9b0f744804
resolve findings ( #3150 )
...
Fixes all six HIGH findings from the buzz security report, one commit
per finding. Independently reviewed to approval by Max at `0158ae542`,
plus a deep isolated live pass (clean-room compose stack, weird ports,
full product matrix) at the same head — see the buzz-security thread for
evidence. `fe65c07c3` merges current `origin/main` on top (new commit,
no rebase), inheriting the nostr 0.44.6 bump (#3135 ) and relay-admin ban
gate (#3128 ).
## Findings and fixes
| Finding | Commit | Fix |
|---|---|---|
| 003 — quinn-proto RUSTSEC-2026-0185 | `e5dcdec72` | Bump quinn-proto
0.11.14 → 0.11.16 (lockfile-only) |
| 002/004 — linkify-it quadratic-parse DoS (GHSA-22p9-wv53-3rq4,
GHSA-v245-v573-v5vm) | `923b3c20f` | pnpm override `linkify-it: ^5.0.2`;
`pnpm why` confirms a single 5.0.2 copy |
| 001 — media reads served unauthenticated by default | `0f277e3e2` |
Helm `requireMediaGetAuth` defaults to `true` + rendered-chart test
pinning the default |
| 006 — removed workflow owners retain webhook-exfiltration authority |
`4749bd56c` | Fail-closed per-fire authority gate (current owner/admin
membership) on **all four** trigger doors (on_event, scheduler
pre-claim, manual trigger, webhook — masked as generic 404), save-time
gate for `call_webhook` defs, durable disable-on-removal wired to kinds
9001 + 9022 |
| 005 — git Smart-HTTP reads ignore channel membership | `e648f2dba` +
`0158ae542` | `authorize_git_read`: caller's **current active
membership** in the repo's bound channel, checked before any
hydration/subprocess on all three read doors (`info_refs` for both
services + `upload_pack` POST). Uniform generic 404 denials (no
membership probing), no repo-owner bypass, first-`buzz-channel`-tag
binding semantics fail closed on ambiguous duplicates (mutation-verified
test). Resolution follows the live kind:30617 announcement, so
deleted/replaced announcements deny immediately. The committed
`e2e-git-perms.sh` guest scenario previously asserted the vulnerability
— now asserts denial. |
## Behavior changes to be aware of
1. **Unbound repos fail closed for git reads.** `buzz repos create`
emits no `buzz-channel` tag, so CLI-created repos without a binding are
unreadable via git HTTP. Correct per finding 005's fail-closed posture;
a follow-up could bind CLI-created repos at creation time.
2. **006 is conservative:** a workflow disabled on owner removal does
not auto-re-enable if the owner is re-added — explicit re-enable
required.
3. Merge conflict resolution in `fe65c07c3`: kept main's
`@radix-ui/react-dismissable-layer` 1.1.19 bump alongside the linkify-it
security override (`pnpm-workspace.yaml` + lockfile).
## Verification at the merge head `fe65c07c3` (same shell)
- buzz-relay `--lib`: 761 passed / 1 failed — the lone red is the known
pre-existing `mesh_demo::demo_join_forwarded_arm_round_trips_echo` 504
flake, present on main
- SEC-005 module incl. PG behavioral matrix: 8/8 (removed-member,
never-member, owner-no-bypass, deleted-30617, malformed/ambiguous
binding, owner-mismatch all denied)
- buzz-workflow 153/0, buzz-db 84/0; `clippy --all-targets -D warnings`
+ `fmt --check` clean
- Desktop JS 3637/3637, tsc clean, biome clean,
file-size/px-text/pubkey-truncation gates clean
- `helm lint` + `helm unittest` (40/40) on `deploy/charts/buzz`
- All five pre-push hooks green (desktop-check, desktop-test,
rust-tests, desktop-tauri-test, branch-skew)
Prior review evidence at `0158ae542` (pre-merge): Max's independent
exact-head approval + clean-room live regression pass
(`WORK_LOGS/2026-07-27_SECURITY_HIGH_LIVE_TEST.md` in his workspace).
Max will re-run the deep local pass at this post-merge head before
merge.
---------
Signed-off-by: Tyler Longwell <tlongwell@block.xyz >
Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz >
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz >
Co-authored-by: Tyler Longwell <tlongwell@block.xyz >
2026-07-27 14:18:24 -04:00
070fb6a161
chore(deps): update radix-ui-primitives monorepo ( #3063 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [@radix-ui/react-alert-dialog](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/alert-dialog ))
| [`1.1.19` →
`1.1.23`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-alert-dialog/1.1.19/1.1.23 )
|
|
|
| [@radix-ui/react-checkbox](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/checkbox ))
| [`1.3.7` →
`1.3.11`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-checkbox/1.3.7/1.3.11 )
|
|
|
| [@radix-ui/react-dialog](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog ))
| [`1.1.19` →
`1.1.23`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-dialog/1.1.19/1.1.23 )
|
|
|
| [@radix-ui/react-dismissable-layer](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/dismissable-layer ))
| [`1.1.15` →
`1.1.19`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-dismissable-layer/1.1.15/1.1.19 )
|
|
|
| [@radix-ui/react-dropdown-menu](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/dropdown-menu ))
| [`2.1.20` →
`2.1.24`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-dropdown-menu/2.1.20/2.1.24 )
|
|
|
| [@radix-ui/react-focus-scope](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/focus-scope ))
| [`1.1.12` →
`1.1.16`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-focus-scope/1.1.12/1.1.16 )
|
|
|
| [@radix-ui/react-popover](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/popover ))
| [`1.1.19` →
`1.1.23`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-popover/1.1.19/1.1.23 )
|
|
|
| [@radix-ui/react-separator](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/separator ))
| [`1.1.11` →
`1.1.15`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-separator/1.1.11/1.1.15 )
|
|
|
| [@radix-ui/react-slot](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/slot ))
| [`1.3.0` →
`1.3.3`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-slot/1.3.0/1.3.3 )
|
|
|
| [@radix-ui/react-tabs](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/tabs ))
| [`1.1.17` →
`1.1.21`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-tabs/1.1.17/1.1.21 )
|
|
|
| [@radix-ui/react-toggle](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/toggle ))
| [`1.1.14` →
`1.1.18`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-toggle/1.1.14/1.1.18 )
|
|
|
| [@radix-ui/react-tooltip](https://radix-ui.com/primitives )
([source](https://redirect.github.com/radix-ui/primitives/tree/HEAD/packages/react/tooltip ))
| [`1.2.12` →
`1.2.16`](https://renovatebot.com/diffs/npm/@radix-ui%2freact-tooltip/1.2.12/1.2.16 )
|
|
|
---
> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/1) for more information.
---
### Release Notes
<details>
<summary>radix-ui/primitives
(@​radix-ui/react-alert-dialog)</summary>
###
[`v1.1.23`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/alert-dialog/CHANGELOG.md#1123 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
- Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`,
`@radix-ui/react-context@1.2.2`, `@radix-ui/react-dialog@1.1.23`,
`@radix-ui/react-primitive@2.1.10`
###
[`v1.1.22`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/alert-dialog/CHANGELOG.md#1122 )
- Updated dependencies: `@radix-ui/react-dialog@1.1.22`,
`@radix-ui/react-primitive@2.1.9`
###
[`v1.1.21`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/alert-dialog/CHANGELOG.md#1121 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/primitive@1.1.7`,
`@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`,
`@radix-ui/react-dialog@1.1.21`, `@radix-ui/react-primitive@2.1.8`
###
[`v1.1.20`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/alert-dialog/CHANGELOG.md#1120 )
- Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked `/* @​__PURE__ */` and use named
render functions instead of `Component.displayName = ...` assignments,
which previously prevented dead-code elimination with some bundlers.
- Updated dependencies: `@radix-ui/react-dialog@1.1.20`,
`@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`,
`@radix-ui/react-context@1.2.0`, `@radix-ui/react-primitive@2.1.7`
</details>
<details>
<summary>radix-ui/primitives (@​radix-ui/react-checkbox)</summary>
###
[`v1.3.11`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/checkbox/CHANGELOG.md#1311 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
- Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`,
`@radix-ui/react-context@1.2.2`, `@radix-ui/react-presence@1.1.10`,
`@radix-ui/react-primitive@2.1.10`,
`@radix-ui/react-use-controllable-state@1.2.6`,
`@radix-ui/react-use-size@1.1.4`
###
[`v1.3.10`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/checkbox/CHANGELOG.md#1310 )
- Updated dependencies: `@radix-ui/react-primitive@2.1.9`
###
[`v1.3.9`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/checkbox/CHANGELOG.md#139 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/primitive@1.1.7`,
`@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`,
`@radix-ui/react-presence@1.1.9`, `@radix-ui/react-primitive@2.1.8`,
`@radix-ui/react-use-controllable-state@1.2.5`,
`@radix-ui/react-use-size@1.1.3`
###
[`v1.3.8`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/checkbox/CHANGELOG.md#138 )
- Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked `/* @​__PURE__ */` and use named
render functions instead of `Component.displayName = ...` assignments,
which previously prevented dead-code elimination with some bundlers.
- Fixed a bug where updating a `Checkbox`, `Switch`, or `RadioGroup`
value programmatically (eg. a "select all" control) while inside a
`<form>` would dispatch a `click` event from the hidden bubble input
that propagated to ancestor `onClick` handlers.
- Updated dependencies: `@radix-ui/react-presence@1.1.8`,
`@radix-ui/react-use-controllable-state@1.2.4`,
`@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`,
`@radix-ui/react-context@1.2.0`, `@radix-ui/react-primitive@2.1.7`,
`@radix-ui/react-use-size@1.1.2`
</details>
<details>
<summary>radix-ui/primitives (@​radix-ui/react-dialog)</summary>
###
[`v1.1.23`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dialog/CHANGELOG.md#1123 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
- Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`,
`@radix-ui/react-context@1.2.2`,
`@radix-ui/react-dismissable-layer@1.1.19`,
`@radix-ui/react-focus-guards@1.1.6`,
`@radix-ui/react-focus-scope@1.1.16`, `@radix-ui/react-id@1.1.4`,
`@radix-ui/react-portal@1.1.17`, `@radix-ui/react-presence@1.1.10`,
`@radix-ui/react-primitive@2.1.10`, `@radix-ui/react-slot@1.3.3`,
`@radix-ui/react-use-controllable-state@1.2.6`,
`@radix-ui/react-use-layout-effect@1.1.4`
###
[`v1.1.22`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dialog/CHANGELOG.md#1122 )
- Updated dependencies: `@radix-ui/react-slot@1.3.2`,
`@radix-ui/react-primitive@2.1.9`,
`@radix-ui/react-dismissable-layer@1.1.18`,
`@radix-ui/react-focus-scope@1.1.15`, `@radix-ui/react-portal@1.1.16`
###
[`v1.1.21`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dialog/CHANGELOG.md#1121 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/primitive@1.1.7`,
`@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`,
`@radix-ui/react-dismissable-layer@1.1.17`,
`@radix-ui/react-focus-guards@1.1.5`,
`@radix-ui/react-focus-scope@1.1.14`, `@radix-ui/react-id@1.1.3`,
`@radix-ui/react-portal@1.1.15`, `@radix-ui/react-presence@1.1.9`,
`@radix-ui/react-primitive@2.1.8`, `@radix-ui/react-slot@1.3.1`,
`@radix-ui/react-use-controllable-state@1.2.5`,
`@radix-ui/react-use-layout-effect@1.1.3`
###
[`v1.1.20`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dialog/CHANGELOG.md#1120 )
- Fixed broken ARIA references in Dialogs where a title or description
elements are not rendered.
- Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked `/* @​__PURE__ */` and use named
render functions instead of `Component.displayName = ...` assignments,
which previously prevented dead-code elimination with some bundlers.
- Updated dependencies: `@radix-ui/react-dismissable-layer@1.1.16`,
`@radix-ui/react-focus-scope@1.1.13`, `@radix-ui/react-portal@1.1.14`,
`@radix-ui/react-presence@1.1.8`,
`@radix-ui/react-use-controllable-state@1.2.4`,
`@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`,
`@radix-ui/react-context@1.2.0`, `@radix-ui/react-focus-guards@1.1.4`,
`@radix-ui/react-id@1.1.2`, `@radix-ui/react-primitive@2.1.7`,
`@radix-ui/react-slot@1.3.0`, `@radix-ui/react-use-layout-effect@1.1.2`
</details>
<details>
<summary>radix-ui/primitives
(@​radix-ui/react-dismissable-layer)</summary>
###
[`v1.1.19`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dismissable-layer/CHANGELOG.md#1119 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
- Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`,
`@radix-ui/react-primitive@2.1.10`,
`@radix-ui/react-use-callback-ref@1.1.4`,
`@radix-ui/react-use-effect-event@0.0.5`
###
[`v1.1.18`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dismissable-layer/CHANGELOG.md#1118 )
- Updated dependencies: `@radix-ui/react-primitive@2.1.9`
###
[`v1.1.17`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dismissable-layer/CHANGELOG.md#1117 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/primitive@1.1.7`,
`@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-primitive@2.1.8`,
`@radix-ui/react-use-callback-ref@1.1.3`,
`@radix-ui/react-use-effect-event@0.0.4`
###
[`v1.1.16`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dismissable-layer/CHANGELOG.md#1116 )
- Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked `/* @​__PURE__ */` and use named
render functions instead of `Component.displayName = ...` assignments,
which previously prevented dead-code elimination with some bundlers.
- Updated dependencies: `@radix-ui/primitive@1.1.6`,
`@radix-ui/react-compose-refs@1.1.3`, `@radix-ui/react-primitive@2.1.7`,
`@radix-ui/react-use-callback-ref@1.1.2`,
`@radix-ui/react-use-effect-event@0.0.3`
</details>
<details>
<summary>radix-ui/primitives
(@​radix-ui/react-dropdown-menu)</summary>
###
[`v2.1.24`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dropdown-menu/CHANGELOG.md#2124 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
- Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`,
`@radix-ui/react-context@1.2.2`, `@radix-ui/react-id@1.1.4`,
`@radix-ui/react-menu@2.1.24`, `@radix-ui/react-primitive@2.1.10`,
`@radix-ui/react-use-controllable-state@1.2.6`
###
[`v2.1.23`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dropdown-menu/CHANGELOG.md#2123 )
- Updated dependencies: `@radix-ui/react-menu@2.1.23`,
`@radix-ui/react-primitive@2.1.9`
###
[`v2.1.22`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dropdown-menu/CHANGELOG.md#2122 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/primitive@1.1.7`,
`@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`,
`@radix-ui/react-id@1.1.3`, `@radix-ui/react-menu@2.1.22`,
`@radix-ui/react-primitive@2.1.8`,
`@radix-ui/react-use-controllable-state@1.2.5`
###
[`v2.1.21`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/dropdown-menu/CHANGELOG.md#2121 )
- Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked `/* @​__PURE__ */` and use named
render functions instead of `Component.displayName = ...` assignments,
which previously prevented dead-code elimination with some bundlers.
- Updated dependencies: `@radix-ui/react-menu@2.1.21`,
`@radix-ui/react-use-controllable-state@1.2.4`,
`@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`,
`@radix-ui/react-context@1.2.0`, `@radix-ui/react-id@1.1.2`,
`@radix-ui/react-primitive@2.1.7`
</details>
<details>
<summary>radix-ui/primitives
(@​radix-ui/react-focus-scope)</summary>
###
[`v1.1.16`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/focus-scope/CHANGELOG.md#1116 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
- Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`,
`@radix-ui/react-primitive@2.1.10`,
`@radix-ui/react-use-callback-ref@1.1.4`
###
[`v1.1.15`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/focus-scope/CHANGELOG.md#1115 )
- Updated dependencies: `@radix-ui/react-primitive@2.1.9`
###
[`v1.1.14`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/focus-scope/CHANGELOG.md#1114 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/react-compose-refs@1.1.4`,
`@radix-ui/react-primitive@2.1.8`,
`@radix-ui/react-use-callback-ref@1.1.3`
###
[`v1.1.13`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/focus-scope/CHANGELOG.md#1113 )
- Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked `/* @​__PURE__ */` and use named
render functions instead of `Component.displayName = ...` assignments,
which previously prevented dead-code elimination with some bundlers.
- Updated dependencies: `@radix-ui/react-compose-refs@1.1.3`,
`@radix-ui/react-primitive@2.1.7`,
`@radix-ui/react-use-callback-ref@1.1.2`
</details>
<details>
<summary>radix-ui/primitives (@​radix-ui/react-popover)</summary>
###
[`v1.1.23`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/popover/CHANGELOG.md#1123 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
- Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`,
`@radix-ui/react-context@1.2.2`,
`@radix-ui/react-dismissable-layer@1.1.19`,
`@radix-ui/react-focus-guards@1.1.6`,
`@radix-ui/react-focus-scope@1.1.16`, `@radix-ui/react-id@1.1.4`,
`@radix-ui/react-popper@1.3.7`, `@radix-ui/react-portal@1.1.17`,
`@radix-ui/react-presence@1.1.10`, `@radix-ui/react-primitive@2.1.10`,
`@radix-ui/react-slot@1.3.3`,
`@radix-ui/react-use-controllable-state@1.2.6`
###
[`v1.1.22`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/popover/CHANGELOG.md#1122 )
- Updated dependencies: `@radix-ui/react-slot@1.3.2`,
`@radix-ui/react-primitive@2.1.9`,
`@radix-ui/react-dismissable-layer@1.1.18`,
`@radix-ui/react-focus-scope@1.1.15`, `@radix-ui/react-popper@1.3.6`,
`@radix-ui/react-portal@1.1.16`
###
[`v1.1.21`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/popover/CHANGELOG.md#1121 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/primitive@1.1.7`,
`@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`,
`@radix-ui/react-dismissable-layer@1.1.17`,
`@radix-ui/react-focus-guards@1.1.5`,
`@radix-ui/react-focus-scope@1.1.14`, `@radix-ui/react-id@1.1.3`,
`@radix-ui/react-popper@1.3.5`, `@radix-ui/react-portal@1.1.15`,
`@radix-ui/react-presence@1.1.9`, `@radix-ui/react-primitive@2.1.8`,
`@radix-ui/react-slot@1.3.1`,
`@radix-ui/react-use-controllable-state@1.2.5`,
`@radix-ui/react-use-layout-effect@1.1.3`
###
[`v1.1.20`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/popover/CHANGELOG.md#1120 )
- Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked `/* @​__PURE__ */` and use named
render functions instead of `Component.displayName = ...` assignments,
which previously prevented dead-code elimination with some bundlers.
- Updated dependencies: `@radix-ui/react-popper@1.3.4`,
`@radix-ui/react-dismissable-layer@1.1.16`,
`@radix-ui/react-focus-scope@1.1.13`, `@radix-ui/react-portal@1.1.14`,
`@radix-ui/react-presence@1.1.8`,
`@radix-ui/react-use-controllable-state@1.2.4`,
`@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`,
`@radix-ui/react-context@1.2.0`, `@radix-ui/react-focus-guards@1.1.4`,
`@radix-ui/react-id@1.1.2`, `@radix-ui/react-primitive@2.1.7`,
`@radix-ui/react-slot@1.3.0`
</details>
<details>
<summary>radix-ui/primitives
(@​radix-ui/react-separator)</summary>
###
[`v1.1.15`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/separator/CHANGELOG.md#1115 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
- Updated dependencies: `@radix-ui/react-primitive@2.1.10`
###
[`v1.1.14`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/separator/CHANGELOG.md#1114 )
- Updated dependencies: `@radix-ui/react-primitive@2.1.9`
###
[`v1.1.13`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/separator/CHANGELOG.md#1113 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/react-primitive@2.1.8`
###
[`v1.1.12`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/separator/CHANGELOG.md#1112 )
- Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked `/* @​__PURE__ */` and use named
render functions instead of `Component.displayName = ...` assignments,
which previously prevented dead-code elimination with some bundlers.
- Updated dependencies: `@radix-ui/react-primitive@2.1.7`
</details>
<details>
<summary>radix-ui/primitives (@​radix-ui/react-slot)</summary>
###
[`v1.3.3`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/slot/CHANGELOG.md#132-133 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
###
[`v1.3.2`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/slot/CHANGELOG.md#132-133 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
###
[`v1.3.1`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/slot/CHANGELOG.md#131 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/primitive@1.1.7`,
`@radix-ui/react-compose-refs@1.1.4`
</details>
<details>
<summary>radix-ui/primitives (@​radix-ui/react-tabs)</summary>
###
[`v1.1.21`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tabs/CHANGELOG.md#1121 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
- Updated dependencies: `@radix-ui/react-context@1.2.2`,
`@radix-ui/react-direction@1.1.4`, `@radix-ui/react-id@1.1.4`,
`@radix-ui/react-presence@1.1.10`, `@radix-ui/react-primitive@2.1.10`,
`@radix-ui/react-roving-focus@1.1.19`,
`@radix-ui/react-use-controllable-state@1.2.6`
###
[`v1.1.20`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tabs/CHANGELOG.md#1120 )
- Updated dependencies: `@radix-ui/react-primitive@2.1.9`,
`@radix-ui/react-roving-focus@1.1.18`
###
[`v1.1.19`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tabs/CHANGELOG.md#1119 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/primitive@1.1.7`,
`@radix-ui/react-context@1.2.1`, `@radix-ui/react-direction@1.1.3`,
`@radix-ui/react-id@1.1.3`, `@radix-ui/react-presence@1.1.9`,
`@radix-ui/react-primitive@2.1.8`,
`@radix-ui/react-roving-focus@1.1.17`,
`@radix-ui/react-use-controllable-state@1.2.5`
###
[`v1.1.18`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tabs/CHANGELOG.md#1118 )
- Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked `/* @​__PURE__ */` and use named
render functions instead of `Component.displayName = ...` assignments,
which previously prevented dead-code elimination with some bundlers.
- Updated dependencies: `@radix-ui/react-presence@1.1.8`,
`@radix-ui/react-roving-focus@1.1.16`,
`@radix-ui/react-use-controllable-state@1.2.4`,
`@radix-ui/primitive@1.1.6`, `@radix-ui/react-context@1.2.0`,
`@radix-ui/react-direction@1.1.2`, `@radix-ui/react-id@1.1.2`,
`@radix-ui/react-primitive@2.1.7`
</details>
<details>
<summary>radix-ui/primitives (@​radix-ui/react-toggle)</summary>
###
[`v1.1.18`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/toggle/CHANGELOG.md#1118 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
- Updated dependencies: `@radix-ui/react-primitive@2.1.10`,
`@radix-ui/react-use-controllable-state@1.2.6`
###
[`v1.1.17`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/toggle/CHANGELOG.md#1117 )
- Updated dependencies: `@radix-ui/react-primitive@2.1.9`
###
[`v1.1.16`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/toggle/CHANGELOG.md#1116 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/primitive@1.1.7`,
`@radix-ui/react-primitive@2.1.8`,
`@radix-ui/react-use-controllable-state@1.2.5`
###
[`v1.1.15`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/toggle/CHANGELOG.md#1115 )
- Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked `/* @​__PURE__ */` and use named
render functions instead of `Component.displayName = ...` assignments,
which previously prevented dead-code elimination with some bundlers.
- Updated dependencies: `@radix-ui/react-use-controllable-state@1.2.4`,
`@radix-ui/primitive@1.1.6`, `@radix-ui/react-primitive@2.1.7`
</details>
<details>
<summary>radix-ui/primitives (@​radix-ui/react-tooltip)</summary>
###
[`v1.2.16`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tooltip/CHANGELOG.md#1216 )
- Reverted breaking changes that caused compatibility issues with React
Server Components.
- Updated dependencies: `@radix-ui/react-compose-refs@1.1.5`,
`@radix-ui/react-context@1.2.2`,
`@radix-ui/react-dismissable-layer@1.1.19`, `@radix-ui/react-id@1.1.4`,
`@radix-ui/react-popper@1.3.7`, `@radix-ui/react-portal@1.1.17`,
`@radix-ui/react-presence@1.1.10`, `@radix-ui/react-primitive@2.1.10`,
`@radix-ui/react-slot@1.3.3`,
`@radix-ui/react-use-controllable-state@1.2.6`,
`@radix-ui/react-use-layout-effect@1.1.4`,
`@radix-ui/react-visually-hidden@1.2.11`
###
[`v1.2.15`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tooltip/CHANGELOG.md#1215 )
- Updated dependencies: `@radix-ui/react-slot@1.3.2`,
`@radix-ui/react-primitive@2.1.9`,
`@radix-ui/react-dismissable-layer@1.1.18`,
`@radix-ui/react-popper@1.3.6`, `@radix-ui/react-portal@1.1.16`,
`@radix-ui/react-visually-hidden@1.2.10`
###
[`v1.2.14`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tooltip/CHANGELOG.md#1214 )
- Republish through CI to attach provenance attestations. The previous
versions of these packages were published manually outside of CI and
therefore shipped without provenance; this patch re-releases the same
code through the CI pipeline so every package includes an attestation.
- Updated dependencies: `@radix-ui/primitive@1.1.7`,
`@radix-ui/react-compose-refs@1.1.4`, `@radix-ui/react-context@1.2.1`,
`@radix-ui/react-dismissable-layer@1.1.17`, `@radix-ui/react-id@1.1.3`,
`@radix-ui/react-popper@1.3.5`, `@radix-ui/react-portal@1.1.15`,
`@radix-ui/react-presence@1.1.9`, `@radix-ui/react-primitive@2.1.8`,
`@radix-ui/react-slot@1.3.1`,
`@radix-ui/react-use-controllable-state@1.2.5`,
`@radix-ui/react-use-layout-effect@1.1.3`,
`@radix-ui/react-visually-hidden@1.2.9`
###
[`v1.2.13`](https://redirect.github.com/radix-ui/primitives/blob/HEAD/packages/react/tooltip/CHANGELOG.md#1213 )
- Fixed a bug where `Tooltip.Content` children were mounted to the DOM
twice.
- Improved tree-shaking so bundlers can drop unused components.
Component parts are now marked `/* @​__PURE__ */` and use named
render functions instead of `Component.displayName = ...` assignments,
which previously prevented dead-code elimination with some bundlers.
- Updated dependencies: `@radix-ui/react-popper@1.3.4`,
`@radix-ui/react-dismissable-layer@1.1.16`,
`@radix-ui/react-portal@1.1.14`, `@radix-ui/react-presence@1.1.8`,
`@radix-ui/react-visually-hidden@1.2.8`,
`@radix-ui/react-use-controllable-state@1.2.4`,
`@radix-ui/primitive@1.1.6`, `@radix-ui/react-compose-refs@1.1.3`,
`@radix-ui/react-context@1.2.0`, `@radix-ui/react-id@1.1.2`,
`@radix-ui/react-primitive@2.1.7`, `@radix-ui/react-slot@1.3.0`,
`@radix-ui/react-use-layout-effect@1.1.2`
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions ) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/ ).
View the [repository job
log](https://developer.mend.io/github/block/buzz ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-27 01:09:48 -07:00
