chore: bump up all non-major npm dependencies

chore: bump up fast-xml-parser version to v5.5.6 [SECURITY] (#14676 )
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [fast-xml-parser](https://redirect.github.com/NaturalIntelligence/fast-xml-parser) | [`5.4.1` → `5.5.6`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.4.1/5.5.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.5.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.4.1/5.5.6?slim=true) | ### GitHub Vulnerability Alerts #### [CVE-2026-33036](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r) ## Summary The fix for CVE-2026-26278 added entity expansion limits (`maxTotalExpansions`, `maxExpandedLength`, `maxEntityCount`, `maxEntitySize`) to prevent XML entity expansion Denial of Service. However, these limits are only enforced for DOCTYPE-defined entities. **Numeric character references** (`&#NNN;` and `&#xHH;`) and standard XML entities (`<`, `>`, etc.) are processed through a separate code path that does NOT enforce any expansion limits. An attacker can use massive numbers of numeric entity references to completely bypass all configured limits, causing excessive memory allocation and CPU consumption. ## Affected Versions fast-xml-parser v5.x through v5.5.3 (and likely v5.5.5 on npm) ## Root Cause In `src/xmlparser/OrderedObjParser.js`, the `replaceEntitiesValue()` function has two separate entity replacement loops: 1. **Lines 638-670**: DOCTYPE entities — expansion counting with `entityExpansionCount` and `currentExpandedLength` tracking. This was the CVE-2026-26278 fix. 2. **Lines 674-677**: `lastEntities` loop — replaces standard entities including `num_dec` (`/&#([0-9]{1,7});/g`) and `num_hex` (`/&#x([0-9a-fA-F]{1,6});/g`). **This loop has NO expansion counting at all.** The numeric entity regex replacements at lines 97-98 are part of `lastEntities` and go through the uncounted loop, completely bypassing the CVE-2026-26278 fix. ## Proof of Concept ```javascript const { XMLParser } = require('fast-xml-parser'); // Even with strict explicit limits, numeric entities bypass them const parser = new XMLParser({ processEntities: { enabled: true, maxTotalExpansions: 10, maxExpandedLength: 100, maxEntityCount: 1, maxEntitySize: 10 } }); // 100K numeric entity references — should be blocked by maxTotalExpansions=10 const xml = `<root>${'&#65;'.repeat(100000)}</root>`; const result = parser.parse(xml); // Output: 500,000 chars — bypasses maxExpandedLength=100 completely console.log('Output length:', result.root.length); // 500000 console.log('Expected max:', 100); // limit was 100 ``` **Results:** - 100K `&#65;` references → 500,000 char output (5x default maxExpandedLength of 100,000) - 1M references → 5,000,000 char output, ~147MB memory consumed - Even with `maxTotalExpansions=10` and `maxExpandedLength=100`, 10K references produce 50,000 chars - Hex entities (`A`) exhibit the same bypass ## Impact **Denial of Service** — An attacker who can provide XML input to applications using fast-xml-parser can cause: - Excessive memory allocation (147MB+ for 1M entity references) - CPU consumption during regex replacement - Potential process crash via OOM This is particularly dangerous because the application developer may have explicitly configured strict entity expansion limits believing they are protected, while numeric entities silently bypass all of them. ## Suggested Fix Apply the same `entityExpansionCount` and `currentExpandedLength` tracking to the `lastEntities` loop (lines 674-677) and the HTML entities loop (lines 680-686), similar to how DOCTYPE entities are tracked at lines 638-670. ## Workaround Set `htmlEntities:false` --- ### Release Notes <details> <summary>NaturalIntelligence/fast-xml-parser (fast-xml-parser)</summary> ### [`v5.5.6`](e54155f530...870043e75e) [Compare Source](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.5...v5.5.6) ### [`v5.5.5`](ea07bb2e84...e54155f530) [Compare Source](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.4...v5.5.5) ### [`v5.5.4`](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.3...ea07bb2e8435a88136c0e46d7ee8a345107b7582) [Compare Source](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.3...v5.5.4) ### [`v5.5.3`](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.2...v5.5.3) [Compare Source](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.2...v5.5.3) ### [`v5.5.2`](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.1...e0a14f7d15a293732e630ce1b7faa39924de2359) [Compare Source](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.1...v5.5.2) ### [`v5.5.1`](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.5.1): integrate path-expression-matcher [Compare Source](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.0...v5.5.1) - support path-expression-matcher - fix: stopNode should not be parsed - performance improvement for stopNode checking ### [`v5.5.0`](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.4.2...ce017923460f92861e8fc94c91e52f9f5bd6a1b0) [Compare Source](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.4.2...v5.5.0) ### [`v5.4.2`](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.4.1...v5.4.2) [Compare Source](https://redirect.github.com/NaturalIntelligence/fast-xml-parser/compare/v5.4.1...v5.4.2) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-23 07:40:46 +08:00 · 2026-03-18 05:37:41 +00:00 · 2026-03-18 13:28:53 +08:00 · 2026-03-18 13:28:05 +08:00
25 changed files with 3659 additions and 2748 deletions
--- a/.github/deployment/node/Dockerfile
+++ b/.github/deployment/node/Dockerfile
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.7
+# syntax=docker/dockerfile:1.22

 FROM node:22-bookworm-slim AS assets
 WORKDIR /app
--- a/.github/workflows/release-mobile.yml
+++ b/.github/workflows/release-mobile.yml
@@ -182,7 +182,7 @@ jobs:
        run: yarn workspace @affine/android cap sync
      - uses: actions/setup-python@v6
        with:
-          python-version: '3.13'
+          python-version: '3.14'
      - name: Auth gcloud
        id: auth
        uses: google-github-actions/auth@v2
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -30,9 +30,9 @@ resolver = "3"
  chrono = "0.4"
  clap = { version = "4.4", features = ["derive"] }
  core-foundation = "0.10"
-  coreaudio-rs = "0.12"
-  cpal = "0.15"
-  criterion = { version = "0.5", features = ["html_reports"] }
+  coreaudio-rs = "0.14"
+  cpal = "0.17"
+  criterion = { version = "0.8", features = ["html_reports"] }
  criterion2 = { version = "3", default-features = false }
  crossbeam-channel = "0.5"
  dispatch2 = "0.3"
@@ -80,18 +80,18 @@ resolver = "3"
  parking_lot = "0.12"
  path-ext = "0.1.2"
  pdf-extract = { git = "https://github.com/toeverything/pdf-extract", branch = "darksky/improve-font-decoding" }
-  phf = { version = "0.11", features = ["macros"] }
+  phf = { version = "0.13", features = ["macros"] }
  proptest = "1.3"
-  proptest-derive = "0.5"
+  proptest-derive = "0.8"
  pulldown-cmark = "0.13"
-  rand = "0.9"
-  rand_chacha = "0.9"
-  rand_distr = "0.5"
+  rand = "0.10"
+  rand_chacha = "0.10"
+  rand_distr = "0.6"
  rayon = "1.10"
  readability = { version = "0.3.0", default-features = false }
  regex = "1.10"
  rubato = "0.16"
-  screencapturekit = "0.3"
+  screencapturekit = "0.4"
  serde = "1"
  serde_json = "1"
  sha3 = "0.10"
@@ -104,29 +104,29 @@ resolver = "3"
    "sqlite",
    "tls-rustls",
  ] }
-  strum_macros = "0.27.0"
+  strum_macros = "0.28.0"
  symphonia = { version = "0.5", features = ["all", "opt-simd"] }
-  text-splitter = "0.27"
+  text-splitter = "0.29"
  thiserror = "2"
-  tiktoken-rs = "0.7"
+  tiktoken-rs = "0.9"
  tokio = "1.45"
-  tree-sitter = { version = "0.25" }
+  tree-sitter = { version = "0.26" }
  tree-sitter-c = { version = "0.24" }
  tree-sitter-c-sharp = { version = "0.23" }
  tree-sitter-cpp = { version = "0.23" }
-  tree-sitter-go = { version = "0.23" }
+  tree-sitter-go = { version = "0.25" }
  tree-sitter-java = { version = "0.23" }
-  tree-sitter-javascript = { version = "0.23" }
+  tree-sitter-javascript = { version = "0.25" }
  tree-sitter-kotlin-ng = { version = "1.1" }
-  tree-sitter-python = { version = "0.23" }
+  tree-sitter-python = { version = "0.25" }
  tree-sitter-rust = { version = "0.24" }
-  tree-sitter-scala = { version = "0.24" }
+  tree-sitter-scala = { version = "0.25" }
  tree-sitter-typescript = { version = "0.23" }
-  uniffi = "0.29"
+  uniffi = "0.31"
  url = { version = "2.5" }
  uuid = "1.8"
  v_htmlescape = "0.15"
-  windows = { version = "0.61", features = [
+  windows = { version = "0.62", features = [
    "Win32_Devices_FunctionDiscovery",
    "Win32_Foundation",
    "Win32_Media_Audio",
@@ -138,10 +138,10 @@ resolver = "3"
    "Win32_System_Variant",
    "Win32_UI_Shell_PropertiesSystem",
  ] }
-  windows-core = { version = "0.61" }
+  windows-core = { version = "0.62" }
  y-octo = { path = "./packages/common/y-octo/core" }
  y-sync = { version = "0.4" }
-  yrs = "0.23.0"
+  yrs = "0.25.0"

 [profile.dev.package.sqlx-macros]
 opt-level = 3
--- a/blocksuite/affine/shared/package.json
+++ b/blocksuite/affine/shared/package.json
@@ -39,7 +39,7 @@
    "micromark-extension-gfm-table": "^2.1.0",
    "micromark-extension-gfm-task-list-item": "^2.1.0",
    "micromark-util-combine-extensions": "^2.0.0",
-    "pdfmake": "^0.2.20",
+    "pdfmake": "^0.3.0",
    "quick-lru": "^7.3.0",
    "rehype-parse": "^9.0.0",
    "rehype-stringify": "^10.0.0",
@@ -73,7 +73,7 @@
    "!dist/__tests__"
  ],
  "devDependencies": {
-    "@types/pdfmake": "^0.2.12",
+    "@types/pdfmake": "^0.3.0",
    "vitest": "^4.0.18"
  },
  "version": "0.26.3"
--- a/blocksuite/playground/package.json
+++ b/blocksuite/playground/package.json
@@ -22,7 +22,7 @@
    "@toeverything/pdfium": "^0.1.1",
    "@toeverything/y-indexeddb": "0.10.0-canary.9",
    "@types/katex": "^0.16.7",
-    "browser-fs-access": "^0.37.0",
+    "browser-fs-access": "^0.38.0",
    "jszip": "^3.10.1",
    "katex": "^0.16.27",
    "lit": "^3.2.0",
--- a/packages/backend/native/package.json
+++ b/packages/backend/native/package.json
@@ -32,7 +32,7 @@
    "build:debug": "napi build"
  },
  "devDependencies": {
-    "@napi-rs/cli": "3.5.0",
+    "@napi-rs/cli": "3.5.1",
    "tiktoken": "^1.0.17"
  }
 }
--- a/packages/backend/server/package.json
+++ b/packages/backend/server/package.json
@@ -79,7 +79,7 @@
    "graphql-scalars": "^1.24.0",
    "graphql-upload": "^17.0.0",
    "html-validate": "^9.0.0",
-    "htmlrewriter": "^0.0.12",
+    "htmlrewriter": "^0.0.13",
    "http-errors": "^2.0.0",
    "ioredis": "^5.8.2",
    "is-mobile": "^5.0.0",
@@ -96,7 +96,7 @@
    "piscina": "^5.1.4",
    "prisma": "^6.6.0",
    "react": "^19.2.1",
-    "react-dom": "19.2.1",
+    "react-dom": "19.2.4",
    "reflect-metadata": "^0.2.2",
    "rxjs": "^7.8.2",
    "semver": "^7.7.3",
--- a/packages/common/infra/package.json
+++ b/packages/common/infra/package.json
@@ -18,7 +18,7 @@
    "@affine/templates": "workspace:*",
    "@preact/signals-core": "^1.8.0",
    "eventemitter2": "^6.4.9",
-    "foxact": "^0.2.49",
+    "foxact": "^0.3.0",
    "fractional-indexing": "^3.2.0",
    "fuse.js": "^7.0.0",
    "graphemer": "^1.4.0",
--- a/packages/common/y-octo/utils/fuzz/Cargo.lock
+++ b/packages/common/y-octo/utils/fuzz/Cargo.lock
@@ -74,6 +74,12 @@ dependencies = [
 "windows-sys",
 ]

+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
 [[package]]
 name = "arbitrary"
 version = "1.4.1"
@@ -168,6 +174,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"

+[[package]]
+name = "chacha20"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "rand_core 0.10.0",
+]
+
 [[package]]
 name = "clap"
 version = "4.5.38"
@@ -224,6 +241,15 @@ dependencies = [
 "loom",
 ]

+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.21"
@@ -238,7 +264,7 @@ checksum = "5041cc499144891f3790297212f32a74fb938e5136a14943f338ef9e0ae276cf"
 dependencies = [
 "cfg-if",
 "crossbeam-utils",
- "hashbrown",
+ "hashbrown 0.14.5",
 "lock_api",
 "once_cell",
 "parking_lot_core",
@@ -255,6 +281,12 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
 [[package]]
 name = "event-listener"
 version = "5.4.0"
@@ -286,6 +318,12 @@ dependencies = [
 "getrandom 0.2.16",
 ]

+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
 [[package]]
 name = "generator"
 version = "0.8.4"
@@ -320,22 +358,69 @@ checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
 "cfg-if",
 "libc",
- "r-efi",
+ "r-efi 5.2.0",
 "wasi 0.14.2+wasi-0.2.4",
 ]

+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.0",
+ "wasip2",
+ "wasip3",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"

+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
 [[package]]
 name = "heck"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"

+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "indexmap"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
+]
+
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.1"
@@ -374,6 +459,12 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"

+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
 [[package]]
 name = "lib0"
 version = "0.16.10"
@@ -393,9 +484,9 @@ checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"

 [[package]]
 name = "libfuzzer-sys"
-version = "0.4.9"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf78f52d400cf2d84a3a973a78a592b4adc535739e0a5597a0da6f0c357adc75"
+checksum = "f12a681b7dd8ce12bff52488013ba614b869148d54dd79836ab85aafdd53f08d"
 dependencies = [
 "arbitrary",
 "cc",
@@ -530,29 +621,30 @@ dependencies = [

 [[package]]
 name = "phf"
-version = "0.11.3"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
 "phf_macros",
 "phf_shared",
+ "serde",
 ]

 [[package]]
 name = "phf_generator"
-version = "0.11.3"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
 dependencies = [
+ "fastrand",
 "phf_shared",
- "rand 0.8.5",
 ]

 [[package]]
 name = "phf_macros"
-version = "0.11.3"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
 dependencies = [
 "phf_generator",
 "phf_shared",
@@ -563,9 +655,9 @@ dependencies = [

 [[package]]
 name = "phf_shared"
-version = "0.11.3"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
 dependencies = [
 "siphasher",
 ]
@@ -585,6 +677,16 @@ dependencies = [
 "zerocopy",
 ]

+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.95"
@@ -609,6 +711,12 @@ version = "5.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"

+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "rand"
 version = "0.8.5"
@@ -622,12 +730,13 @@ dependencies = [

 [[package]]
 name = "rand"
-version = "0.9.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
 dependencies = [
- "rand_chacha 0.9.0",
- "rand_core 0.9.3",
+ "chacha20",
+ "getrandom 0.4.2",
+ "rand_core 0.10.0",
 ]

 [[package]]
@@ -642,12 +751,12 @@ dependencies = [

 [[package]]
 name = "rand_chacha"
-version = "0.9.0"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+checksum = "3e6af7f3e25ded52c41df4e0b1af2d047e45896c2f3281792ed68a1c243daedb"
 dependencies = [
 "ppv-lite86",
- "rand_core 0.9.3",
+ "rand_core 0.10.0",
 ]

 [[package]]
@@ -661,21 +770,18 @@ dependencies = [

 [[package]]
 name = "rand_core"
-version = "0.9.3"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
-dependencies = [
- "getrandom 0.3.3",
-]
+checksum = "0c8d0fd677905edcbeedbf2edb6494d676f0e98d54d5cf9bda0b061cb8fb8aba"

 [[package]]
 name = "rand_distr"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a8615d50dcf34fa31f7ab52692afec947c4dd0ab803cc87cb3b0b4570ff7463"
+checksum = "4d431c2703ccf129de4d45253c03f49ebb22b97d6ad79ee3ecfc7e3f4862c1d8"
 dependencies = [
 "num-traits",
- "rand 0.9.1",
+ "rand 0.10.0",
 ]

 [[package]]
@@ -729,19 +835,35 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

 [[package]]
-name = "serde"
-version = "1.0.219"
+name = "semver"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -814,9 +936,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

 [[package]]
 name = "syn"
-version = "2.0.101"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce2b7fc941b3a24138a0a7cf8e858bfc6a992e7978a068a5c760deb0ed43caf"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -928,6 +1050,12 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"

+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
 [[package]]
 name = "utf8parse"
 version = "0.2.2"
@@ -961,6 +1089,24 @@ dependencies = [
 "wit-bindgen-rt",
 ]

+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.100"
@@ -1018,6 +1164,40 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
 [[package]]
 name = "windows"
 version = "0.58.0"
@@ -1155,6 +1335,26 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
 [[package]]
 name = "wit-bindgen-rt"
 version = "0.39.0"
@@ -1164,6 +1364,74 @@ dependencies = [
 "bitflags",
 ]

+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
 [[package]]
 name = "y-octo"
 version = "0.0.2"
@@ -1177,8 +1445,8 @@ dependencies = [
 "nanoid",
 "nom",
 "ordered-float",
- "rand 0.9.1",
- "rand_chacha 0.9.0",
+ "rand 0.10.0",
+ "rand_chacha 0.10.0",
 "rand_distr",
 "serde",
 "serde_json",
@@ -1192,8 +1460,8 @@ version = "0.0.0"
 dependencies = [
 "lib0",
 "libfuzzer-sys",
- "rand 0.9.1",
- "rand_chacha 0.9.0",
+ "rand 0.10.0",
+ "rand_chacha 0.10.0",
 "y-octo",
 "y-octo-utils",
 "yrs",
@@ -1207,17 +1475,17 @@ dependencies = [
 "clap",
 "lib0",
 "phf",
- "rand 0.9.1",
- "rand_chacha 0.9.0",
+ "rand 0.10.0",
+ "rand_chacha 0.10.0",
 "y-octo",
 "yrs",
 ]

 [[package]]
 name = "yrs"
-version = "0.23.1"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a7cab84724ae7f361a8c92465f5160922cbb941a499e1a8cacd103351ab9c78"
+checksum = "f6893d39bc55d014e4a1d0e71d06c0c41590d5cdeac35c126be44998bc320cff"
 dependencies = [
 "arc-swap",
 "async-lock",
@@ -1228,7 +1496,7 @@ dependencies = [
 "serde_json",
 "smallstr",
 "smallvec",
- "thiserror 1.0.69",
+ "thiserror 2.0.12",
 ]

 [[package]]
--- a/packages/common/y-octo/utils/fuzz/Cargo.toml
+++ b/packages/common/y-octo/utils/fuzz/Cargo.toml
@@ -10,9 +10,9 @@ version = "0.0.0"
 [dependencies]
 lib0          = "=0.16.10"
 libfuzzer-sys = "0.4"
-rand          = "0.9"
-rand_chacha   = "0.9"
-yrs           = "=0.23.1"
+rand          = "0.10"
+rand_chacha   = "0.10"
+yrs           = "=0.25.0"

 y-octo-utils = { path = "..", features = ["fuzz"] }

--- a/packages/frontend/admin/package.json
+++ b/packages/frontend/admin/package.json
@@ -45,7 +45,7 @@
    "embla-carousel-react": "^8.5.1",
    "input-otp": "^1.4.1",
    "lodash-es": "^4.17.23",
-    "lucide-react": "^0.508.0",
+    "lucide-react": "^0.577.0",
    "next-themes": "^0.4.4",
    "react": "^19.2.1",
    "react-day-picker": "^9.4.3",
--- a/packages/frontend/apps/android/App/capacitor-cordova-android-plugins/build.gradle
+++ b/packages/frontend/apps/android/App/capacitor-cordova-android-plugins/build.gradle
@@ -9,7 +9,7 @@ buildscript {
        mavenCentral()
    }
    dependencies {
-        classpath 'com.android.tools.build:gradle:8.10.0'
+        classpath 'com.android.tools.build:gradle:8.13.2'
    }
 }

--- a/packages/frontend/apps/android/App/gradle/libs.versions.toml
+++ b/packages/frontend/apps/android/App/gradle/libs.versions.toml
@@ -1,44 +1,44 @@
 [versions]
-android-gradle-plugin          = "8.10.0"
-androidx-activity-compose      = "1.10.1"
-androidx-appcompat             = "1.7.0"
-androidx-browser               = "1.8.0"
-androidx-compose-bom           = "2025.05.00"
+android-gradle-plugin          = "8.13.2"
+androidx-activity-compose      = "1.13.0"
+androidx-appcompat             = "1.7.1"
+androidx-browser               = "1.9.0"
+androidx-compose-bom           = "2025.12.01"
 androidx-coordinatorlayout     = "1.3.0"
-androidx-core-ktx              = "1.16.0"
-androidx-core-splashscreen     = "1.0.1"
-androidx-datastore-preferences = "1.2.0-alpha02"
-androidx-espresso-core         = "3.6.1"
-androidx-junit                 = "1.2.1"
-androidx-lifecycle-compose     = "2.9.0"
+androidx-core-ktx              = "1.18.0"
+androidx-core-splashscreen     = "1.2.0"
+androidx-datastore-preferences = "1.2.1"
+androidx-espresso-core         = "3.7.0"
+androidx-junit                 = "1.3.0"
+androidx-lifecycle-compose     = "2.10.0"
 androidx-material3             = "1.3.1"
-androidx-navigation            = "2.9.0"
-apollo                         = "4.2.0"
-apollo-kotlin-adapters         = "0.0.6"
+androidx-navigation            = "2.9.7"
+apollo                         = "4.4.2"
+apollo-kotlin-adapters         = "0.7.0"
 # @keep
 compileSdk                 = "36"
-firebase-bom               = "33.13.0"
-firebase-crashlytics       = "3.0.3"
-google-services            = "4.4.2"
-gradle-versions            = "0.52.0"
-hilt                       = "2.56.2"
-hilt-ext                   = "1.2.0"
-jna                        = "5.17.0"
+firebase-bom               = "33.16.0"
+firebase-crashlytics       = "3.0.6"
+google-services            = "4.4.4"
+gradle-versions            = "0.53.0"
+hilt                       = "2.59.2"
+hilt-ext                   = "1.3.0"
+jna                        = "5.18.1"
 junit                      = "4.13.2"
-kotlin                     = "2.1.20"
+kotlin                     = "2.3.20"
 kotlinx-coroutines         = "1.10.2"
-kotlinx-datetime           = "0.6.2"
-kotlinx-serialization-json = "1.8.1"
-ksp                        = "2.1.20-2.0.1"
+kotlinx-datetime           = "0.7.1-0.6.x-compat"
+kotlinx-serialization-json = "1.10.0"
+ksp                        = "2.3.6"
 # @keep
 minSdk               = "23"
 mozilla-rust-android = "0.9.6"
-okhttp-bom           = "5.0.0-alpha.14"
-richtext             = "1.0.0-alpha02"
+okhttp-bom           = "5.3.2"
+richtext             = "1.0.0-alpha03"
 # @keep
 targetSdk              = "35"
 timber                 = "5.0.1"
-version-catalog-update = "1.0.0"
+version-catalog-update = "1.1.0"

 [libraries]
 android-gradle-plugin                    = { module = "com.android.tools.build:gradle", version.ref = "android-gradle-plugin" }
--- a/packages/frontend/apps/android/App/gradle/wrapper/gradle-wrapper.properties
+++ b/packages/frontend/apps/android/App/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.4-all.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/packages/frontend/apps/electron/package.json
+++ b/packages/frontend/apps/electron/package.json
@@ -62,7 +62,7 @@
    "electron-log": "^5.4.3",
    "electron-squirrel-startup": "1.0.1",
    "electron-window-state": "^5.0.3",
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.27.0",
    "fs-extra": "^11.2.0",
    "glob": "^11.0.0",
    "lodash-es": "^4.17.23",
--- a/packages/frontend/component/package.json
+++ b/packages/frontend/component/package.json
@@ -53,7 +53,7 @@
    "dayjs": "^1.11.13",
    "emoji-mart": "^5.6.0",
    "emojibase-data": "^16.0.3",
-    "foxact": "^0.2.49",
+    "foxact": "^0.3.0",
    "jotai": "^2.10.3",
    "lit": "^3.2.1",
    "lodash-es": "^4.17.23",
@@ -62,7 +62,7 @@
    "nanoid": "^5.1.6",
    "next-themes": "^0.4.4",
    "react": "^19.2.1",
-    "react-dom": "19.2.1",
+    "react-dom": "19.2.4",
    "react-paginate": "^8.3.0",
    "react-router-dom": "^6.30.3",
    "react-transition-state": "^2.2.0",
--- a/packages/frontend/core/package.json
+++ b/packages/frontend/core/package.json
@@ -60,7 +60,7 @@
    "eventemitter2": "^6.4.9",
    "file-type": "^21.0.0",
    "filesize": "^10.1.6",
-    "foxact": "^0.2.49",
+    "foxact": "^0.3.0",
    "fuse.js": "^7.0.0",
    "graphemer": "^1.4.0",
    "graphql": "^16.9.0",
@@ -70,7 +70,7 @@
    "image-blob-reduce": "^4.1.0",
    "is-svg": "^6.1.0",
    "jotai": "^2.10.3",
-    "jotai-scope": "^0.7.2",
+    "jotai-scope": "^0.10.0",
    "katex": "^0.16.27",
    "lib0": "^0.2.114",
    "lit": "^3.2.1",
--- a/packages/frontend/core/src/blocksuite/ai/components/ai-chat-content/ai-chat-content.spec.ts
+++ b/packages/frontend/core/src/blocksuite/ai/components/ai-chat-content/ai-chat-content.spec.ts
@@ -0,0 +1,41 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { describe, expect, test, vi } from 'vitest';
+
+import { AIChatContent } from './ai-chat-content';
+
+describe('AIChatContent pinned scroll tracking', () => {
+  test('records scroll position from the chat messages host', async () => {
+    let scrollEndHandler: (() => void) | undefined;
+
+    const chatMessages = {
+      scrollTop: 256,
+      updateComplete: Promise.resolve(),
+      addEventListener: vi.fn((event: string, handler: EventListener) => {
+        if (event === 'scrollend') {
+          scrollEndHandler = handler as () => void;
+        }
+      }),
+    };
+
+    const content = {
+      chatMessagesRef: { value: chatMessages },
+      _scrollListenersInitialized: false,
+      lastScrollTop: undefined,
+    } as unknown as AIChatContent;
+
+    (AIChatContent.prototype as any)._initializeScrollListeners.call(content);
+    await chatMessages.updateComplete;
+    await Promise.resolve();
+
+    expect(chatMessages.addEventListener).toHaveBeenCalledWith(
+      'scrollend',
+      expect.any(Function)
+    );
+
+    scrollEndHandler?.();
+
+    expect((content as any).lastScrollTop).toBe(256);
+  });
+});
--- a/packages/frontend/core/src/blocksuite/ai/components/ai-chat-messages/ai-chat-messages.spec.ts
+++ b/packages/frontend/core/src/blocksuite/ai/components/ai-chat-messages/ai-chat-messages.spec.ts
@@ -0,0 +1,50 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
+
+import { AIChatMessages } from './ai-chat-messages';
+
+describe('AIChatMessages scrolling', () => {
+  beforeEach(() => {
+    vi.stubGlobal('requestAnimationFrame', (cb: FrameRequestCallback) => {
+      cb(0);
+      return 1;
+    });
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  test('scrollToEnd scrolls the host element', () => {
+    const scrollTo = vi.fn();
+    const element = {
+      scrollTo,
+    } as unknown as AIChatMessages;
+
+    Object.defineProperty(element, 'scrollHeight', {
+      configurable: true,
+      value: 480,
+    });
+
+    AIChatMessages.prototype.scrollToEnd.call(element);
+
+    expect(scrollTo).toHaveBeenCalledWith({
+      top: 480,
+      behavior: 'smooth',
+    });
+  });
+
+  test('scrollToPos scrolls the host element', () => {
+    const scrollTo = vi.fn();
+    const element = {
+      scrollTo,
+    } as unknown as AIChatMessages;
+
+    AIChatMessages.prototype.scrollToPos.call(element, 128);
+
+    expect(scrollTo).toHaveBeenCalledWith({ top: 128 });
+  });
+});
--- a/packages/frontend/core/src/blocksuite/ai/components/ai-message-content/rich-text.ts
+++ b/packages/frontend/core/src/blocksuite/ai/components/ai-message-content/rich-text.ts
@@ -32,6 +32,7 @@ export class ChatContentRichText extends WithDisposable(ShadowlessElement) {
      extensions: this.extensions,
      affineFeatureFlagService: this.affineFeatureFlagService,
      theme: this.theme,
+      scrollable: false,
    })(text, this.state)}`;
  }
 }
--- a/packages/frontend/core/src/blocksuite/ai/components/text-renderer.ts
+++ b/packages/frontend/core/src/blocksuite/ai/components/text-renderer.ts
@@ -85,6 +85,7 @@ export type TextRendererOptions = {
  testId?: string;
  affineFeatureFlagService?: FeatureFlagService;
  theme?: Signal<ColorScheme>;
+  scrollable?: boolean;
 };

 // todo: refactor it for more general purpose usage instead of AI only?
@@ -140,9 +141,12 @@ export class TextRenderer extends SignalWatcher(
    }

    .text-renderer-container {
+      padding: 0;
+    }
+
+    .text-renderer-container.scrollable {
      overflow-y: auto;
      overflow-x: hidden;
-      padding: 0;
      overscroll-behavior-y: none;
    }
    .text-renderer-container.show-scrollbar::-webkit-scrollbar {
@@ -325,6 +329,7 @@ export class TextRenderer extends SignalWatcher(
    const classes = classMap({
      'text-renderer-container': true,
      'custom-heading': !!customHeading,
+      scrollable: this.options.scrollable !== false,
    });
    const theme = this.options.theme?.value;
    return html`
--- a/packages/frontend/native/package.json
+++ b/packages/frontend/native/package.json
@@ -25,7 +25,7 @@
    ]
  },
  "devDependencies": {
-    "@napi-rs/cli": "3.5.0",
+    "@napi-rs/cli": "3.5.1",
    "@napi-rs/whisper": "^0.0.4",
    "@types/node": "^22.0.0",
    "ava": "^7.0.0",
--- a/tools/cli/package.json
+++ b/tools/cli/package.json
@@ -38,7 +38,7 @@
    "postcss-loader": "^8.1.1",
    "postcss-selector-parser": "^7.1.0",
    "prettier": "^3.7.4",
-    "react-refresh": "^0.17.0",
+    "react-refresh": "^0.18.0",
    "source-map-loader": "^5.0.0",
    "style-loader": "^4.0.0",
    "swc-loader": "^0.2.6",
--- a/yarn.lock
+++ b/yarn.lock