chore: Bump the dependencies group with 10 updates

[dependabot]

Bumps the dependencies group with 10 updates:

Package	From	To
vite	8.1.5	8.2.2
@eventuras/ratio-ui	2.17.3	2.19.0
@types/react	19.2.17	19.2.18
@vitejs/plugin-react	6.0.4	6.1.1
@eventuras/markdown	0.15.0	0.15.1
@react-router/dev	8.3.0	8.3.1
@react-router/node	8.3.0	8.3.1
isbot	5.2.1	5.2.2
react-router	8.3.0	8.3.1
@types/react-dom	19.2.3	19.2.5

Updates vite from 8.1.5 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update rolldown-related dependencies (#23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
• use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#23231) (b4d66fe)
• module-runner: add TLA circular import case (#23299) (4a261f2)
• module-runner: simplify server-hmr tests (#23300) (599b44b)
• ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

• use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

8.2.1 (2026-08-06)

Bug Fixes

• build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
• bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)

... (truncated)

Commits

• de1111a release: v8.2.2
• cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
• 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
• 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
• 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
• 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
• 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
• 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
• 599b44b test(module-runner): simplify server-hmr tests (#23300)
• 4a261f2 test(module-runner): add TLA circular import case (#23299)
• Additional commits viewable in compare view

Updates @eventuras/ratio-ui from 2.17.3 to 2.19.0

Release notes

Sourced from @​eventuras/ratio-ui's releases.

@​eventuras/ratio-ui@​2.19.0

Minor Changes

• 8474931: New AsideLayout layout primitive: content with a sticky companion rail. Compose AsideLayout.Main with AsideLayout.Aside — the aside (a registration card, summary, or table of contents) sticks beside the content from lg, offset for an app header via top and sized via width, and stacks below the content on small screens.

• 3e6a023: DescriptionList gains variant="facts" — an editorial key-facts strip with mono overline terms above serif values in a bordered grid — and variant="meta" — compact label/value rows for card asides and summaries. The root now also accepts className and testId. The default look is unchanged.

• fd0df5b: Drawer is now a floating sheet: inset from the screen edges with radius, border and shadow, a real scrim behind it (new themable --scrim token), slide transitions, a draggable dismiss handle on top/bottom sheets, and new Drawer.Eyebrow plus scrim/stackOffset props for stacked drawers. The close button moved into Drawer.Header's row, and slot padding moved from the panel into the slots so the body scrolls alone and the footer divider runs full-bleed. Breaking detail: a drawer composed without the slots gets no default padding anymore — use the slots, or pad the content yourself. Full anatomy is documented in the Drawer stories.

  Dialog joins the same family: one shell (surface, hairline border, shared --radius-overlay/--shadow-overlay/--ease-overlay/--scrim tokens, slot padding with a full-bleed footer divider) where a dialog is the centered placement — fade + scale entry — and a drawer the edge placement. New Dialog.Header and Dialog.Eyebrow mirror Drawer's; AlertDialog and CommandPalette inherit the look.

• ea3cc16: Heading gains a size prop (sm | md | lg) that decouples the visual scale from the semantic level. Unset keeps the document prose scale from global.css; set, the heading renders on a compact editorial scale — serif at medium weight, tight tracking, margins zeroed — for composed UI such as cards, panels, and detail-page headers where the layout owns spacing.

Patch Changes

• 3c08b91: Internal: Hero, ValueTile, Sidebar, Footer, and Section now build their compound exports with Object.assign inference instead of a hand-rolled *Component interface plus cast — matching Heading and DescriptionList. No runtime API change; the slot prop interfaces these components use are now exported (HeroSlotProps, SectionTitleProps, SidebarSlotProps, ValueTileValueProps, ValueTileCaptionProps, …), and the never re-exported *Component interfaces are gone.
• 951e5cb: A data-testid passed to Switch, NumberField, Menu.Link, Menu.Button or Console was silently dropped: the component set its own data-testid after spreading caller props, and React removes an attribute set to undefined. It now comes before the spread, as in most of the library, so both routes work. Heading, EmptyState and SaveStatus solved this with a

... (truncated)

Changelog

Sourced from @​eventuras/ratio-ui's changelog.

2.19.0

Minor Changes

• 8474931: New AsideLayout layout primitive: content with a sticky companion rail. Compose AsideLayout.Main with AsideLayout.Aside — the aside (a registration card, summary, or table of contents) sticks beside the content from lg, offset for an app header via top and sized via width, and stacks below the content on small screens.

• 3e6a023: DescriptionList gains variant="facts" — an editorial key-facts strip with mono overline terms above serif values in a bordered grid — and variant="meta" — compact label/value rows for card asides and summaries. The root now also accepts className and testId. The default look is unchanged.

• fd0df5b: Drawer is now a floating sheet: inset from the screen edges with radius, border and shadow, a real scrim behind it (new themable --scrim token), slide transitions, a draggable dismiss handle on top/bottom sheets, and new Drawer.Eyebrow plus scrim/stackOffset props for stacked drawers. The close button moved into Drawer.Header's row, and slot padding moved from the panel into the slots so the body scrolls alone and the footer divider runs full-bleed. Breaking detail: a drawer composed without the slots gets no default padding anymore — use the slots, or pad the content yourself. Full anatomy is documented in the Drawer stories.

  Dialog joins the same family: one shell (surface, hairline border, shared --radius-overlay/--shadow-overlay/--ease-overlay/--scrim tokens, slot padding with a full-bleed footer divider) where a dialog is the centered placement — fade + scale entry — and a drawer the edge placement. New Dialog.Header and Dialog.Eyebrow mirror Drawer's; AlertDialog and CommandPalette inherit the look.

• ea3cc16: Heading gains a size prop (sm | md | lg) that decouples the visual scale from the semantic level. Unset keeps the document prose scale from global.css; set, the heading renders on a compact editorial scale — serif at medium weight, tight tracking, margins zeroed — for composed UI such as cards, panels, and detail-page headers where the layout owns spacing.

Patch Changes

• 3c08b91: Internal: Hero, ValueTile, Sidebar, Footer, and Section now build their compound exports with Object.assign inference instead of a hand-rolled *Component interface plus cast — matching Heading and DescriptionList. No runtime API change; the slot prop interfaces these components use are now exported (HeroSlotProps, SectionTitleProps, SidebarSlotProps, ValueTileValueProps, ValueTileCaptionProps, …), and the never re-exported *Component interfaces are gone.
• 951e5cb: A data-testid passed to Switch, NumberField, Menu.Link, Menu.Button or Console was silently dropped: the component set its own data-testid after spreading caller props, and React removes an attribute set to undefined. It now comes before the spread, as in most of the library, so

... (truncated)

Commits

• 67d164f chore: version packages
• 3c08b91 chore(ratio-ui): build compounds with Object.assign inference
• 8474931 feat(ratio-ui): add AsideLayout, content with a sticky companion rail
• ea3cc16 feat(ratio-ui): add Heading size prop for a compact editorial scale
• 3e6a023 feat(ratio-ui): add DescriptionList facts and meta variants
• fd0df5b feat(ratio-ui): unify Drawer and Dialog as one floating overlay family
• 951e5cb fix(ratio-ui): don't drop a forwarded data-testid
• be796b1 chore: version packages
• ccf363c feat(ratio-ui): add SaveStatus
• 52e06d4 feat(ratio-ui): add EmptyState
• Additional commits viewable in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.0.4 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• 39b3173 release: plugin-react@6.1.0 (#1428)
• f1340b0 feat(react): add native React Compiler support (#1419)
• 9ab698e fix(deps): update all non-major dependencies (#1375)
• 68c0cb8 release: plugin-react@6.0.5 (#1362)
• Additional commits viewable in compare view

Updates @eventuras/markdown from 0.15.0 to 0.15.1

Release notes

Sourced from @​eventuras/markdown's releases.

@​eventuras/markdown@​0.15.1

Patch Changes

• a875a24: Internal engine/renderer split — no API change. MarkdownContent is now a thin binding of a design-system-agnostic engine (src/core/) to a Ratio UI renderer set (src/ratio/), along the semantic MarkdownRenderers contract described in docs/adr/0001-engine-renderer-split.md. Parsing, sanitization, URL policy, and fence extraction live in the engine; renderer sets are plain prop-to-component mappings. A build guard (check-core-imports) keeps src/core/ free of design-system imports so it stays extractable to a standalone package.

• e6adb33: The @eventuras/markdown* family splits into tiers (ADR-0001, PR 2 of the package split):

  • @eventuras/markdown-core (new) — framework-agnostic utilities and remark plugins: normalizeMarkdown, mergeSanitizeSchemas, extractHeadings (with injectable slugify), remarkCallout + calloutSanitizeSchema. No React; unist-util-visit is the only dependency.
  • @eventuras/markdown-react (new) — the React engine extracted from @eventuras/markdown: MarkdownEngine + the MarkdownRenderers slot contract are now public API, so a design-system binding is a plain prop-to-component mapping. Parsing, GFM, the sanitize-last pipeline, URL policy, and fence extraction are owned by the engine. Re-exports the core tier.
  • @eventuras/markdown — unchanged for consumers: same exports, same behavior. It now binds the engine to Ratio UI renderers and re-exports the shared helpers.

• Updated dependencies [e6adb33]

  • @​eventuras/markdown-react@​0.1.0

Changelog

Sourced from @​eventuras/markdown's changelog.

0.15.1

Patch Changes

• a875a24: Internal engine/renderer split — no API change. MarkdownContent is now a thin binding of a design-system-agnostic engine (src/core/) to a Ratio UI renderer set (src/ratio/), along the semantic MarkdownRenderers contract described in docs/adr/0001-engine-renderer-split.md. Parsing, sanitization, URL policy, and fence extraction live in the engine; renderer sets are plain prop-to-component mappings. A build guard (check-core-imports) keeps src/core/ free of design-system imports so it stays extractable to a standalone package.

• e6adb33: The @eventuras/markdown* family splits into tiers (ADR-0001, PR 2 of the package split):

  • @eventuras/markdown-core (new) — framework-agnostic utilities and remark plugins: normalizeMarkdown, mergeSanitizeSchemas, extractHeadings (with injectable slugify), remarkCallout + calloutSanitizeSchema. No React; unist-util-visit is the only dependency.
  • @eventuras/markdown-react (new) — the React engine extracted from @eventuras/markdown: MarkdownEngine + the MarkdownRenderers slot contract are now public API, so a design-system binding is a plain prop-to-component mapping. Parsing, GFM, the sanitize-last pipeline, URL policy, and fence extraction are owned by the engine. Re-exports the core tier.
  • @eventuras/markdown — unchanged for consumers: same exports, same behavior. It now binds the engine to Ratio UI renderers and re-exports the shared helpers.

• Updated dependencies [e6adb33]

  • @​eventuras/markdown-react@​0.1.0

Commits

• be796b1 chore: version packages
• e6adb33 refactor(markdown): extract markdown-core + markdown-react packages — ADR-000...
• 3216ab3 Deps: Bump the npm group across 1 directory with 19 updates
• a875a24 refactor(markdown): split engine from Ratio renderers — ADR-0001 + build guard
• 321f79a Deps: Bump @​testing-library/jest-dom from 6.9.1 to 7.0.0
• 55ed376 Deps: Bump jsdom from 29.1.1 to 30.0.1
• 196b06c Deps: Bump the npm group with 25 updates
• See full diff in compare view

Updates @react-router/dev from 8.3.0 to 8.3.1

Release notes

Sourced from @​react-router/dev's releases.

v8.3.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v831

Changelog

Sourced from @​react-router/dev's changelog.

v8.3.1

Patch Changes

• Bump @remix-run/node-fetch-server dependency (#15447)
• Generate JavaScript entry files at package build time so react-router reveal --no-typescript does not require Prettier at runtime (#15373)
  • Deprecate the --no-typescript flag ahead of its removal in React Router v9
• Updated dependencies:
  • react-router@8.3.1
  • @react-router/node@8.3.1
  • @react-router/serve@8.3.1

Commits

• da2a0f0 Release v8.3.1 (#15368)
• 818fb10 Bump node fetch server dependency (#15447)
• 6638226 Generate JavaScript entries at build time (#15373)
• fc873b0 Use optional catch bindings (#15372)
• 8bc59bc chore: format
• See full diff in compare view

Updates @react-router/node from 8.3.0 to 8.3.1

Release notes

Sourced from @​react-router/node's releases.

v8.3.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v831

Changelog

Sourced from @​react-router/node's changelog.

v8.3.1

Patch Changes

• Bump @remix-run/node-fetch-server dependency (#15447)
• fix: Prevent client disconnects during streaming from crashing the Node process (#15324)
• Updated dependencies:
  • react-router@8.3.1

Commits

• da2a0f0 Release v8.3.1 (#15368)
• 818fb10 Bump node fetch server dependency (#15447)
• 1401852 Prevent streaming disconnects from crashing Node (#15324)
• fc873b0 Use optional catch bindings (#15372)
• See full diff in compare view

Updates isbot from 5.2.1 to 5.2.2

Changelog

Sourced from isbot's changelog.

5.2.2

• Pattern update: reduce size

Commits

• eff2b5a Pattern update: reduce size
• 09506ca adjust procedure for zsh, too
• 06e1827 Does anyone read this? I'll be at the coffee shop accross the street.
• 344052d nothing really
• See full diff in compare view

Updates react-router from 8.3.0 to 8.3.1

Release notes

Sourced from react-router's releases.

v8.3.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v831

Changelog

Sourced from react-router's changelog.

v8.3.1

Patch Changes

• Fix Expected fetcher: <key> error thrown on navigation when a fetcher is aborted during its post-action revalidation (#15365)
• Fix lazy route discovery caching a path as discovered when the triggering navigation was aborted after the manifest response settled but before the route tree was patched, which permanently (for the session) shadowed the real route behind a catch-all or produced 404s on every subsequent visit (#15399)
• Improve route matching performance for long paths (#15417)
• Improve validation of action request origins (#15419)
• Fix <ScrollRestoration> leaving history.scrollRestoration set to "auto" after a bfcache restore, which let the browser restore scroll on subsequent history traversals before the destination route had rendered (#15397)
• Properly respect the relative option in useSubmit/fetcher.submit when resolivng the action path (#15400)
• Add additional URL validation on client side navigations/redirects (#15445)

Commits

• da2a0f0 Release v8.3.1 (#15368)
• 917e6fd fix(fog-of-war): don't cache aborted lazy route discoveries as discovered (#1...
• 2e0bf72 Validate client-side navigation targets (#15445)
• f45d4ca Revert "fix: normalize control characters in relative URLs (#15416)" (#15442)
• c091832 fix: validate schemeful action origins (#15419)
• 308d206 fix: improve matching perf (#15417)
• 36bdbeb fix: normalize control characters in relative URLs (#15416)
• 801e2ae fix(react-router): re-enable manual scroll restoration after a bfcache restor...
• 5e98140 fix: honor the relative option in useSubmit and fetcher.submit (#15400)
• 5843d38 refactor(router): use definite assignment assertions in createDeferred (#15396)
• Additional commits viewable in compare view

Updates @types/react-dom from 19.2.3 to 19.2.5

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions