deps(deps): Bump the patch-and-minor group with 13 updates

[dependabot]

Bumps the patch-and-minor group with 13 updates:

Package	From	To
@anthropic-ai/sdk	0.56.0	0.101.0
yaml	2.8.3	2.9.0
@radix-ui/react-dialog	1.1.15	1.1.16
@radix-ui/react-popover	1.1.15	1.1.16
@radix-ui/react-select	2.2.6	2.3.0
@radix-ui/react-slot	1.2.4	1.2.5
@radix-ui/react-tabs	1.1.13	1.1.14
@radix-ui/react-tooltip	1.2.8	1.2.9
postcss	8.5.10	8.5.15
react	19.2.5	19.2.7
@types/react	19.2.14	19.2.17
react-dom	19.2.5	19.2.7
monaco-editor	0.52.2	0.55.1

Updates @anthropic-ai/sdk from 0.56.0 to 0.101.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.101.0

0.101.0 (2026-06-05)

Full Changelog: sdk-v0.100.1...sdk-v0.101.0

Features

• client: add support for middleware (9b01120)

Bug Fixes

• apply request timeout to inner fetch only, not middleware chain (#40) (25c13f6)
• streaming: carry stop_details through beta message_delta accumulation (ed3fec7)
• streaming: correctly parse json numbers with scientific notation (#9) (7d5e642)

Chores

• internal: fix artifact url (925ec27)
• internal: fix branch names (fa3cf2c)
• internal: update private repo name (a8ac213)

Documentation

• point security reports to Anthropic's HackerOne program (#16) (5c7912c)

sdk: v0.100.1

0.100.1 (2026-05-29)

Full Changelog: sdk-v0.100.0...sdk-v0.100.1

Bug Fixes

• streaming: carry encrypted_content on beta compaction blocks (#1025) (eccddf3)

Chores

• client: update lockfiles to have proper dependencies on standardwebhooks (5e9b523)

sdk: v0.100.0

0.100.0 (2026-05-28)

Full Changelog: sdk-v0.99.0...sdk-v0.100.0

Features

• api: Add support for claude-opus-4-8, mid-conversation system blocks, and usage.output_tokens_details (bb0bf27)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.101.0 (2026-06-05)

Full Changelog: sdk-v0.100.1...sdk-v0.101.0

Features

• client: add support for middleware (9b01120)

Bug Fixes

• apply request timeout to inner fetch only, not middleware chain (#40) (25c13f6)
• streaming: carry stop_details through beta message_delta accumulation (ed3fec7)
• streaming: correctly parse json numbers with scientific notation (#9) (7d5e642)

Chores

• internal: fix artifact url (925ec27)
• internal: fix branch names (fa3cf2c)
• internal: update private repo name (a8ac213)

Documentation

• point security reports to Anthropic's HackerOne program (#16) (5c7912c)

0.100.1 (2026-05-29)

Full Changelog: sdk-v0.100.0...sdk-v0.100.1

Bug Fixes

• streaming: carry encrypted_content on beta compaction blocks (#1025) (eccddf3)

Chores

• client: update lockfiles to have proper dependencies on standardwebhooks (5e9b523)

0.100.0 (2026-05-28)

Full Changelog: sdk-v0.99.0...sdk-v0.100.0

Features

• api: Add support for claude-opus-4-8, mid-conversation system blocks, and usage.output_tokens_details (bb0bf27)

Documentation

... (truncated)

Commits

• 185ec06 chore: release main
• fab8910 codegen metadata
• 7ff4036 fix: apply request timeout to inner fetch only, not middleware chain (#40)
• 257bc1f feat(client): add support for middleware
• 5b3ace5 chore(internal): fix artifact url
• 70966be fix(streaming): correctly parse json numbers with scientific notation (#9)
• 7e22f20 docs: point security reports to Anthropic's HackerOne program (#16)
• e569db5 chore(internal): fix branch names
• 4725328 fix(streaming): carry stop_details through beta message_delta accumulation
• f90eb81 chore(internal): update private repo name
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.

Updates yaml from 2.8.3 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0 (#677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#676)

Commits

• ddb21b0 2.9.0
• 167365b docs: Clarify that not all errors can be avoided
• 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
• 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
• ccdf743 2.8.4
• f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
• e1a1a77 fix: Handle invalid unicode escapes
• a163ea0 style: Satify Prettier
• b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
• 93c951b chore: Bump JSR version to v2.8.3 (#673)
• Additional commits viewable in compare view

Updates @radix-ui/react-dialog from 1.1.15 to 1.1.16

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.1.16

• Fixed disabled pointer events in closed dialogs
• Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-dialog since your current version.

Updates @radix-ui/react-popover from 1.1.15 to 1.1.16

Changelog

Sourced from @​radix-ui/react-popover's changelog.

1.1.16

• Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-popover since your current version.

Updates @radix-ui/react-select from 2.2.6 to 2.3.0

Changelog

Sourced from @​radix-ui/react-select's changelog.

2.3.0

• Added unstable Provider and BubbleInput parts to Select. Select.unstable_Provider sets up Select's context and state without implicitly rendering the hidden native select, and Select.unstable_BubbleInput exposes that previously internal native select so consumers can recompose it explicitly. Select continues to render both by default.
• Added support for presence-based exit animations in Select
• Fixed Select hidden input so it submits empty string when no value is selected
• Fixed placeholder rendering when a controlled Select is reset to an empty value
• Added missing __selectScope prop to PopperContent component
• Fixed Select closing unexpectedly after touch-scrolling its content when rendered inside an open shadow DOM
• Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Fixed SelectValue logging invalid prop errors when used with both asChild and a placeholder
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/react-collection@1.1.9, @radix-ui/react-direction@1.1.2, @radix-ui/number@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-callback-ref@1.1.2, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-use-layout-effect@1.1.2, @radix-ui/react-use-previous@1.1.2, @radix-ui/react-visually-hidden@1.2.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-select since your current version.

Updates @radix-ui/react-slot from 1.2.4 to 1.2.5

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.2.5

• Fixed infinite re-render loop in React 19 caused by Slot creating a new ref callback on every render
• Added support for nested Slottable via a render prop, so a slotted element can be wrapped while still merging Slot props and refs onto it
• Added repository.directory to all package.json files
• Improved error messages for invalid slot children
• Updated dependencies: @radix-ui/react-compose-refs@1.1.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-slot since your current version.

Updates @radix-ui/react-tabs from 1.1.13 to 1.1.14

Changelog

Sourced from @​radix-ui/react-tabs's changelog.

1.1.14

• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-direction@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-roving-focus@1.1.12, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-tabs since your current version.

Updates @radix-ui/react-tooltip from 1.2.8 to 1.2.9

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.2.9

• Fixed runtime error when event target is non-Node
• Fixed a Tooltip bug so that skipDelayDuration={0} works as expected. Previously, the open delay could still be skipped when moving between triggers.
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-visually-hidden@1.2.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-tooltip since your current version.

Updates postcss from 8.5.10 to 8.5.15

Release notes

Sourced from postcss's releases.

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

Changelog

Sourced from postcss's changelog.

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

Commits

• eae46db Release 8.5.15 version
• 79508ff Update CI actions
• b128e21 Speed up declaration parsing by avoiding creating new array on each token
• 9825dca Fix code format
• 55789c8 Update dependencies
• 84fbbe9 Install older pnpm action for old Node.js
• 9f860bd Revert pnpm action for old Node.js
• 0877198 Update CI actions
• b2d1a33 Fix linter warnings
• 0700dac Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
• Additional commits viewable in compare view

Updates react from 19.2.5 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

Commits

• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates @types/react from 19.2.14 to 19.2.17

Commits

• See full diff in compare view

Updates react-dom from 19.2.5 to 19.2.7

Release notes

Sourced from react-dom's releases.

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

Commits

• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.

Updates monaco-editor from 0.52.2 to 0.55.1

Release notes

Sourced from monaco-editor's releases.

v0.55.1

Changes:

• #5121: Fixes missing language exports
• #5122: v0.55.1

This list of changes was auto generated.

v0.55.0

Changes:

• #5120: Fixes npx playwright install --with-deps
• #5118: Fixes microsoft/monaco-editor#5113
• #5117: v0.55.0
• #5116: Install playwright dependencies in monaco-editor-core job
• #5105: Fixes website
• #5104: fixes website & adds editor.api.d.ts
• #5102: Fixes typedoc & updates pipelines to test website
• #5100: Updates website dependencies
• #5071: Bump vite from 5.4.20 to 5.4.21 in /samples/browser-esm-vite-react
• #4961: Bump on-headers and compression in /samples

• #5040: Bump @​babel/runtime from 7.18.9 to 7.28.4 in /website
• #5095: Bump vite from 7.1.9 to 7.1.11 in /samples/browser-esm-vite
• #5097: Cleans up build scripts
• #5098: Dont build the editor when building the website
• #5099: Run tests
• #5094: Adds vite esm example
• #5093: Adds playground support for esmUrl
• #5092: Updates changelog
• #5090: Adds localization section to readme
• #5089: Adds missing NLS files
• #5088: Dont use .js for typescript imports, as rollup adds them to the output
• #5070: Bump vite from 7.1.5 to 7.1.11
• #5069: Bump playwright and @​playwright/test
• #5058: Add monaco-editor-core dependencies to monaco-editor after updating monaco-editor-core.
• #5053: Bump loader-utils from 2.0.2 to 2.0.4 in /website
• #5055: Bump postcss and css-loader in /website
• #5054: Bump json5 from 2.2.1 to 2.2.3 in /website
• #4973: Fix Kotlin number literals
• #4991: Bump vite from 2.9.17 to 5.4.20 in /samples/browser-esm-vite-react
• #5039: Bump webpack from 5.90.1 to 5.102.1 in /website
• #5037: Bump ws in /website
• #5010: [Bug] Multiple issues with how monaco-editor is published
• #5051: Fixes #5010

... (truncated)

Changelog

Sourced from monaco-editor's changelog.

[0.55.1]

• Fixes missing language exports (monaco.json/typescript/...) due to wrong "types" path - #5123

[0.55.0]

Breaking Changes

• Moves nested namespaces (languages.css, languages.html, languages.json, languages.typescript) to top level namespaces (css, html, json, typescript) to simplify the build process and align with typescript recommendations.

New Features

• Adds native LSP support (see new lsp namespace).

Bug Fixes

• Updates dompurify to 3.2.7

[0.54.0]

• Adds option editor.mouseMiddleClickAction
• Various bug fixes

[0.53.0]

• ⚠️ This release deprecates the AMD build and ships with significant changes of the AMD build. The AMD build will still be shipped for a while, but we don't offer support for it anymore. Please migrate to the ESM build.

New Features

• Next Edit Suggestion support.
• Scroll On Middle Click
• Edit Context Support

Breaking Changes

• Internal AMD modules are no longer accessible. Accessing internal AMD modules was never supported. While this is still possible in the ESM build, we don't encourage this usage pattern.
• The browser-script-editor scenario for unbundled synchronous script import and editor creation no longer works. Instead, a the ESM build should be used with a bundler, such as vite or webpack.
• Custom AMD workers don't work anymore out of the box.

[0.52.0]

• Comment added inside of IModelContentChangedEvent

[0.51.0]

• New fields IEditorOptions.placeholder and IEditorOptions.compactMode
• New fields IGotoLocationOptions.multipleTests and IGotoLocationOptions.alternativeTestsCommand
• New field IInlineEditOptions.backgroundColoring
• New experimental field IEditorOptions.experimental.useTrueInlineView
• New options CommentThreadRevealOptions for comments

Contributions to monaco-editor:

... (truncated)

Commits

• 516f350 Fixes missing language exports (#5121)
• 9221aa0 v0.55.1 (#5122)
• d678c1d Merge pull request #5120 from microsoft/hediet/enormous-herring
• f047a08 Fixes npx playwright install --with-deps
• 220c1ca Fixes microsoft/monaco-editor#5113 (#5118)
• 1b175c7 v0.55.0 (#5117)
• 574b846 Install playwright dependencies in monaco-editor-core job (#5116)
• 5486e82 update (#5105)
• e70b661 fixes website & adds editor.api.d.ts (#5104)
• 36efbe0 Fixes typedoc & updates pipelines to test website (#5102)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[akaieuan]

Closing — adjusting dependabot cadence; will revisit via slower-paced PRs.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml