chore(deps): Update npm minor dependencies (minor)

[amadeusitgroup-renovate-app]

This PR contains the following updates:

Package	Change	Age	Confidence
jsdom	30.0.1 → 30.1.0
react (source)	19.2.8 → 19.3.0
react-dom (source)	19.2.8 → 19.3.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

jsdom/jsdom (jsdom)

v30.1.0

Compare Source

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

• Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
• Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
• Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
• Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
• Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
• Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
• Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
• Changed window.close() to preserve access to the document and its DOM through retained references.
• Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
• Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
• Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
• Fixed :focus matching in shadow trees. (@​asamuzaK)
• Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during element.replaceWith().
• Fixed the ordering of script execution, custom element callbacks, iframe loading, and mutation observer notifications during DOM insertion, including in shadow trees.
• Fixed queued events and navigation continuing after window.close() or iframe removal, and prevented new scripts, resource loads, timers, and animation frames from starting in destroyed documents. (@​scttcper)
• Fixed parent documents waiting indefinitely for loading to finish when a child iframe removes itself during loading.
• Fixed request cancellation across redirects, during pending requestInterceptor() callbacks, and when reusing an XMLHttpRequest after aborting it.
• Fixed resource loading and JSDOM.fromURL() potentially hanging when response handling throws and response stream cleanup does not finish.
• Fixed successful cached resource loads being treated as aborted.
• Fixed getComputedStyle() and document.styleSheets using the wrong stylesheet order after inserting or updating <style> elements.
• Fixed getComputedStyle() ignoring nested @import and @media rules in imported stylesheets, and returning stale results after imports finish loading.
• Fixed style invalidation, stylesheet removal, and frame source updates in shadow trees.
• Fixed repeated getComputedStyle() calls changing case-sensitive background URLs, and inconsistent resolution of border shorthands containing system colors. (@​scttcper)
• Fixed computed border widths, including borderless elements incorrectly reporting 16px, which regressed in v30.0.0. (@​Alberto-BaseNet)
• Fixed getComputedStyle() to resolve 'font-weight' keywords to numeric values. (@​tianrking)
• Fixed getComputedStyle() to convert lengths to pixels inside CSS math functions containing percentages, and to resolve percentages in 'font-size' math functions. (@​soroushm)
• Fixed serialization of min() and max() containing nested calc(), which regressed in v30.0.0. (@​asamuzaK)
• Fixed CSS values mixing lengths or percentages with math functions, such as 'grid-template-columns' values containing both 100px and calc(). (@​rome-xi)
• Fixed parsing of 'background' and 'border' shorthands with adjacent components, such as url(a.png)no-repeat, including a crash when parsing inline styles. Also fixed handling of invalid shorthand assignments and escaped or unusual characters in CSS declarations. (@​asamuzaK)
• Fixed parsing of unitless zero values in 'flex' shorthands, such as 35 1 0, and rejection of negative 'flex-basis' lengths and percentages. (@​asamuzaK)
• Fixed shorthand style assignments producing extra mutation records and custom element callbacks for intermediate values. (@​scttcper)
• Fixed Range and Selection handling of CDATA sections, including boundary offsets and range cloning, extraction, deletion, insertion, and stringification. (@​scttcper)
• Fixed text.normalize() incorrectly removing the text node or merging its siblings. (@​scttcper)
• Fixed cloning and importing CDATA sections and processing instructions whose contents have been modified, and serialization of CDATA sections adopted into HTML documents.
• Fixed stale named-property collections on window, and incorrect named access from empty or namespaced id="" and name="" values. (@​scttcper)
• Fixed elements in documents created with DOMParser or document.implementation.createHTMLDocument() appearing as named properties on window and being retained in memory. (@​Iaotle)
• Fixed memory leaks from mutation observers retaining observed nodes, abort signals retaining removed event listeners, and storage event tracking retaining closed windows. (@​scttcper)
• Fixed storage events being sent to windows created after the storage change, and ensured surviving recipients still receive events when the source document is destroyed.
• Fixed attribute lookups after namespace prefix changes, and namespaced attributes incorrectly affecting ID lookups and element behavior. (@​scttcper)
• Fixed input.list in detached element trees. (@​scttcper)
• Fixed attr.ownerDocument after setting an attribute node on an element in another document or adopting its element. (@​Kjubikstronk)
• Fixed fresh element.getElementsByTagName() calls using the previous document's case-sensitivity rules after adoption between HTML and XML documents. (@​Kjubikstronk)
• Fixed element.tagName returning stale casing after adoption between HTML and XML documents.
• Fixed radio button grouping and checkedness updates for controls with different form owners, controls outside their form, unnamed controls, and canceled clicks.
• Fixed <select> selection updates when moving options, and unintended selection resets when moving a whole <select> or changing unrelated descendants.
• Fixed cloning <input> elements to preserve input.indeterminate.
• Fixed focus state after removing a focused element or its ancestor, including inside shadow trees.
• Fixed script execution when inserting children into a connected, empty <script>. (@​Kjubikstronk)
• Fixed incorrect script execution after changes to src="", and handling of type="", for="", and event="".
• Fixed document.currentScript during nested script execution and scripts in shadow trees.
• Fixed event dispatch, window.event, and default passive listener handling for non-node event targets, and event dispatch when user code modifies window.constructor.
• Fixed volumechange and ratechange events to fire asynchronously. (@​christianaurichzm)
• Fixed DOM APIs accepting user-created proxies around DOM objects where genuine DOM objects are required.
• Fixed XPath iterator invalidation after DOM mutations and errors for invalid result types.
• Fixed NodeIterator traversal when its filter removes nodes.
• Fixed fileReader.readAsText() to honor the blob's MIME type charset when no supported explicit encoding is supplied.
• Fixed fractional seconds in time input parsing and serialization. (@​Jaybhade)
• Fixed large input.valueAsNumber assignments for time and local date/time inputs.
• Fixed hard wrapping of <textarea> values to use the numeric textarea.cols value.
• Fixed document.readyState to be "complete" for documents created with document.implementation.createDocument() and document.implementation.createHTMLDocument().
• Fixed element.translate for empty translate="" values and elements without a parent.
• Fixed XML parsing of lone surrogates to replace them with the Unicode replacement character.
• Fixed node.lookupNamespaceURI() for the xml and xmlns prefixes. (@​vojtisprime11)
• Fixed <base> elements to ignore data: and javascript: URLs. (@​vojtisprime11)
• Fixed svgElement.viewportElement inside <symbol> elements.
• Fixed the default blobEvent.timecode to be NaN.
• Fixed the object shape and property descriptors of CSS.

react/react (react)

v19.3.0

Compare Source

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #​31975, #​31987, #​31996, #​31999, #​32001, #​32002, #​32028, #​32029, #​32031, #​32034, #​32038, #​32041, #​32050, #​32090, #​32105, #​32254, #​32379, #​32422, #​32462, #​32540, #​32545, #​32585, #​32599, #​32611, #​32612, #​32617, #​32651, #​32653, #​32656, #​32664, #​32699, #​32723, #​32734, #​32751, #​32752, #​32760, #​32761, #​32764, #​32772, #​32790, #​32819, #​32820, #​32822, #​32833, #​32849, #​33094, #​33191, #​33200, #​33206, #​33293, #​33330, #​33331, #​33332, #​33357, #​33362, #​33433, #​33576, #​34374, #​34450, #​34481, #​34500, #​34502, #​34510, #​34511, #​34539, #​35567, #​35564, #​35485, #​35380, #​35063, #​35060, #​34676, #​36917, #​35337, #​35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #​32465, #​32613, #​32619, #​32654, #​32660, #​32682, #​32722, #​32813, #​32814, #​33056, #​33058, #​33093, #​34069, #​34103, #​34544, #​34545, #​37062, #​37061, #​37060, #​36047, #​36010, #​35642, #​35641, #​35637, #​35630, #​34935, #​37457, #​37408, #​37326, #​37251, #​37171, #​37169, #​37168, #​37167, #​37166, #​37165, #​37164, #​37163, #​37162, #​37161, #​37160, #​37125, #​37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #​37143, #​37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #​37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #​35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #​37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #​37104, #​37203, #​37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #​36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #​36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #​36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #​36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #​36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #​35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #​35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #​35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #​35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #​35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #​36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #​34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #​34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #​34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #​36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #​35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #​34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #​35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #​34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #​35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #​37104, #​37203, #​37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #​37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #​37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #​37113)
• Only remove properties from Host Singletons on release (@​gnoff #​37112)
• Don't invoke effects on moved children in StrictMode (@​sophiebits #​36948)
• Throw a clearer error when a rejected Promise is incorrectly instrumented (@​eps1lon #​36328)
• Fix context propagation into Suspense fallbacks (@​acdlite #​36160)
• Fix context propagation through suspended Suspense boundaries (@​acdlite #​35839)
• Fix useDeferredValue getting stuck (@​gaearon #​36134)
• Update useActionState error message to say "action state" instead of "form state" (@​rickhanlonii #​35790)
• Don't warn when rendering data block scripts (@​eps1lon #​35953)
• Treat fibers with alternates as mounted in getNearestMountedFiber (@​sebmarkbage #​35578)
• Always instrument the lazy initializer thenable (@​gnoff #​35521)
• Annotate cascading updates for DevTools performance tracks in DEV (@​huntie #​34961)
• Resolve the .default export of a React.lazy as the canonical value (@​sebmarkbage #​34906)
• Limit owner stacks to 10 frames (@​eps1lon #​34864)
• Ensure useEffectEvent reads latest values in forwardRef and memo() components (@​eps1lon #​34831)

React DOM

• Copy source onto the synthetic toggle event (@​lazerg #​37389)
• Update HTML parser rules for the new <select> parser (@​josepharhar #​34804)
• Update defaultValue for type="number" inputs to match other input types (@​sophiebits #​36980)
• Avoid setting innerHTML when it hasn't changed (@​sophiebits #​36949)
• Forward the nonce option in ReactDOM.preloadModule() (@​UditDewan #​36851)
• Support fetchPriority for module resources (@​TheAlexLichter #​36835)
• Track stylesheet preloads when explicitly preloaded to avoid unnecessary suspension (@​gnoff #​36386)
• Suggest correct casing for the misspelled credentialless iframe attribute (@​vmx906 #​36322)
• Add credentialless as a recognized boolean attribute for iframes (@​vmx906 #​36148)
• Prevent reentrant finishedTask from calling completeAll multiple times (@​gnoff #​36287)
• Update the CSS shorthand property list (@​kidonng #​35636)
• Support the maskType SVG prop (@​sleitor #​35921)
• Add support for onFullscreenChange and onFullscreenError events (@​chirokas #​34621)
• Include submitter in submit events (@​eps1lon #​35590)
• Fire onReset when automatically resetting forms (@​eps1lon #​35176)
• Use the FormData submitter parameter (@​jenseng #​29028)
• Fix form status reset when component state is updated (@​eps1lon #​34075)
• Batch updates from resize events until the next frame (@​eps1lon #​35117)

React Server

• Add nonce to rendered import maps (@​mattcosta7 #​37339)
• Add an onBrowserBailout option to observe subtrees that defer to the browser (@​gnoff #​37193)
• Stop the caller's signal from retaining a finished render (@​unstubbable #​37315)
• Construct the render lifetime controller only when it is needed (@​unstubbable #​37357)
• Fix react-dom/server hanging on Deno (@​fraidev #​35235)
• Extend stack overflow recovery to retries in SSR (@​jackpope #​36977)
• Fix false-positive hydration mismatch on nonce attributes (@​MaxwellCohen #​37030)
• Guard shell-error callbacks instead of nulling them out on the request (@​eps1lon #​36916)
• Stop firing onAllReady after the shell errored (@​eps1lon #​36903)
• Treat an incomplete tree as an error during error recovery (@​acdlite #​36911)
• Fix non-script modulepreload tracking (@​fallintoplace #​36564)
• Finalize postponed nextSegmentId after the prelude flush (@​gaojude #​36779)
• Preserve referrerPolicy in image preload headers (@​ulises-jeremias #​36803)
• Allow pending work to specialize abort reasons (@​gnoff #​36586)
• Abort tasks that suspend after aborting during render (@​gnoff #​36585)
• Finish abort in a scheduled task (@​gnoff #​36580)
• Fix aborts during resumed rendering (@​gnoff #​36584)
• Track abort state on the request (@​gnoff #​36583)
• Model external work scheduling explicitly in the fb bundle (@​gnoff #​36576)
• Continue reporting aborted task errors after a fatal abort (@​gnoff #​36575)
• Disallow abort reentrancy (@​gnoff #​36574)
• Stop transpiling computed property names (@​eps1lon #​36542)
• Fix crash when capturing the callsite of a stalled use() of a rejected Flight chunk (@​lubieowoce #​36544)
• Double invoke effects in Strict Mode during hydration (@​eps1lon #​35961)
• Add additional task reentrancy protections in Fizz (@​gnoff #​36291)
• Don't outline Suspense boundaries with suspensey CSS during shell flush (@​gnoff #​35824)
• Push a stalled use() to the owner stack and debug task (@​eps1lon #​35226)
• Fix useId tracking on replay (@​gnoff #​35518)
• Correctly handle replaying when hydrating (@​gnoff #​35494)
• Simplify the createSuspenseBoundary path (@​sebmarkbage #​35087)
• Unify preamble-only fields to save a field on Suspense boundaries (@​sebmarkbage #​35068)
• Unify prerender-only fields to save a field on Suspense boundaries (@​sebmarkbage #​35067)
• Push halted awaits to the owner stack for late-arriving I/O info (@​unstubbable #​35019)
• Include all Node.js APIs in the Bun entrypoint for react-dom/server (@​RiskyMH #​34193)
• Detach a Suspense boundary after flushing its segment (@​gnoff #​34694)

React Server Components

• Keep an element pending while a referenced row is resolving (@​unstubbable #​37542)
• Fix RangeError from exponential debug info growth (@​unstubbable #​37481)
• Abort the cache signal when debug objects are retained (@​unstubbable #​37342)
• Transfer key validation of lazy nodes when they are unwrapped (@​unstubbable #​37258)
• Add pending_weak to the Flight thenable protocol (@​acdlite #​37154)
• Outline and dedupe repeated strings (@​gaearon #​37147)
• Port Reply Server traversal guards to the Flight Client (@​eps1lon #​37144)
• Define Flight chunk .then with Object.defineProperty (@​eps1lon #​37109)
• Support Turbopack's experimental array format for chunks (@​sampoder #​37095)
• Limit fake JSX call site stacks to 10 frames (@​timneutkens #​37086)
• Improve performance when decoding Flight replies (@​gnoff #​37090)
• Recognize Node 22+ V8 frames for Promise statics in debug info (@​gaearon #​36969)
• Tailor the warning for binary data serialized through toJSON (Node Buffer) (@​unstubbable #​36873)
• Resolve models before JSON.stringify for faster serialization (@​mhart #​36795)
• Prune debug info when chunks error (@​gnoff #​36782)
• Avoid main-thread stalls from large debug strings (@​unstubbable #​36570)
• Fix stranded row content under Node stream backpressure (@​unstubbable #​36516)
• Fix dropped FormData entries in decodeReplyFromBusboy (@​unstubbable #​36468)
• Harden types and improve performance of Flight replies (@​eps1lon #​36425)
• Add more cycle protections to Flight replies (@​eps1lon #​36236)
• Transport AggregateError.errors (@​eps1lon #​36156)
• Bail out early when a backing entry for Blob deserialization is not a Blob (@​eps1lon #​36055)
• Clear chunk reason after successful module initialization (@​unstubbable #​36024)
• Add support for transporting Error.cause (@​eps1lon #​35810)
• Walk parsed JSON instead of using a reviver for faster RSC payload parsing (@​timneutkens #​35776)
• Skip transferReferencedDebugInfo during debug info resolution (@​unstubbable #​35795)
• Add unstable_allowPartialStream option to Flight Client (@​unstubbable #​35731)
• Fix encodeReply for JSX with temporary references (@​unstubbable #​35730)
• Fix debug channel flag in Node.js renderToPipeableStream (@​feedthejim #​35724)
• Fix stack overflow in visitAsyncNode with deep async chains (@​unstubbable #​35612)
• Allow Server Components to render context providers from client modules (@​rickhanlonii #​35675)
• Allow overriding request.timeOrigin via options.startTime (@​lubieowoce #​35598)
• Warn once if eval is disabled in the dev environment (@​eps1lon #​35661)
• Restore original function name in dev server callstacks served with unsafe-eval (@​eps1lon #​35650)
• Fix react-markup types for server references (@​eps1lon #​35634)
• Add more DoS mitigations to Flight replies and harden Flight (@​unstubbable #​35632)
• Allow cyclic references to be serialized when unwrapping lazy elements (@​unstubbable #​35471)
• Improve cyclic thenable detection in Flight reply server (@​cvan20191 #​35369)
• Add extra loop protection to Flight reply server (@​sebmarkbage #​35351)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage #​35345)
• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #​35290)
• Never parse then functions in Flight replies (@​sebmarkbage #​35289)
• Patch Flight reply server with fixes from Flight Client (@​sebmarkbage #​35277)
• Complete the list of Node.js internal Promise awaits (@​eps1lon #​35161)
• Reduce risk of maximum call stack exceeded when emitting async sequences (@​eps1lon #​35159)
• Fix pending chunks count for streams and async iterables in DEV (@​unstubbable #​35143)
• Fix broken byte stream parsing caused by buffer detachment (@​unstubbable #​35127)
• Fix hasReadable flag in Node.js clients' debug channel (@​unstubbable #​35039)
• Fix debug info filtering to include later resolved I/O (@​unstubbable #​35036)
• Cache the value when visiting the same I/O or Promise along different paths (@​sebmarkbage #​35005)
• Clone subsequent I/O nodes when resolved more than once (@​sebmarkbage #​35003)
• Fix hang after resolving cyclic references (@​unstubbable #​34988)
• Allow passing DEV-only startTime as an option (@​sebmarkbage #​34912)
• Ignore bound-anonymous-fn resources as they're not considered I/O (@​sebmarkbage #​34911)
• Fix detached ArrayBuffer error when streaming typed arrays (@​unstubbable #​34849)
• Exclude RSC stream if the stream resolves in a task (@​sebmarkbage #​34838)
• Forward the current environment when forwarding I/O entries (@​sebmarkbage #​34836)
• Look for moved debug info when logging component performance track (@​sebmarkbage #​34839)
• Respect displayName of Promise instances on the server (@​sebmarkbage #​34825)
• Avoid unnecessary indirection when serializing debug info (@​unstubbable #​34797)
• Fix preload as attribute for stylesheets (@​unstubbable #​34760)
• Don't serialize toJSON in debug path and omit wide arrays (@​sebmarkbage #​34759)
• Add support for <Activity> (@​eps1lon #​34697)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

npm audit — website

⚠️ Pre-existing vulnerabilities in website (severity ≥ high) — not introduced by this PR, informational only.

Severity	Advisory	Package
high	image-size: ICNS parser allows denial of service through an infinite loop	image-size
high	image-size: JXL and HEIF parsers allow denial of service through infinite loops	image-size

These were already present on the base branch. Use npm audit fix or upgrade dependencies to resolve them.

[github-actions]

npm audit — extension

✅ No vulnerabilities found (severity ≥ moderate).