[dependabot]

Bumps the version-updates group with 11 updates in the / directory:

Package	From	To
@capacitor-mlkit/barcode-scanning	8.2.1	8.2.2
@capacitor/android	8.5.2	8.6.0
@capacitor/app	8.1.1	8.1.2
@capacitor/core	8.5.2	8.6.0
@noriginmedia/norigin-spatial-navigation	3.3.0	3.4.0
@preact/signals	2.11.3	2.11.4
preact	11.0.0	11.2.0
@capacitor/cli	8.5.2	8.6.0
@vitejs/plugin-legacy	8.2.3	8.2.4
jsdom	30.1.1	30.1.3
vitest	5.0.3	5.1.0

Bumps the version-updates group with 1 update in the /ops/billing directory: nodemailer.
Bumps the version-updates group with 4 updates in the /ops/billing/admin directory: typescript, lucide-react, @tailwindcss/vite and tailwindcss.

Updates @capacitor-mlkit/barcode-scanning from 8.2.1 to 8.2.2

Release notes

Sourced from @​capacitor-mlkit/barcode-scanning's releases.

@​capacitor-mlkit/barcode-scanning@​8.2.2

Patch Changes

• 0ca9fbc2d54b9d8cbcf8010e9a41ba2339496827 (#362): fix: restore the original WebView background after stopScan() instead of forcing a white background

Commits

• f5b8218 chore(release): publish (#363)
• 46874cc fix(document-scanner): deliver the scanDocument(...) result via `appRestore...
• e5abba0 docs: replace banner images with new branding (#364)
• 0ca9fbc fix(barcode-scanning): restore the original WebView background after `stopSca...
• d3246c2 docs(barcode-scanning): link the embedded scanner post (#360)
• See full diff in compare view

Updates @capacitor/android from 8.5.2 to 8.6.0

Release notes

Sourced from @​capacitor/android's releases.

8.6.0

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Changelog

Sourced from @​capacitor/android's changelog.

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Commits

• ef3ce6e Release 8.6.0
• 4b40f4b chore: add Backstage catalog-info.yaml
• 463225f fix(cli): bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674)
• d19f1ea fix(cli): redact sensitive values from telemetry payloads (#8665)
• 02e43f8 fix(android): keep callbacks on non-public base classes from R8
• 19d2a40 feat(android): recognize @​capacitor-community/ssl-pinning for cert pinning (#...
• 50a3c51 feat(cli): recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666)
• 841017a fix(cli): report npm 12 blocked install scripts in doctor and migrate (#8655)
• acaa9e6 docs: minor correction (#8660)
• 9dc5aeb fix(android): keep plugin annotation types from R8 full mode (#8646)
• Additional commits viewable in compare view

Updates @capacitor/app from 8.1.1 to 8.1.2

Release notes

Sourced from @​capacitor/app's releases.

@​capacitor/app@​8.1.2

8.1.2 (2026-10-02)

Bug Fixes

• app: silence the String?-to-Any coercion warning in getAppLanguage on iOS (#2598) (0706269)

Commits

• 87c0bb8 chore(release): publish [skip ci]
• 0706269 fix(app): silence the String?-to-Any coercion warning in getAppLanguage on iO...
• 03fca06 docs(screen-orientation): fix iOS orientation snippet for UIScene (#2597)
• bf42d23 fix(status-bar): avoid retain cycle between StatusBar and the bridge (#2569)
• 5608b1c fix(browser): only fire browserFinished when the Custom Tab actually terminat...
• ed6cf8f fix(share): present share sheet from the topmost view controller on iOS (#2574)
• fd606de fix(push-notifications): show foreground notification image on Android (#2572)
• 467dafd chore(release): publish [skip ci]
• fa8ddfb fix(share): Add nonce validation to broadcast receiver on Android (#2592)
• 89070d4 chore: migrate local notifications to new repo (#2584)
• Additional commits viewable in compare view

Updates @capacitor/core from 8.5.2 to 8.6.0

Release notes

Sourced from @​capacitor/core's releases.

8.6.0

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Changelog

Sourced from @​capacitor/core's changelog.

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Commits

• ef3ce6e Release 8.6.0
• 4b40f4b chore: add Backstage catalog-info.yaml
• 463225f fix(cli): bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674)
• d19f1ea fix(cli): redact sensitive values from telemetry payloads (#8665)
• 02e43f8 fix(android): keep callbacks on non-public base classes from R8
• 19d2a40 feat(android): recognize @​capacitor-community/ssl-pinning for cert pinning (#...
• 50a3c51 feat(cli): recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666)
• 841017a fix(cli): report npm 12 blocked install scripts in doctor and migrate (#8655)
• acaa9e6 docs: minor correction (#8660)
• 9dc5aeb fix(android): keep plugin annotation types from R8 full mode (#8646)
• Additional commits viewable in compare view

Updates @noriginmedia/norigin-spatial-navigation from 3.3.0 to 3.4.0

Release notes

Sourced from @​noriginmedia/norigin-spatial-navigation's releases.

@​noriginmedia/norigin-spatial-navigation@​3.4.0

Minor Changes

• 9a6d9fc: Add clearLastFocusedChild(focusKey) to make a container forget its last focused child, so focus next entering it goes to preferredChildFocusKey (or the first child). It does not move focus.

Patch Changes

• Updated dependencies [9a6d9fc]
  • @​noriginmedia/norigin-spatial-navigation-core@​4.2.0

Commits

• 20a497a ci: Release Packages (#251)
• 9a6d9fc feat: add clearLastFocusedChild(focusKey) to core (#250)
• f34e75f ci: Release Packages (#248)
• 62bb920 Ensure the preferredChildFocusKey is actually a descendant of the target focu...
• 965230d ci: Release Packages (#245)
• 3d33d5f Fixed TypeError due to race condition in node onFocus and onBlur promises (#244)
• See full diff in compare view

Updates @preact/signals from 2.11.3 to 2.11.4

Release notes

Sourced from @​preact/signals's releases.

@​preact/signals@​2.11.4

Patch Changes

• #997 42d2c5f Thanks @​JoviDeCroock! - Use the active Preact VNode marker.

• Updated dependencies [7528bce, 500b790, 19e6e73]:

  • @​preact/signals-core@​1.14.5

Changelog

Sourced from @​preact/signals's changelog.

2.11.4

Patch Changes

• #997 42d2c5f Thanks @​JoviDeCroock! - Use the active Preact VNode marker.

• Updated dependencies [7528bce, 500b790, 19e6e73]:

  • @​preact/signals-core@​1.14.5

Commits

• 30a797e Version Packages (#992)
• 42d2c5f Harden vnode recognition (#997)
• See full diff in compare view

Updates preact from 11.0.0 to 11.2.0

Release notes

Sourced from preact's releases.

11.2.0

Features

• Support scoped custom element registries when rendering into shadow roots (#5342, thanks @​JoviDeCroock)

Fixes

• Ignore non-function values for on* props instead of registering invalid event handlers (#5345, thanks @​JoviDeCroock)
• Pass a thrown null or undefined to error boundaries without replacing it with a TypeError (#5347, thanks @​jonkwheeler)
• Preserve event handlers on unmounted nodes so events already bubbling can finish (#5349, thanks @​JoviDeCroock)

Performance

• Reduce bundle size across core, hooks, and compat (#5343, thanks @​JoviDeCroock)

11.1.1

Fixes

• Fix rendering, updating, and hydrating \<template> elements in SVG and MathML namespaces (#5339, thanks @​JoviDeCroock)

Types

• Add declarative shadow DOM attributes to \<template>, including their camelCase forms (#5338, thanks @​b84330808)

11.1.0

Features

• Add preact/compat/compiler-runtime for apps compiled with React Compiler (#5323, thanks @​JoviDeCroock)

Fixes

• Harden VNode recognition with a shared symbol marker (#5335, thanks @​JoviDeCroock)
• Isolate layout-effect errors to the throwing component so unrelated effects and lifecycle callbacks still run (#5321, thanks @​JoviDeCroock)
• Stop appending px to unitless SVG paint and aspect-ratio values in compat (#5233, thanks @​dylanpulver)

Types

• Allow the list attribute on all valid input types (#5331, thanks @​playlikeboy)

Compatibility

The new VNode marker requires @preact/signals 2.11.4 or later and preact-render-to-string 6.8.2 or later when using those packages.

11.0.2

Fixes

• Keep queued components updating and finish act() cleanup after an uncaught render error (#5265, thanks @​JoviDeCroock)
• Correct the browser ESM entry point for preact/compat/server (#5304, thanks @​rschristian)
• Retain deferred hydration ranges through suspension, resumption, and unmounting (#5315, thanks @​JoviDeCroock)
• Leave non-plain style objects untouched in compat, preserving string-valued signal styles (#5318, thanks @​JoviDeCroock)

... (truncated)

Commits

• c95929d Merge pull request #5350 from preactjs/release/11.2.0
• 74f5730 11.2.0
• bc4e5bc Merge pull request #5349 from preactjs/preserve-unmounted-event-handlers
• 9131571 Merge branch 'main' into preserve-unmounted-event-handlers
• 4bfd080 Merge pull request #5347 from jonkwheeler/fix/throw-null-then
• 64ecd84 Preserve event handlers on unmounted nodes
• 98ea442 Pass a thrown null or undefined to error boundaries
• 076fe9c Merge pull request #5345 from preactjs/fix/ignore-non-function-event-props
• 7657cec Ignore non-function values for on* props
• 81dbe69 Merge pull request #5343 from preactjs/busy-brown-0oklh9
• Additional commits viewable in compare view

Updates @capacitor/cli from 8.5.2 to 8.6.0

Release notes

Sourced from @​capacitor/cli's releases.

8.6.0

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Changelog

Sourced from @​capacitor/cli's changelog.

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Commits

• ef3ce6e Release 8.6.0
• 4b40f4b chore: add Backstage catalog-info.yaml
• 463225f fix(cli): bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674)
• d19f1ea fix(cli): redact sensitive values from telemetry payloads (#8665)
• 02e43f8 fix(android): keep callbacks on non-public base classes from R8
• 19d2a40 feat(android): recognize @​capacitor-community/ssl-pinning for cert pinning (#...
• 50a3c51 feat(cli): recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666)
• 841017a fix(cli): report npm 12 blocked install scripts in doctor and migrate (#8655)
• acaa9e6 docs: minor correction (#8660)
• 9dc5aeb fix(android): keep plugin annotation types from R8 full mode (#8646)
• Additional commits viewable in compare view

Updates @vitejs/plugin-legacy from 8.2.3 to 8.2.4

Release notes

Sourced from @​vitejs/plugin-legacy's releases.

v8.2.4

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.4

Bug Fixes

• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update all non-major dependencies (#23337) (d550815)
• deps: update all non-major dependencies (#23404) (238ad81)
• deps: update all non-major dependencies (#23445) (fc7c104)
• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23967) (0105733)
• respect build.sourcemap from environment (#23879) (82e7aa0)

Miscellaneous Chores

• deps: update dependency tsdown to ^0.23.2 (#23895) (ac9a56d)
• deps: use typescript v7 (#23778) (928e721)
• merge prereleases in changelog (#23466) (99bd9d1)
• use oxfmt sortImports (#23319) (97ad042)

Code Refactoring

• plugin-legacy: use JSON import for core-js version (#23771) (0075c4b)

Changelog

Sourced from @​vitejs/plugin-legacy's changelog.

8.2.4 (2026-11-05)

Bug Fixes

• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update all non-major dependencies (#23337) (d550815)
• deps: update all non-major dependencies (#23404) (238ad81)
• deps: update all non-major dependencies (#23445) (fc7c104)
• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23967) (0105733)
• respect build.sourcemap from environment (#23879) (82e7aa0)

Miscellaneous Chores

• deps: update dependency tsdown to ^0.23.2 (#23895) (ac9a56d)
• deps: use typescript v7 (#23778) (928e721)
• merge prereleases in changelog (#23466) (99bd9d1)
• use oxfmt sortImports (#23319) (97ad042)

Code Refactoring

• plugin-legacy: use JSON import for core-js version (#23771) (0075c4b)

Commits

• ba958bd fix(deps): update all non-major dependencies (#23217)
• See full diff in compare view

Updates jsdom from 30.1.1 to 30.1.3

Release notes

Sourced from jsdom's releases.

v30.1.3

• Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
• Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
• Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
• Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
• Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
• Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
• Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
• Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
• Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
• Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
• Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
• Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
• Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
• Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)

v30.1.2

• Updated URLs to support Unicode v18.0.0 in internationalized domain names.
• Reduced package size and memory use for CSS property definitions. (@​scttcper)
• Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
• Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
• Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
• Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
• Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
• Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.
• Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().
• Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)
• Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.
• Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.
• Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)

Commits

• 058c0f5 30.1.3
• fcd1fd1 Cascade parsed longhands independently
• a3ee786 Cascade computed style properties on demand
• f42dc15 Resolve colors before caching or using currentcolor
• 074b1fb Compute background-position lengths against the final font size
• d19598c Apply style rules nested in multiple @​media rules
• 45d626c Rule out attribute selector subjects before matching
• 3ff0a5b Upgrade Undici and remove abort workarounds
• 8813bb1 Ignore CSS declarations with unparseable math functions
• 63712d8 Fix XHR credentials across redirects
• Additional commits viewable in compare view

Updates vitest from 5.0.3 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

• Add --last-failed to run only failed tests  -  by @​sheremet-va in vitest-dev/vitest#11558