[dependabot]

Bumps the safe-version-updates group with 20 updates:

Package	From	To
@rive-app/react-canvas-lite	4.31.0	4.36.0
@zip.js/zip.js	2.8.60	2.23.0
next	16.3.1	16.4.2
react	19.2.8	19.3.1
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.1
@types/react-dom	19.2.4	19.3.0
react-hot-toast	2.6.0	2.6.1
sharp	0.35.3	0.35.5
xstate	5.32.5	5.33.2
@playwright/test	1.62.1	1.64.1
@testing-library/dom	10.4.1	10.4.2
@testing-library/react	16.3.2	16.3.3
@vitejs/plugin-react	6.0.5	6.1.2
chrome-launcher	1.2.1	1.2.2
eslint-config-flat-gitignore	2.3.0	2.4.0
eslint-config-next	16.3.1	16.4.2
lighthouse	13.4.1	13.5.0
postcss	8.5.26	8.5.30
prettier	3.9.6	3.9.10

Updates @rive-app/react-canvas-lite from 4.31.0 to 4.36.0

Release notes

Sourced from @​rive-app/react-canvas-lite's releases.

4.36.0

Features

• Adds early support for key and text inputs

• Adds support for directional focus navigation

• chore: bump JS runtime to 2.44.0 1c346e8

4.35.0

• chore: bump JS runtime to 2.43.1 b87fd33

4.34.3

• chore: bump js runtime to 2.42.2 19048cb

4.34.2

• fix: address canvas getting 0x0 on React strict mode 094a142

4.34.1

• fix: release the canvas backing store on unmount 93bdd6d

4.34.0

This release enables GPU Canvas content to work in React runtimes as an opt-in feature, specifically for the @​rive-app/react-webgl2 runtime. It follows the JS runtime's 2.42.0 release, which introduces the foundation for a deferred rendering pattern for both Canvas2d and WebGL2. This will continue to be built upon in future releases to improve performance in the long run.

New

With GPU Canvas, you can opt-in at the useRiveFile level if constructing the file yourself, or at the useRive/<Rive /> level, both are valid, with some caveats to keep in mind.

useRiveFile

• enableGPUCanvas: boolean — When passing parameters to useRiveFile, you can opt in to GPU Canvas with this flag set to true. After passing the resulting RiveFile to the riveFile parameter on useRive, it will draw GPU Canvas content.

useRive / <Rive />

• enableGPUCanvas: boolean — When creating a Rive instance through the useRive hook or the <Rive /> component, opt in to render GPU Canvas content with this flag set to true. Note that if you pass in riveFile (as opposed to src or buffer), the Rive instance will respect the rendering mode the riveFile was set up with as source of truth.

useOffscreenRenderer default

The React runtime currently defaults useOffscreenRenderer to true, so that instancing multiple Rive graphics on a page would lessen the chance of running into WebGL context limits that browsers impose. Opting in to enableGPUCanvas now changes that React-side default to false.

If you set useOffscreenRenderer to any value, the runtime will respect that and will not draw GPU Canvas content if set to true, even if you opt in with enableGPUCanvas. We recommend either leaving useOffscreenRenderer unset or to false when you want to draw GPU canvas content.

More docs to come and will be linked here soon!

Commits

• feature: add enableGPUCanvas param to allow GPU Canvas content to render for WebGL2 React variant 03d8cbb
• docs comment touchups 76bc972

4.33.1

• chore: bump js runtime to 2.41.1 ba078d7

4.33.0

... (truncated)

Changelog

Sourced from @​rive-app/react-canvas-lite's changelog.

v4.36.0

30 September 2026

• chore: bump JS runtime to 2.44.0 1c346e8
• chore: release 4.36.0 6910f08

v4.35.0

24 September 2026

• chore: bump JS runtime to 2.43.1 b87fd33
• chore: release 4.35.0 0b254da

v4.34.3

16 September 2026

• chore: bump js runtime to 2.42.2 19048cb
• chore: release 4.34.3 c547066

v4.34.2

11 September 2026

• fix: address canvas getting 0x0 on React strict mode 094a142
• chore: release 4.34.2 f963f95

v4.34.1

4 September 2026

• fix: release the canvas backing store on unmount 93bdd6d
• chore: release 4.34.1 c432d46

v4.34.0

3 September 2026

• feature: add enableGPUCanvas param to allow GPU Canvas content to render for WebGL2 React variant 03d8cbb
• chore: release 4.34.0 e51fb48
• docs comment touchups 76bc972

v4.33.1

2 September 2026

• chore: bump js runtime to 2.41.1 ba078d7
• chore: release 4.33.1 2f2c7a4

... (truncated)

Commits

• 6910f08 chore: release 4.36.0
• 1c346e8 chore: bump JS runtime to 2.44.0
• 0b254da chore: release 4.35.0
• b87fd33 chore: bump JS runtime to 2.43.1
• c547066 chore: release 4.34.3
• 19048cb chore: bump js runtime to 2.42.2
• f963f95 chore: release 4.34.2
• 094a142 fix: address canvas getting 0x0 on React strict mode
• c432d46 chore: release 4.34.1
• 93bdd6d fix: release the canvas backing store on unmount
• Additional commits viewable in compare view

Updates @zip.js/zip.js from 2.8.60 to 2.23.0

Release notes

Sourced from @​zip.js/zip.js's releases.

v2.23.0

What's Changed in v2.23.0

New features

• Add the filter option to the import*() methods of ZipFS and ZipDirectoryEntry: the function receives each entry read from the zip file and returns true (or a promise resolving to true) to import it. It can read the data of the entry to decide, and the entries left out never reach the duplicates policy
• Add the filter option to the export*() methods and to getExportedSize(): the function receives each ZipEntry of the tree and returns true to export it. Leaving out a directory leaves out its subtree, the entries left out are not read and are not counted by onprogress and onentryprogress
• Add the filter option to exportFileSystemHandle(), with the same semantics as the zip exports
• Add the filter option to addFileSystemHandle() and addFileSystemEntry(): the function receives each handle found and its path, so a directory like node_modules or hidden files can be left out without walking them

Full Changelog: gildas-lormeau/zip.js@v2.22.1...v2.23.0

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com

v2.22.1

What's Changed in v2.22.1

Bug fixes

• A zip file written behind a prefix which was removed together with its whole first entry, like a self-extracting page whose first entry is the face shown by the host, is read again: the entries are shifted to their real positions and their data can be read. Since v2.21.0, the shift was decided on the first central directory record only, and a first record whose local file header lies in the removed bytes proves nothing, so the entries kept their stored offsets and getData() failed with ERR_LOCAL_FILE_HEADER_NOT_FOUND, whatever the strictness option. The reader now checks the following records until one settles the question, and keeps the protection against a damaged end of central directory record whose local file headers are right
• An entry which lies before the start of the zip file after such a shift is no longer reported as WARNING_UNSORTED_CENTRAL_DIRECTORY

Full Changelog: gildas-lormeau/zip.js@v2.22.0...v2.22.1

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com

v2.22.0

What's Changed in v2.22.0

appendZip()

• New readerOptions option: the options of the ZipReader which reads the zip file to copy. The zip file used to be read with the default options only, so a zip file the reader rejects by default could not be appended as-is. Set filenameValidation or strictness to copy the entries of a zip file holding unsafe or unusual filenames, filenameEncoding to decode the filenames the duplicate check and the filter option see, and password to let filter read the data of encrypted entries with getData(). The bytes of the entries are copied as-is whatever the options are. A value which is neither an object nor unset throws ERR_INVALID_READER_OPTIONS, now exported by the core builds as well
• The filter function receives a second argument: the entry of the current zip which has the same filename, as add() or a previous appendZip() call left it, or undefined when there is none. It is the way to apply a duplicate filename policy, since keeping both entries throws ERR_DUPLICATED_NAME: return !existingEntry to keep the entry of the current zip, call remove(existingEntry) and return true to replace it, or compare crc32, uncompressedSize or lastModDate to decide. A removed entry leaves its bytes in the output, as remove() always did, and a strict ZipReader reports them as prepended data. remove() now accepts the EntryMetaData returned by add() in its type declaration
• The zip file being copied is closed when filter throws, and the documentation of appendZip() now states that add() calls made while filter runs are written before the copied entries, while those made once the copy has started are written after it
• The entries passed to filter are not modified any more once the callback has returned: the copy used to rewrite their offset with the position in the output and to hang the fields of the rebuilt central directory on them
• A zip file whose own entries share a filename is rejected with ERR_DUPLICATED_NAME before anything is written, as before, and this is now documented: a ZipWriter holds one entry per filename, so the filter option is the way to keep one of them

Bug fixes

• new ZipReader(reader, null) reads the zip file with the default options instead of failing with a TypeError when the entries are read; a null options argument is treated as unset, like the other falsy values everywhere in the API

Removed

• The transferStreams configuration option is removed. It had been a no-op since v2.19.0, when the path transferring the streams to the web workers was removed: the data always crosses the worker boundary chunk by chunk. configure() ignores the key silently, so a call still passing it keeps working; TypeScript reports the key as unknown in WorkerConfiguration, delete it from the call

Tests

• A real byte overlap between two entries, stretched consistently in the local file header and the central directory record so that the default checkLocalDirectory check passes, is detected with checkOverlappingEntry whatever the order the entries are read in; the existing overlap fixtures overlapped only through a phantom data descriptor

Full Changelog: gildas-lormeau/zip.js@v2.21.0...v2.22.0

... (truncated)

Commits

• a6ba503 bump up version
• d1735b8 add a filter option to the file system handle methods
• 0a5dddd add a filter option to the filesystem imports and exports
• ee23dab bump up version
• 6694ef2 confirm a central directory shift on the following records
• 00efcb5 bump up version
• 1c34759 accept null reader options, close the source when the filter throws
• a3d8c1f pass the existing entry to the appendzip filter
• 3456c5b remove the dead transferstreams configuration key
• 2184671 test a real byte overlap under the local directory check
• Additional commits viewable in compare view

Updates next from 16.3.1 to 16.4.2

Release notes

Sourced from next's releases.

v16.4.2

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @​lukesandberg in vercel/next.js#100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @​sokra in vercel/next.js#100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in vercel/next.js#100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in vercel/next.js#100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in vercel/next.js#100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in vercel/next.js#100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in vercel/next.js#100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682
• fix(scripts): correct typo in rm.mjs error message: #87015
• docs: improve clarity and punctuation in README: #86096
• Fix debug build paths Pages Router support entries: #93529
• bundle-analyzer: record historical snapshots on each analyze run: #93520
• fix: detect proxy.ts correctly with compound pageExtensions: #93246
• feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

• docs: correction to dynamicParams migration: #96624
• docs: proxy event argument: #96435
• docs: remove experimental note from runtime prefetching: #96615
• Preserve per-segment prefetching after dynamic navigation: #96583
• Rename static generation stream option to waitForAllReady: #96564
• Remove obsolete static generation plumbing: #96563
• [turbopack] Drop dead writes to exports: #96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #96549
• [turbopack] Strip leading BOM before parsing CSS: #96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550

... (truncated)

Commits

• 2864b17 v16.4.2
• a42cb59 Revert "[lts-active] Keep requests through middleware in a single OpenTelemet...
• f0760ec [lts-active] Backport additional documentation fixes since v16.4.0 (#100262)
• 845007a [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions (#100211)
• 6a79d8a [lts-active] Backport docs fixes since v16.4.0 (#100246)
• a75a782 [lts-active] Keep requests through middleware in a single OpenTelemetry trace...
• 8ad8524 [lts-active] Turbopack: Ignore realpath errors during module resolution, matc...
• 29d030e [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependenc...
• 3e50b82 [lts-active] fix(next-code-frame): snap visible window to char boundaries (#1...
• 9458fb9 [lts-active] Turbopack: backport Pages Router dev module graph chaining (#988...
• Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #37113)
• Only remove properties from Host Singletons on release (@​gnoff #37112)

... (truncated)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• 2dc7da7 [test] Bump Jest to 30.4 (#37382)
• 4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
• dbc3750 Update required references to GitHub repo (

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
doctor-derek	Ready	Preview	Oct 23, 2026 9:51am UTC

[github-actions]

🧹 ESLint

Quality check 1 of 3

✅ Zero warnings.

[github-actions]

🧪 Vitest

Quality check 2 of 3

❌ Vitest failed. Any retained coverage may be partial.

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
 Test Files  1 failed | 41 passed (42)
      Tests  1 failed | 232 passed (233)
   Duration  16.29s (transform 1.07s, setup 9.89s, import 2.64s, tests 8.18s, environment 16.22s)

[github-actions]

🎭 Playwright

Quality check 3 of 3

✅ Playwright completed successfully.

Running 90 tests using 1 worker
  90 passed (3.2m)

Open preview deployment

[github-actions]

🗺️ XState v5 State Machine Diff Visualization

Architecture visualization

Base 10a7e0583865 → Head 07ed8955ab90

No XState state-machine topology changes detected.

Download canonical graphs, structured diff, Mermaid, and diagnostics

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml