chore(deps): bump the app-minor-patch group across 1 directory with 26 updates

[dependabot]

Bumps the app-minor-patch group with 26 updates in the /app directory:

Package	From	To
@prisma/adapter-pg	7.8.0	7.10.0
@prisma/client	7.8.0	7.10.0
adm-zip	0.6.0	0.6.1
csv-parse	7.0.1	7.0.2
firebase	12.16.0	12.19.0
firebase-admin	14.2.0	14.4.0
lucide-react	1.25.0	1.47.0
next	16.2.10	16.3.5
pg	8.22.0	8.23.0
@types/pg	8.20.0	8.23.1
radix-ui	1.6.4	1.6.7
react	19.2.7	19.3.0
@types/react	19.2.17	19.3.0
react-dom	19.2.7	19.3.0
@types/react-dom	19.2.3	19.3.0
recharts	3.9.2	3.10.1
sonner	2.0.7	2.0.8
tailwind-merge	3.6.0	3.7.0
@firebase/rules-unit-testing	5.0.1	5.0.2
@playwright/test	1.61.1	1.63.0
@types/node	26.1.1	26.6.1
@types/pg	8.20.0	8.23.1
@types/react	19.2.17	19.3.0
@types/react-dom	19.2.3	19.3.0
eslint	10.7.0	10.10.0
eslint-config-next	16.2.10	16.3.5
prisma	7.8.0	7.10.0
spdx-license-list	6.11.0	6.12.0
tsx	4.23.1	4.23.13

Updates @prisma/adapter-pg from 7.8.0 to 7.10.0

Release notes

Sourced from @​prisma/adapter-pg's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

• 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
• a180209 fix(adapter-pg): map PostgreSQL deadlocks to P2034 (#29717)
• 800f1d1 fix(adapter-pg): preserve constraint name for unique violations (23505) (#29587)
• 7ef2104 fix(postgres): handle SQLSTATE 23001 for RESTRICT violations (#29554)
• 35003fd chore(adapter-pg): remove duplicate values parameter (#29650)
• d6d9fc9 chore: remove parameterization from sqlcommenter-query-insights (#29518)
• See full diff in compare view

Updates @prisma/client from 7.8.0 to 7.10.0

Release notes

Sourced from @​prisma/client's releases.

7.10.0

Prisma ORM 7.10.0

Prisma ORM 7.10.0 introduces a compatibility package for running Prisma 7 alongside newer Prisma versions, secures Prisma Studio's local server, and includes fixes across Prisma Client and the PostgreSQL, MariaDB, Neon, SQLite, and Prisma Postgres Serverless adapters.

Highlights

Run Prisma 7 alongside Prisma 8

This release introduces @prisma/prisma7, a compatibility package that lets you retain a matching Prisma 7 CLI and configuration while installing Prisma 8 in the same project.

Once 7.10.0 is released, a side-by-side installation can use:

npm install --save-dev prisma@8 @prisma/prisma7@7.10.0
npm install @prisma/client@7.10.0

Use prisma for the directly installed Prisma 8 CLI and prisma7 for Prisma 7:

npx prisma --version
npx prisma7 --version
npx prisma7 generate
npx prisma7 migrate dev
npx prisma7 db push

Prisma 7 now prefers version-specific configuration files, allowing its configuration to coexist with Prisma 8's prisma.config.* files:

// prisma7.config.ts
import { defineConfig } from '@prisma/prisma7/config'
export default defineConfig({
schema: 'prisma/schema.prisma',
migrations: {
path: 'prisma/migrations',
},
})

Without an explicit --config option, Prisma 7 searches for:

1. Root-level prisma7.config.* files.
2. .config/prisma7.* files.
3. Existing prisma.config.* files as a backwards-compatible fallback.

The supported extensions are .js, .ts, .mjs, .cjs, .mts, and .cts. An explicit config path always takes precedence:

... (truncated)

Commits

• 05c1b88 Teach Prisma 7 to prefer versioned config files (#30020)
• cf2bc1f Rename prisma7 package to @​prisma/prisma7 (#30002)
• ce5a34c Complete downstream actionable Prisma 7 guidance propagation (#29994)
• 3f13ec6 Complete CLI-owned prisma7 distribution identity (#29969)
• 179ba0c feat(prisma7): add side-by-side CLI wrapper (#29949)
• 3fa65ac fix(p2002): correct modelName in nested create unique constraint errors #2959...
• 6b6d9e9 chore(deps): update engines to 7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b90...
• b64e33c chore(deps): update engines to 7.10.0-3.9d90ce2c89d5c95a1148aef15e5561ab6c490...
• 2046f9b feat(client): expose ModelName to compute function in Result extensions (#29782)
• f2b3abd chore(deps): update engines to 7.10.0-1.6d040c802892de6d56c7e0061b7a10b3e6a0c...
• Additional commits viewable in compare view

Updates adm-zip from 0.6.0 to 0.6.1

Release notes

Sourced from adm-zip's releases.

v0.6.1

Full Changelog: cthackers/adm-zip@v0.6.0...v0.6.1

• Updated dev dependencies
• Fixed uncaught crash in async decompression on malformed DEFLATE data
• Fixed addLocalFolder following symlinks out of the archived folder
• Stripped setuid/setgid/sticky bits from extracted file permissions
• Enforced the decompression size cap on the async path and for size 0
• Rejected archives with duplicate entry names
• Blocked extraction from writing through symlinks inside the target
• Routed malformed-header parse errors through the async callback
• Rejected zip entries whose declared data extent runs past the buffer
• Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
• Fixed addLocalFolderAsync2 mangling local paths on Windows

Commits

• cb2cf9b Fixed addLocalFolderAsync2 mangling local paths on Windows
• 54902b6 Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
• 73131bd Fixed CI
• 758898d Rejected zip entries whose declared data extent runs past the buffer
• 74b6e9f Routed malformed-header parse errors through the async callback
• eaa35fa Blocked extraction from writing through symlinks inside the target
• 1e015e3 Increment version
• 05101d4 Rejected archives with duplicate entry names
• 4916006 Enforced the decompression size cap on the async path and for size 0
• 6a63c33 Stripped setuid/setgid/sticky bits from extracted file permissions
• Additional commits viewable in compare view

Updates csv-parse from 7.0.1 to 7.0.2

Changelog

Sourced from csv-parse's changelog.

7.0.2 (2026-08-02)

Bug Fixes

• csv-parse: prototype replacement reachable via columns (#497)

Performance Improvements

• csv-parse: avoid unnecessary allocation in ResizeableBuffer.toString (#495)

Commits

• 288c9c6 chore(release): publish
• 2ad6c07 refactor(csv-parse): rename group_columns_by_name tests
• eb4d148 fix(csv-parse): prototype replacement reachable via columns (#497)
• 1d4ed3b perf(csv-parse): avoid unnecessary allocation in ResizeableBuffer.toString (#...
• See full diff in compare view

Updates firebase from 12.16.0 to 12.19.0

Release notes

Sourced from firebase's releases.

firebase@12.19.0

For more detailed release notes, see Firebase JavaScript SDK Release Notes.

What's Changed

@​firebase/ai@​2.16.0

Minor Changes

• 6b17ef5 #10319 - Fixed the issue where the SDK hardcodes invalid 'function' role, causing 400 errors during function calling on gemini-3.6-flash

Patch Changes

• 6f86596 #10320 - Fixed a client-side validation guardrail that incorrectly blocked text/x.enum when responseSchema or responseJsonSchema was provided. The SDK now correctly accepts both application/json and text/x.enum for structured outputs.

firebase@12.19.0

Minor Changes

• 6b17ef5 #10319 - Fixed the issue where the SDK hardcodes invalid 'function' role, causing 400 errors during function calling on gemini-3.6-flash

Patch Changes

• Updated dependencies [8676365, 8316986, b74b53c, 0e8554b, 50213a1, 6b17ef5, 392bce0, 6f86596]:
• @​firebase/auth@​1.13.6
• @​firebase/app@​0.16.2
• @​firebase/firestore@​4.17.2
• @​firebase/analytics@​0.10.25
• @​firebase/messaging@​0.13.3
• @​firebase/ai@​2.16.0
• @​firebase/auth-compat@​0.6.11
• @​firebase/app-compat@​0.5.18
• @​firebase/firestore-compat@​0.4.14
• @​firebase/analytics-compat@​0.2.31
• @​firebase/messaging-compat@​0.2.30

@​firebase/analytics@​0.10.25

Patch Changes

• 50213a1 #10233 - Update api-extractor and documentation pipeline. Includes some fixes to documentation comments and links.

@​firebase/analytics-compat@​0.2.31

Patch Changes

• Updated dependencies [50213a1]:
• @​firebase/analytics@​0.10.25

@​firebase/app@​0.16.2

Patch Changes

• Update SDK_VERSION.

... (truncated)

Commits

• 9045b75 Version Packages (#10366)
• b4b6afb Merge main into release
• 5855050 chore: combine open dependabot PRs (#10361)
• b70f27b chore: Migrate gsutil usage instructions to gcloud storage (#10360)
• 0faaeb4 feat(util): migrate tests to Vitest (#10353)
• 5186c56 chore(deps): update actions/setup-java action to v6 (#10359)
• b6943ff test(component): migrate tests to Vitest (#10344)
• c287a3d chore: Require yarn ^1.22.22 for development (#10358)
• 33deffb test: increase browser no activity and disconnect tolerance (#10345)
• c318c64 fix(auth): align chromedriver version to 151.0.5 to eliminate duplicate insta...
• Additional commits viewable in compare view

Updates firebase-admin from 14.2.0 to 14.4.0

Release notes

Sourced from firebase-admin's releases.

Firebase Admin Node.js SDK v14.4.0

New Features

• feat(ml): deprecate Machine Learning APIs (#3245)

Miscellaneous

• [chore] Release 14.4.0 (#3252)
• build(deps-dev): bump @​types/lodash from 4.17.24 to 4.17.25 (#3256)
• upgrade @​google-cloud/storage and @​google-cloud/firestore to the most recent version (#3253)
• build(deps): bump fast-uri from 3.1.5 to 3.1.7 (#3249)
• build(deps-dev): bump browserslist from 4.28.4 to 4.28.9 (#3250)
• build(deps-dev): bump nock from 14.0.16 to 14.0.17 (#3248)
• build(deps): bump @​fastify/busboy from 3.2.0 to 3.2.2 (#3246)
• chore(docs): add custom @excludeFromDocs tag to filter generated docs (#3206)
• build(deps): bump @​firebase/database-compat from 2.1.4 to 2.1.7 (#3242)
• build(deps-dev): bump @​firebase/app-compat from 0.5.15 to 0.5.17 (#3243)
• build(deps-dev): bump @​firebase/auth-types from 0.13.1 to 0.13.2 (#3244)
• chore(ml): Skip flaky ML tests blocking nightly builds (#3241)
• build(deps): bump brace-expansion (#3240)
• build(deps-dev): bump @​firebase/auth-compat from 0.6.8 to 0.6.9 (#3238)

Firebase Admin Node.js SDK v14.3.0

New Features

• feat(dataconnect): update "X-Client-Version" header value to match the Node/Admin/{version} convention (#3230)
• feat(dataconnect): add "X-Firebase-Sqlconnect-Affinity" header for GSLB soft stickiness (#3227)
• feat(dataconnect): add "X-Client-Version" header for cloud monitoring (#3222)

Miscellaneous

• [chore] Release 14.3.0 (#3237)
• chore(deps): upgrade @google-cloud and typescript-eslint dependencies (#3236)
• build(deps-dev): bump @​types/node from 26.1.1 to 26.2.0 (#3231)
• build(deps-dev): bump @​microsoft/api-extractor from 7.58.9 to 7.58.12 (#3224)
• build(deps): bump fast-uri from 3.1.4 to 3.1.5 (#3228)
• build(deps-dev): bump @​firebase/app-compat from 0.5.13 to 0.5.15 (#3216)
• build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#3220)
• build(deps): bump fast-uri from 3.1.2 to 3.1.4 (#3219)
• chore: fix race condition in auth tenant management tests (#3218)

Commits

• 7cf116b [chore] Release 14.4.0 (#3252)
• 72994c4 build(deps-dev): bump @​types/lodash from 4.17.24 to 4.17.25 (#3256)
• c151174 upgrade @​google-cloud/storage and @​google-cloud/firestore to the most recent...
• cda2de9 build(deps): bump fast-uri from 3.1.5 to 3.1.7 (#3249)
• cb89261 build(deps-dev): bump browserslist from 4.28.4 to 4.28.9 (#3250)
• fa8f28a build(deps-dev): bump nock from 14.0.16 to 14.0.17 (#3248)
• 9fda27d build(deps): bump @​fastify/busboy from 3.2.0 to 3.2.2 (#3246)
• 802daa0 feat(ml): deprecate Machine Learning APIs (#3245)
• 441a4e0 chore(docs): add custom @excludeFromDocs tag to filter generated docs (#3206)
• 5545be9 build(deps): bump @​firebase/database-compat from 2.1.4 to 2.1.7 (#3242)
• Additional commits viewable in compare view

Updates lucide-react from 1.25.0 to 1.47.0

Release notes

Sourced from lucide-react's releases.

Version 1.47.0

What's Changed

• feat(icons): add lambda icon by @​UbaidUllah9962 in lucide-icons/lucide#4017
• feat(icons): delegated faucet icon from lab by @​karsa-mistmere in lucide-icons/lucide#4764
• feat(icons): added door-closed-package icon by @​karsa-mistmere in lucide-icons/lucide#4814
• feat(icons): added 'nepali-rupee' icon by @​sarajdhakal in lucide-icons/lucide#4608
• feat(icons): added tube-lotion icon by @​AlecRust in lucide-icons/lucide#4029
• feat(icons): Added cupcake icon by @​briz123 in lucide-icons/lucide#3000
• feat(icons): added square-dashed-x icon by @​EthanHazel in lucide-icons/lucide#4535
• feat(icons): add rotate-cw-clock icon by @​gkkconan in lucide-icons/lucide#3979
• fix(icons): remove path from save-off by @​HPRILLER in lucide-icons/lucide#4848
• fix(icons): changed calendar-chevrons-right by @​karsa-mistmere in lucide-icons/lucide#4865
• fix(icons): changed broccoli icon by @​jguddas in lucide-icons/lucide#4871
• feat(icons): added square-dashed-plus by @​psjdev in lucide-icons/lucide#4849

New Contributors

• @​UbaidUllah9962 made their first contribution in lucide-icons/lucide#4017
• @​sarajdhakal made their first contribution in lucide-icons/lucide#4608
• @​AlecRust made their first contribution in lucide-icons/lucide#4029
• @​gkkconan made their first contribution in lucide-icons/lucide#3979
• @​HPRILLER made their first contribution in lucide-icons/lucide#4848
• @​psjdev made their first contribution in lucide-icons/lucide#4849

Full Changelog: lucide-icons/lucide@1.46.0...1.47.0

Version 1.46.0

What's Changed

• feat(icons): Added new icons: clef-g, clef-f and clef-c by @​rrod497 in lucide-icons/lucide#4083
• chore(deps-dev): bump astro from 7.3.0 to 7.3.2 in the astro-deps group by @​dependabot[bot] in lucide-icons/lucide#4860
• feat(icons): added monitor-pc icon by @​karsa-mistmere in lucide-icons/lucide#4791

Full Changelog: lucide-icons/lucide@1.45.0...1.46.0

Version 1.45.0

What's Changed

• feat(icons): added calendar-chevrons-right icon by @​AlexandrePhilibert in lucide-icons/lucide#3565
• feat(icons): added building-complex-plus icon by @​tylerkade in lucide-icons/lucide#4758
• feat(icons): add hourglass-cog icon by @​lazerg in lucide-icons/lucide#4635
• feat(icons): added mouth & mouth-off by @​karsa-mistmere in lucide-icons/lucide#4787
• feat(icons): added iv-bag icon by @​karsa-mistmere in lucide-icons/lucide#4821
• fix(icons): changed lectern icon by @​UsamaKhan in lucide-icons/lucide#2925
• feat(icons): add layout-arrow-right and layout-arrow-down by @​samuelalake in lucide-icons/lucide#4541
• feat(icons): added park icon by @​skajosborn in lucide-icons/lucide#3177
• fix(icons): changed album, book-marked, folder-bookmark icons by @​karsa-mistmere in lucide-icons/lucide#3043
• fix(icons): correct misspelled tags by @​decknamec in lucide-icons/lucide#4836
• feat(icons): added houses icon by @​danielbayley in lucide-icons/lucide#3241
• feat(icons): added notebook-dot icon by @​elenakovelskikh in lucide-icons/lucide#3228
• feat(icons): add messages-circle icon by @​Mirazstudio-offical in lucide-icons/lucide#4754
• feat(icons): added plant-pot icon by @​vqh2602 in lucide-icons/lucide#3122

... (truncated)

Commits

• 94e4cb9 chore(dependencies): Update dependencies (#4806)
• 99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
• 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
• 0f8d48b test(packages): updates unit test snapshots with face-slightly-smiling (#4676)
• See full diff in compare view

Updates next from 16.2.10 to 16.3.5

Release notes

Sourced from next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
• next/image: Reject empty images when reading/writing to the disk cache (#98186)
• Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
• Add CSP nonce to script tags of loading and template files (#98403)
• Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653

... (truncated)

Commits

• ca2c75e v16.3.5
• 14fb290 [backport] Fix use cache prerender signal retention (#98448)
• 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
• 4b56cee [16.3.x] Backport docs fixes (#98317)
• 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
• 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
• 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
• d9eac96 [16.3.x] next/image: skip 0-byte entries when initializing disk LRU cache (#9...
• 84b35fe [test] Fix 16.3 deploy test assertions (#98133)
• 14f9c1a [16.3.x][ci] Run flake detection and new deploy tests when merged and on back...
• Additional commits viewable in compare view

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

• Add support for query pipelineing.

Commits

• df274d1 Publish
• eb19d0f Add opt-in query pipelining (#3652)
• See full diff in compare view

Updates @types/pg from 8.20.0 to 8.23.1

Commits

• See full diff in compare view

Updates radix-ui from 1.6.4 to 1.6.7

Changelog

Sourced from radix-ui's changelog.

1.6.6, 1.6.7

• Reverted breaking changes that caused compatibility issues with React Server Components.

1.6.5

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.

Commits

• See full diff in compare view

Updates react from 19.2.7 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (

[roger-guifav]

TL;DR

Este PR atualiza 26 dependencias do app (versoes menores e correcoes), incluindo prisma, react, next, firebase e eslint. O codigo em si continua saudavel: typecheck, lint e os 680 testes passam. Mas o CI esta vermelho porque o inventario de licencas de terceiros ficou desatualizado, e isso so se resolve com um commit extra no PR. Nao mergear antes disso.

Verdict: Ajustes necessários

(revisado no head SHA 98e71ea)

Parecer

Bump agrupado semanal de dependencias minor/patch, escopo correto: toca apenas manifesto e lockfile, sem mudanca de codigo. Fatos fora do diff que pesam na decisao: o workflow de CI tem um gate que compara o inventario de licencas de terceiros com os lockfiles, e bots de dependencia nao regeneram esse arquivo; o historico do repo mostra o mantenedor fazendo commits de refresh desse inventario apos bumps, entao existe precedente e o caminho e conhecido. O cliente gerado do prisma e commitado no repo e o bump anterior de prisma regerou esses arquivos no mesmo PR, convencao que este PR nao seguiu. Verdade de producao que importa: o Dockerfile roda o generate do prisma no build da imagem e nao omite dependencias opcionais, entao o drift do cliente gerado nao quebra runtime. Pergunta de merge: eu mergearia e dormiria tranquilo depois do commit que regera o inventario (e de preferencia o cliente prisma); no estado atual o CI vermelho barra.

Críticos (P0)

Nenhum.

Bloqueadores de correção (P1)

1. O job principal de CI esta vermelho no passo de verificacao do inventario de licencas: a checagem (ancora is stale; regenerate it no script gerador em scripts/) acusa que o arquivo de inventario em docs/ esta desatualizado em relacao aos lockfiles. Reproduzi localmente no head do PR: o check falha antes e passa depois de rodar o gerador, que reescreve o arquivo quase por inteiro. Aplicar antes do merge: rodar o gerador do inventario a partir da raiz do repo e commitar o arquivo atualizado neste PR.

Endereçar no PR (P2)

1. O cliente gerado do prisma e versionado no repo (diretorio src/generated/prisma) e ficou com o carimbo da versao anterior nos arquivos class.ts e prismaNamespace.ts, enquanto o pacote subiu de 7.8.0 para 7.10.0. O generate com a versao nova altera esses dois arquivos (versao do cliente, versao do engine e ajuste de tipagem do construtor). Nao ha quebra funcional: typecheck e testes passam com os arquivos atuais, e CI e imagem Docker regeram o cliente. Mas o bump anterior de prisma no repo regerou os arquivos commitados no mesmo PR, e deixar o artefato em drift cria divergencia silenciosa entre o que esta versionado e o que a toolchain gera. Absorver no PR atual: rodar o generate do prisma no app e commitar os dois arquivos, de preferencia no mesmo commit do item P1.

Endereçar no PR (P3 / nits)

Nenhum.

Acoes que somente o humano pode fazer (ainda...)

1. Os dois ajustes acima exigem push na branch deste PR (o bot de dependencias nao regenera esses arquivos). Um unico commit do mantenedor com o inventario regerado e os dois arquivos do cliente prisma resolve ambos. Merge somente depois do job de CI voltar a ficar verde.

Verificado

• Head revisado: 98e71ea (reconfirmado ao final, sem movimento).
• CI lido na API: job de lint/teste/build vermelho no passo do inventario de licencas; os outros tres jobs (funcao de thumbnail, e2e de browser e smoke da imagem Docker) verdes. O job falhou antes de chegar em lint/typecheck/testes, entao compensei com validacao local.
• Validacao local no head, com instalacao limpa via lockfile: generate do prisma ok, typecheck sem erros (baseline no merge-base tambem limpa), lint limpo com tolerancia zero de warnings, suite de testes verde com 680 passando e 8 pulados.
• Auditoria runtime dos icones: todos os imports nomeados da biblioteca de icones existem na versao nova, nenhum ausente.
• Carga de firebase-admin/firestore testada em runtime: ok (a dependencia do firestore virou opcional na versao nova, mas continua instalada nos caminhos de build atuais).
• Claims do corpo do PR contra o diff: 26 atualizacoes confirmadas (22 no manifesto, 4 apenas na resolucao do lockfile); diff limitado a manifesto e lockfile; contagem de arquivos confere com a API.
• Scan de segredos no diff (padroes comuns de chaves de git e cloud): nenhum segredo encontrado.

---

Roger (Hermes KVM) - review v2 - 98e71ea