[dependabot]

Bumps the minor-and-patch group with 42 updates in the / directory:

Package	From	To
turbo	2.8.8	2.11.10
gsap	3.15.0	3.15.1
motion	14.0.0	14.10.1
next	15.5.12	15.5.29
react	19.2.4	19.3.1
@types/react	19.2.14	19.3.0
react-dom	19.2.4	19.3.1
@types/react-dom	19.2.3	19.3.0
@types/react	19.2.14	19.3.0
@types/react-dom	19.2.3	19.3.0
autoprefixer	10.4.24	10.6.2
postcss	8.5.6	8.5.32
fs-extra	11.3.3	11.4.1
@tailwindcss/node	4.3.3	4.3.5
@radix-ui/react-accordion	1.2.12	1.3.1
@radix-ui/react-alert-dialog	1.1.15	1.2.1
@radix-ui/react-aspect-ratio	1.1.16	1.2.0
@radix-ui/react-checkbox	1.3.3	1.4.1
@radix-ui/react-collapsible	1.1.21	1.2.1
@radix-ui/react-context-menu	2.3.8	2.4.1
@radix-ui/react-dialog	1.1.15	1.3.1
@radix-ui/react-dropdown-menu	2.1.16	2.2.1
@radix-ui/react-hover-card	1.1.15	1.2.1
@radix-ui/react-menubar	1.1.25	1.2.1
@radix-ui/react-navigation-menu	1.3.0	1.4.1
@radix-ui/react-popover	1.1.15	1.3.1
@radix-ui/react-progress	1.1.8	1.2.1
@radix-ui/react-radio-group	1.3.8	1.5.1
@radix-ui/react-scroll-area	1.3.0	1.4.0
@radix-ui/react-select	2.2.6	2.4.1
@radix-ui/react-separator	1.1.16	1.2.0
@radix-ui/react-slider	1.3.6	1.6.1
@radix-ui/react-slot	1.2.4	1.5.0
@radix-ui/react-switch	1.2.6	1.4.1
@radix-ui/react-tabs	1.1.13	1.2.1
@radix-ui/react-toast	1.2.15	1.3.1
@radix-ui/react-toggle	1.1.19	1.2.1
@radix-ui/react-toggle-group	1.1.20	1.2.1
@radix-ui/react-tooltip	1.2.8	1.4.1
sonner	2.0.7	2.0.8
tailwind-merge	3.4.0	3.7.0
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.8
axe-core	4.11.1	4.14.0

Updates turbo from 2.8.8 to 2.11.10

Release notes

Sourced from turbo's releases.

Turborepo v2.11.10

What's Changed

Changelog

• fix: Allow non-recursive Turbo commands in root tasks by @​sahyl in vercel/turborepo#14814
• chore: Release Turborepo 2.11.9 by @​github-actions[bot] in vercel/turborepo#14824
• chore(deps): Update dependency @​vercel/geistdocs to v2 by @​vercel-gh-bot-4[bot] in vercel/turborepo#14417
• chore: Update with-gatsby example by @​vercel-gh-bot-3[bot] in vercel/turborepo#14796
• fix: Avoid pnpm batch-shim shutdown hangs on Windows by @​sahyl in vercel/turborepo#14819
• chore(deps): Update dependency @​vercel/geistdocs to v2.11.0 by @​vercel-gh-bot-3[bot] in vercel/turborepo#14832
• fix: Exclude tool-managed directories from local dependency inputs by @​PedroRosalba in vercel/turborepo#14696
• fix: Match git's text=auto binary detection in file hashing by @​PedroRosalba in vercel/turborepo#14697
• fix: Drop @​react-router/dev from Remix match list by @​Pcmhacker-piro in vercel/turborepo#14800
• fix: Match package configuration files and directory inputs in task-level affected detection by @​PedroRosalba in vercel/turborepo#14804
• fix: Parse pnpm 8 single-project lockfiles by @​PedroRosalba in vercel/turborepo#14806
• fix: Keep task env vars in the hash when globalEnv excludes inferred vars by @​PedroRosalba in vercel/turborepo#14805
• docs: Generate the sitemap from Geistdocs sources by @​molebox in vercel/turborepo#14865
• fix: Restore cached symlinks when outputs are already on disk by @​PedroRosalba in vercel/turborepo#14807
• chore: Remove CODEOWNERS file by @​anthonyshew with @​Copilot in vercel/turborepo#14810
• feat: Enable WebMCP for Turborepo docs by @​anthonyshew in vercel/turborepo#14828
• fix: Exit quietly when turbo ls output is piped to a closed reader by @​drakeo338 in vercel/turborepo#14868
• fix: Distrust compromised eMudhra intermediate certificates by @​anthonyshew in vercel/turborepo#14876

Full Changelog: vercel/turborepo@v2.11.9...v2.11.10

Turborepo v2.11.9

What's Changed

Changelog

• chore: Release Turborepo 2.11.8 by @​github-actions[bot] in vercel/turborepo#14789
• perf: Prefetch Cargo metadata during lazy graph construction by @​anthonyshew in vercel/turborepo#14497
• perf: Compute Berry lockfile closures once across workspaces by @​anthonyshew in vercel/turborepo#14499
• perf: Check cache hit outputs in place instead of on the blocking pool by @​anthonyshew in vercel/turborepo#14524
• perf: Speed up Berry lockfile loading by @​anthonyshew in vercel/turborepo#14500
• perf: Parse bun.lock without building a JSON syntax tree by @​anthonyshew in vercel/turborepo#14502
• perf: Skip the dry run cache batch window when there is no remote cache by @​anthonyshew in vercel/turborepo#14505
• perf: Emit lockfile closures pre-sorted and cheapen closure interning by @​anthonyshew in vercel/turborepo#14525
• perf: Reuse configuration derived from turbo.json between the shim and the CLI by @​anthonyshew in vercel/turborepo#14521
• feat: Report locked tools-only setup plans by @​anthonyshew in vercel/turborepo#14483
• perf: Compute Bun lockfile closures once across workspaces by @​anthonyshew in vercel/turborepo#14501
• perf: Reuse open parent directories when restoring cache archives by @​anthonyshew in vercel/turborepo#14506
• perf: Skip dropping the run right before turbo run exits by @​anthonyshew in vercel/turborepo#14507
• perf: Match literal input exclusions without compiling globs by @​anthonyshew in vercel/turborepo#14510
• perf: Copy pruned package files in parallel by @​anthonyshew in vercel/turborepo#14512
• feat: Report proposed first-lock and refresh setup plans by @​anthonyshew in vercel/turborepo#14571
• perf: Compress large cache archives with multithreaded zstd by @​anthonyshew in vercel/turborepo#14698
• perf: Read tracked file stats from directory listings on Windows by @​anthonyshew in vercel/turborepo#14633

... (truncated)

Commits

• e521641 publish 2.11.10 to registry
• aaf5a3a fix: Distrust compromised eMudhra intermediate certificates (#14876)
• 9816503 fix: Exit quietly when turbo ls output is piped to a closed reader (#14868)
• af866e5 feat: Enable WebMCP for Turborepo docs (#14828)
• b42cc68 chore: Remove CODEOWNERS file (#14810)
• 921155f fix: Restore cached symlinks when outputs are already on disk (#14807)
• 9330903 docs: Generate the sitemap from Geistdocs sources (#14865)
• 6048038 fix: Keep task env vars in the hash when globalEnv excludes inferred vars (#1...
• 57ecce3 fix: Parse pnpm 8 single-project lockfiles (#14806)
• d926d6a fix: Match package configuration files and directory inputs in task-level aff...
• Additional commits viewable in compare view

Updates gsap from 3.15.0 to 3.15.1

Commits

• 5e6c35f 3.15.1
• See full diff in compare view

Updates motion from 14.0.0 to 14.10.1

Changelog

Sourced from motion's changelog.

[14.10.1] 2026-11-05

Fixed

• animate: Fix not recognising timeline of only nested sequences as timeline.
• Various performance-related improvements.

[14.10.0] 2026-11-05

Added

• press: count, hold and repeat, for double/triple press, long press and multipress gestures.
• drag: Expose getProps on the dragConstraints function context.
• drag: x/y props for headless gesture tracking.
• Reorder: Home and End buttons move selected item to beginning and end of list, respectively.
• motion: New tap prop for configuring press gesture.

Fixed

• animate: Minor fixes.

[14.9.1] 2026-11-04

Added

• Ensure accelerated transform animations finish correctly.
• AnimatePresence: Fix exit never starting when a child mounts already exiting.
• AnimatePresence: Fix exit stuck after an open layoutId card switches to another item.
• Ensure accelerated animations are cleaned up in WebKit.

[14.9.0] 2026-10-30

Added

• PresenceContext: Added internal keepValuesOnRemount option for internal use.
• dragConstraints: Accepts function for internal use.
• Reorder: Keyboard accessibility now focuses just the first item, arrows move focus, arrow keys work in relation to how items are presented on-screen.

[14.8.0] 2026-10-29

Added

• transition: Added mixer option for passing custom mixer functions.

Fixed

• Only counts projection stats while recordStats() is running.
• Fix accelerated animations stuck at initial after remount.
• drag: 20% smaller.
• m component: 6% smaller.

... (truncated)

Commits

• 78f3ff5 v14.10.1
• 5243b32 Updating changelog
• a404e1a Merge pull request #4070 from motiondivision/claude/project-thread-e45kg1
• cfdf2ef Merge branch 'main' into claude/project-thread-e45kg1
• 94097e4 Merge pull request #4067 from motiondivision/lean/5-binding
• d95cc90 Merge pull request #4066 from motiondivision/lean/4-spans
• 5797936 Fix timing flake in "built when played after a pause" test
• 7a0a081 Merge remote-tracking branch 'origin/main' into claude/project-thread-kgyuj9
• 16320ad Merge pull request #4065 from motiondivision/lean/2-value
• 1c9194b Raise framer-motion size budgets to current sizes
• Additional commits viewable in compare view

Updates next from 15.5.12 to 15.5.29

Release notes

Sourced from next's releases.

v15.5.29

This release contains security fixes for the following advisories:

Moderate

• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v15.5.28

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v15.5.27

This release contains security fixes for the following advisories:

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

v15.5.26

This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026

Commits

• 17014e9 v15.5.29
• 9fc04bd [lts-maintenance] Strip internal middleware cookie headers from edge response...
• 848ec29 [lts-maintenance] Fix stale compressed framing for forwarded fetch responses ...
• 4f13335 [lts-maintenance] [next/image] Fix false-positive AVIF/HEIC detection (#272)
• df196a8 [lts-maintenance] [ci] Pin deploy test deployments to Node.js 22.x (#100887)
• 2829b57 [lts-maintenance][cd] Move release un-draft to a follow-up job in bot-autonom...
• 2810b5b [lts-maintenance][cd] Gate release bot credentials behind GitHub environments...
• 195cd6a v15.5.28
• 1b53604 [cd] Allow branch to get published
• 5e3b687 [lts-maintenance][next/image] Bump sharp (#232)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates react from 19.2.4 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #37113)
• Only remove properties from Host Singletons on release (@​gnoff #37112)

... (truncated)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• 2dc7da7 [test] Bump Jest to 30.4 (#37382)
• 4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
• dbc3750 Update required references to GitHub repo (#36752)
• 900ae09 [flow] Bump flow to v0.317.0 (#36701)
• fbb1370 [flow] Bump flow to v0.307.1 (#36199)
• 56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
• 74568e8 [Flight] Transport AggregateErrors.errors (#36156)
• e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
• db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates @types/react from 19.2.14 to 19.3.0

Commits

• See full diff in compare view

Updates react-dom from 19.2.4 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTr...

  Description has been truncated

[cloudflare-workers-and-pages]

Deploying glinui-app with    Cloudflare Pages

Latest commit:	ec8f2b0
Status:	✅  Deploy successful!
Preview URL:	https://f2c07a30.glinui-app.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-mino-n79k.glinui-app.pages.dev

View logs