Skip to content

build(deps): update frontend packages - #66

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/frontend-packages
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/frontend-packages

Conversation

@renovate

@renovate renovate Bot commented Oct 4, 2026 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@clerk/clerk-js (source) ^6.34.1 → ^6.39.0 age confidence pnpm.catalog.default minor
@clerk/react (source) ^6.17.2 → ^6.17.8 age confidence pnpm.catalog.default patch
@clerk/shared (source) ^4.36.0 → ^4.40.0 age confidence pnpm.catalog.default minor
@clerk/testing (source) 2.2.39 → 2.2.45 age confidence pnpm.catalog.default patch
@playwright/test (source) 1.63.0 → 1.64.0 age confidence pnpm.catalog.default minor 1.64.1
@posthog/react (source) ^1.11.2 → ^1.11.3 age confidence pnpm.catalog.default patch
@radix-ui/react-slot (source) ^1.3.3 → ^1.5.0 age confidence pnpm.catalog.default minor
@sentry/react (source) ^11.0.0 → ^11.7.0 age confidence pnpm.catalog.default minor 11.8.0
@sentry/vite-plugin (source) ^5.4.0 → ^5.4.1 age confidence pnpm.catalog.default patch
@tanstack/eslint-plugin-query (source) ^5.104.0 → ^5.104.2 age confidence pnpm.catalog.default patch 5.104.3
@tanstack/react-query (source) ^5.104.0 → ^5.104.2 age confidence pnpm.catalog.default patch 5.104.3
@tanstack/react-query-devtools (source) ^5.104.0 → ^5.104.2 age confidence pnpm.catalog.default patch 5.104.3
@tanstack/react-router (source) ^1.170.40 → ^1.170.44 age confidence pnpm.catalog.default patch
@tanstack/react-table (source) ^9.2.4 → ^9.3.1 age confidence pnpm.catalog.default minor
@tanstack/react-virtual (source) ^3.14.13 → ^3.14.18 age confidence pnpm.catalog.default patch 3.14.20 (+1)
@tanstack/router-plugin (source) ^1.168.41 → ^1.168.45 age confidence pnpm.catalog.default patch 1.168.46
@types/node (source) ^26.6.3 → ^26.6.5 age confidence pnpm.catalog.default patch
@vitejs/plugin-react (source) ^6.1.1 → ^6.1.2 age confidence pnpm.catalog.default patch
@vitest/browser-playwright (source) 5.0.1 → 5.0.4 age confidence pnpm.catalog.default patch 5.0.5
@vitest/coverage-v8 (source) 5.0.1 → 5.0.4 age confidence pnpm.catalog.default patch 5.0.5
framer-motion ^13.4.4 → ^13.5.1 age confidence pnpm.catalog.default minor
globals ^17.12.0 → ^17.13.0 age confidence pnpm.catalog.default minor
immer ^11.1.18 → ^11.1.21 age confidence pnpm.catalog.default patch
lucide-react (source) ^1.48.0 → ^1.56.0 age confidence pnpm.catalog.default minor 1.57.0
node (source) ^26 → ^26.11.1 age confidence devEngines.runtime minor v26.12.0
oxfmt (source) ^0.71.0 → ^0.73.0 age confidence pnpm.catalog.default minor
oxlint (source) ^1.86.0 → ^1.88.0 age confidence pnpm.catalog.default minor
oxlint-tsgolint ^7.0.2003 → ^7.0.2004 age confidence pnpm.catalog.default patch
playwright (source) 1.63.0 → 1.64.0 age confidence pnpm.catalog.default minor 1.64.1
pnpm (source) ^12 → ^12.11.2 age confidence devEngines.packageManager minor
posthog-js (source) ^1.434.16 → ^1.438.9 age confidence pnpm.catalog.default minor 1.438.11 (+1)
radix-ui (source) ^1.6.7 → ^1.8.1 age confidence pnpm.catalog.default minor
react-day-picker (source) ^10.0.1 → ^10.0.2 age confidence pnpm.catalog.default patch
react-hook-form (source) ^7.89.0 → ^7.90.0 age confidence pnpm.catalog.default minor
react-resizable-panels (source) ^4.14.1 → ^4.14.5 age confidence pnpm.catalog.default patch
release-it ^21.1.0 → ^21.1.1 age confidence pnpm.catalog.default patch
shadcn (source) ^4.21.0 → ^4.21.4 age confidence pnpm.catalog.default patch 4.21.5
vite (source) 1.0.0 → 1.1.0 age confidence pnpm.catalog.default minor 1.2.0
vite-plus (source) 1.0.0 → 1.1.0 age confidence pnpm.catalog.default minor 1.2.0
vitest (source) 5.0.1 → 5.0.4 age confidence pnpm.catalog.default patch 5.0.5
zod (source) ^4.6.5 → ^4.6.7 age confidence pnpm.catalog.default patch

Release Notes

clerk/javascript (@​clerk/clerk-js)

v6.39.0

Compare Source

Minor Changes
  • Add a role mapping step to the self-serve Directory Sync setup in <OrganizationProfile />. Organization admins can now assign an organization role to each directory group their identity provider pushes, set which group wins when a member belongs to several, and turn role syncing on or off. Members in no mapped group keep the organization's default role. The step is read-only for members without the org:sys_memberships:manage permission and while the organization's role set is being migrated. (#​10081) by @​kalafut
Patch Changes
  • Add an enterpriseConnectionsUrl option to handleRedirectCallback() and <AuthenticateWithRedirectCallback />. When the Clerk API asks an OAuth sign-up to choose between several enterprise connections for the same email domain, the callback navigates to this URL, which defaults to the enterprise-connections route of your sign-up page. (#​9947) by @​NicolasLopes7

  • Updated dependencies [dcb03d3, 31c1930]:

v6.38.1

Compare Source

Patch Changes
  • Fix <HandleSSOCallback /> dropping the error when a Clerk Protect challenge fails on the SSO callback. The error is now available on errors from useSignIn() or useSignUp(), and a failed sign-up challenge calls navigateToSignUp instead of navigateToSignIn. (#​10103) by @​wobsoriano

  • Updated dependencies [568c668]:

v6.38.0

Compare Source

Minor Changes
  • SAML enterprise connections can trust several Identity Provider signing certificates at once. EnterpriseConnection.samlConnection now includes idpCertificates, every trusted certificate with its validity window, and organization.createEnterpriseConnection() and organization.updateEnterpriseConnection() accept saml.idpCertificates, an array that replaces the connection's whole set. The single saml.idpCertificate input is deprecated in favor of the array; it keeps working and still replaces the whole set. (#​9996) by @​mauricioabreu
Patch Changes

v6.37.0

Compare Source

Minor Changes
  • Add experimental APIs for biometric sign-in in native apps. This includes the trusted_device strategy for sign-in and session reverification, nativeSettings on the auth config, and __experimental_ methods on User for managing biometric credentials. These may change in minor releases. (#​9989) by @​mikepitre
Patch Changes

v6.36.0

Compare Source

Minor Changes
  • Custom flows built with useSignIn() and useSignUp() now handle Clerk Protect challenges for you. When a sign-in or sign-up method gets a challenge, Clerk shows it in a modal and the method returns once the user passes it. For SSO, the challenge appears when the user comes back to <HandleSSOCallback />. Classic resource methods such as clerk.client.signIn.create(), and apps without Clerk's UI loaded, still return with protectCheck set, as before. (#​9950) by @​wobsoriano
Patch Changes
  • The Solana wallet picker downloads about 2 KB instead of about 306 KB, and installing @clerk/ui or @clerk/clerk-js no longer pulls in React Native, Metro, and @solana/web3.js. The picker now lists only wallets that can complete Sign in with Solana, so the Mobile Wallet Adapter option that appeared on Android Chrome is gone. (#​9994) by @​manovotny

  • Updated dependencies [c8eb8d5]:

v6.35.0

Compare Source

Minor Changes
  • Support Google Workspace directories in Directory Sync. Organization admins can upload a service account key and delegated admin email from the setup flow, start a sync on demand, and see the result of the last one. DirectorySync gains setCredentials(), sync(), getSyncStatus(), and credentialsConfigured. (#​9722) by @​gabrielmeloc22
Patch Changes
  • Capture authentication timezones so Clerk emails can display timestamps in a stored user timezone. (#​9540) by @​tmilewski

  • Fix abandoned passkey registrations counting toward the limit on unverified identifications. Cancelling or failing the browser passkey prompt left a pending registration on the account that is hidden from the user's passkey list, so it could silently block adding an email address or phone number until it expired. The pending registration is now removed as soon as the prompt is abandoned. In <UserProfile />, the "Add a passkey" button also shows a loading state while a registration is in progress, and a failed attempt no longer leaves its error banner on screen after a later attempt succeeds. (#​9812) by @​brunol95

  • Ignore errors from the background session touch that runs when the page regains focus. (#​9965) by @​Ephem

    These errors were previously both unhandled and uncaught, now they are just intentionally unhandled. The page is usually in a good enough state to recover gracefully, but the uncaught errors led to noise in the browser console and error tracking tools which we now avoid.

  • Updated dependencies [6a14691, 0ee4ee2, 7a3fcf5, 69c1b9c, d9cf0f2]:

clerk/javascript (@​clerk/react)

v6.17.8

Compare Source

Patch Changes

v6.17.7

Compare Source

Patch Changes
  • Fix <HandleSSOCallback /> dropping the error when a Clerk Protect challenge fails on the SSO callback. The error is now available on errors from useSignIn() or useSignUp(), and a failed sign-up challenge calls navigateToSignUp instead of navigateToSignIn. (#​10103) by @​wobsoriano

  • Updated dependencies [568c668]:

v6.17.6

Compare Source

Patch Changes

v6.17.5

Compare Source

Patch Changes

v6.17.4

Compare Source

Patch Changes
  • Custom flows built with useSignIn() and useSignUp() now handle Clerk Protect challenges for you. When a sign-in or sign-up method gets a challenge, Clerk shows it in a modal and the method returns once the user passes it. For SSO, the challenge appears when the user comes back to <HandleSSOCallback />. Classic resource methods such as clerk.client.signIn.create(), and apps without Clerk's UI loaded, still return with protectCheck set, as before. (#​9950) by @​wobsoriano

  • Updated dependencies [c8eb8d5]:

v6.17.3

Compare Source

Patch Changes
clerk/javascript (@​clerk/shared)

v4.40.0

Compare Source

Minor Changes
  • Add a role mapping step to the self-serve Directory Sync setup in <OrganizationProfile />. Organization admins can now assign an organization role to each directory group their identity provider pushes, set which group wins when a member belongs to several, and turn role syncing on or off. Members in no mapped group keep the organization's default role. The step is read-only for members without the org:sys_memberships:manage permission and while the organization's role set is being migrated. (#​10081) by @​kalafut
Patch Changes
  • Add an enterpriseConnectionsUrl option to handleRedirectCallback() and <AuthenticateWithRedirectCallback />. When the Clerk API asks an OAuth sign-up to choose between several enterprise connections for the same email domain, the callback navigates to this URL, which defaults to the enterprise-connections route of your sign-up page. (#​9947) by @​NicolasLopes7

v4.39.1

Compare Source

Patch Changes
  • The missing and invalid key errors now say that npx clerk@latest init does not need a Clerk account and writes temporary dev keys. Readers previously saw init listed beside link, env pull and the Dashboard link, and assumed signing up was required before any of the steps would work. (#​10099) by @​eatmorespinach

v4.39.0

Compare Source

Minor Changes
  • SAML enterprise connections can trust several Identity Provider signing certificates at once. EnterpriseConnection.samlConnection now includes idpCertificates, every trusted certificate with its validity window, and organization.createEnterpriseConnection() and organization.updateEnterpriseConnection() accept saml.idpCertificates, an array that replaces the connection's whole set. The single saml.idpCertificate input is deprecated in favor of the array; it keeps working and still replaces the whole set. (#​9996) by @​mauricioabreu

v4.38.0

Compare Source

Minor Changes
  • Add experimental APIs for biometric sign-in in native apps. This includes the trusted_device strategy for sign-in and session reverification, nativeSettings on the auth config, and __experimental_ methods on User for managing biometric credentials. These may change in minor releases. (#​9989) by @​mikepitre

v4.37.1

Compare Source

Patch Changes
  • Custom flows built with useSignIn() and useSignUp() now handle Clerk Protect challenges for you. When a sign-in or sign-up method gets a challenge, Clerk shows it in a modal and the method returns once the user passes it. For SSO, the challenge appears when the user comes back to <HandleSSOCallback />. Classic resource methods such as clerk.client.signIn.create(), and apps without Clerk's UI loaded, still return with protectCheck set, as before. (#​9950) by @​wobsoriano

v4.37.0

Compare Source

Minor Changes
  • Support Google Workspace directories in Directory Sync. Organization admins can upload a service account key and delegated admin email from the setup flow, start a sync on demand, and see the result of the last one. DirectorySync gains setCredentials(), sync(), getSyncStatus(), and credentialsConfigured. (#​9722) by @​gabrielmeloc22

  • Update the SSO and Directory Sync sections of the <OrganizationProfile /> Security page to the latest designs. Both sections now show a "Configure" button until something is set up (SSO then shows "Add connection"), and SSO connection rows show the identity provider's logo and an actions menu (Edit, Continue configuration, Activate/Deactivate, Remove). These actions have been removed from the SSO connection page, and status badges are no longer color-coded. Okta logos now follow the theme's foreground color, so they stay visible in dark mode, including on the enterprise connection chooser and in <UserProfile />. (#​9940) by @​kalafut

    The SSO button uses the new ssoSection.primaryButton__configure localization key; ssoSection.primaryButton__startConfiguration is deprecated and no longer used. In directorySyncSection, primaryButton__startConfiguration is renamed to primaryButton__configure and badge__unconfigured is removed.

Patch Changes
  • Capture authentication timezones so Clerk emails can display timestamps in a stored user timezone. (#​9540) by @​tmilewski

  • Fix publishable-key generation for production instances in local Clerk environments. (#​9633) by @​brkalow

  • Add a localized message for the too_many_unverified_identifications error, shown when adding an email address or phone number is blocked by pending verifications or an incomplete passkey setup. (#​9812) by @​brunol95

clerk/javascript (@​clerk/testing)

v2.2.45

Compare Source

Patch Changes

v2.2.44

Compare Source

Patch Changes

v2.2.43

Compare Source

Patch Changes

v2.2.42

Compare Source

Patch Changes

v2.2.41

Compare Source

Patch Changes

v2.2.40

Compare Source

Patch Changes
microsoft/playwright (@​playwright/test)

v1.64.0

Compare Source

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');

for (const tool of await page.webmcp.tools())
  console.log(tool.name, tool.description);

const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  use: {
    video: {
      mode: 'on',
      size: { width: 1920, height: 1080 },
      fps: 60,
      show: {
        actions: {
          style: {
            point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
            highlight: 'outline: 2px solid #&#8203;333; background: rgba(0, 128, 255, .15)',
            title: 'font-size: 16px',
          },
        },
      },
    },
  },
});
  • New fps option in testOptions.video, recordVideo and
    screencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
  • New style option takes CSS declarations for the point marker, the target
    highlight and the action title. It replaces the fontSize option, which is now deprecated.
  • The cursor stays visible at the last action point, survives navigations and travels along a natural, eased path.
  • Videos are encoded with VP9 instead of VP8, which takes less CPU and produces smaller files of the same or better
    quality.
  • All video options are also available in Playwright MCP and playwright-cli.

🎯 Test runner

  • New testProject.default option keeps a project in the config without running it by default. You can configure every browser you care about, and let a plain npx playwright test run just your favourite one:

    // playwright.config.ts
    import { defineConfig, devices } from '@playwright/test';
    
    export default defineConfig({
      projects: [
        { name: 'chromium', use: devices['Desktop Chrome'] },
        { name: 'firefox', use: devices['Desktop Firefox'], default: false },
        { name: 'webkit', use: devices['Desktop Safari'], default: false },
      ],
    });
    npx playwright test                     # runs chromium only
    npx playwright test --project=firefox   # runs firefox
    npx playwright test --project="*"       # runs all three, for example on CI
  • New --shuffle command line option schedules tests in a random order, which helps to find tests that accidentally depend on each other.

    npx playwright test --shuffle
    # Running 42 tests using 4 workers, shuffle seed 271828182
    # ...
    
    # Pass the seed to reproduce the same order.
    npx playwright test --shuffle 271828182
  • New lock option in test.describe.configure() adds test locks to all tests in a file or a group:

    test.describe.configure({ lock: 'user-settings' });
  • New type option of toHaveScreenshot in testConfig.expect stores all unnamed screenshots as WebP:

    // playwright.config.ts
    export default defineConfig({
      expect: {
        toHaveScreenshot: { type: 'webp' },
      },
    });

🪆 Locator.within()

New locator.within() combines two locators that you already have, reading in the natural order —
"this button, within that dialog":

const saveButton = page.getByRole('button', { name: 'Save' });
const dialog = page.getByTestId('settings-dialog');

await saveButton.within(dialog).click();

Relative locators such as locator.nth() or locator.first() are resolved inside each parent
separately, which makes column-like queries straightforward:

// The third cell of every row, not the third cell in the table.
const thirdColumn = page.getByRole('cell').nth(2).within(page.getByRole('row'));
await expect(thirdColumn).toHaveText(['Apple', 'Banana', 'Cherry']);

New APIs

Breaking changes ⚠️

  • screen property is now forwarded from the device descriptors. If you use ...devices['Desktop Chrome'] and alike, window.screen and media queries now see the emulated screen size. You can opt-out by explicitly setting screen to undefined:

    // playwright.config.ts
    export default defineConfig({
      use: {
        ...devices['Desktop Chrome'],
        screen: undefined,
      },
    });
  • JSX in your test files now follows your tsconfig.json. Playwright compiles JSX in test files according to the jsx, jsxFactory, jsxFragmentFactory and jsxImportSource tsconfig options, and defaults to the automatic runtime from react/jsx-runtime.

  • --update-snapshots=missing now passes the test run. Tests that only create missing snapshots now pass in the 'missing' mode of testConfig.updateSnapshots, so that CI can generate new snapshots and verify the existing ones in a single run. The mode used when the option is not specified is now called 'default' and behaves as before: missing snapshots are written and the test fails.

  • Elements inside hidden iframes are considered hidden. Elements inside an iframe that is not visible, for example with visibility: hidden, are now considered hidden by actions, locator.isVisible() and expect(locator).toBeVisible().

Browser Versions

  • Chromium 156.0.8078.4
  • Mozilla Firefox 157.0
  • WebKit 27.2

This version was also tested against the following stable channels:

  • Google Chrome 155
  • Microsoft Edge 155
PostHog/posthog-js (@​posthog/react)

v1.11.3

Compare Source

Patch Changes
  • #​5120 5929eab Thanks @​breken-ai! - PostHogFeature without match shows the fallback when the flag evaluates to false.
    (2026-09-29)
  • Updated dependencies [5929eab]:
    • posthog-js@​1.435.1
radix-ui/primitives (@​radix-ui/react-slot)

v1.5.0

  • Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
  • Fixed Slot throwing when an asChild child is a lazy reference whose resolved value is itself a lazy reference.

v1.4.0

  • Added support for multiple aria-describedby attributes.
  • Fixed compatibility issues with React Server Components.
getsentry/sentry-javascript (@​sentry/react)

v11.7.0

Compare Source

Important Changes
  • feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#​25014)

    The new cronTriggersIntegration sends check-ins for Cron Triggers. Each check-in includes the schedule from controller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.

    Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare V

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • "before 8am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from maxstue as a code owner October 4, 2026 22:18
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 4, 2026
@renovate
renovate Bot force-pushed the renovate/frontend-packages branch 24 times, most recently from 48a61a3 to 09acb82 Compare October 12, 2026 02:00
@renovate
renovate Bot force-pushed the renovate/frontend-packages branch 3 times, most recently from f5022ca to 3e2b546 Compare October 13, 2026 02:48
@renovate
renovate Bot force-pushed the renovate/frontend-packages branch 8 times, most recently from 6dd38d2 to 8cddf23 Compare October 15, 2026 05:37
@renovate
renovate Bot force-pushed the renovate/frontend-packages branch from 8cddf23 to 963d4db Compare October 15, 2026 12:04

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant