Bump the major group across 1 directory with 38 updates

[dependabot]

Bumps the major group with 38 updates in the / directory:

Package	From	To
@csstools/postcss-oklab-function	4.0.12	5.0.2
@headlessui/react	1.7.19	2.2.9
@kittycad/react-shared	0.1.9	1.2.1
@tweenjs/tween.js	23.1.3	25.0.0
@xstate/react	4.1.3	6.1.0
chokidar	4.0.3	5.0.0
diff	7.0.0	8.0.4
@types/diff	7.0.2	8.0.0
html2canvas-pro	1.5.13	2.0.2
openid-client	5.7.1	6.8.2
react-hotkeys-hook	4.6.2	5.2.4
react-resizable-panels	3.0.6	4.7.6
react-router-dom	6.30.2	7.13.2
ua-parser-js	1.0.41	2.0.9
uuid	11.1.0	13.0.0
web-vitals	3.5.2	5.2.0
yargs	17.7.2	18.0.0
@biomejs/biome	1.9.4	2.4.9
@electron/fuses	1.8.0	2.1.1
@electron/notarize	2.5.0	3.1.1
@nabla/vite-plugin-eslint	2.0.6	3.0.1
@testing-library/react	15.0.7	16.3.2
@types/node	22.19.1	25.5.0
@types/uuid	9.0.8	11.0.0
@vitejs/plugin-react	4.7.0	6.0.1
@vitest/web-worker	3.2.4	4.1.2
cross-env	7.0.3	10.1.0
dpdm	3.14.0	4.0.1
electron	38.7.2	41.1.0
eslint	8.57.1	10.1.0
eslint-plugin-react-hooks	5.2.0	7.0.1
pixelmatch	5.3.0	7.1.0
tailwindcss	3.4.18	4.2.2
typescript	5.9.3	6.0.2
vite	5.4.21	8.0.3
vite-tsconfig-paths	4.3.2	6.1.1
vitest	3.2.4	4.1.2
glob	11.1.0	13.0.6

Updates @csstools/postcss-oklab-function from 4.0.12 to 5.0.2

Changelog

Sourced from @​csstools/postcss-oklab-function's changelog.

5.0.2

February 21, 2026

• Updated @csstools/css-color-parser to 4.0.2 (patch)

5.0.1

January 25, 2026

• Updated @csstools/css-color-parser to 4.0.1 (patch)

5.0.0

January 14, 2026

• Updated: Support for Node 20.19.0 or later (major).
• Removed: commonjs API. In supported Node versions require(esm) will work without needing to make code changes.
• Updated @csstools/css-tokenizer to 4.0.0 (major)
• Updated @csstools/utilities to 3.0.0 (major)
• Updated @csstools/css-parser-algorithms to 4.0.0 (major)
• Updated @csstools/postcss-progressive-custom-properties to 5.0.0 (major)
• Updated @csstools/css-color-parser to 4.0.0 (major)

Commits

• See full diff in compare view

Updates @headlessui/react from 1.7.19 to 2.2.9

Release notes

Sourced from @​headlessui/react's releases.

@​headlessui/react@​v2.2.9

Fixed

• Improve focus management in shadow DOM roots (#3794)
• Don't accidentally open the Combobox when touching the ComboboxButton while dragging on mobile (#3795)
• Ensure sibling Dialog components are scrollable on mobile (#3796)
• Infer Combobox type based on onChange handler (#3798)
• Allow home/end key default behavior inside ComboboxInput when Combobox is closed (#3798)
• Ensure interacting with a Dialog on iOS works after interacting with a disallowed area (#3801)
• Freeze Listbox values as soon as a value is selected (#3802)
• Ensure refs are forwarded when freezing data (#3390)
• Do not serialize React components into form fields (49e9e8e)

@​headlessui/react@​v2.2.8

Fixed

• Ensure we are not freezing data when the static prop is used (#3779)
• Ensure onChange types are contravariant instead of bivariant (#3781)
• Support <summary> as a focusable element inside <details> (#3389)
• Fix Maximum update depth exceeded crash when using transition prop (#3782)
• Ensure pressing Tab in the ComboboxInput, correctly syncs the input value (#3785)
• Ensure --button-width and --input-width have the latest value (#3786)
• Fix 'Invalid prop data-headlessui-state supplied to React.Fragment' warning (#3788)
• Ensure element in ref callback is always connected when rendering in a Portal (#3789)
• Ensure form state is up to date when using uncontrolled components (#3790)
• Ensure data-open on ComboboxInput is up to date (#3791)
• Ensure changing the immediate prop value on the Combobox component works as expected (#3792)

@​headlessui/react@​v2.2.7

Fixed

• Fix incorrect double invocation of menu items, listbox options and combobox options (#3766)
• Fix memory leak in SSR environment (#3767)
• Ensure programmatic .click() on MenuButton ref works (#3768)
• Don't activate hovered items while using the keyboard (#3769)

@​headlessui/react@​v2.2.6

Fixed

• Fix immediately closing Listbox by requiring some cursor movement (#3762)

@​headlessui/react@​v2.2.5

Fixed

• Fix listbox closing immediately after opening on touch devices (#3755)

@​headlessui/react@​v2.2.4

Fixed

• Fix Combobox error (unexpected undefined) when using virtual mode (#3734)

... (truncated)

Changelog

Sourced from @​headlessui/react's changelog.

[2.2.9] - 2025-09-25

Fixed

• Improve focus management in shadow DOM roots (#3794)
• Don't accidentally open the Combobox when touching the ComboboxButton while dragging on mobile (#3795)
• Ensure sibling Dialog components are scrollable on mobile (#3796)
• Infer Combobox type based on onChange handler (#3798)
• Allow home/end key default behavior inside ComboboxInput when Combobox is closed (#3798)
• Ensure interacting with a Dialog on iOS works after interacting with a disallowed area (#3801)
• Freeze Listbox values as soon as a value is selected (#3802)
• Ensure refs are forwarded when freezing data (#3390)
• Do not serialize React components into form fields (49e9e8e)

[2.2.8] - 2025-09-12

Fixed

• Ensure we are not freezing data when the static prop is used (#3779)
• Ensure onChange types are contravariant instead of bivariant (#3781)
• Support <summary> as a focusable element inside <details> (#3389)
• Fix Maximum update depth exceeded crash when using transition prop (#3782)
• Ensure pressing Tab in the ComboboxInput, correctly syncs the input value (#3785)
• Ensure --button-width and --input-width have the latest value (#3786)
• Fix 'Invalid prop data-headlessui-state supplied to React.Fragment' warning (#3788)
• Ensure element in ref callback is always connected when rendering in a Portal (#3789)
• Ensure form state is up to date when using uncontrolled components (#3790)
• Ensure data-open on ComboboxInput is up to date (#3791)
• Ensure changing the immediate prop value on the Combobox component works as expected (#3792)

[2.2.7] - 2025-07-30

Fixed

• Fix incorrect double invocation of menu items, listbox options and combobox options (#3766)
• Fix memory leak in SSR environment (#3767)
• Ensure programmatic .click() on MenuButton ref works (#3768)
• Don't activate hovered items while using the keyboard (#3769)

[2.2.6] - 2025-07-24

Fixed

• Fix immediately closing Listbox by requiring some cursor movement (#3762)

[2.2.5] - 2025-07-23

Fixed

• Fix listbox closing immediately after opening on touch devices (#3755)

... (truncated)

Commits

• 589ea90 2.2.9 - @​headlessui/react
• bba75c7 update changelog
• ca536ed update changelog
• 49e9e8e do not serialize React components into form fields
• 2a647a7 Ensure refs are forwarded when freezing data (#3390)
• da2fa94 Freeze values as soon as possible (#3802)
• 6b5709a Fix touch actions on iOS after entering disallowed area (#3801)
• 433b174 Allow home/end key default behavior inside ComboboxInput when Combobox is...
• 31b3e47 Infer Combobox type based on onChange handler (#3798)
• b0615ad Ensure sibling Dialog components are scrollable on mobile (#3796)
• Additional commits viewable in compare view

Updates @kittycad/react-shared from 0.1.9 to 1.2.1

Commits

• See full diff in compare view

Updates @tweenjs/tween.js from 23.1.3 to 25.0.0

Release notes

Sourced from @​tweenjs/tween.js's releases.

v25.0.0 - end of the end

BREAKING: no longer auto-start tweens by default when calling tween.update(). To restore previous behavior for the whole app, set the static Tween.autoStartOnUpdate property to true.

fix: make the end() method work better by setting the end time to start + duration instead of Infinity.

Full Changelog: tweenjs/tween.js@v24.0.0...v25.0.0

v24.0.0 - groupies!

This release finally deprecates usage of TWEEN as a default Group. All new Tweens now default to having no group, and must be explicitly added to a group if desired. Plus some other improvements to related to groups, including breaking changes (see below for all details and how to migrate if affected).

What's Changed

• Tiny readme fix for import-map example code. by @​Bug-Reaper in tweenjs/tween.js#685
• do not default to global TWEEN group for new Tweens, do not auto-add/remove tweens from groups, and update docs accordingly by @​trusktr in tweenjs/tween.js#688

New Contributors

• @​Bug-Reaper made their first contribution in tweenjs/tween.js#685

---

More Details

  feat: do not automatically add/remove a tween to/from its associated group, and do not automatically add new Tweens to the global TWEEN group by default.

feat: the tween.group(group) method now has a reciprocal tween.remove() method that will remove a tween from its associated group, and unassociate the group. tween.group() without an arg is no longer valid, see breaking changes and migration below.

fix: when a tween is stopped before its end time, do not allow its update method to continue, therefore preventing logic (f.e. repeat logic) from being triggered

docs: improved the docs, adding some missing information, removing all examples of the global TWEEN group which has been deprecated, and adding docs on how to manage groups of tweens. Also updated samples to use import syntax for importing Tween, avoiding the use of the TWEEN UMD global variable which has been deprecated.

feat: A new Group.allStopped() method returns true if all tweens in a group are not playing (i.e. stopped, and not paused), otherwise false. Useful for stopping an animation loop once all tweens in a group have finished their animation.

deprecated: Methods on TWEEN that come from Group are now deprecated to be removed in a future major version. Migrate forward by making a new Group instead of using TWEEN as a group.

deprecated: The UMD script that creates a global TWEEN variable is deprecated to be removed in a future major version.

deprecated: The CommonJS build is deprecated to be removed in a future major version.

BREAKING:

• Tweens are no longer automatically added or removed from groups by default when you call any Tween methods such as start(), stop(), or pause(), and the preserve parameter to Group.update() now defaults to true and is deprecated to be removed in a future major version.
  • MIGRATION: To keep old behavior for a while, explicitly call group.update() with false for the second parameter. To migrate forward, do not rely on automatic add/remove of tweens, and instead add/remove tweens to/from groups manually.
• Group.update() no longer returns a boolean indicating if all tweens have been removed.
  • MIGRATION: Don't rely on auto-add/remove to/from groups. This boolean return was previously useful for stopping an animation loop once all tweens were finished animating. Instead, use the new Group.allStopped() method to check if all tweens in a group are stopped in order to determine whether or not to continue an animation loop.
• The second group parameter to Tween.constructor now defaults to undefined instead of the global TWEEN group. Additionally it accepts a value of true to restore the old default behavior. The true value is deprecated and will be removed in a future major version.
  • MIGRATION: For the time being the parameter can be set to true to restore the old behavior. To migrate forward, use tween.group(group) or group.add(tween) instead.
• The argless tween.group() signature has been removed.

... (truncated)

Commits

• eb07dd2 v25.0.0
• 79fd510 BREAKING: no longer auto-start tweens by default when calling tween.update()....
• c92f761 v24.0.0
• 20169e2 Merge pull request #688 from tweenjs/default-to-no-global-group
• f28f069 feat: do not automatically add/remove a tween to/from its associated group
• 2469f1c Merge pull request #685 from Bug-Reaper/patch-1
• 68d91ce ✍️ : Adds missing letter "m" in importmap example.
• 0b1d4cf ✍️ : Fix path for module-map example (missing dot)
• See full diff in compare view

Updates @xstate/react from 4.1.3 to 6.1.0

Release notes

Sourced from @​xstate/react's releases.

@​xstate/react@​6.1.0

Minor Changes

• #5470 3e03427 Thanks @​davidkpiano! - useActor and useSelector now throw when the actor reaches an error state, allowing errors to be caught by React error boundaries.

  import { createMachine } from 'xstate';
  import { useActor } from '@xstate/react';
  import { ErrorBoundary } from 'react-error-boundary';
  const machine = createMachine({
  initial: 'idle',
  states: {
  idle: {
  on: {
  fetch: 'loading'
  }
  },
  loading: {
  invoke: {
  src: fromPromise(async () => {
  throw new Error('Network error');
  }),
  onDone: 'success'
  // Without onError, the actor enters an error state
  }
  },
  success: {}
  }
  });
  function App() {
  return (
  <ErrorBoundary fallback={<p>Something went wrong</p>}>
  <ActorComponent />
  </ErrorBoundary>
  );
  }
  function ActorComponent() {
  // If the actor errors, the error will be thrown
  // and caught by the nearest error boundary
  const [snapshot, send] = useActor(machine);
  return <div>{snapshot.value}</div>;
  }

@​xstate/react@​6.0.0

Patch Changes

... (truncated)

Commits

• d4f8c5b Version Packages (#5471)
• 3e03427 [@​xstate/react] Throw errors instead of swallowing (#5470)
• 79d6338 Version Packages (#5468)
• d54cc47 [@​xstate/store] Add wildcard support for store.on('*', ...) (#5467)
• dbfe25d Add AGENTS.md
• 2406e13 Version Packages (#5466)
• a741fe7 [v5] Routable states (#4184)
• ad809a0 [core] Export types so setup() declaration emit works (#5464)
• 87e980d Version Packages (#5465)
• 287b51e [core] getInitialMicrosteps(…) and getMicrosteps(…) (#5457)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​xstate/react since your current version.

Updates chokidar from 4.0.3 to 5.0.0

Release notes

Sourced from chokidar's releases.

5.0.0

• Make the package ESM-only. Reduces on-disk package size from ~150kb to ~80kb
• Increase minimum node.js version to v20.19. The versions starting from it support loading esm files from cjs
• fix: Make types more precise paulmillr/chokidar#1424
• perf: re-use double slash regex paulmillr/chokidar#1435
• Update readdirp to ESM-only v5
• Lots of minor improvements in tests
• Increase security of NPM releases. Switch to token-less Trusted Publishing, with help of jsbt
• Switch compilation mode to isolatedDeclaration-based typescript for simplified auto-generated docs

New Contributors

• @​mhkeller made their first contribution in paulmillr/chokidar#1426
• @​btea made their first contribution in paulmillr/chokidar#1432

Full Changelog: paulmillr/chokidar@4.0.3...5.0.0

Commits

• c0c8d20 Release 5.0.0.
• b211cec Remove src from npm
• 8742246 Upgrade dev deps, jsbt, ci files. Upgrade readdirp to v5.
• de5a34c Merge pull request #1442 from paulmillr/flaky-buns
• c08a6c4 fix: throttle based on dir + target
• 0c55ab3 test: wait for explicit calls in directory test
• ce81be5 perf: re-use double slash regex (#1435)
• 7d9c1ed Merge pull request #1433 from paulmillr/super-matrices
• 3915541 Merge pull request #1430 from paulmillr/esm-only
• 9308bed chore: use Nodejs 24 in CI (#1432)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for chokidar since your current version.

Updates diff from 7.0.0 to 8.0.4

Changelog

Sourced from diff's changelog.

8.0.4

• #667 - fix another bug in diffWords when used with an Intl.Segmenter. If the text to be diffed included a combining mark after a whitespace character (i.e. roughly speaking, an accented space), diffWords would previously crash. Now this case is handled correctly.

8.0.3

• #631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).
• #635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.
• #641 - the format of file headers in createPatch etc. patches can now be customised somewhat. It now takes a headerOptions option that can be used to disable the file headers entirely, or omit the Index: line and/or the underline. In particular, this was motivated by a request to make jsdiff patches compatible with react-diff-view, which they now are if produced with headerOptions: FILE_HEADERS_ONLY.
• #647 and #649 - fix denial-of-service vulnerabilities in parsePatch whereby adversarial input could cause a memory-leaking infinite loop, typically crashing the calling process. Also fixed ReDOS vulnerabilities whereby adversarially-crafted patch headers could take cubic time to parse. Now, parsePatch should reliably take linear time. (Handling of headers that include the line break characters \r, \u2028, or \u2029 in non-trailing positions is also now more reasonable as side effect of the fix.)

8.0.2

• #616 Restored compatibility of diffSentences with old Safari versions. This was broken in 8.0.0 by the introduction of a regex with a lookbehind assertion; these weren't supported in Safari prior to version 16.4.
• #612 Improved tree shakeability by marking the built CJS and ESM packages with sideEffects: false.

8.0.1

• #610 Fixes types for diffJson which were broken by 8.0.0. The new bundled types in 8.0.0 only allowed diffJson to be passed string arguments, but it should've been possible to pass either strings or objects (and now is). Thanks to Josh Kelley for the fix.

8.0.0

• #580 Multiple tweaks to diffSentences:
  • tokenization no longer takes quadratic time on pathological inputs (reported as a ReDOS vulnerability by Snyk); is now linear instead
  • the final sentence in the string is now handled the same by the tokenizer regardless of whether it has a trailing punctuation mark or not. (Previously, "foo. bar." tokenized to ["foo.", " ", "bar."] but "foo. bar" tokenized to ["foo.", " bar"] - i.e. whether the space between sentences was treated as a separate token depended upon whether the final sentence had trailing punctuation or not. This was arbitrary and surprising; it is no longer the case.)
  • in a string that starts with a sentence end, like "! hello.", the "!" is now treated as a separate sentence
  • the README now correctly documents the tokenization behaviour (it was wrong before)
• #581 - fixed some regex operations used for tokenization in diffWords taking O(n^2) time in pathological cases
• #595 - fixed a crash in patch creation functions when handling a single hunk consisting of a very large number (e.g. >130k) of lines. (This was caused by spreading indefinitely-large arrays to .push() using .apply or the spread operator and hitting the JS-implementation-specific limit on the maximum number of arguments to a function, as shown at https://stackoverflow.com/a/56809779/1709587; thus the exact threshold to hit the error will depend on the environment in which you were running JsDiff.)
• #596 - removed the merge function. Previously JsDiff included an undocumented function called merge that was meant to, in some sense, merge patches. It had at least a couple of serious bugs that could lead to it returning unambiguously wrong results, and it was difficult to simply "fix" because it was unclear precisely what it was meant to do. For now, the fix is to remove it entirely.
• #591 - JsDiff's source code has been rewritten in TypeScript. This change entails the following changes for end users:

  • the diff package on npm now includes its own TypeScript type definitions. Users who previously used the @types/diff npm package from DefinitelyTyped should remove that dependency when upgrading JsDiff to v8.

    Note that the transition from the DefinitelyTyped types to JsDiff's own type definitions includes multiple fixes and also removes many exported types previously used for options arguments to diffing and patch-generation functions. (There are now different exported options types for abortable calls - ones with a timeout or maxEditLength that may give a result of undefined - and non-abortable calls.) See the TypeScript section of the README for some usage tips.

  • The Diff object is now a class. Custom extensions of Diff, as described in the "Defining custom diffing behaviors" section of the README, can therefore now be done by writing a class CustomDiff extends Diff and overriding methods, instead of the old way based on prototype inheritance. (I think code that did things the old way should still work, though!)

  • diff/lib/index.es6.js and diff/lib/index.mjs no longer exist, and the ESM version of the library is no longer bundled into a single file.

  • The ignoreWhitespace option for diffWords is no longer included in the type declarations. The effect of passing ignoreWhitespace: true has always been to make diffWords just call diffWordsWithSpace instead, which was confusing, because that behaviour doesn't seem properly described as "ignoring" whitespace at all. The property remains available to non-TypeScript applications for the sake of backwards compatibility, but TypeScript applications will now see a type error if they try to pass ignoreWhitespace: true to diffWords and should change their code to call diffWordsWithSpace instead.

  • JsDiff no longer purports to support ES3 environments. (I'm pretty sure it never truly did, despite claiming to in its README, since even the 1.0.0 release used Array.map which was added in ES5.)

• #601 - diffJson's stringifyReplacer option behaves more like JSON.stringify's replacer argument now. In particular:
  • Each key/value pair now gets passed through the replacer once instead of twice
  • The key passed to the replacer when the top-level object is passed in as value is now "" (previously, was undefined), and the key passed with an array element is the array index as a string, like "0" or "1" (previously was whatever the key for the entire array was). Both the new behaviours match that of JSON.stringify.
• #602 - diffing functions now consistently return undefined when called in async mode (i.e. with a callback). Previously, there was an odd quirk where they would return true if the strings being diffed were equal and undefined otherwise.

Commits

• dd2f994 8.0.4 release (#678)
• 3cc4384 Update docs on releasing to reflect migration to yarn berry (#677)
• 6fc2aa6 yarn up '*' && yarn up -R '**' (#676)
• af7393a yarn up '*' && yarn up -R '**' (#670)
• 4b5d180 Fix another bug in diffWords's "intlSegmenter" mode (#667)
• 10da50c yarn up '*' && yarn up -R '**' (#666)
• 8dc164b Migrate from Yarn Classic to Yarn Berry (#662)
• 750fbd6 yarn upgrade --latest (#661)
• abe2bde Add release notes for undocumented releases (#658)
• 13576bf 8.0.3 release (#652)
• Additional commits viewable in compare view

Updates @types/diff from 7.0.2 to 8.0.0

Commits

• See full diff in compare view

Updates html2canvas-pro from 1.5.13 to 2.0.2

Release notes

Sourced from html2canvas-pro's releases.

v2.0.2

Please refer to CHANGELOG.md for details.

v2.0.1

Please refer to CHANGELOG.md for details.

v2.0.0

Please refer to CHANGELOG.md for details.

v1.6.7

Please refer to CHANGELOG.md for details.

v1.6.6

Please refer to CHANGELOG.md for details.

v1.6.5

Please refer to CHANGELOG.md for details.

v1.6.4

Please refer to CHANGELOG.md for details.

v1.6.3

Please refer to CHANGELOG.md for details.

v1.6.2

Please refer to CHANGELOG.md for details.

v1.6.1

Please refer to CHANGELOG.md for details.

v1.6.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from html2canvas-pro's changelog.

2.0.2 (2026-02-26)

Fixes

• document-cloner: ensure correct order for adoptNode() (58bbe5d)

2.0.1 (2026-02-24)

Features

• add image smoothing control support (b4d7018)
• add support for clip-path CSS property with various shape functions (828865f)

Refactor

• major architecture refactoring - apply SOLID principles and improve code quality (368875e)

Chore

• release: 2.0.0 (1c485a8)

Fixes

• dom-normalizer: replace transforms with identity values (7b1bccf)
• text-renderer: fix letter-spacing and CJK baseline offset (#73) (3d9d31f)

2.0.0 (2026-02-21)

Features

• add image smoothing control support (b4d7018)

Refactor

• major architecture refactoring - apply SOLID principles and improve code quality (368875e)

1.6.7 (2026-02-13)

Chore

• release: 1.6.6 (222b73f)

... (truncated)

Commits

• 11efc91 chore(release): 2.0.2
• 58bbe5d fix(document-cloner): ensure correct order for adoptNode()
• b87b3e4 chore(release): 2.0.1
• 7b1bccf fix(dom-normalizer): replace transforms with identity values
• 828865f feat: add support for clip-path CSS property with various shape functions
• 3d9d31f fix(text-renderer): fix letter-spacing and CJK baseline offset (#73)
• 1c485a8 chore(release): 2.0.0
• b4d7018 feat: add image smoothing control support
• 368875e refactor: major architecture refactoring - apply SOLID principles and improve...
• a0ec61f chore(release): 1.6.7
• Additional commits viewable in compare view

Updates openid-client from 5.7.1 to 6.8.2

Release notes

Sourced from openid-client's releases.

v6.8.2

Fixes

• use duplex: half for fetchProtectedResource with ReadableStream body input (f6f84e2)

v6.8.1

Refactor

• workaround dpop nonce caching caveats with customFetch (a9eb50f)

v6.8.0

Features

• respect retry-after in CIBA and Device Authorization Grant polling (6ce3411)

Documentation

• remove mention of Edge Runtime from the readme (2e41ad5)

v6.7.1

Fixes

• passport: include req.host from express@5 for ease of use in express@4 (81f6c12)

v6.7.0

Features

• support for the ML-DSA Algorithm Identifiers (9543da5)

v6.6.4

Fixes

• recognize N_A in the token exchange grant (770b177)

v6.6.3

Documentation

• fix TokenEndpointResponseHelpers.claims() note (b77c786)

Refactor

• passport: allow custom logic to drive initiating auth requests (0b57115), closes #811

v6.6.2

Fixes

• RFC8414: strip any terminating "/" when pathname is present (e884302)

... (truncated)

Changelog

Sourced from openid-client's changelog.

6.8.2 (2026-02-07)

Fixes

• use duplex: half for fetchProtectedResource with ReadableStream body input (f6f84e2)

6.8.1 (2025-09-27)

Refactor

• workaround dpop nonce caching caveats with customFetch (a9eb50f)

6.8.0 (2025-09-11)

Features

• respect retry-after in CIBA and Device Authorization Grant polling (6ce3411)

Documentation

• remove mention of Edge Runtime from the readme (2e41ad5)

6.7.1 (2025-08-29)

Fixes

• passport: include req.host from express@5 for ease of use in express@4 (81f6c12)

6.7.0 (2025-08-27)

Features

• support for the ML-DSA Algorithm Identifiers (9543da5)

6.6.4 (2025-08-12)

Fixes

• recognize N_A in the token exchange grant (770b177)

6.6.3 (2025-08-05)

... (truncated)

Commits

• b14e51c chore(release): 6.8.2
• f6f84e2 fix: use duplex: half for fetchProtectedResource with ReadableStream body input
• f879890 chore: bump packages
• b506e1a build(deps): bump the actions group with 4 updates (#853)
• 0baa958 chore: bump packages
• c5d4931 chore: bump packages
• 7cf3c12 test: revert undici for the time being
• 8b2e360 chore: bump packages
• 79386b7 build(deps): bump lodash from 4.17.21 to 4.17.23 (#849)
• 950e199 build(deps-dev): bump tar from 7.5.3 to 7.5.6 (#848)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for openid-client since your current version.

Updates react-hotkeys-hook from 4.6.2 to 5.2.4

Release notes

Sourced from react-hotkeys-hook's releases.

v5.2.4

• Merge pull request #1312 from JohannesKlauss/revert-1275-main 1197daf
• Revert Regression introduced in "Try to prevent events firing incorrectly when using useKey: true" 612e549
• Merge pull request #1311 from ShrimpCryptid/feat/clarify-ishotkeypressed-multiple-key-behavior 0219c01
• doc: Updated wording on isHotkeyPressed key argument 9203b7f
• fix: Update documentation for isHotkeyPressed to describe arguments correctly 154eab9

---

JohannesKlauss/react-hotkeys-hook@v5.2.3...v5.2.4...

Description has been truncated