chore(deps): bump the production-dependencies group with 44 updates

[dependabot]

Bumps the production-dependencies group with 44 updates:

Package	From	To
typescript	6.0.3	7.0.2
@astrojs/cloudflare	14.1.4	14.3.4
@hugeicons/core-free-icons	4.2.3	4.3.5
@sentry/browser	10.67.0	11.6.0
@tabler/icons	3.45.0	3.49.0
@tanstack/virtual-core	3.17.5	3.18.0
astro	7.1.3	7.3.8
posthog-js	1.405.3	1.438.7
tailwind-variants	3.2.2	3.3.1
@astrojs/react	6.0.1	7.0.1
@base-ui/react	1.6.0	1.9.0
@tanstack/react-virtual	3.14.7	3.14.14
lucide-react	1.25.0	1.54.0
react	19.2.7	19.3.0
react-dom	19.2.7	19.3.0
shadcn	4.13.1	4.21.4
sonner	2.0.7	2.0.8
tailwind-merge	3.6.0	3.7.0
@astrojs/starlight	0.41.3	0.42.6
sharp	0.35.3	0.35.5
three	0.185.1	0.186.1
@modelcontextprotocol/sdk	1.29.0	1.32.1
pg	8.22.0	8.23.1
@apidevtools/swagger-parser	12.1.0	13.1.0
@aws-sdk/client-s3	3.1091.0	3.1149.0
@babel/parser	8.0.4	8.0.7
@exodus/bytes	1.15.1	1.16.0
@fastify/busboy	3.2.0	3.2.2
@hono/mcp	0.3.1	0.3.2
@hono/node-server	2.0.11	2.1.4
@hono/zod-openapi	1.5.1	1.6.3
@libsql/client	0.17.4	0.18.0
@sentry/bun	10.67.0	11.6.0
@sentry/node	10.67.0	11.6.0
@ungap/structured-clone	1.3.3	1.4.0
add-mcp	1.13.0	2.4.1
drizzle-orm	0.45.2	0.45.4
hono	4.12.31	4.13.13
posthog-node	5.46.0	5.55.1
whatwg-url	17.1.0	17.2.0
ws	8.21.1	8.22.0
yaml	2.9.0	2.9.1
zod	4.4.3	4.6.5
@astrojs/language-server	2.16.12	2.17.2

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates @astrojs/cloudflare from 14.1.4 to 14.3.4

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.3.4

Patch Changes

• #18213 1e5523d Thanks @​astro-factory! - Fixes the globalThis.process shim being prepended to client-side scripts. The shim is now only added to the server output.

• #18253 78dca00 Thanks @​astro-factory! - Fixes the @astrojs/cloudflare/hono usage example so i18n() is mounted before pages(). In the old order, i18n() never ran, so locale redirects and fallbacks were skipped.

• #18145 02246c9 Thanks @​astro-factory! - Fixes dev dependency scan failing when a frontmatter line starts with import.meta or import(

• #17677 4f85749 Thanks @​andreialba! - Fixes remote images without a file extension failing with 400 Unsupported format: null when using the cloudflare-binding image service

  Astro only adds the f (format) parameter to /_image URLs when it can infer a format from the source, and otherwise leaves it off so the image service resolves the format from the source itself. Extensionless remote images, such as GitHub avatars like https://avatars.githubusercontent.com/u/1234, take that path. The image transform endpoint now falls back to the source's media type when f is absent, passing SVG sources through unchanged and encoding everything else as WebP. This also fixes SVG images, which are requested as f=svg and previously failed the same way.

• #18057 8db3024 Thanks @​asqar! - Fixes astro build failing with fetch failed / connect ECONNREFUSED 127.0.0.1:<port> during prerendering on hosts where localhost resolves to IPv6

  The prerenderer started its Vite preview server with host: 'localhost' and then built the fetch URL by re-stating that same hostname. localhost was therefore resolved twice, independently — once by listen() to pick a bind address and once by fetch() to pick a connect address — with nothing making the two agree. On hosts where those resolutions land on different families, the preview server listens on ::1 while fetch dials 127.0.0.1, and every prerender request is refused. The URL is now derived from the address actually bound, so bind and connect agree by construction.

• Updated dependencies [6987261, 62b13ba]:

  • @​astrojs/internal-helpers@​0.12.0
  • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.3

Patch Changes

• #18059 30cb32e Thanks @​Princesseuh! - Fixes image transforms without a specified quality outputting an higher quality than expected on certain formats

• #18091 28d59a9 Thanks @​astro-factory! - Fixes optimizeDeps.include glob astro/runtime/** matching .d.ts files, which caused 83 unnecessary optimizer entries and empty output chunks per environment during dev

• #18032 f7dbc6a Thanks @​adamchal! - Fixes image requests when using imageService: 'compile' with passthroughImageService().

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.2

Patch Changes

• #17958 b95c574 Thanks @​astro-factory! - Fixes a build failure when the wrangler config uses the exports field to declare Durable Object classes

• #18022 24946f7 Thanks @​matthewp! - Fixes cold astro dev crashes when using the passthrough image service

• #17842 d68db73 Thanks @​adamchal! - Fixes broken images on static sites by transforming prerendered images at build time with the default Cloudflare Images binding

• #17945 750b4db Thanks @​matthewp! - Pre-bundles renderer server entrypoints and the default console logger during dev so they are included in the initial optimization pass, preventing a mid-request re-optimization that could crash the dev server on Cloudflare (workerd).

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.1

Patch Changes

• #17914 a400504 Thanks @​astro-factory! - Fixes a build crash when a custom worker entrypoint exports Durable Object classes alongside prerendered pages. The prerender worker no longer inherits durable_objects, migrations, or workflows from the entry worker config.

• Updated dependencies []:

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.3.4

Patch Changes

• #18213 1e5523d Thanks @​astro-factory! - Fixes the globalThis.process shim being prepended to client-side scripts. The shim is now only added to the server output.

• #18253 78dca00 Thanks @​astro-factory! - Fixes the @astrojs/cloudflare/hono usage example so i18n() is mounted before pages(). In the old order, i18n() never ran, so locale redirects and fallbacks were skipped.

• #18145 02246c9 Thanks @​astro-factory! - Fixes dev dependency scan failing when a frontmatter line starts with import.meta or import(

• #17677 4f85749 Thanks @​andreialba! - Fixes remote images without a file extension failing with 400 Unsupported format: null when using the cloudflare-binding image service

  Astro only adds the f (format) parameter to /_image URLs when it can infer a format from the source, and otherwise leaves it off so the image service resolves the format from the source itself. Extensionless remote images, such as GitHub avatars like https://avatars.githubusercontent.com/u/1234, take that path. The image transform endpoint now falls back to the source's media type when f is absent, passing SVG sources through unchanged and encoding everything else as WebP. This also fixes SVG images, which are requested as f=svg and previously failed the same way.

• #18057 8db3024 Thanks @​asqar! - Fixes astro build failing with fetch failed / connect ECONNREFUSED 127.0.0.1:<port> during prerendering on hosts where localhost resolves to IPv6

  The prerenderer started its Vite preview server with host: 'localhost' and then built the fetch URL by re-stating that same hostname. localhost was therefore resolved twice, independently — once by listen() to pick a bind address and once by fetch() to pick a connect address — with nothing making the two agree. On hosts where those resolutions land on different families, the preview server listens on ::1 while fetch dials 127.0.0.1, and every prerender request is refused. The URL is now derived from the address actually bound, so bind and connect agree by construction.

• Updated dependencies [6987261, 62b13ba]:

  • @​astrojs/internal-helpers@​0.12.0
  • @​astrojs/underscore-redirects@​1.0.4

14.3.3

Patch Changes

• #18059 30cb32e Thanks @​Princesseuh! - Fixes image transforms without a specified quality outputting an higher quality than expected on certain formats

• #18091 28d59a9 Thanks @​astro-factory! - Fixes optimizeDeps.include glob astro/runtime/** matching .d.ts files, which caused 83 unnecessary optimizer entries and empty output chunks per environment during dev

• #18032 f7dbc6a Thanks @​adamchal! - Fixes image requests when using imageService: 'compile' with passthroughImageService().

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

14.3.2

Patch Changes

• #17958 b95c574 Thanks @​astro-factory! - Fixes a build failure when the wrangler config uses the exports field to declare Durable Object classes

• #18022 24946f7 Thanks @​matthewp! - Fixes cold astro dev crashes when using the passthrough image service

• #17842 d68db73 Thanks @​adamchal! - Fixes broken images on static sites by transforming prerendered images at build time with the default Cloudflare Images binding

• #17945 750b4db Thanks @​matthewp! - Pre-bundles renderer server entrypoints and the default console logger during dev so they are included in the initial optimization pass, preventing a mid-request re-optimization that could crash the dev server on Cloudflare (workerd).

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

14.3.1

Patch Changes

... (truncated)

Commits

• e4f8f46 [ci] release (#18120)
• 78dca00 Mount i18n() before pages() in documented astro/hono order (#18253)
• 1e5523d Scope Cloudflare adapter process banner to SSR and prerender environments onl...
• 322cd13 Update astro (#18203)
• 4f85749 fix(cloudflare): resolve image format from the source when f is absent (#17...
• 02246c9 Fix @astrojs/cloudflare dependency scan incorrectly matching import.meta ...
• 4ce2fca [ci] format
• 8db3024 fix(cloudflare): derive prerender server URL from the bound address (#18057)
• 790c6f7 [ci] release (#18035)
• 00393ff Update dependency vitest [SECURITY] (#18026)
• Additional commits viewable in compare view

Updates @hugeicons/core-free-icons from 4.2.3 to 4.3.5

Commits

• See full diff in compare view

Updates @sentry/browser from 10.67.0 to 11.6.0

Release notes

Sourced from @​sentry/browser's releases.

11.6.0

Important Changes

• feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

  The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.

  import * as Sentry from '@sentry/nextjs/cloudflare';
  import handler from './.open-next/worker.js';
  export default Sentry.withSentry(
  env => ({
  dsn: env.SENTRY_DSN,
  tracesSampleRate: 1.0,
  }),
  handler,
  );

• feat(server-utils): Add instrumentation for pi-durable (#24993)

  The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

• fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

  When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).

Other Changes

• feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
• feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
• feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)
• feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)
• fix(browser): Check for clock drift on page lifecycle events (#25091)
• fix(core): Exclude attachments from internal exception events (#25160)
• fix(effect): Convert Effect span times to the Sentry clock (#24972)
• fix(effect): Detect HTTP spans named after the request method (#25159)
• fix(node): Register Vercel keep-alive listeners once (#25146)
• fix(replay): Place CLS and INP web vitals at the right time (#24990)
• fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)
• fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)

• chore: Add external contributor to CHANGELOG.md (#25136)
• chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)
• chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)
• feat(cloudflare): Wrap vinext Worker entries with @sentry/nextjs/cloudflare (#25000)

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

11.6.0

Important Changes

• feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

  The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.

  import * as Sentry from '@sentry/nextjs/cloudflare';
  import handler from './.open-next/worker.js';
  export default Sentry.withSentry(
  env => ({
  dsn: env.SENTRY_DSN,
  tracesSampleRate: 1.0,
  }),
  handler,
  );

• feat(server-utils): Add instrumentation for pi-durable (#24993)

  The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

• fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

  When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).

Other Changes

• feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
• feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
• feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)
• feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)
• fix(browser): Check for clock drift on page lifecycle events (#25091)
• fix(core): Exclude attachments from internal exception events (#25160)
• fix(effect): Convert Effect span times to the Sentry clock (#24972)
• fix(effect): Detect HTTP spans named after the request method (#25159)
• fix(node): Register Vercel keep-alive listeners once (#25146)
• fix(replay): Place CLS and INP web vitals at the right time (#24990)
• fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)
• fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)

• chore: Add external contributor to CHANGELOG.md (#25136)
• chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)
• chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)

... (truncated)

Commits

• 3c0c830 release: 11.6.0
• 13743e9 Merge pull request #25184 from getsentry/prepare-release/11.6.0
• 3605c50 chore(size-limit): Bump @​sentry/node size limits
• 53ae996 meta(changelog): Update changelog for 11.6.0
• e99e6e1 feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
• 2fdcb23 test(e2e): Add Mastra Jev classifier test to node-mastra (#25115)
• 5bb9a68 feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate span...
• 221dd86 test(e2e): Add a cloudflare-pi-durable end-to-end application (#25022)
• 966e1ff feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
• b70f6bb test(e2e): Add a node-pi-durable end-to-end application (#24994)
• Additional commits viewable in compare view

Updates @tabler/icons from 3.45.0 to 3.49.0

Release notes

Sourced from @​tabler/icons's releases.

Release 3.49.0

18 new icons:

• outline/alphabet-chinese
• outline/alphabet-devanagari
• outline/alphabet-ethiopic
• outline/alphabet-georgian
• outline/alphabet-japanese
• outline/blob-dashed
• outline/circle-heart
• outline/circle-pause
• outline/circle-play
• outline/circle-stop
• outline/file-lock
• outline/folder-lock
• outline/lens-concave
• outline/lens-convex
• outline/memory
• outline/square-dashed-top-solid
• outline/square-dashed-x
• outline/triangle-dashed

Fixes and improvements

• Add alphabet, arabic, typography and character tags to alphabet-arabic (#1643)
• Match brand-instagram size to other square brand icons (#1615)
• Fix square-dashed icon drawn as a solid square (#1614)
• Redraw square-dashed and table-dashed icons (#1640)
• Add squircle tag to all square-rounded icons (#1641)
• Webfont: Fix filled home webfont glyph having zero width in Chrome (#1616)
• Webfont: Fix sass and style fields in package.json to point to dist/, and stop publishing the intermediate SVG fonts, which the CSS never referenced (#1633)
• Webfont: Make webfont builds reproducible, so font files no longer change between builds of the same icons (#1624)
• Webfont: Drop the unused svgtofont dependency (#1620)
• Astro, Preact, React, React Native, SolidJS, Vue: Stop publishing source maps, which made up about 70% of the package size (#1634)
• Svelte, Svelte Runes: Add default export conditions and document per-icon imports (#1630)
• React Native: Stop passing extra props (testID, style, onPress, …) to every node of the icon, only the root Svg gets them. title is now exposed to screen readers via accessibility props (#1628)

Release 3.48.0

18 new icons:

• outline/duplicate
• outline/folder-ai
• outline/folder-sparkle
• outline/git-branch-check
• outline/git-branch-x

... (truncated)

Commits

• bbed884 Create the GitHub release even when the publish command fails
• e3ae34b Create the GitHub release when Changesets does not report the publish
• 009744c Release (#1647)
• e1c0cbe Move memory icon 1px down to center it on the grid
• e2b499f Attach the zip with all icon formats to the GitHub release
• 5e960f8 Publish the packages with npm trusted publishing (OIDC)
• 253cb08 Remove thanks from the changelogs and the release notes
• e2a3994 Format the release notes like the previous releases, list renamed icons
• 8d22e88 Remove thanks to the maintainers from the release notes
• 9790d59 Create a single GitHub release with the changes of all packages
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tabler/icons since your current version.

Updates @tanstack/virtual-core from 3.17.5 to 3.18.0

Release notes

Sourced from @​tanstack/virtual-core's releases.

@​tanstack/virtual-core@​3.18.0

Minor Changes

• #1300 43675bc - feat(virtual-core): add cancelScroll() to stop an in-flight scrollToIndex / scrollToOffset / scrollBy / scrollToEnd from correcting toward its target, so a user gesture can take over the viewport (#1285)

Patch Changes

• #1276 9df47a3 - Fix scrollToIndex(last, { align: 'end' }) overshooting the last item by paddingEnd; it now respects scrollPaddingEnd like other end-aligned items. To scroll to the very bottom including paddingEnd, use scrollToEnd().

• #1293 c644f10 - fix(virtual-core): don't cache a 0 size when measureElement receives a node that isn't attached to the document yet

• #1294 2a631f4 - Keep scrollToIndex reconciliation active until pending ResizeObserver measurements can update its target, including when useAnimationFrameWithResizeObserver is enabled. Respect an external scroll away from a reached target during this settling period.

@​tanstack/virtual-core@​3.17.11

Patch Changes

• #1284 06d1b6b - Read the current scroll offset when the debounced scroll-end fallback fires so measurement adjustments made since the last browser scroll event are not overwritten by stale state.

• #1248 2c0a0ea - Keep a travelling smooth scrollToIndex alive when content is prepended. With anchorTo: 'end', the prepend anchor sync wrote scrollTop instantly, which cancelled the browser's smooth animation and left the scroll stranded partway; Chromium drops a smooth request re-issued right after such a cancel, so it could not be resumed. The sync is now skipped while a smooth programmatic scroll is still in flight, and the animation continues to its recomputed target. A smooth scroll that has already landed still receives the anchor sync.

@​tanstack/virtual-core@​3.17.10

Patch Changes

• #1272 ab3278c - Keep an end-pinned virtualizer following appended items when older items are trimmed in the same update and the item count does not increase. Recognize ordered, overlapping windows while preserving reading anchors for users who have scrolled away from the end.

  Preserve item keys in the lazy measurement cache so a stable getItemKey callback reading mutable data cannot change the identity of previously measured rows.

@​tanstack/virtual-core@​3.17.9

Patch Changes

• #1260 4a0adf3 - Recover the bottom pin when the browser clamps an end-anchored scroll compensation write. resizeItem compensates a size change by writing scrollTop before the consumer has committed the new total size, so when the grown item does not itself extend the scroll range the browser clamps the write to the old maximum and the viewport is left short of the end with no scroll event to correct it. Two cases hit this: paddingEnd > 0 with a growing last item, where the overflowing item only extends scrollHeight to its own end and the clamp lands exactly paddingEnd short (#1258); and a row above the last one growing while the last row keeps its size, under directDomUpdates (#1266). A compensation write whose target exceeds the scroll maximum at write time is now recorded as clamped and re-issued once the sizer has grown — right after notify for consumers that size the container synchronously in onChange, and from _willUpdate for consumers that size it during a render. The clamped read-back keeps the retry pending; any other scroll event cancels it, so a user reading history is never yanked.

@​tanstack/virtual-core@​3.17.8

Patch Changes

• #1256 a0a411e - Cancel the pending isScrolling reset when a scroll observer is torn down, and reset isScrolling and scrollDirection in cleanup() so they don't stay stuck after the scroll element changes or is removed.

• #1246 d2cf98b - Ignore connected measurement nodes whose indexes are outside the current item count.

@​tanstack/virtual-core@​3.17.7

Patch Changes

• #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

@​tanstack/virtual-core@​3.17.6

Patch Changes

• #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.

Changelog

Sourced from @​tanstack/virtual-core's changelog.

3.18.0

Minor Changes

• #1300 43675bc - feat(virtual-core): add cancelScroll() to stop an in-flight scrollToIndex / scrollToOffset / scrollBy / scrollToEnd from correcting toward its target, so a user gesture can take over the viewport (#1285)

Patch Changes

• #1276 9df47a3 - Fix scrollToIndex(last, { align: 'end' }) overshooting the last item by paddingEnd; it now respects scrollPaddingEnd like other end-aligned items. To scroll to the very bottom including paddingEnd, use scrollToEnd().

• #1293 c644f10 - fix(virtual-core): don't cache a 0 size when measureElement receives a node that isn't attached to the document yet

• #1294 2a631f4 - Keep scrollToIndex reconciliation active until pending ResizeObserver measurements can update its target, including when useAnimationFrameWithResizeObserver is enabled. Respect an external scroll away from a reached target during this settling period.

3.17.11

Patch Changes

• #1284 06d1b6b - Read the current scroll offset when the debounced scroll-end fallback fires so measurement adjustments made since the last browser scroll event are not overwritten by stale state.

• #1248 2c0a0ea - Keep a travelling smooth scrollToIndex alive when content is prepended. With anchorTo: 'end', the prepend anchor sync wrote scrollTop instantly, which cancelled the browser's smooth animation and left the scroll stranded partway; Chromium drops a smooth request re-issued right after such a cancel, so it could not be resumed. The sync is now skipped while a smooth programmatic scroll is still in flight, and the animation continues to its recomputed target. A smooth scroll that has already landed still receives the anchor sync.

3.17.10

Patch Changes

• #1272 ab3278c - Keep an end-pinned virtualizer following appended items when older items are trimmed in the same update and the item count does not increase. Recognize ordered, overlapping windows while preserving reading anchors for users who have scrolled away from the end.

  Preserve item keys in the lazy measurement cache so a stable getItemKey callback reading mutable data cannot change the identity of previously measured rows.

3.17.9

Patch Changes

• #1260 4a0adf3 - Recover the bottom pin when the browser clamps an end-anchored scroll compensation write. resizeItem compensates a size change by writing scrollTop before the consumer has committed the new total size, so when the grown item does not itself extend the scroll range the browser clamps the write to the old maximum and the viewport is left short of the end with no scroll event to correct it. Two cases hit this: paddingEnd > 0 with a growing last item, where the overflowing item only extends scrollHeight to its own end and the clamp lands exactly paddingEnd short (#1258); and a row above the last one growing while the last row keeps its size, under directDomUpdates (#1266). A compensation write whose target exceeds the scroll maximum at write time is now recorded as clamped and re-issued once the sizer has grown — right after notify for consumers that size the container synchronously in onChange, and from _willUpdate for consumers that size it during a render. The clamped read-back keeps the retry pending; any other scroll event cancels it, so a user reading history is never yanked.

3.17.8

Patch Changes

• #1256 a0a411e - Cancel the pending isScrolling reset when a scroll observer is torn down, and reset isScrolling and scrollDirection in cleanup() so they don't stay stuck after the scroll element changes or is removed.

• #1246 d2cf98b - Ignore connected measurement nodes whose indexes are outside the current item count.

3.17.7

Patch Changes

• #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

... (truncated)

Commits

• 259fc1a ci: Version Packages (#1299)
• 2a631f4 fix(virtual-core): reconcile index scrolls after pending measurements (#1294)
• 43675bc feat(virtual-core): add cancelScroll() to stop an in-flight scroll reconcilia...
• c644f10 fix(virtual-core): skip sync measurement of detached nodes (#1293)
• 9df47a3 fix(virtual-core): stop scrollToIndex(last, { align: 'end' }) overshooting by...
• 78371e8 ci: Version Packages (#1279)
• 06d1b6b fix(virtual-core): refresh offset in scroll-end fallback (#1284)
• 2c0a0ea fix(virtual-core): keep a travelling smooth scroll alive through a prepend (#...
• df47889 ci: Version Packages (#1277)
• ab3278c fix(virtual-core): preserve mea...

  Description has been truncated

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: spiritledsoftware/caplets/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5b513039-edc2-48b5-a1be-7c7849f4f722

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tanstack/​react-virtual@​3.14.7 ⏵ 3.14.14	+1		+1	+1
	@​base-ui/​react@​1.6.0 ⏵ 1.9.0			+1	-3
	@​tanstack/​virtual-core@​3.17.5 ⏵ 3.18.0	+1		+1	+2
	@​types/​pg@​8.20.0 ⏵ 8.23.1	+1		+1
	@​types/​ws@​8.18.1 ⏵ 8.18.2	+1		+1
	@​types/​react-dom@​19.2.3 ⏵ 19.3.0	+1		+1
	@​sentry/​node@​10.67.0 ⏵ 11.6.0	-21		-13	+1
	@​types/​react@​19.2.17 ⏵ 19.3.0	+1		+1
	posthog-node@​5.46.0 ⏵ 5.55.1	+19		+1	-1
	@​sentry/​bun@​10.67.0 ⏵ 11.6.0			-10	+1
	@​babel/​parser@​8.0.4 ⏵ 8.0.7				+1
	@​astrojs/​language-server@​2.16.12 ⏵ 2.17.2			+1
	lucide-react@​1.25.0 ⏵ 1.54.0			+1	+1
	sonner@​2.0.7 ⏵ 2.0.8			+1	-2
	@​sentry/​browser@​10.67.0 ⏵ 11.6.0	+21		-8	+1
	posthog-js@​1.405.3 ⏵ 1.438.7			+2
	react@​19.2.7 ⏵ 19.3.0	+1		+1
	@​astrojs/​cloudflare@​14.1.4 ⏵ 14.3.4			+1	+1
	@​astrojs/​starlight@​0.41.3 ⏵ 0.42.6	+1		+1	+2
	tailwind-merge@​3.6.0 ⏵ 3.7.0	+1		+1
	@​ungap/​structured-clone@​1.3.3 ⏵ 1.4.0	+1		+1
	tailwind-variants@​3.2.2 ⏵ 3.3.1	+1		+1	+2
	@​hono/​mcp@​0.3.1 ⏵ 0.3.2			+1	-4
	yaml@​2.9.1
	@​libsql/​client@​0.17.4 ⏵ 0.18.0	+1		+1
	astro@​7.1.3 ⏵ 7.3.8	+1	+75	+1
	drizzle-orm@​0.45.4
	pg@​8.22.0 ⏵ 8.23.1	+1		+1	+3
	@​fastify/​busboy@​3.2.0 ⏵ 3.2.2	+1	+23
	shadcn@​4.13.1 ⏵ 4.21.4			-1	+1
	ws@​8.22.0
See 16 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm sentry under LicenseRef-FSL-1.1-ALv2 License: LicenseRef-FSL-1.1-ALv2 - The applicable license policy does not permit this license (5) (package/LICENSE.md) From: pnpm-lock.yaml → npm/@sentry/node@11.6.0 → npm/sentry@0.45.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/sentry@0.45.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report