⬆️ chore: Refresh Dependencies Within Their Majors and Clear the Fixable Audit Findings

e2e/login.spec.ts

@@ -158,7 +158,7 @@ test.describe('2FA verification flow', () => {
 
     await expect(page.getByText(/two-factor/i)).toBeVisible();
     await expect(page.locator('[data-input-otp]')).toBeVisible();
-    await expect(page.locator('[role="separator"]')).toBeVisible();
+    await expect(page.locator('[data-input-otp-container] [role="separator"]')).toBeVisible();
     await expect(page.getByText(/back to login/i)).toBeVisible();
   });
 

package.json

@@ -25,82 +25,82 @@
   "dependencies": {
     "@clickhouse/click-ui": "0.9.1",
     "@librechat/data-schemas": "^0.0.74",
-    "@radix-ui/react-dialog": "1.1.15",
-    "@tailwindcss/vite": "^4.3.1",
-    "@tanstack/react-devtools": "0.10.0",
+    "@radix-ui/react-dialog": "1.3.1",
+    "@tailwindcss/vite": "^4.3.3",
+    "@tanstack/react-devtools": "0.10.13",
     "@tanstack/react-query": "5.104.5",
     "@tanstack/react-router": "1.170.46",
     "@tanstack/react-router-devtools": "1.167.2",
     "@tanstack/react-router-ssr-query": "1.167.3",
     "@tanstack/react-start": "1.169.4",
     "@tanstack/router-plugin": "1.168.48",
-    "@types/bun": "^1.3.14",
+    "@types/bun": "^1.4.4",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "date-fns": "^4.4.0",
-    "dayjs": "^1.11.21",
+    "dayjs": "^1.11.23",
     "dotenv": "^17.4.2",
     "i18next": "^25.10.10",
-    "i18next-browser-languagedetector": "^8.2.1",
-    "input-otp": "^1.4.2",
+    "i18next-browser-languagedetector": "^8.2.2",
+    "input-otp": "^1.5.0",
     "iron-webcrypto": "2.0.0",
     "js-yaml": "^4.3.2",
     "librechat-data-provider": "^0.8.524",
-    "lodash": "4.18.0",
+    "lodash": "4.18.1",
     "lucide-react": "^0.545.0",
-    "mongoose": "8.24.1",
+    "mongoose": "8.24.7",
     "prom-client": "^15.1.3",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "react-i18next": "^16.6.6",
     "react-movable": "^3.4.1",
     "react-textarea-autosize": "^8.5.9",
-    "styled-components": "^6.4.2",
-    "tailwindcss": "^4.3.1",
-    "zod": "^4.4.3"
+    "styled-components": "^6.6.0",
+    "tailwindcss": "^4.3.3",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@axe-core/playwright": "^4.11.3",
-    "@playwright/test": "^1.61.0",
-    "@tailwindcss/node": "^4.3.1",
+    "@axe-core/playwright": "^4.14.0",
+    "@playwright/test": "^1.64.1",
+    "@tailwindcss/node": "^4.3.3",
     "@tanstack/devtools-vite": "0.3.12",
     "@tanstack/react-query-devtools": "5.104.5",
-    "@testing-library/dom": "^10.4.1",
-    "@testing-library/jest-dom": "^6.9.1",
-    "@testing-library/react": "^16.3.2",
+    "@testing-library/dom": "^10.4.2",
+    "@testing-library/jest-dom": "^6.10.0",
+    "@testing-library/react": "^16.3.3",
     "@testing-library/user-event": "^14.6.7",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^22.20.0",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "@typescript-eslint/eslint-plugin": "^8.61.1",
-    "@typescript-eslint/parser": "^8.61.1",
+    "@types/node": "^22.20.5",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@typescript-eslint/eslint-plugin": "^8.72.0",
+    "@typescript-eslint/parser": "^8.72.0",
     "@vitejs/plugin-react": "^5.2.0",
-    "eslint": "^10.5.0",
+    "eslint": "^10.13.0",
     "eslint-plugin-click-ui": "file:./tools/eslint-plugin-click-ui",
-    "eslint-plugin-import-x": "^4.16.2",
-    "eslint-plugin-tailwind-canonical-classes": "^1.3.3",
+    "eslint-plugin-import-x": "^4.17.1",
+    "eslint-plugin-tailwind-canonical-classes": "^1.6.0",
     "jsdom": "^27.4.0",
     "lint-staged": "^16.4.0",
     "patch-package": "^8.0.1",
-    "prettier": "^3.8.4",
-    "prettier-plugin-tailwindcss": "^0.7.4",
+    "prettier": "^3.9.10",
+    "prettier-plugin-tailwindcss": "^0.8.1",
     "typescript": "^5.9.3",
-    "vite": "^8.0.16",
+    "vite": "^8.3.5",
     "vite-tsconfig-paths": "^6.1.1",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.12"
   },
   "overrides": {
     "@babel/core": "7.29.7",
-    "@radix-ui/react-dialog": "1.1.15",
-    "@radix-ui/react-dismissable-layer": "1.1.11",
-    "@tanstack/devtools": "0.11.0",
-    "@tanstack/devtools-ui": "0.5.1",
+    "@radix-ui/react-dialog": "1.3.1",
+    "@radix-ui/react-dismissable-layer": "1.2.1",
+    "@tanstack/devtools": "0.15.0",
+    "@tanstack/devtools-ui": "0.7.1",
     "@tanstack/devtools-vite": "0.3.12",
     "@tanstack/history": "1.162.5",
     "@tanstack/query-core": "5.104.5",
     "@tanstack/query-devtools": "5.104.5",
-    "@tanstack/react-devtools": "0.10.0",
+    "@tanstack/react-devtools": "0.10.13",
     "@tanstack/react-query": "5.104.5",
     "@tanstack/react-query-devtools": "5.104.5",
     "@tanstack/react-router": "1.170.46",
@@ -125,25 +125,24 @@
     "@tanstack/store": "0.11.2",
     "@tanstack/virtual-file-routes": "1.162.0",
     "axios": "1.20.0",
-    "baseline-browser-mapping": "2.11.0",
-    "browserslist": "4.28.7",
+    "baseline-browser-mapping": "2.11.32",
+    "browserslist": "4.29.4",
     "js-yaml": "4.3.2",
-    "katex": "0.18.2",
-    "lodash": "4.18.0",
-    "lodash-es": "4.18.0",
+    "katex": "0.18.11",
+    "lodash": "4.18.1",
+    "lodash-es": "4.18.1",
     "moment": "2.31.0",
-    "mongoose": "8.24.1",
-    "nanoid": "3.3.18",
+    "mongoose": "8.24.7",
+    "nanoid": "3.3.20",
     "picomatch": "4.0.7",
-    "postcss": "8.5.23",
+    "postcss": "8.5.31",
     "seroval": "1.6.12",
     "seroval-plugins": "1.6.12",
     "solid-js": "1.9.17",
     "source-map-js": "1.2.2",
     "srvx": "1.0.7",
-    "undici": "7.29.1",
-    "vite": "8.0.16",
-    "ws": "8.21.0",
-    "yaml": "2.8.3"
+    "vite": "8.3.5",
+    "ws": "8.22.0",
+    "yaml": "2.9.1"
   }
 }

src/components/CommandMenu.tsx

@@ -127,15 +127,13 @@ export function CommandMenu({ open, onOpenChange }: t.CommandMenuProps) {
   ];
 
   const tabs: t.StaticCommand[] = [
-    ...CONFIG_TABS.map(
-      (tab): t.StaticCommand => ({
-        id: `config-tab-${tab.id}`,
-        icon: 'settings',
-        label: localize(tab.labelKey),
-        keywords: ['configuration', 'config', tab.id],
-        onSelect: () => navigateTo('/configuration', { tab: tab.id }),
-      }),
-    ),
+    ...CONFIG_TABS.map((tab): t.StaticCommand => ({
+      id: `config-tab-${tab.id}`,
+      icon: 'settings',
+      label: localize(tab.labelKey),
+      keywords: ['configuration', 'config', tab.id],
+      onSelect: () => navigateTo('/configuration', { tab: tab.id }),
+    })),
     {
       id: 'access-groups',
       icon: 'user',

src/components/InputOTP.tsx

@@ -8,10 +8,7 @@ const InputOTP = React.forwardRef<
 >(({ className, containerClassName, ...props }, ref) => (
   <OTPInput
     ref={ref}
-    containerClassName={clsx(
-      'flex items-center gap-2 has-[:disabled]:opacity-50',
-      containerClassName,
-    )}
+    containerClassName={clsx('flex items-center gap-2 has-disabled:opacity-50', containerClassName)}
     className={clsx('disabled:cursor-not-allowed', className)}
     {...props}
   />

src/components/__tests__/AuthCard.test.tsx

@@ -1,6 +1,6 @@
 import { renderToStaticMarkup } from 'react-dom/server';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
 import type * as t from '@/types';
 import { adminLoginFn, adminVerify2FAFn, ssoStartFn } from '@/server';
@@ -59,24 +59,14 @@ function signIn() {
   fireEvent.click(screen.getByRole('button', { name: localizeEn('com_auth_sign_in') }));
 }
 
-/**
- * input-otp re-syncs the selection on timers it never clears (0, 10 and 50 ms
- * after each change of the code). On the fake clock they end with the test,
- * instead of firing into the torn-down jsdom of a finished file.
- */
 beforeEach(() => {
-  vi.useFakeTimers({ shouldAdvanceTime: true });
   loginFn.mockReset();
   verify2FAFn.mockReset();
   startFn.mockReset();
   navigate.mockReset();
   window.location.hash = '';
 });
 
-afterEach(() => {
-  vi.useRealTimers();
-});
-
 /** Turns of the event loop React's scheduler (on `setImmediate`) may still need for work queued before the test ends. */
 const SCHEDULER_TURNS = 3;
 
@@ -173,6 +163,7 @@ describe('AuthCard sign-in failures', () => {
     expect(screen.getByLabelText(localizeEn('com_auth_2fa_code_label'))).toBeVisible();
   });
 
+  /** input-otp re-syncs the selection 0, 10 and 50 ms after each change of the code and clears those timers on unmount. */
   it('leaves no timer of the 2FA step to fire once jsdom is torn down', async () => {
     loginFn.mockResolvedValue({ error: false, requires2FA: true, tempToken: 'temp-token' });
     verify2FAFn.mockResolvedValue({ error: true, code: 'totp_invalid' });
@@ -183,7 +174,6 @@ describe('AuthCard sign-in failures', () => {
     fireEvent.change(otp, { target: { value: '123456' } });
     expect(await screen.findByText(localizeEn('com_auth_2fa_invalid_code'))).toBeVisible();
     cleanup();
-    vi.useRealTimers();
 
     await idleWithoutWindow(100);
   });

src/components/configuration/edits.ts

@@ -420,13 +420,11 @@ export function buildConfigChanges(
   }
   const payload = buildSavePayload(touchedPaths, plain, schemaPaths, context);
   const ops: t.ConfigChange[] = [
-    ...payload.saves.map(
-      ({ fieldPath, value }): t.ConfigChange => ({
-        op: 'set',
-        path: fieldPath,
-        value,
-      }),
-    ),
+    ...payload.saves.map(({ fieldPath, value }): t.ConfigChange => ({
+      op: 'set',
+      path: fieldPath,
+      value,
+    })),
     ...payload.resets.map((path): t.ConfigChange => ({ op: 'reset', path })),
   ];
   const issues: t.ConfigIssue[] = [];

src/components/configuration/reveal.ts

@@ -316,7 +316,7 @@ export function revealConfigPath(
      * flat rows, eagerly rendered bodies): open every group around it.
      */
     const openAround = (inner: HTMLElement) => {
-      for (let grid = inner.closest<HTMLElement>(CLOSED_GRID); grid; ) {
+      for (let grid = inner.closest<HTMLElement>(CLOSED_GRID); grid;) {
         const owner = grid.parentElement;
         if (owner) changed = expandContainer(owner, tried) || changed;
         grid = owner?.closest<HTMLElement>(CLOSED_GRID) ?? null;

src/components/configuration/review/group.ts

@@ -297,14 +297,12 @@ function partLabel(
 
 /** What a change deletes of the target's own value with it (`dropped`), listed under its row. */
 function droppedDetails(item: t.ChangeSummaryItem, key: string, ctx: t.ReviewLabelContext) {
-  return item.dropped?.map(
-    (part, i): t.ReviewRow => ({
-      key: `${key}:dropped:${i}`,
-      label: partLabel(part, item, ctx),
-      item: part,
-      valueLabels: valueLabelsAt(part.path, ctx),
-    }),
-  );
+  return item.dropped?.map((part, i): t.ReviewRow => ({
+    key: `${key}:dropped:${i}`,
+    label: partLabel(part, item, ctx),
+    item: part,
+    valueLabels: valueLabelsAt(part.path, ctx),
+  }));
 }
 
 /**

src/components/configuration/summary.ts

@@ -228,14 +228,12 @@ export function summarizeChanges(
     });
   const visibility = changeSet.ops
     .filter((op) => op.op === 'tombstone' || op.op === 'untombstone')
-    .map(
-      (op): t.ChangeSummaryItem => ({
-        path: op.path,
-        kind: op.op === 'tombstone' ? 'hidden' : 'reverted',
-        before: layers.baselineAt(op.path),
-        after: undefined,
-      }),
-    );
+    .map((op): t.ChangeSummaryItem => ({
+      path: op.path,
+      kind: op.op === 'tombstone' ? 'hidden' : 'reverted',
+      before: layers.baselineAt(op.path),
+      after: undefined,
+    }));
   return [
     ...plainItems(changeSet, plan, layers),
     ...changeSet.collections.flatMap((pending) =>

src/components/configuration/wizard/__tests__/Preview.test.tsx

@@ -52,15 +52,13 @@ function renderPreview(
 
 /** A preview of one row per imported path, and the keys it leaves out. */
 function rowsOf(paths: string[], skipped: t.ReviewSkippedRow[] = []): t.ImportPreviewState {
-  const rows = paths.map(
-    (fieldPath): t.ImportPreviewRow => ({
-      fieldPath,
-      label: fieldPath,
-      rows: [],
-      unchanged: false,
-      unknown: false,
-    }),
-  );
+  const rows = paths.map((fieldPath): t.ImportPreviewRow => ({
+    fieldPath,
+    label: fieldPath,
+    rows: [],
+    unchanged: false,
+    unknown: false,
+  }));
   return { ...previewOf(), groups: [{ key: 'all', title: 'All', rows }], skipped };
 }
 

src/components/grants/GrantsPage.tsx

@@ -21,7 +21,11 @@ export function GrantsPage({ activeTab, onTabChange }: t.GrantsPageProps) {
       aria-label={localize('com_grants_title')}
       className="flex min-h-0 flex-1 flex-col overflow-hidden px-4 pt-2"
     >
-      <Tabs value={resolvedTab} onValueChange={onTabChange} ariaLabel={localize('com_grants_title')}>
+      <Tabs
+        value={resolvedTab}
+        onValueChange={onTabChange}
+        ariaLabel={localize('com_grants_title')}
+      >
         <Tabs.TriggersList>
           <Tabs.Trigger value="management">{localize('com_grants_tab_management')}</Tabs.Trigger>
           {canReadAuditLog && (

src/components/shared/Avatar.tsx

@@ -3,12 +3,5 @@ import type * as t from '@/types';
 import { getInitials } from '@/utils';
 
 export function Avatar({ name, size = 'md', className }: t.AvatarProps) {
-  return (
-    <CUIAvatar
-      text={getInitials(name)}
-      textSize={size}
-      title={name}
-      className={className}
-    />
-  );
+  return <CUIAvatar text={getInitials(name)} textSize={size} title={name} className={className} />;
 }

src/components/shared/Pagination.test.tsx

@@ -3,7 +3,11 @@ import { describe, it, expect, vi } from 'vitest';
 import { getPageNumbers, Pagination } from './Pagination';
 
 vi.mock('@clickhouse/click-ui', () => ({
-  Pagination: ({ currentPage, totalPages, onChange }: {
+  Pagination: ({
+    currentPage,
+    totalPages,
+    onChange,
+  }: {
     currentPage: number;
     totalPages: number;
     onChange: (page: number) => void;

src/hooks/config/import.ts

@@ -599,9 +599,11 @@ export function useImportPreview({
   const issuesFor = useCallback(
     (included: ReadonlySet<string>): string[] => {
       if (!snapshot) return [];
-      const ops = entriesFor(included).map(
-        ({ fieldPath, value }): t.ConfigChange => ({ op: 'set', path: fieldPath, value }),
-      );
+      const ops = entriesFor(included).map(({ fieldPath, value }): t.ConfigChange => ({
+        op: 'set',
+        path: fieldPath,
+        value,
+      }));
       if (ops.length === 0) return [];
       const { issues } = planConfigChanges(ops, snapshot, features, writeRules, limits);
       return describeIssues(issues, [], localize).summaries;