[dependabot]

Bumps the production-dependencies group with 9 updates in the / directory:

Package	From	To
@simplewebauthn/browser	13.3.0	14.0.0
@simplewebauthn/server	13.3.0	14.1.0
date-fns	4.1.0	4.4.0
jose	6.2.2	6.2.15
lucide-react	1.7.0	1.70.0
react	19.2.4	19.3.1
react-dom	19.2.4	19.3.1
tailwind-merge	3.5.0	3.7.0
zod	4.4.3	4.6.7

Updates @simplewebauthn/browser from 13.3.0 to 14.0.0

Release notes

Sourced from @​simplewebauthn/browser's releases.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

• [server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

• [browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

• [browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

• [browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

• [server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @​agektmr)

• [server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

• [server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

• [server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

• [server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

• [server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

• [browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

v13.3.3

Changes:

• [server] Updated MDS blob signature verification to support more algorithms (#788)
• [server] Updated MetadataService to know about the new FIDO MDS blob trust anchor certificate (#789)

v13.3.2

This update fixes a CVSS v4 Low (2.0) security vulnerability identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Fixed an issue with verifyRegistrationResponse() allowing a maliciously-crafted attestation statement's x5c to contain a self-signed "root certificate" instead of chaining back to an RP-specified trust anchor (GHSA-6hxq-p678-4hr2)

v13.3.1

Changes:

... (truncated)

Changelog

Sourced from @​simplewebauthn/browser's changelog.

v14.0.0 - The one after they go quantum

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

• [server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)
• [browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)
• [browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)
• [browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)
• [server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773)
• [server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info

... (truncated)

Commits

• 3e2dc0c Update version to v14.0.0
• 618c0e9 Merge v14.0.0 milestone to master (#792)
• See full diff in compare view

Updates @simplewebauthn/server from 13.3.0 to 14.1.0

Release notes

Sourced from @​simplewebauthn/server's releases.

v14.1.0

Changes:

• [server] Support for the FIDO Convenience Metadata Service has been added with the new ConvenienceMetadataService. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#convenience-metadata-service for more info (#812)
• [server] verifyRegistrationResponse() and verifyAuthenticationResponse() will now raise a SimpleWebAuthnError when expectedRPID or expectedOrigin are not valid values (#824)
• [server] "android-key" attestation statement verification now checks that the x5c root certificate is a known one before verifying the certificate chain (#821)
• [server] "android-key" attestation statement verification now knows about the new Google Android Key Attestation CA1 trust anchor (#820)
• [server] "tpm" attestation statement verification now properly parses non-TPM_ALG_NULL schemes in pubArea (#822)

v14.0.3

Changes:

• [server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4) security vulnerability identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh)

v14.0.1

• [server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

• [server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

• [browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

• [browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

• [browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

• [server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @​agektmr)

• [server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

• [server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

• [server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

... (truncated)

Changelog

Sourced from @​simplewebauthn/server's changelog.

v14.1.0

Changes:

• [server] Support for the FIDO Convenience Metadata Service has been added with the new ConvenienceMetadataService. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#convenience-metadata-service for more info (#812)
• [server] verifyRegistrationResponse() and verifyAuthenticationResponse() will now raise a SimpleWebAuthnError when expectedRPID or expectedOrigin are not valid values (#824)
• [server] "android-key" attestation statement verification now checks that the x5c root certificate is a known one before verifying the certificate chain (#821)
• [server] "android-key" attestation statement verification now knows about the new Google Android Key Attestation CA1 trust anchor (#820)
• [server] "tpm" attestation statement verification now properly parses non-TPM_ALG_NULL schemes in pubArea (#822)

v14.0.3

Changes:

• [server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4 / 10) and a CVSS v3 Moderate (6.3 / 10) security vulnerabilities identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh, GHSA-j3h4-m3m2-7p7j)

v14.0.1

Changes:

• [server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

... (truncated)

Commits

• 01d1a64 Fix deno publish issue
• f8b71cb Update server version to v14.1.0
• 60c34a1 Require ASCII inputs for expectedRPID and expectedOrigin (#824)
• 8f41b23 Improve TPM pubArea parsing (#822)
• 6a87602 Mount better defenses against malicious cert chains in Android Key attestatio...
• a0d9d94 Add Google Android Key Attestation CA1 trust anchor (#820)
• 96f0f24 Fix copy-pasted "teeEnforced" w/"softwareEnforced" in Android Key error messa...
• df53178 Add support for FIDO Convenience MDS (#812)
• 084e601 Update server version to v14.0.3
• cd402cc Lazily evaluate PQC support to prevent Node warnings on startup (#809)
• Additional commits viewable in compare view

Updates date-fns from 4.1.0 to 4.4.0

Release notes

Sourced from date-fns's releases.

v4.4.0

This release revisits the approach to CDN usage and introduces a new package, @date-fns/cdn and deprecates the date-fns CDN scripts. It allowed reducing the zipped package size from 5.83 MB down to 3.96 MB without introducing any breaking changes.

In v5.0.0-alpha.0 where CDN scripts are completely removed from date-fns the change is more significant and brings the zipped package size down to 2.89 MB.

It is just the first step in optimizing the package size. Expect further size reduction in the future v4 and v5 versions.

Changed

• DEPRECATED: The date-fns CDN scripts are now deprecated and will be removed in the next major release. Please switch to the new @date-fns/cdn package for CDN usage.

• Removed CDN source maps to reduce the package size. If you rely on them, please switch to the new @date-fns/cdn package that still includes them.

v4.3.0

Kudos to @​ImRodry and @​puneetdixit200 for their contributions.

Fixed

• Fixed missing modularized optimization fallback (for Next.js and others). See #4193.

• Fixed pt locale first day of week to be Sunday. See #4195 by @​ImRodry.

• Fixed zh-CN, zh-HK, and zh-TW locale month parsing for October, November, and December. See #4194 by @​puneetdixit200.

v4.2.1

Fixed

• Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

• Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.

Commits

• cd53d25 Promote to v4.4.0
• d948ec1 Preserve but deprecate CDN versions for v4, set up v5 with polyfills
• ee65753 Add root mise :format task
• 9f5bdf5 Add positional argument to test/smoke.sh script
• 651ead6 Split CDN bundles into separate @​date-fns/cdn package
• 224c1a2 Deprecate type tests as attw hangs on date-fns package
• 7bb2842 Switch PACKAGE_OUTPUT_PATH to --dist flag in the package build script
• b6ad5ac Add flags to control package build script
• 424a783 Fix docs release after moving to monorepo setup
• f95bcf1 (docs): Add missing tsx dependency
• Additional commits viewable in compare view

Updates jose from 6.2.2 to 6.2.15

Release notes

Sourced from jose's releases.

v6.2.15

Fixes

• jwe: cancel decompression when output exceeds the limit (67541aa)
• jwks: reject negative cache durations (a3b296f)
• jwt: reject negative clockTolerance (67d6c83)

v6.2.14

Fixes

• types: preserve contextual JWT payload inference (0dbf7a0), closes #911

v6.2.13

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

v6.2.12

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.15 (2026-11-01)

Fixes

• jwe: cancel decompression when output exceeds the limit (67541aa)
• jwks: reject negative cache durations (a3b296f)
• jwt: reject negative clockTolerance (67d6c83)

6.2.14 (2026-10-29)

Fixes

• types: preserve contextual JWT payload inference (0dbf7a0), closes #911

6.2.13 (2026-10-20)

Refactor

• align terminology with JOSE specifications (bafcb74)
• preserve underlying error causes (724ba24), closes #908

6.2.12 (2026-09-05)

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)

... (truncated)

Commits

• f931aa5 chore(release): 6.2.15
• c2dd2ff test: verify decompression is cancelled on output limit
• 67d6c83 fix(jwt): reject negative clockTolerance
• 67541aa fix(jwe): cancel decompression when output exceeds the limit
• a3b296f fix(jwks): reject negative cache durations
• f3737f9 chore(deps-dev): bump electron from 45.0.0 to 45.1.0 in /tap/electron
• f2fbc97 chore(deps-dev): bump workerd in /tap/workerd
• 4533e9d chore(deps): bump the actions group with 4 updates
• f9cee77 chore: cleanup after release
• 5a6a5b6 chore(release): 6.2.14
• Additional commits viewable in compare view

Updates lucide-react from 1.7.0 to 1.70.0

Release notes

Sourced from lucide-react's releases.

Version 1.70.0

What's Changed

• fix(site): fix vercel.json redirects that land on 404 by @​ericfennis in lucide-icons/lucide#5157
• feat(icons): added square-dashed-search icon by @​domarku in lucide-icons/lucide#5119
• fix(lucide-react-native): emit runtime files for alias icon subpaths by @​tlq5l in lucide-icons/lucide#5055
• feat(icons): added moped icon by @​jamiemlaw in lucide-icons/lucide#3373
• feat(icons): added user-exclamation-point, user-round-exclamation-point icons by @​ericfennis in lucide-icons/lucide#5144
• feat(icons): added grid-3x3-off icon by @​gridalchemy in lucide-icons/lucide#5071

New Contributors

• @​domarku made their first contribution in lucide-icons/lucide#5119
• @​tlq5l made their first contribution in lucide-icons/lucide#5055
• @​gridalchemy made their first contribution in lucide-icons/lucide#5071

Full Changelog: lucide-icons/lucide@1.69.0...1.70.0

Version 1.69.0

What's Changed

• feat(icons): added package-pen icon by @​ericfennis in lucide-icons/lucide#5154
• feat(icons): added package-question-mark icon by @​ericfennis in lucide-icons/lucide#5155
• feat(icons): added opacity icon by @​ilyavred in lucide-icons/lucide#4222
• feat(icons): added circle-fading-check icon by @​n2duc in lucide-icons/lucide#4089

New Contributors

• @​ilyavred made their first contribution in lucide-icons/lucide#4222
• @​n2duc made their first contribution in lucide-icons/lucide#4089

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

• fix(site): keep sponsor tiers within content width by @​ffgenius in lucide-icons/lucide#5149
• feat(icons): added mango icon by @​Prsenapati09 in lucide-icons/lucide#4902
• chore(icons): Renamed *-warning and *-alert to *-exclamation-point by @​ericfennis in lucide-icons/lucide#5143

New Contributors

• @​ffgenius made their first contribution in lucide-icons/lucide#5149
• @​Prsenapati09 made their first contribution in lucide-icons/lucide#4902

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

• feat(site): Add sponsor page by @​ericfennis in lucide-icons/lucide#5132
• fix(icons): changed chef-hat icon by @​karsa-mistmere in lucide-icons/lucide#4577
• fix(icons): changed (circle|square)-letter-j by @​karsa-mistmere in lucide-icons/lucide#5138
• feat(icons): added globe-ban icon by @​PrimeTestLab in lucide-icons/lucide#5020
• chore(deps): bump playwright to 1.64.1 to support ubuntu 26.04 runners by @​ericfennis in lucide-icons/lucide#5140
• chore(deps): bump the svelte-deps group across 1 directory with 3 updates by @​dependabot[bot] in lucide-icons/lucide#5139
• feat(icons): added diagram-flow-horizontal, diagram-flow-vertical icons by @​karsa-mistmere in lucide-icons/lucide#5125

... (truncated)

Commits

• b196797 Update deps (#5146)
• 588113e test(build-icons): cover Windows file URL imports (#4862)
• 14cab02 feat(site): Add sponsor page (#5132)
• 1668a0c chore(deps): bump rollup to 4.65.1 and keep typescript on v6 (#5110)
• e8f86fc fix(lucide-react): ignore stale DynamicIcon loads after the name changes (#5060)
• 6657faa chore(deps-dev): bump vite from 8.3.2 to 8.3.3 (#5052)
• 1802f33 feat(lucide-react): add package exports for per-icon imports without changing...
• 20aef31 chore(packages): Update sponsors (#5034)
• fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
• 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
• Additional commits viewable in compare view

Updates react from 19.2.4 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdliteDescription has been truncated