[dependabot]

Bumps the frontend group with 24 updates in the /frontend directory:

Package	From	To
@tailwindcss/vite	4.3.3	4.3.5
@tanstack/react-query	5.101.4	5.107.1
axios	1.18.1	1.21.1
lucide-react	1.26.0	1.72.0
react	19.2.8	19.3.1
@types/react	19.2.17	19.3.0
react-dom	19.2.8	19.3.1
@types/react-dom	19.2.3	19.3.0
react-hook-form	7.82.0	7.92.0
react-hot-toast	2.6.0	2.6.1
react-router-dom	7.18.1	7.18.5
tailwindcss	4.3.3	4.3.5
zod	4.4.3	4.6.7
@babel/core	8.0.6	8.1.2
@rolldown/plugin-babel	0.2.3	0.3.1
@testing-library/user-event	14.6.7	14.6.9
@types/node	24.13.3	24.19.2
@types/react	19.2.17	19.3.0
@types/react-dom	19.2.3	19.3.0
@vitejs/plugin-react	6.0.4	6.3.0
eslint	10.7.0	10.14.0
eslint-plugin-react-refresh	0.5.3	0.5.7
globals	17.7.0	17.14.0
typescript-eslint	8.65.0	8.72.2
vite	8.1.5	8.3.8
vitest	5.0.2	5.1.0

Updates @tailwindcss/vite from 4.3.3 to 4.3.5

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.5

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

v4.3.4

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
• Drop invalid UTF-8 candidates during class detection (#20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
• Improve style invalidation performance of group-* and peer-* variants (#20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)
• Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)
• Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)

... (truncated)

Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.3.5] - 2026-11-06

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

[4.3.4] - 2026-11-02

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
• Drop invalid UTF-8 candidates during class detection (#20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
• Improve style invalidation performance of group-* and peer-* variants (#20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)

... (truncated)

Commits

• 9b2c925 4.3.5 (#20672)
• 2626ae6 4.3.4 (#20447)
• 00ef99d Do not force full page reloads when using @tailwindcss/vite (#20414)
• 50daebd Prevent @tailwindcss/vite crash under Vite's experimental bundledDev (#20...
• See full diff in compare view

Updates @tanstack/react-query from 5.101.4 to 5.107.1

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.107.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.107.1
  • @​tanstack/react-query@​5.107.1

@​tanstack/react-query-next-experimental@​5.107.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.107.1

@​tanstack/react-query-persist-client@​5.107.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.107.1
  • @​tanstack/react-query@​5.107.1

@​tanstack/react-query@​5.107.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.107.1

@​tanstack/react-query-devtools@​5.107.0

Patch Changes

• Updated dependencies [a4d72f7]:
  • @​tanstack/query-devtools@​5.107.0
  • @​tanstack/react-query@​5.107.0

@​tanstack/react-query-next-experimental@​5.107.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.107.0

@​tanstack/react-query-persist-client@​5.107.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.107.0
  • @​tanstack/react-query@​5.107.0

@​tanstack/react-query@​5.107.0

Patch Changes

• Updated dependencies [b6add89]:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.107.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.107.1

5.107.0

Patch Changes

• Updated dependencies [b6add89]:
  • @​tanstack/query-core@​5.107.0

5.106.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.106.1

5.106.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.106.0

5.105.3

Patch Changes

• Updated dependencies [3f4de1b, 969e580]:
  • @​tanstack/query-core@​5.105.3

5.105.2

Patch Changes

• #12230 1e1caa5 - Update the observer options before subscribing so revealing an <Activity> tree whose query key changed while hidden no longer fetches the previous key.

• #12480 8d0dc27 - Exclude status from the filters accepted by QueryClient.isMutating, useIsMutating, and injectIsMutating. These APIs always count mutations with status: 'pending'.

• Updated dependencies [2ee2fd9, 8d0dc27, e69cac6, f2215d2, 86e7957, b6576b3, af0e0ef, 05d9b6a]:

  • @​tanstack/query-core@​5.105.2

5.105.1

Patch Changes

• #11373 7ccba6e - fix({react,preact,angular,solid,vue}-query/infiniteQueryOptions): correct the overload selected for a possibly-undefined 'initialData'

... (truncated)

Commits

• 3875d1d ci: Version Packages (#12543)
• d01e358 ci: Version Packages (#12535)
• 284abac ci: Version Packages (#12526)
• 925168e ci: Version Packages (#12501)
• 7bf1e0f ci: Version Packages (#12498)
• 3f4de1b fix(query-core): skip pausing cancelled retries (#11537)
• d6b2b64 ci: Version Packages (#12476)
• 8d0dc27 fix(query-core): exclude status from mutation count filters (#12480)
• 1e1caa5 fix({react,preact}-query): set the observer options before subscribing (#12230)
• a6be1ce ci: Version Packages (#12391)
• Additional commits viewable in compare view

Updates axios from 1.18.1 to 1.21.1

Release notes

Sourced from axios's releases.

v1.21.1 — November 9, 2026

This release raises the minimum follow-redirects version to fix a published CVE, fixes a Next.js prerendering failure caused by the response duration timer, corrects the getAdapter typings, and includes documentation corrections, new test coverage, CI runner changes and dependency updates.

🔒 Security Fixes

• follow-redirects: Raised the follow-redirects range from ^1.16.0 to ^1.16.2 to fix CVE-2026-116689 (GHSA-mrwp-f3q8-3g9p). In the vulnerable versions, sensitiveHeaders arrays from another realm were ignored and custom credentials could follow redirects. Only the Node.js HTTP adapter is affected, and there are no API changes. (#11410)

🐛 Bug Fixes

• Response Duration: dispatchRequest now measures response.duration with performance.now() and uses Date.now() only when performance.now() isn't available. In v1.21.0, any axios request from a Server Component failed Next.js production builds with Cache Components (cacheComponents: true), because Next.js rejects Date.now() while prerendering. The duration is still a whole number of milliseconds, and system clock changes no longer affect it. (#11411)
• TypeScript: getAdapter now accepts an optional config?: AxiosRequestConfig in index.d.ts and index.d.cts, matching what it does at runtime. You can now call getAdapter('fetch', { env: { fetch: myFetch } }) without a cast. (#11404)

🔧 Maintenance & Chores

• Documentation Corrections: Brought the README and docs site in line with how axios actually behaves:

  • transformRequest runs for every method, and transformers receive (data, headers, status).
  • responseType and Content-Type have no default value.
  • AxiosHeaders#get and #normalize are described correctly.
  • Errors should be identified with axios.isAxiosError(), not by name.
  • The error tables now list ECONNREFUSED and ERR_FORM_DATA_DEPTH_EXCEEDED, and note that FormData parsing has a fixed depth limit that maxDepth doesn't change.
  • New notes cover what redact doesn't scan, which adapters enforce maxContentLength / maxBodyLength, and how formToJSON() handles field name collisions.

  (#11374, #11373, #11389, #11419, #11429, #11430)

• Docs Site: Added a Partners page, a shared card design for sponsors and partners, a Namespace sponsor badge, and a blog whose first post announces HeroDevs Never-Ending Support for Axios v0. Also applied the v1.20.0/v1.21.0 release notes to the docs, and fixed internal links in the es, fr and zh translations so they keep their locale prefix. (#11390, #11399, #11400, #11412, #11401)

• Test Coverage: Added cancellation tests across the HTTP, fetch and XHR adapters. They cover AbortSignal, CancelToken, cancelling while a request interceptor is pending, and timeout precedence. Also added tests for no_proxy edge cases in shouldBypassProxy, such as internationalized domain names, malformed CIDR and IPv4 entries, and port-qualified entries. Neither changes runtime behavior. (#11376, #11431)

• CI: GitHub Actions jobs now run on Namespace runners. The npm publish job stays on GitHub-hosted runners, because npm provenance and trusted publishing (OIDC) only work there. (#11396)

• Dependencies: Updated development and tooling dependencies, including vitest and @vitest/* (to 5.x at the root), typescript (7.x at the root), vite, rollup, eslint, playwright, @commitlint/*, @rollup/plugin-alias, @rollup/plugin-terser, body-parser, multer, serialize-javascript, fast-uri, qs, zizmorcore/zizmor-action, and follow-redirects in /docs. (#11383, #11375, #11372, #11345, #11392, #11387, #11386, #11385, #11391, #11388, #11395, #11421, #11422, #11426)

• Release: Prepared the 1.21.1 release. (#11435)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​Ghoscro (#11374)
• @​pei711 (#11373)
• @​ivanhapaz (#11399)
• @​aelmanaa (#11404)
• @​Aryapatel-007 (#11429, #11430)
• @​umair-ghafoor-ai (#11376)
• @​yxshee (#11389)
• @​malinele (#11401)
• @​AnantDuhan (#11431)

Full Changelog

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

• Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

• Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
• UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

• Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
• Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
• Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
• URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
• Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
• Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
• Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
• XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
• HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
• TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

• Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
• Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
• Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
• Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
• Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
• Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
• Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
• Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

• @​lazerg (#11194)
• @​QIU-Guanzong (#11228)
• @​Iams4kura (#11125)
• @​vjymisal0 (#11179)
• @​jarrensj (#11238)
• @​LineGu (#11132)
• @​luantaraschi (#11134)

... (truncated)

Commits

• 335e2f8 chore(release): prepare release 1.21.1 (#11435)
• c07e981 docs: note that FormData parsing has a fixed depth limit (#11430)
• f0fcec7 test(helpers): cover IDN, CIDR and port edge cases in shouldBypassProxy (#11431)
• 4f203a9 docs(i18n): add locale prefix to internal links in es, fr, zh docs (#11401)
• 98156ee docs: correct request config and AxiosHeaders descriptions (#11389)
• a81d62a test: cover cancellation lifecycle and timeout precedence (#11376)
• a42a19a docs: add missing error codes to the error tables (#11429)
• 1fcaf82 chore(deps-dev): refresh development dependencies (#11426)
• fb88a1b chore(deps-dev): bump the development_dependencies group with 4 updates (#11422)
• 31cc02a chore(deps): bump zizmorcore/zizmor-action from 0.7.1 to 0.8.0 in the github-...
• Additional commits viewable in compare view

Updates lucide-react from 1.26.0 to 1.72.0

Release notes

Sourced from lucide-react's releases.

Version 1.72.0

What's Changed

• feat(site): add keyboard shortcuts to the icons page by @​PrimeTestLab in lucide-icons/lucide#5035
• feat(icons): added mound-shovel icon by @​jwlinqx in lucide-icons/lucide#4329
• feat(icons): added text-pen icon by @​rrod497 in lucide-icons/lucide#4937
• feat(icons): flipped route icon, added route-arrow-right icon by @​samuelalake in lucide-icons/lucide#4729
• chore(metadata): improve tags for common no-result searches by @​ericfennis in lucide-icons/lucide#5187
• feat(icons): added exclamation-mark, question-mark icons by @​karsa-mistmere in lucide-icons/lucide#5184
• feat(site): polish the copy confetti on the icons page by @​PrimeTestLab in lucide-icons/lucide#5191
• feat(icons): added asterism icon by @​KesleyDavid in lucide-icons/lucide#4687

Full Changelog: lucide-icons/lucide@1.71.0...1.72.0

Version 1.71.0

What's Changed

• chore(site): Add support for reduced motion in HomeHeroAnimation by @​ericfennis in lucide-icons/lucide#5159
• fix(scripts): Fixes generateNextJSAliases.mts on commit hook by @​ericfennis in lucide-icons/lucide#5167
• fix(docs): removed docs/guide/comparison.md by @​karsa-mistmere in lucide-icons/lucide#5182
• feat(icons): added stroke-line-cap-butt, stroke-line-cap-round, stroke-line-cap-square and 3 more icons by @​rrod497 in lucide-icons/lucide#4171
• feat(icons): added square-arrow-down-enter, square-arrow-down-exit, square-arrow-down-left-enter and 7 more icons by @​6TELOIV in lucide-icons/lucide#3644
• feat(icons): added cheese icon by @​karsa-mistmere in Description has been truncated