chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@docusaurus/core (source)	3.10.1 → 3.10.2
@docusaurus/module-type-aliases (source)	3.10.1 → 3.10.2
@docusaurus/preset-classic (source)	3.10.1 → 3.10.2
@docusaurus/types (source)	3.10.1 → 3.10.2
@eslint/js (source)	9.39.4 → 9.39.5
@fontsource-variable/geist (source)	5.2.9 → 5.3.0
@tailwindcss/vite (source)	4.3.0 → 4.3.3
@testing-library/user-event	14.6.1 → 14.6.3
@types/multer (source)	2.1.0 → 2.2.0
@types/node (source)	24.13.1 → 24.13.3
@types/node (source)	25.9.3 → 25.9.5
@types/pg (source)	8.20.0 → 8.21.0
@types/react (source)	19.2.17 → 19.2.18
@types/react-dom (source)	19.2.3 → 19.2.4
@types/supertest (source)	7.2.0 → 7.2.1
@vitejs/plugin-react (source)	6.0.2 → 6.0.5
@vitest/coverage-v8 (source)	3.2.6 → 3.2.7
docusaurus-plugin-openapi-docs (source)	5.0.2 → 5.1.3
docusaurus-theme-openapi-docs (source)	5.0.2 → 5.1.3
eslint (source)	9.39.4 → 9.39.5
eslint-plugin-i18next	6.1.4 → 6.1.5
express-rate-limit	8.5.2 → 8.6.2
helmet (source)	8.2.0 → 8.3.0
i18next (source)	26.3.1 → 26.3.6
js-yaml	4.2.0 → 4.3.1
lint-staged	17.0.7 → 17.3.0
multer	2.1.1 → 2.2.0
node-cron (source)	4.2.1 → 4.6.0
postcss (source)	8.5.25 → 8.5.26
prettier (source)	3.8.3 → 3.9.6
puppeteer (source)	25.1.0 → 25.5.0
radix-ui (source)	1.5.0 → 1.6.7
react (source)	19.2.7 → 19.2.8
react-dom (source)	19.2.7 → 19.2.8
react-i18next	17.0.8 → 17.0.11
react-icons	5.6.0 → 5.7.0
react-router-dom (source)	7.17.0 → 7.18.2
shadcn (source)	4.10.0 → 4.16.2
tailwindcss (source)	4.3.0 → 4.3.3
tsc-alias (source)	1.8.17 → 1.9.1
tsx (source)	4.22.4 → 4.23.12
typescript-eslint (source)	8.60.1 → 8.67.0
vite (source)	8.0.16 → 8.2.1

---

Release Notes

facebook/docusaurus (@​docusaurus/core)

v3.10.2

Compare Source

Backport and cherry-pick commits from main for v3.10.2 patch release:

• fix(bundler): do not import @swc/html, fix StackBlitz playground #​12055
• fix(core): use locale url in site config #​12054
• fix(theme-classic): remove redundant sidebar label titles #​11966
• fix(mdx-loader): avoid transforming dotted directory links into asset… #​11944
• fix(dev-server): for HTTPS, support non-RSA TLS certs #​12065
• fix(utils): fix extractLeadingEmoji() edge cases #​12100
• fix(gtag.js, faster): Fix StackBlitz, vendor @types/gtag.js, upgrade @swc/html #​12080
• fix(create-docusaurus): init template README should use npm commands by default #​12138
• fix(cli): docusaurus serve should pass --host to server.listen() #​12127
• fix(core): bump detect-port to v2.1, fix pnpm trustPolicy downgrade issue #​12012
• fix(i18n): complete Spanish translations for theme-common and theme-l… #​12180
• chore(deps): migrate to @11ty/gray-matter #​12181
• fix(core): fix BaseUrlIssueBanner little security issue #​12260
• fix(core): accept boolean attributes in headTags config validation #​12238
• fix(sitemap): don't drop lastmod for an epoch (0) timestamp #​12212
• fix(utils): preserve author names containing commas in git log parsing #​12069

eslint/eslint (@​eslint/js)

v9.39.5

Compare Source

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #​20812 to v9.x) (#​21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#​20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#​20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)

fontsource/font-files (@​fontsource-variable/geist)

v5.3.0

Compare Source

tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.3.3

Compare Source

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#​20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#​20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#​20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#​20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#​20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#​20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#​20310)
• Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#​20124)
• Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#​20314)
• Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#​20319)
• Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#​20325)
• Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#​20318)
• Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#​20329)
• Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#​20335)
• Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#​20336)

v4.3.2

Compare Source

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#​20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#​20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#​20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#​20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#​20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#​20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#​20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#​20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#​20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#​20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#​20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#​20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#​20289)

v4.3.1

Compare Source

Added

• Add --silent option to suppress output in @tailwindcss/cli (#​20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#​20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#​20052)
• Allow @apply to be used with CSS mixins (#​19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#​20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#​20080)
• Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#​20103)
• Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#​20027)
• Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#​20127)
• Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#​20130)
• Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#​20137)
• Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#​20139)
• Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#​20198)
• Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#​19588)
• Allow @variant to be used inside addBase (#​19480)
• Ensure @source globs with symlinks are preserved (#​20203)
• Ensure later @source rules can re-include files excluded by earlier @source not rules (#​20203)
• Upgrade: don't migrate empty class rules to invalid @utility rules (#​20205)
• Ensure transitions between inset-shadow-none and other inset shadows work correctly (#​20208)
• Ensure explicitly referenced @source directories are scanned even when ignored by git (#​20214)
• Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#​20217)
• Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#​20221)
• Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#​20228)

Changed

• Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#​20196)
• Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#​20196)

testing-library/user-event (@​testing-library/user-event)

v14.6.3

Compare Source

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.0.5

Compare Source

Fixed the react compiler preset filter to be linear (#​1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#​1349). The filter was changed to be linear to avoid that.

v6.0.4

Compare Source

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined.
This error is now fixed.

v6.0.3

Compare Source

vitest-dev/vitest (@​vitest/coverage-v8)

v3.2.7

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v3]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10679 (b795e)

    View changes on GitHub

PaloAltoNetworks/docusaurus-openapi-docs (docusaurus-plugin-openapi-docs)

v5.1.3

Compare Source

Patch release with two schema-rendering bug fixes: operation pages no longer freeze the browser when a oneOf's branches each declare their own self-referential discriminator (surfaced on specs like PANW DLP Data Profiles), and additionalProperties now renders correctly inside discriminator map variants. Also includes a batch of dependency updates.

🐛 Bug Fix

• fix(theme): prevent infinite recursion from self-referential discriminators (#​1584)
• fix(theme): handle additionalProperties in map variants (#​1561)

🤖 Dependencies

• chore(deps): bump react-hook-form from 7.81.0 to 7.82.0 (#​1581)
• chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.2 (#​1579)
• chore(deps): bump sass-loader from 16.0.8 to 17.0.0 (#​1580)
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#​1575)
• chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.2 (#​1582)
• chore(deps): bump sass from 1.101.0 to 1.101.3 (#​1577)
• chore(deps): bump @​docusaurus/* from 3.10.1 to 3.10.2 (#​1574)
• chore(deps): bump svgo from 3.3.3 to 3.3.4 (#​1570)
• chore(deps): bump body-parser from 1.20.4 to 1.20.6 (#​1571)
• chore(deps): bump immutable from 5.1.5 to 5.1.9 (#​1572)
• chore(deps): bump fast-uri from 3.1.2 to 3.1.4 (#​1573)
• chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.0 (#​1564)
• chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#​1566)
• chore(deps): bump react-hook-form from 7.79.0 to 7.81.0 (#​1567)
• chore(deps): bump @​redocly/openapi-core from 2.38.0 to 2.39.0 (#​1568)
• chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 (#​1569)
• chore(deps): bump @​redocly/openapi-core from 2.33.0 to 2.38.0 (#​1552)
• chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 (#​1554)
• chore(deps): bump pako from 2.1.0 to 3.0.1 (#​1556)
• chore(deps): bump @​apidevtools/json-schema-ref-parser (#​1557)
• chore(deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 (#​1558)
• chore(deps): bump systeminformation from 5.31.6 to 5.31.17 (#​1559)
• chore(deps): bump websocket-driver from 0.7.4 to 0.7.5 (#​1560)

🔧 Maintenance

• chore(deps-dev): bump @​types/node from 26.0.1 to 26.1.1 (#​1578)
• chore(deps-dev): bump fast-xml-parser from 5.8.0 to 5.10.1 (#​1576)
• chore(deps-dev): bump cypress from 15.18.0 to 15.18.1 (#​1562)
• chore(deps-dev): bump eslint-plugin-prettier from 5.5.5 to 5.5.6 (#​1565)
• chore(deps-dev): bump playwright from 1.61.0 to 1.61.1 (#​1553)
• chore(deps-dev): bump prettier from 3.8.4 to 3.9.4 (#​1555)

Committers: 3

• dependabot[bot]
• Nipunn Koorapati
• Steven Serrata

v5.1.2

Compare Source

Patch release fixing a regression in nested anyOf/oneOf schema rendering where branch properties were duplicated across sibling branches.

🐛 Bug Fix

• fix(theme): stop duplicating branch properties in nested anyOf/oneOf renders (#​1549)

Committers: 1

• Steven Serrata

v5.1.1

Compare Source

5.1.1 (2026-07-08)

Patch release with schema rendering and path-matching fixes: branch descriptions now render for oneOf/anyOf and discriminator mappings, schema normalization is hoisted out of the render path for better performance, and Postman path matchers are ranked by per-segment specificity to prioritize the most specific match. Also includes a batch of dependency updates.

Thanks to @​Mikurosama (#​1526), @​Compaurum (#​1540), and @​gotson (#​1525, and for confirming the fix) for reporting the issues addressed in this release.

🐛 Bug Fix

• fix(plugin): rank path matchers by per-segment specificity (#​1526) (#​1546)
• fix(theme): render branch descriptions for oneOf/anyOf and discriminator mappings (#​1545)
• fix(theme): hoist schema normalization out of render path (#​1527)

🤖 Dependencies

• chore(deps): bump sigstore from 4.1.0 to 4.1.1 (#​1541)
• chore(deps): bump fs-extra from 11.3.5 to 11.3.6 (#​1543)
• chore(deps): bump @​sigstore/core from 3.2.0 to 3.2.1 (#​1538)
• chore(deps): bump commander from 14.0.3 to 15.0.0 (#​1532)
• chore(deps): bump preactjs/compressed-size-action from 2.9.1 to 2.10.0 (#​1528)
• chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 (#​1537)
• chore(deps): bump actions/cache/save from 5.0.5 to 6.1.0 (#​1533)
• chore(deps): bump actions/cache from 5.0.5 to 6.1.0 (#​1531)
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#​1530)

🔧 Maintenance

• chore(deps-dev): bump cypress from 15.16.0 to 15.18.0 (#​1544)
• chore(deps-dev): bump @​types/node from 26.0.0 to 26.0.1 (#​1542)
• chore(deps-dev): bump @​types/node from 25.9.3 to 26.0.0 (#​1529)
• chore(deps-dev): bump start-server-and-test from 3.0.5 to 3.0.11 (#​1536)
• chore(deps-dev): bump playwright from 1.60.0 to 1.61.0 (#​1535)
• chore(deps-dev): bump prettier from 3.8.3 to 3.8.4 (#​1534)

Committers: 2

• Steven Serrata
• dependabot[bot]

v5.1.0

Compare Source

Minor release adding configurable schema expansion depth, numerous schema rendering fixes, improved i18n support, Docusaurus v4 readiness work, and a batch of dependency updates. Also fixes the version script to ensure create-docusaurus-openapi-docs is always bumped in lockstep with the plugin and theme.

🚀 New Feature

• feat(theme): configurable schema expansion level (#​1222) (#​1449)

🐛 Bug Fix

• fix(theme): vendor theme-common/internal usages ahead of Docusaurus v4 (#​1140) (#​1502)
• fix(theme): make i18n strings extractable by write-translations (#​1499)
• fix(plugin): render OpenAPI 3.1 type unions in schema names (#​950) (#​1475)
• fix(theme): prefill Send API Request from example fields (#​544, #​1079) (#​1476)
• fix(plugin): restore menu__list-item--deprecated class on sidebar items (#​1474)
• fix(theme): align CodeSnippets outer tab with Docusaurus storage slot (#​1464)
• fix: render nested arrays as Type[][] in Schema tab (#​1114) (#​1465)
• fix: render allOf schemas with additionalProperties:false on every member (#​1119) (#​1463)
• fix(theme): support multiple x-codeSamples per language (#​1204) (#​1459)
• fix(theme): preserve large integer precision in response panel (#​1208) (#​1458)
• fix: dedupe properties when allOf override redefines nested array items (#​1218) (#​1457)
• fix(theme): pre-populate parameter defaults in API explorer form (#​1226) (#​1448)
• fix: skip vendor extensions at the path level (#​891) (#​1440)
• fix(demo): use bracketed admonition title syntax for Docusaurus 3.10 (#​1445)

📝 Documentation

• docs: document themeConfig.api.schemaExpansion option
• docs: correct categoryLinkSource supported values (#​1447)
• docs: harmonize top-level README with plugin README (#​1446)

🤖 Dependencies

• chore(deps): bump ws from 7.5.10 to 7.5.11 (#​1514)
• chore(deps): bump @​redocly/openapi-core from 2.32.2 to 2.33.0 (#​1515)
• chore(deps): bump react-hook-form from 7.75.0 to 7.79.0 (#​1517)
• chore(deps): bump the react group across 1 directory with 2 updates (#​1503)
• chore(deps): bump sass from 1.99.0 to 1.101.0 (#​1504)
• chore(deps): bump @​redocly/openapi-core from 2.31.5 to 2.32.2 (#​1505)
• chore(deps): bump http-proxy-middleware from 2.0.9 to 2.0.10 (#​1511)
• chore(deps): bump webpack-dev-server from 5.2.4 to 5.2.5 (#​1512)
• chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 (#​1506)
• chore(deps): bump launch-editor from 2.12.0 to 2.14.1 (#​1510)
• chore(deps): bump @​redocly/openapi-core from 2.30.6 to 2.31.5 (#​1497)
• chore(deps): bump github/codeql-action from 4.35.5 to 4.36.1 (#​1501)
• chore(deps): bump @​reduxjs/toolkit from 2.11.2 to 2.12.0 (#​1498)
• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#​1500)
• chore(deps): bump tmp from 0.2.5 to 0.2.7 (#​1490)
• chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#​1489)
• chore(deps): bump sass-loader from 16.0.7 to 16.0.8 (#​1486)
• chore(deps): bump @​redocly/openapi-core from 2.30.5 to 2.30.6 (#​1484)
• chore(deps): bump the react group across 1 directory with 2 updates (#​1477)
• chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#​1482)
• chore(deps): bump @​redocly/openapi-core from 2.30.3 to 2.30.5 (#​1479)
• chore(

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
backend	63.42% <ø> (ø)
frontend	63.42% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.