[dependabot]

Bumps the web-dependencies group with 85 updates in the /web directory:

Package	From	To
@atproto/api	0.18.3	0.29.1
@atproto/common-web	0.4.9	0.5.15
@atproto/lexicon	0.5.2	0.7.17
@atproto/oauth-client-browser	0.3.42	0.5.10
@grafana/faro-react	2.2.0	2.13.0
@grafana/faro-web-sdk	2.2.0	2.13.0
@grafana/faro-web-tracing	2.2.0	2.13.0
@opentelemetry/api	1.9.0	1.10.0
@opentelemetry/instrumentation-document-load	0.56.0	0.69.0
@opentelemetry/instrumentation-fetch	0.211.0	0.300.0
@opentelemetry/instrumentation-user-interaction	0.55.0	0.68.0
@opentelemetry/sdk-trace-web	2.5.0	2.12.0
@radix-ui/react-accordion	1.2.12	1.3.1
@radix-ui/react-alert-dialog	1.1.15	1.2.1
@radix-ui/react-avatar	1.1.11	1.3.1
@radix-ui/react-checkbox	1.3.3	1.4.1
@radix-ui/react-collapsible	1.1.12	1.2.1
@radix-ui/react-dialog	1.1.15	1.3.1
@radix-ui/react-dropdown-menu	2.1.16	2.2.1
@radix-ui/react-label	2.1.8	2.1.17
@radix-ui/react-navigation-menu	1.2.14	1.4.1
@radix-ui/react-popover	1.1.15	1.3.1
@radix-ui/react-progress	1.1.8	1.2.1
@radix-ui/react-radio-group	1.3.8	1.5.1
@radix-ui/react-scroll-area	1.2.10	1.4.0
@radix-ui/react-select	2.2.6	2.4.1
@radix-ui/react-separator	1.1.8	1.2.0
@radix-ui/react-slider	1.3.6	1.6.1
@radix-ui/react-slot	1.2.4	1.5.0
@radix-ui/react-switch	1.2.6	1.4.1
@radix-ui/react-tabs	1.1.13	1.2.1
@radix-ui/react-toast	1.2.15	1.3.1
@radix-ui/react-toggle	1.1.10	1.2.1
@radix-ui/react-tooltip	1.2.8	1.4.1
@tanstack/react-query	5.90.12	5.104.5
@tanstack/react-query-devtools	5.91.1	5.104.5
@tiptap/core	3.17.1	3.32.0
@tiptap/extension-blockquote	3.17.1	3.32.0
@tiptap/extension-bold	3.17.1	3.32.0
@tiptap/extension-bullet-list	3.17.1	3.32.0
@tiptap/extension-code	3.17.1	3.32.0
@tiptap/extension-code-block	3.17.1	3.32.0
@tiptap/extension-code-block-lowlight	3.17.1	3.32.0
@tiptap/extension-document	3.17.1	3.32.0
@tiptap/extension-heading	3.17.1	3.32.0
@tiptap/extension-history	3.17.1	3.32.0
@tiptap/extension-italic	3.17.1	3.32.0
@tiptap/extension-link	3.17.1	3.32.0
@tiptap/extension-list	3.17.1	3.32.0
@tiptap/extension-mention	3.17.1	3.32.0
@tiptap/extension-ordered-list	3.17.1	3.32.0
@tiptap/extension-paragraph	3.17.1	3.32.0
@tiptap/extension-placeholder	3.17.1	3.32.0
@tiptap/extension-strike	3.17.1	3.32.0
@tiptap/extension-text	3.17.1	3.32.0
@tiptap/markdown	3.17.1	3.32.0
@tiptap/pm	3.17.1	3.32.0
@tiptap/react	3.17.1	3.32.0
@tiptap/starter-kit	3.17.1	3.32.0
@tiptap/suggestion	3.17.1	3.32.0
@uiw/react-markdown-preview	5.1.5	5.2.1
@uiw/react-md-editor	4.0.11	4.1.3
@vercel/otel	2.1.0	2.1.3
@xyflow/react	12.10.0	12.12.0
date-fns	4.1.0	4.4.0
dompurify	3.3.1	3.4.17
geist	1.5.1	1.8.2
highlight.js	11.11.1	11.12.0
katex	0.16.28	0.19.0
openapi-fetch	0.13.8	0.17.0
react-hook-form	7.68.0	7.90.0
recharts	3.7.0	3.10.1
use-debounce	10.0.6	10.1.1
zod	4.1.13	4.6.7
@eslint/eslintrc	3.3.3	3.3.7
@playwright/experimental-ct-react	1.57.0	1.62.1
@playwright/test	1.57.0	1.64.1
@storybook/test	8.6.14	8.6.15
@tailwindcss/typography	0.5.19	0.5.20
@testing-library/react	16.3.0	16.3.3
@testing-library/user-event	14.6.1	14.6.8
@types/hast	3.0.4	3.0.5
autoprefixer	10.4.22	10.6.1
openapi-typescript-helpers	0.0.15	0.1.0
postcss	8.5.6	8.5.31

Updates @atproto/api from 0.18.3 to 0.29.1

Release notes

Sourced from @​atproto/api's releases.

@​atproto/api@​0.29.1

Patch Changes

• #5700 53d307b Thanks @​gcwill70! - Add strict access flag to report queues. Non-admin users will only be able to access strict queues and their reports if they are assigned to them.

  Allow filtering SafeLink rules by exact source in queryRules, combining with existing filters and pagination.

@​atproto/api@​0.29.0

Minor Changes

• #5662 a2840e2 Thanks @​foysalit! - Expose client-supplied expiry on strike reversals and preserve supplied expiry when executing scheduled takedowns. Strike amounts and expiry policy remain client-controlled.

Patch Changes

• #5693 1a99766 Thanks @​gcwill70! - Route reports using reporter and reported-account tags. Record automated notes with the matched tag values.

@​atproto/api@​0.28.1

Patch Changes

• #5686 58f14d6 Thanks @​gcwill70! - Add source-aware SafeLink rule synchronization and return rule sources in the API.

@​atproto/api@​0.28.0

Minor Changes

• #5675 95a4cd5 Thanks @​estrattonbailey! - Update Atmosphere Explore recommendations and curated content selection:

  • Breaking: app.bsky.unspecced.getAtmosphereExploreTab returns articles, publications, photos, and livestreams as { items, recIdStr? } section objects instead of arrays.
  • Add the app.bsky.unspecced.getAtmosphereExploreArticleRecommendations skeleton lexicon and source articles from Iris behind the atmosphere_explore:articles:iris:enable gate, returning the recommendation ID on articles.recIdStr. If the Iris request fails or returns a malformed response, fall back to worker-curated articles without a recommendation ID. With the gate off, retain worker-curated articles.
  • Select curated content by location and request topics, prioritize active featured windows, and cap each curated section at 10 groups before hydrating each group's canonicalUri. Every list, including apps, returns at most 10 items, Iris is asked for 10 articles, and each selected list is shuffled with featured items first.
  • Skip malformed worker banners, content entries, and app cards instead of failing the request, keeping valid items and sections.
  • Select a single active announcement banner by location, falling back to the untargeted banner with the latest expiration.

Patch Changes

• #5672 5816c4f Thanks @​gcwill70! - Expose complete lifecycle counts and duration metrics in queue statistics.

Changelog

Sourced from @​atproto/api's changelog.

0.29.1

Patch Changes

• #5700 53d307b Thanks @​gcwill70! - Add strict access flag to report queues. Non-admin users will only be able to access strict queues and their reports if they are assigned to them.

  Allow filtering SafeLink rules by exact source in queryRules, combining with existing filters and pagination.

0.29.0

Minor Changes

• #5662 a2840e2 Thanks @​foysalit! - Expose client-supplied expiry on strike reversals and preserve supplied expiry when executing scheduled takedowns. Strike amounts and expiry policy remain client-controlled.

Patch Changes

• #5693 1a99766 Thanks @​gcwill70! - Route reports using reporter and reported-account tags. Record automated notes with the matched tag values.

0.28.1

Patch Changes

• #5686 58f14d6 Thanks @​gcwill70! - Add source-aware SafeLink rule synchronization and return rule sources in the API.

0.28.0

Minor Changes

• #5675 95a4cd5 Thanks @​estrattonbailey! - Update Atmosphere Explore recommendations and curated content selection:

  • Breaking: app.bsky.unspecced.getAtmosphereExploreTab returns articles, publications, photos, and livestreams as { items, recIdStr? } section objects instead of arrays.
  • Add the app.bsky.unspecced.getAtmosphereExploreArticleRecommendations skeleton lexicon and source articles from Iris behind the atmosphere_explore:articles:iris:enable gate, returning the recommendation ID on articles.recIdStr. If the Iris request fails or returns a malformed response, fall back to worker-curated articles without a recommendation ID. With the gate off, retain worker-curated articles.
  • Select curated content by location and request topics, prioritize active featured windows, and cap each curated section at 10 groups before hydrating each group's canonicalUri. Every list, including apps, returns at most 10 items, Iris is asked for 10 articles, and each selected list is shuffled with featured items first.
  • Skip malformed worker banners, content entries, and app cards instead of failing the request, keeping valid items and sections.
  • Select a single active announcement banner by location, falling back to the untargeted banner with the latest expiration.

Patch Changes

• #5672 5816c4f Thanks @​gcwill70! - Expose complete lifecycle counts and duration metrics in queue statistics.

0.27.1

Patch Changes

• #5591 f98b78a Thanks @​matthieusieben! - Source Lexicons through each package's own lexicons.json manifest instead of compiling the repo-root lexicons directory directly. Canonical com.atproto.* / tools.ozone.* schemas are symlinked from the root, app.bsky.* / chat.bsky.* are fetched from the bluesky-social/bsky Github repo, other external namespaces resolve from the network, and locally diverging documents are kept under a tracked lexicons-overrides directory. The root lexicons directory now only holds the canonical com.atproto and tools.ozone namespaces. No change to generated output or published API.

• #5656 388dac9 Thanks @​mozzius! - Name the parent of a subscribed post that is a reply in grouped notifications, and return its view in relatedViews, as for reply, quote and mention notifications.

• Updated dependencies [f98b78a]:

... (truncated)

Commits

• 3b6c48d Version packages (#5699)
• 53d307b ozone: add strict access flag to report queues (#5700)
• 3ce35ef Version packages (#5689)
• 1a99766 ozone: queue tag matching (#5693)
• a2840e2 ozone: Preserve client-supplied strike expiry on reversals and scheduled take...
• ccd16f2 Version packages (#5682)
• 58f14d6 ozone: support multiple safelink sources (#5686)
• f8c83c4 Version packages (#5668)
• 95a4cd5 🌎 Integrate algorithmic article recommendations (#5675)
• 5816c4f ozone/fix: add stats to queue view (#5672)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​atproto/api since your current version.

Updates @atproto/common-web from 0.4.9 to 0.5.15

Release notes

Sourced from @​atproto/common-web's releases.

@​atproto/oauth-scopes@​0.5.14

Patch Changes

• Updated dependencies [f98b78a]:
  • @​atproto/syntax@​0.7.7

@​atproto/oauth-client-node@​0.5.12

Patch Changes

• Updated dependencies []:
  • @​atproto-labs/handle-resolver-node@​0.2.14

@​atproto/oauth-client-node@​0.5.11

Patch Changes

• Updated dependencies []:
  • @​atproto-labs/handle-resolver-node@​0.2.13

@​atproto/oauth-client-browser@​0.5.10

Patch Changes

• Updated dependencies []:
  • @​atproto-labs/did-resolver@​0.3.11
  • @​atproto/oauth-client@​0.8.10

@​atproto/oauth-client-node@​0.5.10

Patch Changes

• Updated dependencies []:
  • @​atproto-labs/did-resolver@​0.3.11
  • @​atproto/oauth-client@​0.8.10
  • @​atproto-labs/handle-resolver-node@​0.2.12

@​atproto/lexicon-resolver@​0.4.28

Patch Changes

• Updated dependencies [0e60f3f]:
  • @​atproto-labs/fetch-node@​0.4.3
  • @​atproto/identity@​0.5.20
  • @​atproto/lex@​0.4.2

@​atproto/lexicon-resolver@​0.4.27

Patch Changes

• Updated dependencies [8eac4b0]:
  • @​atproto/identity@​0.5.19

@​atproto/lexicon-resolver@​0.4.26

Patch Changes

... (truncated)

Changelog

Sourced from @​atproto/common-web's changelog.

0.5.15

Patch Changes

• Updated dependencies [f98b78a]:
  • @​atproto/syntax@​0.7.7

0.5.14

Patch Changes

• Updated dependencies [e8b89ff]:
  • @​atproto/lex-data@​0.1.8
  • @​atproto/lex-json@​0.1.7

0.5.13

Patch Changes

• #5556 5019f55 Thanks @​dependabot! - build(deps-dev): bump the dev-dependencies group across 1 directory with 25 updates

0.5.12

Patch Changes

• #5488 fe4087e Thanks @​dependabot! - Bump the dev-dependencies group across 1 directory with 30 updates

0.5.11

Patch Changes

• Updated dependencies [ed0b7d3]:
  • @​atproto/syntax@​0.7.6

0.5.10

Patch Changes

• Updated dependencies [6af9f14]:
  • @​atproto/syntax@​0.7.5

0.5.9

Patch Changes

• Updated dependencies [8b55a4a]:
  • @​atproto/syntax@​0.7.4

0.5.8

... (truncated)

Commits

• ac1ec3a Version packages (#5654)
• a7c8604 Version packages (#5566)
• ee49be8 Version packages (#5554)
• 5019f55 build(deps-dev): bump the dev-dependencies group across 1 directory with 25 u...
• 2e1787c Add tsconfig covering util config files (#5494)
• 1f2604f Version packages (#5490)
• fe4087e Bump the dev-dependencies group across 1 directory with 30 updates (#5488)
• 96c8438 Version packages (#5452)
• 4d2097f Version packages (#5405)
• c7f39c5 NPM dependencies cleanup (#5371)
• Additional commits viewable in compare view

Updates @atproto/lexicon from 0.5.2 to 0.7.17

Release notes

Sourced from @​atproto/lexicon's releases.

@​atproto/lexicon@​0.7.17

Patch Changes

• Updated dependencies [f98b78a]:
  • @​atproto/syntax@​0.7.7
  • @​atproto/common-web@​0.5.15

Changelog

Sourced from @​atproto/lexicon's changelog.

0.7.17

Patch Changes

• Updated dependencies [f98b78a]:
  • @​atproto/syntax@​0.7.7
  • @​atproto/common-web@​0.5.15

0.7.16

Patch Changes

• #5582 e8b89ff Thanks @​haileyok! - Reject CID strings longer than 128 characters before decoding them.
• Updated dependencies []:
  • @​atproto/common-web@​0.5.14

0.7.15

Patch Changes

• #5556 5019f55 Thanks @​dependabot! - build(deps-dev): bump the dev-dependencies group across 1 directory with 25 updates
• Updated dependencies [5019f55]:
  • @​atproto/common-web@​0.5.13

0.7.14

Patch Changes

• #5488 fe4087e Thanks @​dependabot! - Bump the dev-dependencies group across 1 directory with 30 updates

• Updated dependencies [fe4087e]:

  • @​atproto/common-web@​0.5.12

0.7.13

Patch Changes

• Updated dependencies [ed0b7d3]:
  • @​atproto/syntax@​0.7.6
  • @​atproto/common-web@​0.5.11

0.7.12

Patch Changes

• Updated dependencies [6af9f14]:
  • @​atproto/syntax@​0.7.5
  • @​atproto/common-web@​0.5.10

0.7.11

... (truncated)

Commits

• ac1ec3a Version packages (#5654)
• a7c8604 Version packages (#5566)
• e8b89ff Reject CID strings longer than 128 characters (#5582)
• ee49be8 Version packages (#5554)
• 5019f55 build(deps-dev): bump the dev-dependencies group across 1 directory with 25 u...
• 2e1787c Add tsconfig covering util config files (#5494)
• 1f2604f Version packages (#5490)
• fe4087e Bump the dev-dependencies group across 1 directory with 30 updates (#5488)
• 96c8438 Version packages (#5452)
• 4d2097f Version packages (#5405)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​atproto/lexicon since your current version.

Updates @atproto/oauth-client-browser from 0.3.42 to 0.5.10

Release notes

Sourced from @​atproto/oauth-client-browser's releases.

@​atproto/oauth-client-browser@​0.5.10

Patch Changes

• Updated dependencies []:
  • @​atproto-labs/did-resolver@​0.3.11
  • @​atproto/oauth-client@​0.8.10

Changelog

Sourced from @​atproto/oauth-client-browser's changelog.

0.5.10

Patch Changes

• Updated dependencies []:
  • @​atproto-labs/did-resolver@​0.3.11
  • @​atproto/oauth-client@​0.8.10

0.5.9

Patch Changes

• Updated dependencies []:
  • @​atproto/oauth-client@​0.8.9

0.5.8

Patch Changes

• Updated dependencies [5019f55]:
  • @​atproto/did@​0.5.6
  • @​atproto-labs/did-resolver@​0.3.10
  • @​atproto-labs/handle-resolver@​0.4.10
  • @​atproto/oauth-client@​0.8.8
  • @​atproto/oauth-types@​0.7.7

0.5.7

Patch Changes

• Updated dependencies []:
  • @​atproto-labs/did-resolver@​0.3.9
  • @​atproto/oauth-client@​0.8.7

0.5.6

Patch Changes

• Updated dependencies [fe4087e]:
  • @​atproto/did@​0.5.5
  • @​atproto-labs/did-resolver@​0.3.8
  • @​atproto-labs/handle-resolver@​0.4.9
  • @​atproto/oauth-client@​0.8.6
  • @​atproto/oauth-types@​0.7.6

0.5.5

Patch Changes

• Updated dependencies []:

... (truncated)

Commits

• ac1ec3a Version packages (#5654)
• a7c8604 Version packages (#5566)
• ee49be8 Version packages (#5554)
• 7ca16cc Version packages (#5505)
• 1f2604f Version packages (#5490)
• 96c8438 Version packages (#5452)
• 4d2097f Version packages (#5405)
• c7f39c5 NPM dependencies cleanup (#5371)
• 07f4e3e Version packages (#5307)
• 5043c7a Adopt TypeScript 7 stable and tune editor/lint config (#5306)
• Additional commits viewable in compare view

Updates @grafana/faro-react from 2.2.0 to 2.13.0

Release notes

Sourced from @​grafana/faro-react's releases.

v2.13.0

2.13.0 (2026-10-22)

Features

• web-sdk: report rage, dead and error clicks (#2314) (9382a99)

Bug Fixes

• allow frontend owners to approve release package metadata (#2333) (b519200)
• deps: update npm-dependencies (#2322) (0ba0597)
• replay: disable unsupported canvas recording (#2317) (bd9099c)
• session: adopt rotated sessions in same-origin iframes (#2286) (4697c87)
• transport-otlp-http: serialize all measurement values as OTLP attributes (#2288) (94a5aeb)
• web-sdk: report zero TLS time for non-secure resources (#2308) (2540176)
• web-tracing: enforce a single tracing owner across Faro instances (#2178) (b71cd77)

v2.12.1

2.12.1 (2026-09-22)

Bug Fixes

• deps: update npm-dependencies (#2232) (8cd1f9e)
• security: pin pacote to 21.5.1 (CVE-2026-9496) (#2296) (1b6fc3c)
• session: preserve sampling state on metadata updates (#2301) (389cf09)
• web-sdk: use stronger randomness for session sampling (#2299) (1b51d37)
• web-sdk: wait for prerender activation before starting sessions (#2291) (e4bf94d)

v2.12.0

2.12.0 (2026-09-18)

Features

• replay: expose recording pause controls (#2265) (5eb9397)
• replay: preserve recording identity across tab handoffs (#2256) (6891fad)
• replay: use Grafana privacy classes by default (#2262) (adb4bea)
• session: reconcile ownership before telemetry capture (#2261) (ea5de81)
• web-sdk: make reliable Fetch transport the default (#2264) (002103d)

Bug Fixes

• core: do not drop signals added during BatchExecutor flush (#2257) (227a8d1)
• deps: patch Joi prototype pollution vulnerabilities (#2281) (879b04a)
• deps: patch js-yaml CVE-2026-84375 (#2279) (224edc1)
• deps: patch smol-toml denial of service (#2280) (0a216b0)

... (truncated)

Changelog

Sourced from @​grafana/faro-react's changelog.

2.13.0 (2026-10-22)

Features

• web-sdk: report rage, dead and error clicks (#2314) (9382a99)

Bug Fixes

• allow frontend owners to approve release package metadata (#2333) (b519200)
• deps: update npm-dependencies (#2322) (0ba0597)
• replay: disable unsupported canvas recording (#2317) (bd9099c)
• session: adopt rotated sessions in same-origin iframes (#2286) (4697c87)
• transport-otlp-http: serialize all measurement values as OTLP attributes (#2288) (94a5aeb)
• web-sdk: report zero TLS time for non-secure resources (#2308) (2540176)
• web-tracing: enforce a single tracing owner across Faro instances (#2178) (b71cd77)

2.12.1 (2026-09-22)

Bug Fixes

• deps: update npm-dependencies (#2232) (8cd1f9e)
• security: pin pacote to 21.5.1 (CVE-2026-9496) (#2296) (1b6fc3c)
• session: preserve sampling state on metadata updates (#2301) (389cf09)
• web-sdk: use stronger randomness for session sampling (#2299) (1b51d37)
• web-sdk: wait for prerender activation before starting sessions (#2291) (e4bf94d)

2.12.0 (2026-09-18)

Features

• replay: expose recording pause controls (#2265) (5eb9397)
• replay: preserve recording identity across tab handoffs (#2256) (6891fad)
• replay: use Grafana privacy classes by default (#2262) (adb4bea)
• session: reconcile ownership before telemetry capture (#2261) (ea5de81)
• web-sdk: make reliable Fetch transport the default (#2264) (002103d)

Bug Fixes

• core: do not drop signals added during BatchExecutor flush (#2257) (227a8d1)
• deps: patch Joi prototype pollution vulnerabilities (#2281) (879b04a)
• deps: patch js-yaml CVE-2026-84375 (#2279) (224edc1)
• deps: patch smol-toml denial of service (#2280) (0a216b0)
• fetch-v2: bind session invalidation to request identity (#2259) (104e1a7)
• replay: discard invalidated recorder attempts (#2260) (f3e8f24)
• replay: stop logging page errors as session replay errors (#2284) (0b8fafd)
• user-actions: trigger user actions from clicks on nested child elements (#2239) (dbe7340)

2.11.0 (2026-08-26)

Features

... (truncated)

Commits

• d681775 chore: release 2.13.0 (#2316)
• 4fab6c9 chore(deps): update patch updates (#2325)
• dc30061 chore(deps): update patch updates (#2310)
• 06682bf chore: release 2.12.1 (#2297)
• e4bf94d fix(web-sdk): wait for prerender activation before starting sessions (#2291)
• 5d47656 chore(deps): update patch updates (#2292)
• 8cd1f9e fix(deps): update npm-dependencies (#2232)
• 3e151dc chore: release 2.12.0 (#2266)
• 131691c chore(deps): update patch updates (#2230)
• e96e684 chore: release 2.11.0 (#2253)
• Additional commits viewable in compare view

Updates @grafana/faro-web-sdk from 2.2.0 to 2.13.0

Release notes

Sourced from @​grafana/faro-web-sdk's releases.

v2.13.0

2.13.0 (2026-10-22)

Features

• web-sdk: report rage, dead and error clicks (#2314) (9382a99)

Bug Fixes

• allow frontend owners to approve release package metadata (#2333) (b519200)
• deps: update npm-dependencies (#2322) (0ba0597)
• replay: disable unsupported canvas recording (#2...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies, frontend. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.