[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@aws-sdk/client-s3 (source)	3.1159.0 → 3.1168.0
@aws-sdk/s3-request-presigner (source)	3.1159.0 → 3.1168.0
@next/bundle-analyzer (source)	16.4.3 → 16.4.6
@playwright/test (source)	1.64.1 → 1.65.0
@smithy/node-http-handler (source)	4.13.0 → 4.14.2
@supabase/realtime-js (source)	2.118.0 → 2.119.0
@tailwindcss/postcss (source)	4.3.3 → 4.3.5
@tailwindcss/typography>postcss-selector-parser	6.1.5 → 6.1.6
@vitejs/plugin-react (source)	6.1.2 → 6.3.0
@vitest/coverage-v8 (source)	5.0.5 → 5.1.0
axios (source)	1.21.0 → 1.21.1
motion	14.7.1 → 14.14.0
pnpm (source)	10.21.0 → 10.34.9
prettier (source)	3.9.10 → 3.10.1
react-dropzone	20.1.4 → 20.2.0
react-hook-form (source)	7.91.0 → 7.92.0
tailwindcss (source)	4.3.3 → 4.3.5
typescript-eslint (source)	8.72.1 → 8.72.2
vite (source)	8.3.5 → 8.3.8
vitest (source)	5.0.5 → 5.1.0

---

Release Notes

aws/aws-sdk-js-v3 (@​aws-sdk/client-s3)

v3.1168.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1167.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1166.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1165.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1164.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1163.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1162.0

Compare Source

Bug Fixes

• codegen: drop redundant alias from node:stream Readable type import (#​8402) (4e5ce5a)

v3.1161.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1160.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

aws/aws-sdk-js-v3 (@​aws-sdk/s3-request-presigner)

v3.1168.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1167.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1166.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1165.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1164.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1163.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1162.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1161.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1160.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

vercel/next.js (@​next/bundle-analyzer)

v16.4.6

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Pin Tailwind to 4.3.3 in create-next-app and tests (#​101061, #​101176) (#​101307)
• [lts-active] Automatically compress route handler responses if not already compressed (#​101280)
• [lts-active] Turbopack GC fixes for dev (#​100279, #​100370) (#​101308)

Credits

Huge thanks to @​lukesandberg and @​eps1lon for helping!

v16.4.5

Compare Source

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#​100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#​100619)
• [lts-active] Revert "Optimize strict module factory chunks (#​98421)" (#​100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#​100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#​100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#​100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#​100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

microsoft/playwright (@​playwright/test)

v1.65.0

Compare Source

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

• There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
• Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
• Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
• Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  reporter: [
    ['failures'],
    ['html', { onlyFailures: true }],
  ],
});

🎯 Test runner

• New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

  test('restart the server', { lock: '-exclusive-' }, async () => {
    // No other test runs while this one is running.
  });

• test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

  test('upload a file', async ({ page }) => {
    test.skip('Not implemented yet');
  });

• New PLAYWRIGHT_TRANSFORM_CACHE_DIR environment variable sets the directory for transpiled test files, for example on a Linux machine shared with other users.

New APIs

• New options timeout and signal in cdpSession.send().
• New testRun.mode() returns the execution mode of a suite during reporter.preprocess().

Notable Changes ⚠️

• TypeScript class fields now follow useDefineForClassFields from your tsconfig.json, the same as tsc. It is enabled for ES2022 and later targets, and when target is not specified. A field initializer that reads a constructor parameter property now fails, because the initializer runs first:

  class LoginPage {
    // TypeError: Cannot read properties of undefined (reading 'getByRole')
    readonly submit = this.page.getByRole('button', { name: 'Submit' });
  
    constructor(private readonly page: Page) {}
  }

  Move the initialization to the constructor, or set "useDefineForClassFields": false in your tsconfig.json.

• Actions such as locator.click(), locator.check(), locator.tap(), locator.fill(), locator.clear() and locator.selectOption() now wait for the element to be not inert. An action on an element with the inert attribute, or inside such an element, now times out if the element stays inert.

• A sharded run now fails with "No tests found" when no tests match across all shards. Pass --pass-with-no-tests to allow this. An empty shard still passes when other shards have tests.

• Cookie matching now follows RFC 6265. With a URL, browserContext.cookies() and apiRequestContext.cookies() no longer return host-only cookies for subdomains or Path=/api cookies for /apiv2, and a Path=/foo/ cookie does not match /foo. APIRequestContext sends a cookie without a name as Cookie: x instead of Cookie: =x, and stores Set-Cookie: token as a cookie without a name.

• Proxy credentials are no longer sent to websites. The credentials in the proxy option now answer only proxy challenges. To authenticate on a website, use httpCredentials.

• Text that the browser does not render, such as text that is not assigned to a slot or text directly inside a closed <details>, is no longer part of accessible names and aria snapshots. This can change the results of page.getByRole() with a name, locator.ariaSnapshot() and expect(locator).toMatchAriaSnapshot().

• String and URLSearchParams values of the params option in APIRequestContext requests are now appended to the query that the URL already has, instead of replacing it.

• .css, .less and .scss imports in test files now load as empty modules instead of being removed, so the imported file must exist.

• The blob reporter again deletes the content of its output directory before it writes the report. Playwright 1.64 kept reports with other names.

• Test locations of imported calls such as test( in CommonJS output now point to the start of the callee, for example a.spec.ts:3:7 instead of a.spec.ts:3:11. This is the same as in ESM.

Announcements

• ⚠️ Playwright no longer tests on Node.js 20. Use Node.js 22, 24 or 26, as listed in the system requirements.
• 🐳 Docker images now include Node.js 26 instead of Node.js 24, and the latest patch of Chromium on the same branch.

Browser Versions

• Chromium 158.0.8127.18
• Mozilla Firefox 159.0
• WebKit 27.2

This version was also tested against the following stable channels:

• Google Chrome 157
• Microsoft Edge 156

smithy-lang/smithy-typescript (@​smithy/node-http-handler)

v4.14.2

Compare Source

Patch Changes

• 27bdf42: Keep configured and service-default socket idle timeouts armed through response bodies, so a body that stalls after fast headers fails with TimeoutError instead of hanging. Both register the full idle window on the connected socket. Timeouts of 6000 ms or more keep the 3000 ms registration deferral, which is no longer cancelled on headers, so they may fire up to 3000 ms late. For a complete body, close the socket and leave the buffered body readable.

  Socket inactivity includes caller pauses while reading an incomplete body, so consumer backpressure can still trigger socketTimeout.

• Updated dependencies [d5e8c96]

  • @​smithy/core@3.39.0
  • @​smithy/types@4.20.0

v4.14.1

Compare Source

Patch Changes

• fe13e99: Create one http.Agent for concurrent first requests so destroy() closes every socket.
• Updated dependencies [6871574]
  • @​smithy/core@3.38.1

v4.14.0

Compare Source

Minor Changes

• 6f250ec: Let clients offer a service default idle timeout to the request handler through updateHttpClientConfig, taken only when the handler has none of its own.

Patch Changes

• Updated dependencies [6f250ec]
• Updated dependencies [0f58fed]
  • @​smithy/core@3.38.0

supabase/supabase-js (@​supabase/realtime-js)

v2.119.0

Compare Source

🚀 Features

• realtime: broadcast persistence (#​2690)

🩹 Fixes

• realtime: include vsn in the unsupported serializer error (#​2812)

❤️ Thank You

• Claude Opus 5.5
• Guilherme Souza
• Leandro Pereira @​leandrocp
• Rami Hersonsky @​ramiscaleai

tailwindlabs/tailwindcss (@​tailwindcss/postcss)

v4.3.5

Compare Source

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#​20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#​20658, #​20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#​20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#​20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#​20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#​20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#​20632)

v4.3.4

Compare Source

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#​20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#​20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#​20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#​20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#​20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#​20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#​20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#​20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#​20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#​20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#​20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#​20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#​20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#​20408)
• Drop invalid UTF-8 candidates during class detection (#​20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#​20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#​20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#​20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#​20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#​20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#​20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#​20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#​20508)
• Improve style invalidation performance of group-* and peer-* variants (#​20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#​20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#​20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#​20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#​20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#​20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#​20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#​20516)
• Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#​20561)
• Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#​20547, #​20572)
• Underline the correct occurrence of an unsupported data type in --value(…) warnings (#​20554)
• Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#​20540)
• Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#​20574)
• Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#​20576)
• Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#​20575)
• Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#​20577)
• Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#​20558)
• Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#​20486)
• Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#​20578)
• Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#​20582)
• Canonicalization: don't drop a utility that sets a --tw-* variable when an unrelated property has the same value (e.g. link mt-4 no longer becomes mt-4 when link sets margin-top: 16px and --tw-translate-x: 16px) (#​20593)
• Decode single-digit hexadecimal escapes in theme variable and @utility names as the CSS spec does (e.g. @theme { --color-\0: red; } no longer registers --color-0) (#​20591)
• Don't treat !important inside strings, comments or url() in declaration values as the important flag (e.g. content: "a !important b") (#​20627)
• Parse a custom property at the end of the input when it has no trailing ; (e.g. --foo: bar as the last declaration) (#​20653)
• Keep a declaration without a ; at the end of the CSS input (e.g. color: red) (#​20655)

postcss/postcss-selector-parser (@​tailwindcss/typography>postcss-selector-parser)

v6.1.6

Compare Source

• fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (reported by @​zachariah-mithani)
• chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.3.0

Compare Source

Make reactCompilerPreset work with @rolldown/plugin-babel's parallel option (#​1549)

reactCompilerPreset now refers to its Babel preset by module path instead of by function, so it can be sent to worker threads.

v6.2.1

Compare Source

Fix refreshInclude and refreshExclude options not working (#​1543)

Fix mistake from #​1516

v6.2.0

Compare Source

Add refreshInclude and refreshExclude options (#​1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#​1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#​1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

vitest-dev/vitest (@​vitest/coverage-v8)

v5.1.0

Compare Source

   🚀 Features

• Add --last-failed to run only failed tests  -  by @​sheremet-va in #​11558 (82f63)
• Support Temporal.Instant and Temporal.ZonedDateTime in vi.setSystemTime()  -  by @​Prajwal2246, Prajwal2246, Claude Opus 5.5 (1M context), @​hi-ogawa and Codex (GPT-6) in #​11321 (f150f)
• Introduce --since-last-run flag  -  by @​sheremet-va in #​11516 [(08bd9)](

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 4am on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
programming-in-th	Error			Sep 27, 2025 8:24pm

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	7.42%	762 / 10257
🔵	Statements	7.42%	762 / 10257
🔵	Functions	53.39%	118 / 221
🔵	Branches	62.06%	234 / 377

File Coverage

No changed files found.

Generated in workflow #2939 for commit 24ed473 by the Vitest Coverage Report Action

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6ce9c9b3-9175-4cea-89e3-ad2b770e9712

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Progress: resolved 1, reused 0, downloaded 0, added 0
 ERR_PNPM_NO_MATURE_MATCHING_VERSION  Version 3.10.1 (released 33 hours ago) of prettier does not meet the minimumReleaseAge constraint

This error happened while installing a direct dependency of /tmp/renovate/repos/github/programming-in-th/programming.in.th

The latest release of prettier is "3.10.1". Published at 11/12/2026

Other releases are:
  * next: 4.0.0-alpha.13 published at 11/18/2025

If you need the full list of all 201 published versions run "pnpm view prettier versions".

If you want to install the matched version ignoring the time it was published, you can add the package name to the minimumReleaseAgeExclude setting. Read more about it: https://pnpm.io/settings#minimumreleaseageexclude