[dependabot]

Bumps the minor-and-patch group with 52 updates in the / directory:

Package	From	To
@ai-sdk/provider-utils	5.0.51	5.0.76
@astryxdesign/cli	0.6.3	0.7.11
@astryxdesign/core	0.6.3	0.7.11
@biomejs/biome	2.5.14	2.6.6
@electron/asar	4.3.0	4.3.1
@types/node	26.6.3	26.6.6
knip	6.38.0	6.44.2
marked	18.0.11	18.1.3
fs-native-extensions	1.5.1	1.5.3
@modelcontextprotocol/client	2.3.0	2.4.0
@modelcontextprotocol/sdk	1.32.1	1.32.2
@modelcontextprotocol/server-legacy	2.0.0	2.4.0
@ai-sdk/anthropic	4.0.68	4.0.99
@ai-sdk/code-mode	1.0.79	1.0.122
@ai-sdk/cohere	4.0.52	4.0.78
@ai-sdk/google	4.0.85	4.0.114
@ai-sdk/open-responses	2.0.56	2.0.82
@ai-sdk/openai	4.0.80	4.0.111
@ai-sdk/openai-compatible	3.0.59	3.0.87
@ai-sdk/provider	4.0.19	4.0.37
@larksuiteoapi/node-sdk	1.74.0	1.76.0
@openai/agents-core	0.18.0	0.21.0
@slack/socket-mode	3.0.1	3.1.1
@slack/web-api	8.1.1	8.3.0
ai	7.0.122	7.0.165
linkedom	0.18.13	0.18.15
turndown	7.2.4	7.2.5
undici	8.12.3	8.12.4
ws	8.21.3	8.22.2
@types/ws	8.18.1	8.18.2
@types/ws	8.18.1	8.18.2
systeminformation	5.33.18	5.33.19
katex	0.18.9	0.19.1
lucide-react	1.48.0	1.70.0
pele	1.9.0	1.13.0
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
virtua	0.52.7	0.54.2
@playwright/test	1.63.0	1.65.0
@sigstore/bundle	5.0.0	5.0.1
@sigstore/tuf	5.0.0	5.0.1
@sigstore/verify	4.1.2	4.1.3
electron-updater	6.8.9	6.8.11
opencli-mcp	0.0.22	0.0.31
@astryxdesign/theme-neutral	0.6.3	0.7.11
@storybook/react-vite	10.6.0	10.6.6
@vitejs/plugin-react	6.1.1	6.2.1
electron-builder	26.17.0	26.18.0
simple-icons	16.32.0	16.37.0
storybook	10.6.2	10.6.6
vite	8.3.1	8.3.6
astro	7.3.5	7.4.7
cookie	2.0.1	2.0.2

Updates @ai-sdk/provider-utils from 5.0.51 to 5.0.76

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

5.0.76

Patch Changes

• 6400cf8: Add resolveProviderOptions to parse provider options that a model accepts under several providerOptions keys, either as aliases (first) or merged in order (merge), and use it for the existing multi-key lookups in the OpenAI, OpenAI-compatible, Anthropic, Google, and Amazon Bedrock models. Resolution behavior for these models is unchanged.
• f608c05: Reject HTTPS-to-HTTP redirects in validated downloads before requesting the insecure target, including when it matches a configured trusted origin.
• cab9c1f: Return undefined instead of throwing when detectMediaType receives an unsupported topLevelType that matches an inherited object property.
• Updated dependencies [c70adf6]
  • @​ai-sdk/provider@​4.0.37

5.0.75

Patch Changes

• 89aff56: feat(provider-utils): add an experimental_binaryFields option to createJsonResponseHandler

  Providers whose JSON responses carry large base64 strings (images, files) can list their paths, e.g. createJsonResponseHandler(schema, { experimental_binaryFields: ['images[*]'] }). The body is then read as a stream and canonical base64 strings of 64 KiB and more are decoded to Uint8Array while they arrive, instead of holding about four copies of the body in memory (chunks, concatenated bytes, text, parsed string). rawValue, validation errors and APICallError.responseBody contain a short placeholder string instead of the data. Handlers without the option are unchanged. readResponseWithSizeLimit accepts an optional onChunk callback that receives each chunk instead of the chunks being collected.

• Updated dependencies [36802d4]

• Updated dependencies [e0143b0]

• Updated dependencies [934100c]

• Updated dependencies [892af4d]

• Updated dependencies [41465fd]

• Updated dependencies [9754014]

• Updated dependencies [4bb73b0]

• Updated dependencies [2e44144]

  • @​ai-sdk/provider@​4.0.36

5.0.74

Patch Changes

• fa15312: Raise the minimum Undici version to 7.29.1 to include the fix for CVE-2026-84961.

5.0.73

Patch Changes

• 51ca5b7: fix(provider-utils): support cross-realm Uint8Array and ArrayBuffer in uint8-utils and inline file data conversion
• dc6f1c3: fix(provider-utils): decode base64 into a preallocated Uint8Array to avoid ~25x transient memory and long event-loop blocking on large files
• 4ae6986: Add stringifyWithBigIntAndCycles for provider tool serialization that converts BigInt values to decimal strings and replaces ancestor cycles while preserving shared references and toJSON behavior.

5.0.72

Patch Changes

• 7716e18: Support promises and synchronous or asynchronous callbacks in provider API key and token settings. Resolve credentials per authenticated request while preserving existing authentication behavior and synchronous credential serialization.

  The experimental OpenAI Live getServerWebSocketConfig() method can now resolve asynchronously. Await its result before using the connection settings.

... (truncated)

Commits

• 0f3a85f Version Packages (#24672)
• cab9c1f fix(provider-utils): ignore inherited media type signature tables (#24488)
• f608c05 fix(provider-utils): reject HTTPS download downgrades (#24680)
• 6400cf8 fix: consolidate providerOptions namespace resolution (#24670)
• bdc3f91 Version Packages (#24424)
• 89aff56 feat(gateway): add opt-in streaming decoding of large images (#24374)
• 2feaeec Version Packages (#24410)
• fa15312 fix(provider-utils): require patched undici for CVE-2026-84961 (#24420)
• 7498799 Version Packages (#24380)
• 51ca5b7 fix(ai): preserve cross-realm binary data and message cycles (#24370)
• Additional commits viewable in compare view

Updates @astryxdesign/cli from 0.6.3 to 0.7.11

Release notes

Sourced from @​astryxdesign/cli's releases.

Astryx v0.7.11

Astryx 0.7.11 — all @astryxdesign/* packages ship at this version.

OLD_VERSION=0.7.10  # replace with the Core version your project uses today
npm install @astryxdesign/core@0.7.11 @astryxdesign/cli@0.7.11  # plus every other @astryxdesign/* package you use, at 0.7.11
npx @astryxdesign/cli upgrade --from "$OLD_VERSION" --apply --path .

@​astryxdesign/core

New Features

• Under a finger (a coarse primary pointer, on any touch device), Popover grows out of its trigger, wide before tall, with its edge held on the trigger, and shrinks back into the trigger when it closes. The growth plays the theme's --duration-medium-min (in the Storybook theme, the step nearest iOS's 206 ms growth) with its entrance easing, and the shrink plays its exit duration and easing, on the compositor. A close during the growth, or an open during the shrink, turns back from where the popover is. With reduced motion it cross-fades in and out, opacity only, in 200 ms or less. A fine primary pointer (a mouse) keeps its entrance. A tap that lands while it grows is ignored, and a pan started then scrolls nothing. The shrink plays on the layer runtime's exit copy, of which Popover is the first user. The growth starts in the next animation frame, before that frame paints, so the opening tap does no extra layout. (#8187)
• DropdownMenuSubMenu accepts delay and hideDelay, in milliseconds, the same options Tooltip, HoverCard and TopNavMenu have. delay is how long a hovering pointer waits before the flyout opens (default 150), and hideDelay is how long the flyout stays after the pointer leaves (default 200). The defaults match today's timing, so nothing changes unless you pass them. Keyboard focus and touch never wait. (#10298)
• Timestamp takes a timezoneID prop naming the IANA zone its absolute formats render in, such as 'UTC' or 'America/Los_Angeles'. An explicit zone renders identically on the server and the client, so a server-rendered absolute time no longer depends on the server's zone and hydrates without a mismatch. Omit it (or pass 'local') to keep the viewer's own zone, relative formats' visible text ignores it (configured tooltipEntries rows still follow it), and an unknown identifier warns once in development and falls back to the viewer's zone. (#9789)

Fixes

• Animated layout glides now use the theme's --duration-medium instead of --duration-medium-min: 300 ms instead of 225 ms in the Neutral theme, and 410 ms instead of 310 ms with no theme. Their move curve, Reduce Motion behavior, and support for linear() and steps() easing stay unchanged. (#10261)
• Under Reduce Motion, a cross-fade's move and its call's settle wait while a sampler pauses its fade, so the element never moves, and an exit's element never goes, while the paused fade still shows. (#10378)
• Avatar initials and the default person icon paint in primary text on the neutral tint, a pair at 4.5:1 or more in light and dark mode; secondary text fell below 4.5:1 in dark mode. Initials read darker in light mode and lighter in dark mode. (#10205)
• Banner: role="alert" now sits on the title and description only, not on the whole banner, so an urgent alert holds only its message (component:Banner FR8; WCAG 2.2 4.1.3 Status Messages). The dismiss and expand controls, their tooltips, a caller's action, and the supporting content are outside the alert. ARIA attributes passed with role="alert", such as aria-label, move with it. Other roles still land on the banner frame. Use role="alert" only for an urgent message, and announce every other message with useAnnounce. No visual change: the banner renders the same pixels as before. (#6779)
• BottomSheet: a touch release takes the iOS sheet's measured values, and a release moving back toward where the drag began cancels. A release faster than about 1,000 px/s is a flick: it goes at least to the next detent in its direction, so a short fast flick at the lowest detent closes the sheet instead of springing back. From a higher detent, a flick that would carry past the next detent goes on, so a hard flick closes the sheet and a softer one stops at the next detent. A slow or medium touch throw now travels less than before, and a slow touch drag closes the sheet only past halfway to closed. A mouse or pen drag is unchanged. (#10234)
• A labelled Button has its accessible name again in VoiceOver on macOS 14 (Safari 17 and WKWebView). The label sat inside a display: contents wrapper, which that WebKit drops names through, so it read an unnamed "button". The wrapper is now a flex box that takes the Button's own layout, and the Button looks the same. (#10256)
• Under a finger, a Button or IconButton is easier to hit. Its touch target grows toward 44 px through an invisible band, as far as its neighbors leave room, and its box doesn't change. A disabled button, or a busy one that can't be interrupted, gets no band, and a button in a ButtonGroup uses the group's band. Input clear buttons now use the same band in place of their fixed 24 px overlay, and in Safari a tap on that band clears the field. Nothing changes under a mouse. Swizzling a ListItem, CheckboxInput, RadioListItem, InfoTip or SegmentedControl no longer leaves an import of the touch band's styles that can't resolve. (#10216)
• Calendar and DateRangeInput no longer cause a hydration mismatch when the server and the browser are on different dates, for example a UTC server and a visitor already in tomorrow. Today is read only after hydration: a server-rendered Calendar shows no today marker until then, and a Calendar with no focusDate or value keeps its month grid's space empty until the browser's month is known. A DateRangeInput shows the year in its range text until then. (#10226)
• Shift and one mouse wheel notch now scroll a Carousel row by the notch, once. Before, Firefox also scrolled the row on its own, so each notch moved it twice: React's wheel listener is passive, so Carousel could not stop the browser's scroll. A wheel with a horizontal delta, such as a trackpad swipe, and a row with nothing to scroll keep the browser's own scroll. (#10246)
• A theme's borderRadius and padding on the chat-composer target now also set the composer's --_chat-composer-radius and --_chat-composer-padding, so the composer body, its status strip, and the concentric send and attach button radius follow the theme. With density="compact", the body keeps its compact padding, and its radius still follows. Before, the derived-variable registry filed these two mappings under chat, a key no element renders, so defineTheme({components: {'chat-composer': {base: {borderRadius: '16px', padding: '8px'}}}}) emitted only border-radius and padding on the composer root, and everything that reads the two variables kept the default geometry. (#10249)
• CodeBlock's copy button now says when copying fails. A rejected clipboard write used to look like nothing happened. Now the button shows a cross in place of the copy icon for 2 seconds, as a copy shows its check mark (a theme that maps the code-block-copy icon slot keeps its own rest glyph during the failure), and is named, tooltipped and announced as "Failed to copy value to clipboard." (a new localized key, @astryx.codeBlock.copyFailed). A new onCopyError(error) prop receives the rejection once per failed copy; the error itself is never shown. (#10272)
• The Core modules that read process.env.NODE_ENV for development warnings now declare it themselves, so those files type-check in a project that does not install @types/node, such as a swizzled Breadcrumbs, Stepper or TabList. Bundlers still replace the value at build time, so production builds drop the warnings as before. No API changes. (#10252)
• A block-edge reveal or conceal, as in Collapsible, TreeList and Table's row expansion with an animatedLayout handle, now slides the revealed element's children on the same frames as the content beside it, under a still clip on the element's box. An element that paints its own box, such as Table's panelVariant="muted" panel, keeps the moving clip. On iOS Safari a moving clip ran on its own clock and parted from that content for a few frames; now the two stay together. The glide's timing and curve are unchanged. Collapsible's region now wraps its children in one inner element; selectors like region > * or :first-child on the region's children need updating. (#10296)
• Kbd: a key badge grows with a larger text size instead of holding its fixed height, so a bigger glyph stays inside its badge. At the default text size nothing changes. The docs now list ref, say how a screen reader names the shortcut, and say that Kbd only shows keys and does not listen for them. (#10267)
• In a List with hasDividers, a hovered or pressed row keeps both of its dividers visible through its tint, with a mouse and under a finger. The divider above the row used to merge into the tint, and under a finger both dividers did. The dividers keep --color-border; nothing hides. (#10280)
• Overlay, AppShell and MobileNav work in a DOM with no matchMedia, such as an app's jsdom test. Before, Overlay threw on its first render, AppShell as it mounted (with React 19.2 or later), and MobileNav as it closed. Where matchMedia exists, nothing changes. (#10327)
• Carousel paging: on a busy page, a finger held on a settling row now stops it, as on an idle page. Before, when the page received the touch and its lift together, a short hold read as a tap and the row ran on to its target. (#10330)
• Carousel paging: a row that resizes while it settles back onto the page it left now hands back to native scrolling, instead of staying held by the paging. (#10419)
• presentation="adaptive" no longer crashes in environments without matchMedia (jsdom tests). (#10275)
• A Selector's list, opened over its trigger near the bottom of the screen while a software keyboard is up, now slides up and ends above the keyboard with its options in view. Before, it shrank to a sliver or opened under the keyboard. Without a keyboard it opens where it did. (#10169)
• A searchable Selector's closed trigger now names the selected option after its label, so a screen reader announces the selection (for example "Team, Banana, button, collapsed"). (#10170)
• BottomSheet: in iOS Safari, focus moving from a Tall sheet's field to a plain button inside a web component now rides the content down from the blur, as focus moving to any other control that brings up no keyboard does. A frame, or a custom element that can hold a field the page cannot see, still keeps the content in place. (#10388)
• StatusDot's success, warning and error dots paint their status icon role (--color-icon-<status>) instead of the strong status fill, so the dot keeps 3:1 or more against the page and card surfaces; the warning dot used to read near 1.8:1 on a muted card. Success and error dots change colour too: they take their status icon colour, which is darker in light mode in the default theme. An icon inside a status dot now paints in the surface colour. (#10204)
• On a touch screen with a mouse, after a finger opens a menu, a dialog, a drawer, a mobile nav or a popover, a click with a mouse that has not moved since reaches what is under it while the layer enters. Before, that click landed on the entrance's input hold and did nothing. A finger's or a pen's tap during the entrance is still ignored. A mouse that has sent no pointer event since the page loaded still meets the hold. (#10303)
• BottomSheet: in iOS Safari, which publishes no keyboard slide, when the on-screen keyboard closes, a Tall sheet's content rides down with it on UIKit's keyboard spring, instead of jumping back to its earlier scroll once the keyboard is gone. A field that takes focus again before the keyboard is down rides back up, and focus moving to a select, whose picker takes the keyboard's place, starts no ride. In Chrome on Android, a busy page that reads the keyboard's hide late no longer moves the content back up before it settles. (#9776)
• A toast shown over a Dialog no longer blinks out for a frame or more when the Dialog closes outside a click, for example when it closes once an awaited save finishes. The toast stays on screen while the Dialog closes. A close from a click, the Escape key or the backdrop already kept it. (#10251)
• DateInput: under a finger, a bottom-sheet wheel's turn onto a tapped row, a key's row or a value set from outside now plays the shared settle spring from rest, instead of a fixed 300 ms ease-in-ease-out. The wheel's main interaction is a gesture, so all its motion springs; a flick's coast and a slow release's snap stay as they are. (#9924)

Performance

• Closing a Popover, menu or other anchored layer no longer lays out the page an extra time. The layer runtime reads a closing layer's animations only when the layer's closed state declares a discrete display transition or a keyframe animation. It reads that style while the layer is still closed. Such a layer, as TopNavMegaMenu's panel is, still keeps its trigger's anchor name until its fade ends. An animation a script starts is not tracked. (#10368)

... (truncated)

Changelog

Sourced from @​astryxdesign/cli's changelog.

0.7.11

New Features

• astryx build ranks Core blocks of component families its picker was not fitted with somewhat better: the block picker's doc-side word weights are refitted from paraphrases of each block's own source. (#10355)

Fixes

• astryx build names its two alternative page templates in the same order it chooses the start from, so the three templates it shows for a whole page are its best three. The start, the number of alternatives, the blocks and the JSON shape are unchanged. (#10357)
• astryx build --type doc and --type theme now point to astryx search <query> --type doc or --type theme: a build kit has no docs or themes, so build says so once on stderr and names the search that finds them. Stdout, JSON output and exit codes are unchanged. (#10401)
• astryx doctor no longer warns that no theme is wired in an app that imports its themes itself. Without a generated theme module or a package.json astryx.theme, the themes check now passes when the source of the app imports a theme's built module or stylesheet (the imports theme add writes) or passes a theme to Theme, followed through module-scope variables, defineTheme({extends}), re-exports and installed packages to its package, and names the file. Only a theme whose package is installed, or a local theme, counts. A theme passed to Theme that doctor cannot trace (a prop, a function result, a variable declared inside a component) is reported as not confirmed (info), not as missing. (#10353)
• The CLI's semver range check reads ^0 as any 0.x.y and ^0.0 as any 0.0.y, and reads a hyphen range (1.0.0 - 2.0.0) as inclusive bounds, with a partial upper bound (1.0.0 - 2) covering its whole series as npm does. Before, ^0 and ^0.0 were locked to a single patch version and a hyphen range could never match, so astryx doctor and the peer-version checks reported a false mismatch for projects that declare those ranges. (#10184)
• The reminder to run astryx init in a project that has not run it no longer prints before every command. It now prints after a command that succeeds, at most once a day per project, recorded in the per-user state as the daily hints are. It does not print with --json, after a command that fails, or when CI is set. astryx doctor still reports the missing setup in its agent-docs check every time. No JSON shape or exit code changes. (#10343)
• In a folder inside an Astryx project whose own package.json declares no Astryx package, such as a tool folder that installs its own @astryxdesign/core, the setup reminder's init command now names the project's release, as run from the project's folder: the project's own CLI when it installs one, otherwise the package runner pinned to the project's Core, such as npx @astryxdesign/cli@0.7.3 init. It used to pin the release of the CLI that answered the run, whatever the project records. No JSON shape or exit code changes. (#10343)
• astryx experimental render: a page outside a project now renders. Outside a project (no Core or CLI the folder reads, and no package.json that declares one), the page takes the @astryxdesign/* packages its folder lacks, and the integrations a host approves, from the copy the CLI itself runs with, instead of failing with ERR_RENDER_MISSING_DEPENDENCY. React and StyleX come from that copy too, so the page loads one copy of each, even in a React app that installs its own. When that copy's Core cannot be downloaded, a page that needs it fails with ERR_VERSIONS_UNAVAILABLE, as other commands that read Core do. Inside a project, the page uses only the project's own packages. (#10362)
• A link to a topic that an integration replaces under the same name opens the replacement. In an app whose integration replaced theme or getting-started, doctor reported Core's links to them as naming no doc. (#10342)
• swizzle no longer copies a component's browser test harnesses (*.spec.ts, *.spec.tsx, such as Item's ItemMarkerColumns.a11y.chromium.spec.ts) when the installed Core source holds them: @astryxdesign/core 0.7.5 and earlier, or Core's repository source. They import Playwright and an unpublished test package, so a project that swizzled such a component failed to type-check or build. Core 0.7.6 and later ship no harnesses, so swizzling from them is unchanged. (#10230)
• astryx theme build no longer depends on the order it loads the core component docs. A parent doc that lists a sub-component by name only, such as Avatar.doc.mjs listing AvatarStatusDot, erased the values the sub-component's own doc declares when it loaded after that doc; when Avatar.doc.mjs loaded last, avatar-status-dot variant:success counted as a custom value. The build now merges every doc's entry for a component. (#10288)
• astryx integration verify no longer reports theme_module_stale for a theme whose built module differs only in the command its comment says built it, such as a theme built with yarn astryx and verified where pnpm exec astryx runs. Any other difference still fails. (#10344)

Performance

• A compact or full hook list, and the suggestions for an unknown hook name, list each of Core's folders once. Before, they listed a folder again for each hook they looked up. (#10324)
• A search, build or component read lists each folder once. A process that runs several reads, such as a docs site's search or an agent harness, reuses a folder's listing once the folder has stayed unchanged for two seconds. A later read lists the folder again after an entry is added, removed or renamed. (#10274)
• Within one operation, component discovery reads each component doc once, and the component matcher looks for each component's doc once, not once for each name they resolve. Resolving 30 names that only the matcher finds, such as names in another case, makes 14,794 file-system calls instead of 305,108. Results are unchanged. (#10277)

Documentation

• The Authoring guides (Quick Start, Field reference, Building Blocks, Ship, Help, and Make your integration work globally) now carry the keyword "authoring", so astryx search authoring lists them right after the Authoring overview instead of after API function pages. (#10354)
• astryx build --help lists every value --type accepts (component, hook, doc, template, theme), matching the invalid-type error and what build actually runs, and says that doc and theme give an empty kit, since the kit has no doc or theme group. A test keeps the help text, the choices, the API doc and the error message on build and search naming the same set, and checks what each value returns. (#10361)
• Getting Started has an Upgrade section: upgrade every Astryx package your app lists in one command, to the same release, then run astryx upgrade. If your package manager holds new releases back, exempt the whole @astryxdesign/* scope, not only some of its packages. (#10241)
• The custom theme guide names the files of a local theme, including the same-stem descriptor theme add reads. (#10347)
• The CLI's bundled colour token docs say the status icon colours (--color-icon-<status>) paint status marks on the page or a card, such as a StatusDot. (#10204)
• New block, "Table — Selection in the Leading Mark": row selection with no checkbox column. Each row shows its avatar, and the checkbox takes the avatar's slot while a mouse is over it, on keyboard focus, and on every row once anything is selected. On touch screens the checkbox always shows. It uses the existing useTableSelectionState and renders the checkboxes in the name column, so no new Table API is involved. (#10395)

Other Changes

• Internal: the export reader can report type-only exports and map a module's whole public surface in one pass. No change to any command's output. (#10365)

Contributors

Thanks to everyone who contributed to this release:

• @​cixzhang
• @​josephfarina
• @​thecodebasedot
• @​utsavo-afk
• @​vjeux

---

... (truncated)

Commits

• df8a86a chore(release): version packages for v0.7.11 (#10443)
• 8b836a3 fix(cli): satisfy partial caret and hyphen semver ranges (#10184)
• 8b16f6d feat(cli): the export reader reports type-only exports on request, in one pas...
• b3fb292 fix(cli): build --type doc|theme points to search (#10401)
• fed78ba docs(Table): a block that puts row selection in each row's leading mark (#10395)
• b66434e fix(cli): the setup reminder names the project's release and prints at most o...
• a888b3d test(cli): provider-ledger loads through requireNatively (#10364)
• 0d62e69 fix(cli): doctor counts themes an app wires itself (#10353)
• 2963b47 chore(release): plan 0.7.11 (#10413)
• 658c896 [fix] render: outside a project, take Astryx from the copy the CLI runs with ...
• Additional commits viewable in compare view

Updates @astryxdesign/core from 0.6.3 to 0.7.11

Release notes

Sourced from @​astryxdesign/core's releases.

Astryx v0.7.11

Astryx 0.7.11 — all @astryxdesign/* packages ship at this version.

OLD_VERSION=0.7.10  # replace with the Core version your project uses today
npm install @astryxdesign/core@0.7.11 @astryxdesign/cli@0.7.11  # plus every other @astryxdesign/* package you use, at 0.7.11
npx @astryxdesign/cli upgrade --from "$OLD_VERSION" --apply --path .

@​astryxdesign/core

New Features

• Under a finger (a coarse primary pointer, on any touch device), Popover grows out of its trigger, wide before tall, with its edge held on the trigger, and shrinks back into the trigger when it closes. The growth plays the theme's --duration-medium-min (in the Storybook theme, the step nearest iOS's 206 ms growth) with its entrance easing, and the shrink plays its exit duration and easing, on the compositor. A close during the growth, or an open during the shrink, turns back from where the popover is. With reduced motion it cross-fades in and out, opacity only, in 200 ms or less. A fine primary pointer (a mouse) keeps its entrance. A tap that lands while it grows is ignored, and a pan started then scrolls nothing. The shrink plays on the layer runtime's exit copy, of which Popover is the first user. The growth starts in the next animation frame, before that frame paints, so the opening tap does no extra layout. (#8187)
• DropdownMenuSubMenu accepts delay and hideDelay, in milliseconds, the same options Tooltip, HoverCard and TopNavMenu have. delay is how long a hovering pointer waits before the flyout opens (default 150), and hideDelay is how long the flyout stays after the pointer leaves (default 200). The defaults match today's timing, so nothing changes unless you pass them. Keyboard focus and touch never wait. (#10298)
• Timestamp takes a timezoneID prop naming the IANA zone its absolute formats render in, such as 'UTC' or 'America/Los_Angeles'. An explicit zone renders identically on the server and the client, so a server-rendered absolute time no longer depends on the server's zone and hydrates without a mismatch. Omit it (or pass 'local') to keep the viewer's own zone, relative formats' visible text ignores it (configured tooltipEntries rows still follow it), and an unknown identifier warns once in development and falls back to the viewer's zone. (#9789)

Fixes

• Animated layout glides now use the theme's --duration-medium instead of --duration-medium-min: 300 ms instead of 225 ms in the Neutral theme, and 410 ms instead of 310 ms with no theme. Their move curve, Reduce Motion behavior, and support for linear() and steps() easing stay unchanged. (#10261)
• Under Reduce Motion, a cross-fade's move and its call's settle wait while a sampler pauses its fade, so the element never moves, and an exit's element never goes, while the paused fade still shows. (#10378)
• Avatar initials and the default person icon paint in primary text on the neutral tint, a pair at 4.5:1 or more in light and dark mode; secondary text fell below 4.5:1 in dark mode. Initials read darker in light mode and lighter in dark mode. (#10205)
• Banner: role="alert" now sits on the title and description only, not on the whole banner, so an urgent alert holds only its message (component:Banner FR8; WCAG 2.2 4.1.3 Status Messages). The dismiss and expand controls, their tooltips, a caller's action, and the supporting content are outside the alert. ARIA attributes passed with role="alert", such as aria-label, move with it. Other roles still land on the banner frame. Use role="alert" only for an urgent message, and announce every other message with useAnnounce. No visual change: the banner renders the same pixels as before. (#6779)
• BottomSheet: a touch release takes the iOS sheet's measured values, and a release moving back toward where the drag began cancels. A release faster than about 1,000 px/s is a flick: it goes at least to the next detent in its direction, so a short fast flick at the lowest detent closes the sheet instead of springing back. From a higher detent, a flick that would carry past the next detent goes on, so a hard flick closes the sheet and a softer one stops at the next detent. A slow or medium touch throw now travels less than before, and a slow touch drag closes the sheet only past halfway to closed. A mouse or pen drag is unchanged. (#10234)
• A labelled Button has its accessible name again in VoiceOver on macOS 14 (Safari 17 and WKWebView). The label sat inside a display: contents wrapper, which that WebKit drops names through, so it read an unnamed "button". The wrapper is now a flex box that takes the Button's own layout, and the Button looks the same. (#10256)
• Under a finger, a Button or IconButton is easier to hit. Its touch target grows toward 44 px through an invisible band, as far as its neighbors leave room, and its box doesn't change. A disabled button, or a busy one that can't be interrupted, gets no band, and a button in a ButtonGroup uses the group's band. Input clear buttons now use the same band in place of their fixed 24 px overlay, and in Safari a tap on that band clears the field. Nothing changes under a mouse. Swizzling a ListItem, CheckboxInput, RadioListItem, InfoTip or SegmentedControl no longer leaves an import of the touch band's styles that can't resolve. (#10216)
• Calendar and DateRangeInput no longer cause a hydration mismatch when the server and the browser are on different dates, for example a UTC server and a visitor already in tomorrow. Today is read only after hydration: a server-rendered Calendar shows no today marker until then, and a Calendar with no focusDate or value keeps its month grid's space empty until the browser's month is known. A DateRangeInput shows the year in its range text until then. (#10226)
• Shift and one mouse wheel notch now scroll a Carousel row by the notch, once. Before, Firefox also scrolled the row on its own, so each notch moved it twice: React's wheel listener is passive, so Carousel could not stop the browser's scroll. A wheel with a horizontal delta, such as a trackpad swipe, and a row with nothing to scroll keep the browser's own scroll. (#10246)
• A theme's borderRadius and padding on the chat-composer target now also set the composer's --_chat-composer-radius and --_chat-composer-padding, so the composer body, its status strip, and the concentric send and attach button radius follow the theme. With density="compact", the body keeps its compact padding, and its radius still follows. Before, the derived-variable registry filed these two mappings under chat, a key no element renders, so defineTheme({components: {'chat-composer': {base: {borderRadius: '16px', padding: '8px'}}}}) emitted only border-radius and padding on the composer root, and everything that reads the two variables kept the default geometry. (#10249)
• CodeBlock's copy button now says when copying fails. A rejected clipboard write used to look like nothing happened. Now the button shows a cross in place of the copy icon for 2 seconds, as a copy shows its check mark (a theme that maps the code-block-copy icon slot keeps its own rest glyph during the failure), and is named, tooltipped and announced as "Failed to copy value to clipboard." (a new localized key, @astryx.codeBlock.copyFailed). A new onCopyError(error) prop receives the rejection once per failed copy; the error itself is never shown. (#10272)
• The Core modules that read process.env.NODE_ENV for development warnings now declare it themselves, so those files type-check in a project that does not install @types/node, such as a swizzled Breadcrumbs, Stepper or TabList. Bundlers still replace the value at build time, so production builds drop the warnings as before. No API changes. (#10252)
• A block-edge reveal or conceal, as in Collapsible, TreeList and Table's row expansion with an animatedLayout handle, now slides the revealed element's children on the same frames as the content beside it, under a still clip on the element's box. An element that paints its own box, such as Table's panelVariant="muted" panel, keeps the moving clip. On iOS Safari a moving clip ran on its own clock and parted from that content for a few frames; now the two stay together. The glide's timing and curve are unchanged. Collapsible's region now wraps its children in one inner element; selectors like region > * or :first-child on the region's children need updating. (#10296)
• Kbd: a key badge grows with a larger text size instead of holding its fixed height, so a bigger glyph stays inside its badge. At the default text size nothing changes. The docs now list ref, say how a screen reader names the shortcut, and say that Kbd only shows keys and does not listen for them. (#10267)
• In a List with hasDividers, a hovered or pressed row keeps both of its dividers visible through its tint, with a mouse and under a finger. The divider above the row used to merge into the tint, and under a finger both dividers did. The dividers keep --color-border; nothing hides. (#10280)
• Overlay, AppShell and MobileNav work in a DOM with no matchMedia, such as an app's jsdom test. Before, Overlay threw on its first render, AppShell as it mounted (with React 19.2 or later), and MobileNav as it closed. Where matchMedia exists, nothing changes. (#10327)
• Carousel paging: on a busy page, a finger held on a settling row now stops it, as on an idle page. Before, when the page received the touch and its lift together, a short hold read as a tap and the row ran on to its target. (#10330)
• Carousel paging: a row that resizes while it settles back onto the page it left now hands back to native scrolling, instead of staying held by the paging. (#10419)
• presentation="adaptive" no longer crashes in environments without matchMedia (jsdom tests). (#10275)
• A Selector's list, opened over its trigger near the bottom of the screen while a software keyboard is up, now slides up and ends above the keyboard with its options in view. Before, it shrank to a sliver or opened under the keyboard. Without a keyboard it opens where it did. (#10169)
• A searchable Selector's closed trigger now names the selected option after its label, so a screen reader announces the selection (for example "Team, Banana, button, collapsed"). (#10170)
• BottomSheet: in iOS Safari, focus moving from a Tall sheet's field to a plain button inside a web component now rides the content down from the blur, as focus moving to any other control that brings up no keyboard does. A frame, or a custom element that can hold a field the page cannot see, still keeps the content in place. (#10388)
• StatusDot's success, warning and error dots paint their status icon role (--color-icon-<status>) instead of the strong status fill, so the dot keeps 3:1 or more against the page and card surfaces; the warning dot used to read near 1.8:1 on a muted card. Success and error dots change colour too: they take their status icon colour, which is darker in light mode in the default theme. An icon inside a status dot now paints in the surface colour. (#10204)
• On a touch screen with a mouse, after a finger opens a menu, a dialog, a drawer, a mobile nav or a popover, a click with a mouse that has not moved since reaches what is under it while the layer enters. Before, that click landed on the entrance's input hold and did nothing. A finger's or a pen's tap during the entrance is still ignored. A mouse that has sent no pointer event since the page loaded still meets the hold. (#10303)
• BottomSheet: in iOS Safari, which publishes no keyboard slide, when the on-screen keyboard closes, a Tall sheet's content rides down with it on UIKit's keyboard spring, instead of jumping back to its earlier scroll once the keyboard is gone. A field that takes focus again before the keyboard is down rides back up, and focus moving to a select, whose picker takes the keyboard's place, starts no ride. In Chrome on Android, a busy page that reads the keyboard's hide late no longer moves the content back up before it settles. (#9776)
• A toast shown over a Dialog no longer blinks out for a frame or more when the Dialog closes outside a click, for example when it closes once an awaited save finishes. The toast stays on screen while the Dialog closes. A close from a click, the Escape key or the backdrop already kept it. (#10251)
• DateInput: under a finger, a bottom-sheet wheel's turn onto a tapped row, a key's row or a value set from outside now plays the shared settle spring from rest, instead of a fixed 300 ms ease-in-ease-out. The wheel's main interaction is a gesture, so all its motion springs; a flick's coast and a slow release's snap stay as they are. (#9924)

Performance

• Closing a Popover, menu or other anchored layer no longer lays out the page an extra time. The layer runtime reads a closing layer's animations only when the layer's closed state declares a discrete display transition or a keyframe animation. It reads that style while the layer is still closed. Such a layer, as TopNavMegaMenu's panel is, still keeps its trigger's anchor name until its fade ends. An animation a script starts is not tracked. (#10368)

... (truncated)

Changelog

Sourced from @​astryxdesign/core's changelog.

0.7.11

New Features

• Under a finger (a coarse primary pointer, on any touch device), Popover grows out of its trigger, wide before tall, with its edge held on the trigger, and shrinks back into the trigger when it closes. The growth plays the theme's --duration-medium-min (in the Storybook theme, the step nearest iOS's 206 ms growth) with its entrance easing, and the shrink plays its exit duration and easing, on the compositor. A close during the growth, or an open during the shrink, turns back from where the popover is. With reduced motion it cross-fades in and out, opacity only, in 200 ms or less. A fine primary pointer (a mouse) keeps its entrance. A tap that lands while it grows is ignored, and a pan started then scrolls nothing. The shrink plays on the layer runtime's exit copy, of which Popover is the first user. The growth starts in the next animation frame, before that frame paints, so the opening tap does no extra layout. (#8187)
• DropdownMenuSubMenu accepts delay and hideDelay, in milliseconds, the same options Tooltip, HoverCard and TopNavMenu have. delay is how long a hovering pointer waits before the flyout opens (default 150), and hideDelay is how long the flyout stays after the pointer leaves (default 200). The defaults match today's timing, so nothing changes unless you pass them. Keyboard focus and touch never wait. (#10298)
• Timestamp takes a timezoneID prop naming the IANA zone its absolute formats render in, such as 'UTC' or 'America/Los_Angeles'. An explicit zone renders identically on the server and the client, so a server-rendered absolute time no longer depends on the server's zone and hydrates without a mismatch. Omit it (or pass 'local') to keep the viewer's own zone, relative formats' visible text ignores it (configured tooltipEntries rows still follow it), and an unknown identifier warns once in development and falls back to the viewer's zone. (#9789)

Fixes

• Animated layout glides now use the theme's --duration-medium instead of --duration-medium-min: 300 ms instead of 225 ms in the Neutral theme, and 410 ms instead of 310 ms with no theme. Their move curve, Reduce Motion behavior, and support for linear() and steps() easing stay unchanged. (#10261)
• Under Reduce Motion, a cross-fade's move and its call's settle wait while a sampler pauses its fade, so the element never moves, and an exit's element never goes, while the paused fade still shows. (#10378)
• Avatar initials and the default person icon paint in primary text on the neutral tint, a pair at 4.5:1 or more in light and dark mode; secondary text fell below 4.5:1 in dark mode. Initials read darker in light mode and lighter in dark mode. (#10205)
• Banner: role="alert" now sits on the title and description only, not on the whole banner, so an urgent alert holds only its message (component:Banner FR8; WCAG 2.2 4.1.3 Status Messages). The dismiss and expand controls, their tooltips, a caller's action, and the supporting content are outside the alert. ARIA attributes passed with role="alert", such as aria-label, move with it. Other roles still land on the banner frame. Use role="alert" only for an urgent message, and announce every other message with useAnnounce. No visual change: the banner renders the same pixels as before. (#6779)
• BottomSheet: a touch release takes the iOS sheet's measured values, and a release moving back toward where the drag began cancels. A release faster than about 1,000 px/s is a flick: it goes at least to the next detent in its direction, so a short fast flick at the lowest detent clo...

  Description has been truncated