deps: bump the production-dependencies group with 5 updates

[dependabot]

Bumps the production-dependencies group with 5 updates:

Package	From	To
@assistant-ui/react	0.15.14	0.15.16
@assistant-ui/react-markdown	0.14.10	0.14.12
@hookform/resolvers	5.8.0	5.9.1
@tanstack/react-virtual	3.14.9	3.14.10
input-otp	1.4.2	1.5.0

Updates @assistant-ui/react from 0.15.14 to 0.15.16

Release notes

Sourced from @​assistant-ui/react's releases.

@​assistant-ui/react@​0.15.16

Patch Changes

• #6136 f7bd2d9 - fix: keep DevTools updates flowing when a subscriber throws (@​Kinfe123)

• #6055 1f3eaa7 - fix: contain SandboxHost render failures after teardown (@​Kinfe123)

• #6110 48f95b1 - chore: delete the dead ensureBinding and useRuntimeState utilities (@​samdickson22)

  src/context/react/utils/ensureBinding.ts and src/context/react/utils/useRuntimeState.ts imported only each other. Nothing else in the repo referenced them, neither appears in the package barrel or the api-surface snapshot, and the "."-only exports map made them unreachable to consumers. ensureBinding was an external caller of __internal_bindMethods that no longer had a caller of its own; the runtime classes bind themselves in their constructors, so nothing changes at runtime. The public API surface is unchanged and every other emitted file is byte-identical.

• #6156 9c65b51 - deprecate leftover Primitive.If and Empty wrappers on react-native and react-ink, and point them at AuiIf (@​okisdev)

  ThreadIf now reads thread.isEmpty instead of messages.length === 0, matching the loading-aware field already used by ThreadEmpty and AuiIf. First-party examples and docs samples that still called the leftover wrappers now use AuiIf directly.

• #6084 ca9e72c - fix: resync trigger popover cursor after selection (@​rupic-app)

• #6054 59e9a08 - fix: handle rejected asynchronous Markdown exports (@​Kinfe123)

• #6098 b9b9dad - fix: drain unrevealed smooth text when a message completes before any frame (@​rupic-app)

• #6061 75dfbe3 - docs: document Escape-to-stop-speaking on ThreadPrimitive.Root (@​samdickson22)

• #6124 06b04a7 - chore: update dependencies (@​okisdev)

• Updated dependencies [fa30915, b355aef, f7bd2d9, 4947ef4, 332f736, ef9254d, 9c65b51, 5845ba7, 1b30bfd, 365e763, d19921d, 996aa57, 21d6e87, cd247e5, f2b3ef8, 1bf263b, 19e52c4, 06b04a7, a614b5e, 07b51db, 92e52bd]:

  • @​assistant-ui/core@​0.3.15
  • @​assistant-ui/tap@​0.9.14
  • assistant-stream@0.3.39

@​assistant-ui/react@​0.15.15

Patch Changes

• #6071 c3fd447 - feat: host assistant-cloud thread lists on AISDKThreads via RemoteThreadList (@​okisdev)

  AISDKThreads({ cloud }) uses RemoteThreadList and remounts each thread like useChatRuntime. Cloud history withFormat resolves persistence per call so one adapter can serve many threads. useExternalHistory waits for threadListItem.remoteId instead of latching on the first empty paint.

• #5872 f9529bf - feat: move useAssistantTransportRuntime into core/react (@​okisdev)

• #5872 f9529bf - fix: persist data message parts in aui/v0 cloud history (@​okisdev)

• #5839 24a1af7 - fix: validate MCP App resource responses (@​Kinfe123)

• #5817 dab7b7a - fix: dispose sandbox frames when bridge setup fails (@​Kinfe123)

... (truncated)

Changelog

Sourced from @​assistant-ui/react's changelog.

0.15.16

Patch Changes

• #6136 f7bd2d9 - fix: keep DevTools updates flowing when a subscriber throws (@​Kinfe123)

• #6055 1f3eaa7 - fix: contain SandboxHost render failures after teardown (@​Kinfe123)

• #6110 48f95b1 - chore: delete the dead ensureBinding and useRuntimeState utilities (@​samdickson22)

  src/context/react/utils/ensureBinding.ts and src/context/react/utils/useRuntimeState.ts imported only each other. Nothing else in the repo referenced them, neither appears in the package barrel or the api-surface snapshot, and the "."-only exports map made them unreachable to consumers. ensureBinding was an external caller of __internal_bindMethods that no longer had a caller of its own; the runtime classes bind themselves in their constructors, so nothing changes at runtime. The public API surface is unchanged and every other emitted file is byte-identical.

• #6156 9c65b51 - deprecate leftover Primitive.If and Empty wrappers on react-native and react-ink, and point them at AuiIf (@​okisdev)

  ThreadIf now reads thread.isEmpty instead of messages.length === 0, matching the loading-aware field already used by ThreadEmpty and AuiIf. First-party examples and docs samples that still called the leftover wrappers now use AuiIf directly.

• #6084 ca9e72c - fix: resync trigger popover cursor after selection (@​rupic-app)

• #6054 59e9a08 - fix: handle rejected asynchronous Markdown exports (@​Kinfe123)

• #6098 b9b9dad - fix: drain unrevealed smooth text when a message completes before any frame (@​rupic-app)

• #6061 75dfbe3 - docs: document Escape-to-stop-speaking on ThreadPrimitive.Root (@​samdickson22)

• #6124 06b04a7 - chore: update dependencies (@​okisdev)

• Updated dependencies [fa30915, b355aef, f7bd2d9, 4947ef4, 332f736, ef9254d, 9c65b51, 5845ba7, 1b30bfd, 365e763, d19921d, 996aa57, 21d6e87, cd247e5, f2b3ef8, 1bf263b, 19e52c4, 06b04a7, a614b5e, 07b51db, 92e52bd]:

  • @​assistant-ui/core@​0.3.15
  • @​assistant-ui/tap@​0.9.14
  • assistant-stream@0.3.39

0.15.15

Patch Changes

• #6071 c3fd447 - feat: host assistant-cloud thread lists on AISDKThreads via RemoteThreadList (@​okisdev)

  AISDKThreads({ cloud }) uses RemoteThreadList and remounts each thread like useChatRuntime. Cloud history withFormat resolves persistence per call so one adapter can serve many threads. useExternalHistory waits for threadListItem.remoteId instead of latching on the first empty paint.

• #5872 f9529bf - feat: move useAssistantTransportRuntime into core/react (@​okisdev)

• #5872 f9529bf - fix: persist data message parts in aui/v0 cloud history (@​okisdev)

• #5839 24a1af7 - fix: validate MCP App resource responses (@​Kinfe123)

... (truncated)

Commits

• 75e3ef7 chore: update versions (#6086)
• f7bd2d9 fix(react): isolate devtools subscribers (#6136)
• 9c65b51 fix(react-native,react-ink): honor thread.isEmpty in leftover ThreadIf (#6156)
• 48f95b1 chore(react): delete the dead ensureBinding and useRuntimeState utilities (#6...
• 06b04a7 chore: update dependencies (#6124)
• b9b9dad fix: drain smooth text when a message completes before an animation frame (#6...
• 10a0f3a test(react): vary live-completion fetcher and cacheKey independently (#6062)
• b355aef fix(core): prevent assistant frame origin downgrades (#5823)
• 75dfbe3 docs(react): document Escape-to-stop-speaking on ThreadPrimitive.Root (#6061)
• ca9e72c fix(react): resync trigger cursor after selection (#6082) (#6084)
• Additional commits viewable in compare view

Updates @assistant-ui/react-markdown from 0.14.10 to 0.14.12

Release notes

Sourced from @​assistant-ui/react-markdown's releases.

@​assistant-ui/react-markdown@​0.14.12

Patch Changes

• #6160 235fa59 - fix: preserve currency inside one- and two-backtick code spans that contain longer backtick runs (@​okisdev)

@​assistant-ui/react-markdown@​0.14.11

Patch Changes

• #5674 3461ab3 - fix: pass the raw fence language to custom highlighters instead of "unknown" (@​ShobhitPatra)

Changelog

Sourced from @​assistant-ui/react-markdown's changelog.

0.14.12

Patch Changes

• #6160 235fa59 - fix: preserve currency inside one- and two-backtick code spans that contain longer backtick runs (@​okisdev)

0.14.11

Patch Changes

• #5674 3461ab3 - fix: pass the raw fence language to custom highlighters instead of "unknown" (@​ShobhitPatra)

Commits

• 75e3ef7 chore: update versions (#6086)
• 235fa59 fix(markdown): require equal-length inline backtick closers (#6160)
• 4db781c chore: update versions (#5832)
• 3461ab3 fix(react-markdown): pass the raw fence language instead of unknown (#5674)
• See full diff in compare view

Updates @hookform/resolvers from 5.8.0 to 5.9.1

Release notes

Sourced from @​hookform/resolvers's releases.

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

• isNameInFieldArray fails to recognise bracket-notation array paths causing nested errors overwriting (#876) (f18ddfb)

v5.9.0

5.9.0 (2026-08-15)

Features

• update joi to v18 (#873) (c8159ae)

Commits

• f18ddfb fix: isNameInFieldArray fails to recognise bracket-notation array paths causi...
• c8159ae feat: update joi to v18 (#873)
• See full diff in compare view

Updates @tanstack/react-virtual from 3.14.9 to 3.14.10

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.10

Patch Changes

• Updated dependencies [a0a411e, d2cf98b]:
  • @​tanstack/virtual-core@​3.17.8

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.10

Patch Changes

• Updated dependencies [a0a411e, d2cf98b]:
  • @​tanstack/virtual-core@​3.17.8

Commits

• e9874f0 ci: Version Packages (#1247)
• See full diff in compare view

Updates input-otp from 1.4.2 to 1.5.0

Release notes

Sourced from input-otp's releases.

v1.5.0

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

• fix(input): reserve the password manager badge gutter only where it fits
• fix(input): disable spellcheck by default
• fix(input): feature-detect ResizeObserver before observing
• fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
• fix(input): clear pending synchronization timeouts on unmount
• feat(input): add a nonce prop for Content-Security-Policy support
• fix(input): guard the input reference used by the selectionchange listener
• fix(input): opt the container out of browser translation
• fix(input): report cosmetic CSS rule failures as warnings instead of errors
• docs: document the stable iOS selection behavior and its cosmetic limitation

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

• revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
• revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
• docs: align the mobile and edge-case documentation with the stable candidate
• test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

• fix(input): reserve the password manager badge gutter only where it fits
  • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
• fix(input): disable spellcheck by default
  • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
• fix(input): feature-detect ResizeObserver before observing
  • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
• fix(input): fall back to 16px font-size until --root-height resolves
  • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
• fix(input): clear pending sync timeouts on unmount
  • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
• feat(input): add nonce prop
  • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
• fix(input): use the guarded input reference inside the selectionchange listener
  • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
• fix(input): opt the container out of browser translation
  • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.
• fix(input): log CSS rule insertion failures as warnings, not errors
  • Some environments reject individual cosmetic selectors (:autofill in older Android WebViews, for instance). Nothing breaks when that happens, but the console.error was captured by Sentry and similar tools as if the application had failed. Same message, warning level.
• chore(types): narrow onComplete to (value: string) => unknown

... (truncated)

Changelog

Sourced from input-otp's changelog.

[1.5.0]

Promotes the safe 1.5.0-beta.2 code without functional changes. Everything in this release is backwards-compatible: no public type changes and no behavior changes beyond the bug fixes below. Two beta.1 experiments are deliberately excluded — the iOS native-selection workaround (the thin native selection artifact remains a known cosmetic limitation) and the onComplete type narrowing, which returns in 2.0.0 as a documented breaking change.

• fix(input): reserve the password manager badge gutter only where it fits
• fix(input): disable spellcheck by default
• fix(input): feature-detect ResizeObserver before observing
• fix(input): use a 16px fallback until --root-height resolves, preventing iOS focus zoom
• fix(input): clear pending synchronization timeouts on unmount
• feat(input): add a nonce prop for Content-Security-Policy support
• fix(input): guard the input reference used by the selectionchange listener
• fix(input): opt the container out of browser translation
• fix(input): report cosmetic CSS rule failures as warnings instead of errors
• docs: document the stable iOS selection behavior and its cosmetic limitation

[1.5.0-beta.2]

Safe release candidate for 1.5.0. This release withdraws the experimental iOS native-selection workaround from 1.5.0-beta.1 after compatibility review. The edit menu, paste, typing, selection and focus behavior return to the proven 1.4.x implementation; the thin native selection artifact remains a known iOS limitation.

It also withdraws the onComplete type narrowing from 1.5.0-beta.1. Although type-level only, it can fail compilation of existing handlers typed with extra or non-string parameters (a common example is passing react-hook-form's handleSubmit(onSubmit) directly), which makes it a breaking change under semver. It will return in 2.0.0 with a documented migration path.

• revert(input): withdraw the experimental iOS native-selection workaround from 1.5.0-beta.1
• revert(types): withdraw the onComplete narrowing from 1.5.0-beta.1, deferring it to 2.0.0
• docs: align the mobile and edge-case documentation with the stable candidate
• test: verify focus, typing, editing, deletion, paste, Select All → Paste and the native edit menu on iOS 18.0 and 26.5 simulators

[1.5.0-beta.1]

Deprecated experimental release. It introduced an iOS native-selection workaround that moved and scaled the underlying input, and narrowed the onComplete type in a way that can break compilation of existing apps. Both were withdrawn in 1.5.0-beta.2 and are not planned for 1.5.0 stable. Existing installs remain reproducible, but new beta users should use 1.5.0-beta.2 or later.

[1.5.0-beta.0]

Prepared but not published. Its safe changes are included in 1.5.0-beta.2.

• fix(input): reserve the password manager badge gutter only where it fits
  • Once a badge was detected, the input grew 40px past the container to push the badge off the last slot — and the only guard was the distance to the viewport's right edge. Inside a constrained scroll container (a card, a modal) that overhang registered as scrollable overflow: a horizontal scrollbar appeared and shifted the whole layout. The space check now measures the nearest ancestor that constrains horizontal overflow (scroll containers, overflow: hidden/clip ancestors, the container itself, and the real viewport width) and skips the push when the gutter doesn't fit; the badge then stays over the last slot, exactly as with pushPasswordManagerStrategy="none". Nothing is ever clipped, so extensions keep rendering their badges.
• fix(input): disable spellcheck by default
  • Browsers would mark a filled code as a spelling error and underline it. spellCheck now defaults to false; passing your own spellCheck prop still overrides it.
• fix(input): feature-detect ResizeObserver before observing
  • Browsers without ResizeObserver (e.g. iOS Safari <13.4) crashed on mount. When the observer is unavailable, the root height is now simply measured once on mount.
• fix(input): fall back to 16px font-size until --root-height resolves
  • Before the variable is set, the invisible input inherited its font-size — and when that inherited size was under 16px, iOS Safari zoomed the whole page on focus or back-navigation.
• fix(input): clear pending sync timeouts on unmount
  • The autofill/selection sync timeouts could fire after unmount, causing state updates on an unmounted component — noisy act() warnings and flaky CI test runs.
• feat(input): add nonce prop
  • Applied to the <style> tag the library injects, so a style-src Content-Security-Policy that requires nonces no longer blocks it.
• fix(input): use the guarded input reference inside the selectionchange listener
  • Fixes a null is not an object (evaluating 'setSelectionRange') crash when the listener fired while the ref was already null.
• fix(input): opt the container out of browser translation
  • Chrome's translator rewrote the slots' text nodes (wrapping them in <font> elements), crashing React on the next re-render — easiest to hit with alphanumeric codes under an active page translation. The container now carries translate="no"; a one-time code is never meaningful to translate.

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for input-otp since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.