7.82.0

🚀 feat: add opt-in delayError option for setValue (#13337)

setValue("firstName", "Bill", {
  delayError: 500, // delay validation error updates by 500ms
  shouldValidate: true
});

⚡ perf: improve getDirtyFields performance (#13590)

• Improved dirty field calculation, especially for larger forms and deeply nested values.

🐞 fix: expose resetDefaultValues through form context (#13598)

const { resetDefaultValues } = useFormContext();
resetDefaultValues();

🐞 fix: setValue with shouldDirty now correctly updates dirty state when the form is disabled (#13594) 🐞 fix: preserve dirtyFields boolean values for registered array fields (#13586) 🐞 fix: restore FieldArray component export (#13596) 🧪 test: migrate test suite to Playwright and improve delayError test reliability (#13589)

thanks to @​candymask0712, @​wanxiankai, @​a-y-ibrahim, @​ankit1324 & @​abnud11

Version 7.81.0

⚜️ feat: FieldArray component (#13394)

</tr></table> 

... (truncated)

Changelog

Sourced from react-hook-form's changelog.

[7.83.0] - 2026-07-25

Improvements

• Enhance getEventValue to handle file inputs
• Improve TypeScript performance with a hard cap at 10 levels of recursive type depth

Fixed

• Clear internal errors state on argument-less clearErrors()
• Preserve dirtyFields reference stability
• Old checkbox/radio elements polluting internal field state
• useController not re-subscribing onChange/onBlur when control changes
• Allow validation messages to be defined even if their related value is undefined

[7.82.0] - 2026-07-18

Added

• Opt-in delayError option for setValue to delay validation error updates

Fixed

• Expose resetDefaultValues through form context
• setValue with shouldDirty not updating dirty state correctly when the form is disabled
• Preserve dirtyFields boolean values for registered array fields
• Restore FieldArray component export

Performance

• Improve getDirtyFields performance, especially for larger forms and deeply nested values

[7.81.0] - 2026-07-05

Added

• FieldArray component built on useFieldArray for controlled field-array rendering

Fixed

• clearErrors changing the name value from form.subscribe
• reset triggering subscribe with the latest name instead of undefined
• setValues leaving stale elements behind when shrinking a field array
• flatten preserving Date values as leaf nodes
• useFieldArray min length validation error changing location in the errors object
• useController not reflecting a cleared parent object in controlled fields

Security

• Harden unset() against prototype-path traversal (__proto__ / constructor / prototype), matching the existing set() guard

... (truncated)

Commits

• ca8106d 7.83.0
• 69da954 🐞 fix: clear internal errors state on argument-less clearErrors() (#13613)
• d96c5ce 🐞 fix: preserve dirtyFields reference stability (#13612)
• ee7593e 🧪 update old checkbox/radio elements polluting internal field state e2e spec ...
• 2726d81 🐞 fix: old checkbox/radio elements polluting internal field state (#13080)
• 4ca98df ✋ fix repo grammar to prevent those silly one line prs
• d920e93 🧪 add test for enhance getEventValue to handle file inputs (#13289)
• 2ebc8d0 🍖 enhance getEventValue to handle file inputs (#13289)
• 6a38628 ☎️ type perf: improve ts perf with hardcap at 10 depth (#13529)
• ac8a3d0 🐞 fix(useController): resubscribe onChange/onBlur when control changes (#13603)
• Additional commits viewable in compare view

Updates react-i18next from 17.0.8 to 17.0.11

Changelog

Sourced from react-i18next's changelog.

17.0.11

• chore: html-parse-stringify updated to ^4.0.1. The parser powering <Trans> is now actively maintained under the i18next org (

[dependabot]

Labels

The following labels could not be found: client, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.