chore(deps): bump the minor-and-patch group across 1 directory with 26 updates

[dependabot]

Bumps the minor-and-patch group with 25 updates in the / directory:

Package	From	To
@ai-sdk/provider-utils	5.0.27	5.0.28
@astryxdesign/cli	0.4.0	0.4.5
@astryxdesign/core	0.4.0	0.4.5
@biomejs/biome	2.5.6	2.5.9
@types/node	26.1.2	26.2.0
knip	6.26.0	6.32.2
@ai-sdk/anthropic	4.0.39	4.0.40
@ai-sdk/code-mode	1.0.23	1.0.27
@ai-sdk/cohere	4.0.27	4.0.28
@ai-sdk/google	4.0.44	4.0.47
@ai-sdk/open-responses	2.0.28	2.0.29
@ai-sdk/openai	4.0.42	4.0.44
@ai-sdk/openai-compatible	3.0.30	3.0.32
@larksuiteoapi/node-sdk	1.72.0	1.73.0
@openai/agents-core	0.14.3	0.17.0
ai	7.0.66	7.0.70
ws	8.21.2	8.21.3
electron	43.2.0	43.4.1
@earendil-works/pi-tui	0.83.0	0.84.2
lucide-react	1.28.0	1.33.0
mermaid	11.16.1	11.17.0
@astryxdesign/theme-neutral	0.4.0	0.4.5
@storybook/react-vite	10.5.6	10.5.10
@vitejs/plugin-react	6.0.5	6.1.0
vite	8.1.5	8.2.2

Updates @ai-sdk/provider-utils from 5.0.27 to 5.0.28

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

5.0.28

Patch Changes

• e6087c9: fix: handle empty string tool call IDs

Commits

• 97a9489 Version Packages (#19085)
• 52eff91 Version Packages (#18698)
• 7fbfc6d fix: preserve streamed size-limit errors when response cancellation fails (#1...
• cbdbeee Version Packages (#18645)
• 401a4ba fix: allow AI SDK packages to import in runtimes without global fetch (#18535)
• 63db193 Version Packages (#18587)
• 81cd026 perf: make zod imports tree-shakeable (#18304)
• ae26160 Version Packages (#18566)
• 1937bef fix(provider-utils): make URL regex checks stateless (#18570)
• bb31e6b Version Packages (#18508)
• Additional commits viewable in compare view

Updates @astryxdesign/cli from 0.4.0 to 0.4.5

Release notes

Sourced from @​astryxdesign/cli's releases.

v0.4.5

Astryx 0.4.5 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Features

• BottomSheet: snapPoints makes the drag-to-resize stops the host's choice. A stop is the sheet's visible height, written as a viewport fraction (0.5), a percentage ('50%'), or a px length ('320px') — matching height, where a bare number is also px and a string carries its unit. Fractions and percentages re-resolve when the viewport changes, so a sheet keeps the stop the user chose across a rotation, and swapping the points under a resting sheet re-anchors it the same way. A stop of a quarter of the sheet or less is a peek: it slides away rather than reflowing into a sliver, and thins the scrim. Taller stops are working surfaces, so they lay their content out and keep the scrim full — previously the shortest stop was always a peek, which would have thinned the backdrop of a half-height sheet (#5203). Behavior change, deliberate and not breaking: every sheet used to carry three built-in stops (14%, 50% and 92% of the viewport), so a drag could leave it resting somewhere the host never asked for. A sheet now opens and closes unless snapPoints says otherwise; pass snapPoints={[0.14, 0.5, 0.92]} to keep the old stops. No prop, type, or DOM output was removed or renamed, and swipe-to-dismiss, the height budgets, and mobile-keyboard accommodation are untouched.

• Astryx ships translations for 28 more locales. packages/core/locales/ went from en and fr-FR to 30 files — Arabic, Catalan, Chinese (Simplified and Traditional), Czech, Danish, Dutch, Finnish, German, Greek, Hebrew, Hungarian, Italian, Japanese, Korean, Norwegian, Polish, Portuguese (Brazil and Portugal), Romanian, Russian, Serbian, Spanish, Swedish, Turkish, Ukrainian, Vietnamese and Afrikaans — covering every @astryx.* message the components announce or display (#5185). Nothing changes unless you ask for it: InternationalizationProvider still defaults to English, and the catalogs are loaded through the existing ./locales/*.json export. An app that already passes a locale now gets translated component strings where it previously fell back to English.

  The catalogs come from Crowdin and are refreshed nightly (#5186), so a translation landing upstream reaches a release without anyone opening a PR by hand.

• DateRangeInput / Calendar: add maxRangeSpan and minRangeSpan to constrain the size of a selected range. Once a start date is picked, days outside the allowed window are disabled — e.g. maxRangeSpan={7} keeps the range within a 7-day window of the start (#5145).

• FormLayout: add defaultOptionality — set a form-wide default ('optional' or 'required') so only the exception carries a visible indicator. Under 'optional' only isRequired fields show one; under 'required' only isOptional fields do; a field that restates the default shows nothing. Under 'required' the unmarked fields also expose aria-required so screen readers match what sighted users see — resolved on aria-required only, never the native required attribute. Unset keeps today's per-field behavior (#4791).

• Add astryx-input-clear-button theme target on the shared clear button wrapper. Themes can now control the clear button's height and hover independently of other ghost buttons — for example suppressing the hover fill or matching a different element size scale (#5093).

Fixes

• BottomSheet: a pull up from the scroll area now expands the sheet on iOS. Below the tallest detent, dragging up inside the content did nothing on a real device while the grab handle worked — the sheet took the gesture and then froze for the rest of the pull. iOS Safari raises PointerEvents for a finger under the same numeric id it puts in Touch.identifier, so the drag the touch path started was keyed to a live pointer: beginDrag captured that pointer, WebKit handed the capture straight back, and the lostpointercapture a millisecond later cancelled the drag. Touch-driven drags are now marked as such — they take no pointer capture, and lostpointercapture, pointercancel and pointermove for that same finger no longer cancel, end or double-drive them. Browsers that keep the two id spaces apart were never affected, which is why this only showed up on device (#5178).
• Calendar weekday headers now use compact CLDR stand-alone-short names for the selected locale, while preserving the existing Su / Mo / Tu English labels.
• Render generated id attributes on Markdown headings so Outline hash links scroll to their target. Heading slugs now come from parser helpers shared with parseOutlineFromMarkdown, and the components.heading override receives the generated id (#4765).
• StatusDot: pair each variant with a distinct built-in shape drawn from the system's semantic icon vocabulary — success a check, warning an exclamation, error a cross, neutral a ring, accent the plain filled dot — so status no longer relies on colour alone (WCAG 2.1 SC 1.4.1). The shapes mirror the marks Banner/FieldStatus render via defaultIcons, a different axis of consistency from AvatarStatusDot's presence shapes (the two share only the neutral ring, intentionally). The diagonal check and cross take a slightly heavier stroke so they stay crisp and distinct at 8px. Also adds an icon prop for API parity with AvatarStatusDot: a rendered icon replaces the built-in glyph, while booleans and empty renders are ignored so cond && <Icon /> stays safe. The built-in glyphs resolve through the icon registry under scoped statusdot:<variant> keys (the richtext:* precedent), so themes can reshape a variant's mark everywhere via defineTheme({icons}) / registerIcons — including marks for augmented custom variants — while overrides of the standard 24px semantic icons deliberately do not leak into the 8px field. Themes can also target the new stable astryx-statusdot-glyph class and its data-shape attribute — a stroked inline <svg> painted from the dot's currentColor (#4373).
• Table's row-expansion chevron now mirrors correctly under RTL. It previously rotated on expand with no RTL handling at all, so the directional glyph pointed the same way regardless of text direction, matching the pattern already used by TreeListItem's chevron (#5153).

Contributors

Thanks to everyone who contributed to this release:

@​athz @​bhamodi @​cixzhang @​freddymeta @​HelloOjasMutreja @​imdreamrunner @​jiunshinn @​nynexman4464

Full Changelog: facebook/astryx@v0.4.4...v0.4.5

v0.4.4

Astryx 0.4.4 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Components

• Promote BottomSheet and BottomSheetSwitcher from the canary-only Lab package to Core. The stable package now includes their existing native-dialog, drag-detent, transition, and mobile-keyboard behavior, plus Core documentation and examples (#5080).

... (truncated)

Changelog

Sourced from @​astryxdesign/cli's changelog.

0.4.5

---

0.4.4

New Components

• Promote BottomSheet and BottomSheetSwitcher from the canary-only Lab package to Core. The stable package now includes their existing native-dialog, drag-detent, transition, and mobile-keyboard behavior, plus Core documentation and examples (#5080).

New Features

• astryx template --cdn writes a working no-build-step CDN starter page (#5068). A CDN starter is a template, so it joins the template family beside --skeleton rather than claiming a top-level command. It is a flag and not the positional astryx template cdn because the positional resolves against everything discoverAll() finds, where a cdn id would shadow a discovered template. cdn.template.html loads Astryx from jsDelivr and esm.sh with no bundler, no install and no build step, with every CDN URL pinned to the Astryx version you have installed — an unpinned CDN URL resolves to whatever is latest and is cached hard, so a page written today breaks tomorrow without being edited. An existing file is never clobbered; --overwrite replaces it, and --json returns the receipt.

  The annotations are the things that are load-bearing and silent when missing: ?external=react,react-dom (without it esm.sh bundles a second React and every hook throws Cannot read properties of null (reading 'useState')), react/jsx-runtime in the import map (the published bundle imports it; omitting it fails the page with Failed to resolve module specifier), and a font-family on body (nothing in the stylesheets sets a document font, so Button — which is font: inherit — otherwise renders its label in the browser's default serif).

  Three more lessons came out of building a real app on it. The page now <link>s the theme's webfont from Google Fonts, because the theme names Figtree and never loads it, so every viewer silently got the fallback stack (#5015 again). It imports the theme OBJECT and wraps in <Theme theme={neutralTheme} mode="system">, so light and dark follow the OS — the data-astryx-theme attribute alone scopes the stylesheet but cannot switch modes. And #root:empty carries a "Loading…" state, because ESM-from-CDN has real latency and a blank page reads as broken. Markup is htm, with a comment saying it is optional and createElement is the dependency-free alternative.

  A recipe that is only read is a recipe that is only assumed to work, so CI renders it: .github/scripts/cdn-template-smoke-test.mjs scaffolds the page with the real CLI and opens it in headless Chromium, failing on any console error, page error or failed request, and on a page that loads without rendering.

• astryx theme build takes any number of theme files — astryx theme build themes/*.ts compiles them all in one process, so an app with several themes no longer hand-rolls a loop that re-enters the CLI once per theme. Outputs are byte-identical to the serial invocations; the run stops at the first failure and names the theme that failed. The CLI's Node floor (>=22.13) is now declared in engines, so a package manager can enforce it at install instead of the build failing later (#5121).

• defineTheme: color.accent accepts a [light, dark] tuple (#2279) ColorScaleConfig.accent now takes either a single hex or a [light, dark] tuple, matching TokenValue. With a tuple, expandColorScale derives the light half of every generated light-dark() pair from the light seed's palettes and the dark half from the dark seed's, so each scheme gets a consistent derived palette (muted, on-accent, neutrals) instead of the tokens['--color-accent'] workaround that skips scale generation. Single-string configs are unchanged, token for token. Also documents the precedence between color and tokens for accent-derived values: tokens entries win token by token, the var(--color-accent) reference tokens follow a --color-accent override at runtime, and the baked --color-on-accent stays derived from the color.accent seed.

Fixes

• Bottom Sheet showcase block: the filter checkboxes are interactive again (#5157). CheckboxInput is fully controlled — value is required and the input only moves when the owner updates it. The showcase passed a literal value={false} with no onChange, so the three filters ("In stock", "On sale", "Free shipping") rendered but could never be toggled: on the docs site the first thing a reader tries in a Bottom Sheet does nothing, and anyone copying the block inherits three dead controls. Each filter now has its own useState and onChange, matching the checkbox wiring already used in the Bottom Sheet Switcher showcase.

• An integration whose manifest fails to load is no longer silent. A manifest that throws on import — the common case being one still calling a create* authoring factory, removed in 0.3.0 — contributes nothing, and the CLI treated that as if the package had never been configured: astryx discover answered No integrations configured. while astryx.config.mjs plainly configured one, and no command said a word. The only way to find out was to already suspect it and run validate-integration by name. Meta's internal @nest/xds-meta sat invisible to CLI discovery for a week that way, and the app team's conclusion was that the components did not exist (#5119). The load error now counts as an integration issue, so the existing one-line stderr nudge fires on component, template and upgrade, and discover — the command whose whole job is listing integrations — nudges too, as does search. discover also stops reporting configured: false for a project that configured an integration that failed to load; the empty state now distinguishes "you configured nothing" from "what you configured contributed nothing", which is the distinction meta.configured was introduced to carry.

  Nothing becomes fatal: the warning is best-effort, stderr-only, suppressed under --json, and never changes an exit code. Broken contributions are still skipped exactly as before.

Contributors

Thanks to everyone who contributed to this release:

• @​cixzhang
• @​imdreamrunner
• @​jiunshinn

---

0.4.3

Fixes

• The unloaded-font advisory is a notice, not a warning. A theme file cannot load a font — Astryx sets --font-family-* and loading is the app's job — so #5045's advisory fires on any theme naming a webfont, including a perfectly correct one. As a warning that made a clean build read as defective, and it put the shipped template permanently in violation of its own "compiles with no warnings" guard (#5079 had to allowlist the template's two font names in that assertion). The theme.build receipt now separates the two: warnings are defects the author should fix, notices are advisories about a correct theme. The font advisory moves to notices and to stdout with the rest of the build's progress; stderr stays for defects. The template guard is back to warnings being empty, and no longer needs to know which fonts the template names.

... (truncated)

Commits

• 683015a chore: version packages for v0.4.5
• 0e8af82 feat(core): let the Bottom Sheet's host choose its snap points (#5203)
• 14ba912 chore: version packages for v0.4.4
• 972a316 chore(templates): remove abandoned table-page chart/heatmap experiments (#5167)
• dc90488 fix(cli): wire state into the Bottom Sheet showcase checkboxes (#5157)
• 6e7f89c feat(core): promote Bottom Sheet from Lab (#5080)
• 915a7aa fix(cli): a broken integration manifest fails loudly instead of vanishing (#5...
• 71781fc feat(cli): astryx theme build takes any number of themes — one invocation, ...
• ac850d9 feat(cli): astryx template --cdn — an ESM CDN recipe that is verified by rend...
• 5939961 feat(theme): accept a [light, dark] tuple for defineTheme color.accent (#2279...
• Additional commits viewable in compare view

Updates @astryxdesign/core from 0.4.0 to 0.4.5

Release notes

Sourced from @​astryxdesign/core's releases.

v0.4.5

Astryx 0.4.5 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Features

• BottomSheet: snapPoints makes the drag-to-resize stops the host's choice. A stop is the sheet's visible height, written as a viewport fraction (0.5), a percentage ('50%'), or a px length ('320px') — matching height, where a bare number is also px and a string carries its unit. Fractions and percentages re-resolve when the viewport changes, so a sheet keeps the stop the user chose across a rotation, and swapping the points under a resting sheet re-anchors it the same way. A stop of a quarter of the sheet or less is a peek: it slides away rather than reflowing into a sliver, and thins the scrim. Taller stops are working surfaces, so they lay their content out and keep the scrim full — previously the shortest stop was always a peek, which would have thinned the backdrop of a half-height sheet (#5203). Behavior change, deliberate and not breaking: every sheet used to carry three built-in stops (14%, 50% and 92% of the viewport), so a drag could leave it resting somewhere the host never asked for. A sheet now opens and closes unless snapPoints says otherwise; pass snapPoints={[0.14, 0.5, 0.92]} to keep the old stops. No prop, type, or DOM output was removed or renamed, and swipe-to-dismiss, the height budgets, and mobile-keyboard accommodation are untouched.

• Astryx ships translations for 28 more locales. packages/core/locales/ went from en and fr-FR to 30 files — Arabic, Catalan, Chinese (Simplified and Traditional), Czech, Danish, Dutch, Finnish, German, Greek, Hebrew, Hungarian, Italian, Japanese, Korean, Norwegian, Polish, Portuguese (Brazil and Portugal), Romanian, Russian, Serbian, Spanish, Swedish, Turkish, Ukrainian, Vietnamese and Afrikaans — covering every @astryx.* message the components announce or display (#5185). Nothing changes unless you ask for it: InternationalizationProvider still defaults to English, and the catalogs are loaded through the existing ./locales/*.json export. An app that already passes a locale now gets translated component strings where it previously fell back to English.

  The catalogs come from Crowdin and are refreshed nightly (#5186), so a translation landing upstream reaches a release without anyone opening a PR by hand.

• DateRangeInput / Calendar: add maxRangeSpan and minRangeSpan to constrain the size of a selected range. Once a start date is picked, days outside the allowed window are disabled — e.g. maxRangeSpan={7} keeps the range within a 7-day window of the start (#5145).

• FormLayout: add defaultOptionality — set a form-wide default ('optional' or 'required') so only the exception carries a visible indicator. Under 'optional' only isRequired fields show one; under 'required' only isOptional fields do; a field that restates the default shows nothing. Under 'required' the unmarked fields also expose aria-required so screen readers match what sighted users see — resolved on aria-required only, never the native required attribute. Unset keeps today's per-field behavior (#4791).

• Add astryx-input-clear-button theme target on the shared clear button wrapper. Themes can now control the clear button's height and hover independently of other ghost buttons — for example suppressing the hover fill or matching a different element size scale (#5093).

Fixes

• BottomSheet: a pull up from the scroll area now expands the sheet on iOS. Below the tallest detent, dragging up inside the content did nothing on a real device while the grab handle worked — the sheet took the gesture and then froze for the rest of the pull. iOS Safari raises PointerEvents for a finger under the same numeric id it puts in Touch.identifier, so the drag the touch path started was keyed to a live pointer: beginDrag captured that pointer, WebKit handed the capture straight back, and the lostpointercapture a millisecond later cancelled the drag. Touch-driven drags are now marked as such — they take no pointer capture, and lostpointercapture, pointercancel and pointermove for that same finger no longer cancel, end or double-drive them. Browsers that keep the two id spaces apart were never affected, which is why this only showed up on device (#5178).
• Calendar weekday headers now use compact CLDR stand-alone-short names for the selected locale, while preserving the existing Su / Mo / Tu English labels.
• Render generated id attributes on Markdown headings so Outline hash links scroll to their target. Heading slugs now come from parser helpers shared with parseOutlineFromMarkdown, and the components.heading override receives the generated id (#4765).
• StatusDot: pair each variant with a distinct built-in shape drawn from the system's semantic icon vocabulary — success a check, warning an exclamation, error a cross, neutral a ring, accent the plain filled dot — so status no longer relies on colour alone (WCAG 2.1 SC 1.4.1). The shapes mirror the marks Banner/FieldStatus render via defaultIcons, a different axis of consistency from AvatarStatusDot's presence shapes (the two share only the neutral ring, intentionally). The diagonal check and cross take a slightly heavier stroke so they stay crisp and distinct at 8px. Also adds an icon prop for API parity with AvatarStatusDot: a rendered icon replaces the built-in glyph, while booleans and empty renders are ignored so cond && <Icon /> stays safe. The built-in glyphs resolve through the icon registry under scoped statusdot:<variant> keys (the richtext:* precedent), so themes can reshape a variant's mark everywhere via defineTheme({icons}) / registerIcons — including marks for augmented custom variants — while overrides of the standard 24px semantic icons deliberately do not leak into the 8px field. Themes can also target the new stable astryx-statusdot-glyph class and its data-shape attribute — a stroked inline <svg> painted from the dot's currentColor (#4373).
• Table's row-expansion chevron now mirrors correctly under RTL. It previously rotated on expand with no RTL handling at all, so the directional glyph pointed the same way regardless of text direction, matching the pattern already used by TreeListItem's chevron (#5153).

Contributors

Thanks to everyone who contributed to this release:

@​athz @​bhamodi @​cixzhang @​freddymeta @​HelloOjasMutreja @​imdreamrunner @​jiunshinn @​nynexman4464

Full Changelog: facebook/astryx@v0.4.4...v0.4.5

v0.4.4

Astryx 0.4.4 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Components

• Promote BottomSheet and BottomSheetSwitcher from the canary-only Lab package to Core. The stable package now includes their existing native-dialog, drag-detent, transition, and mobile-keyboard behavior, plus Core documentation and examples (#5080).

... (truncated)

Changelog

Sourced from @​astryxdesign/core's changelog.

0.4.5

New Features

• BottomSheet: snapPoints makes the drag-to-resize stops the host's choice. A stop is the sheet's visible height, written as a viewport fraction (0.5), a percentage ('50%'), or a px length ('320px') — matching height, where a bare number is also px and a string carries its unit. Fractions and percentages re-resolve when the viewport changes, so a sheet keeps the stop the user chose across a rotation, and swapping the points under a resting sheet re-anchors it the same way. A stop of a quarter of the sheet or less is a peek: it slides away rather than reflowing into a sliver, and thins the scrim. Taller stops are working surfaces, so they lay their content out and keep the scrim full — previously the shortest stop was always a peek, which would have thinned the backdrop of a half-height sheet (#5203). Behavior change, deliberate and not breaking: every sheet used to carry three built-in stops (14%, 50% and 92% of the viewport), so a drag could leave it resting somewhere the host never asked for. A sheet now opens and closes unless snapPoints says otherwise; pass snapPoints={[0.14, 0.5, 0.92]} to keep the old stops. No prop, type, or DOM output was removed or renamed, and swipe-to-dismiss, the height budgets, and mobile-keyboard accommodation are untouched.

• Astryx ships translations for 28 more locales. packages/core/locales/ went from en and fr-FR to 30 files — Arabic, Catalan, Chinese (Simplified and Traditional), Czech, Danish, Dutch, Finnish, German, Greek, Hebrew, Hungarian, Italian, Japanese, Korean, Norwegian, Polish, Portuguese (Brazil and Portugal), Romanian, Russian, Serbian, Spanish, Swedish, Turkish, Ukrainian, Vietnamese and Afrikaans — covering every @astryx.* message the components announce or display (#5185). Nothing changes unless you ask for it: InternationalizationProvider still defaults to English, and the catalogs are loaded through the existing ./locales/*.json export. An app that already passes a locale now gets translated component strings where it previously fell back to English.

  The catalogs come from Crowdin and are refreshed nightly (#5186), so a translation landing upstream reaches a release without anyone opening a PR by hand.

• DateRangeInput / Calendar: add maxRangeSpan and minRangeSpan to constrain the size of a selected range. Once a start date is picked, days outside the allowed window are disabled — e.g. maxRangeSpan={7} keeps the range within a 7-day window of the start (#5145).

• FormLayout: add defaultOptionality — set a form-wide default ('optional' or 'required') so only the exception carries a visible indicator. Under 'optional' only isRequired fields show one; under 'required' only isOptional fields do; a field that restates the default shows nothing. Under 'required' the unmarked fields also expose aria-required so screen readers match what sighted users see — resolved on aria-required only, never the native required attribute. Unset keeps today's per-field behavior (#4791).

• Add astryx-input-clear-button theme target on the shared clear button wrapper. Themes can now control the clear button's height and hover independently of other ghost buttons — for example suppressing the hover fill or matching a different element size scale (#5093).

Fixes

• BottomSheet: a pull up from the scroll area now expands the sheet on iOS. Below the tallest detent, dragging up inside the content did nothing on a real device while the grab handle worked — the sheet took the gesture and then froze for the rest of the pull. iOS Safari raises PointerEvents for a finger under the same numeric id it puts in Touch.identifier, so the drag the touch path started was keyed to a live pointer: beginDrag captured that pointer, WebKit handed the capture straight back, and the lostpointercapture a millisecond later cancelled the drag. Touch-driven drags are now marked as such — they take no pointer capture, and lostpointercapture, pointercancel and pointermove for that same finger no longer cancel, end or double-drive them. Browsers that keep the two id spaces apart were never affected, which is why this only showed up on device (#5178).
• Calendar weekday headers now use compact CLDR stand-alone-short names for the selected locale, while preserving the existing Su / Mo / Tu English labels.
• Render generated id attributes on Markdown headings so Outline hash links scroll to their target. Heading slugs now come from parser helpers shared with parseOutlineFromMarkdown, and the components.heading override receives the generated id (#4765).
• StatusDot: pair each variant with a distinct built-in shape drawn from the system's semantic icon vocabulary — success a check, warning an exclamation, error a cross, neutral a ring, accent the plain filled dot — so status no longer relies on colour alone (WCAG 2.1 SC 1.4.1). The shapes mirror the marks Banner/FieldStatus render via defaultIcons, a different axis of consistency from AvatarStatusDot's presence shapes (the two share only the neutral ring, intentionally). The diagonal check and cross take a slightly heavier stroke so they stay crisp and distinct at 8px. Also adds an icon prop for API parity with AvatarStatusDot: a rendered icon replaces the built-in glyph, while booleans and empty renders are ignored so cond && <Icon /> stays safe. The built-in glyphs resolve through the icon registry under scoped statusdot:<variant> keys (the richtext:* precedent), so themes can reshape a variant's mark everywhere via defineTheme({icons}) / registerIcons — including marks for augmented custom variants — while overrides of the standard 24px semantic icons deliberately do not leak into the 8px field. Themes can also target the new stable astryx-statusdot-glyph class and its data-shape attribute — a stroked inline <svg> painted from the dot's currentColor (#4373).
• Table's row-expansion chevron now mirrors correctly under RTL. It previously rotated on expand with no RTL handling at all, so the directional glyph pointed the same way regardless of text direction, matching the pattern already used by TreeListItem's chevron (#5153).

Contributors

Thanks to everyone who contributed to this release:

• @​athz
• @​bhamodi
• @​cixzhang
• @​freddymeta
• @​HelloOjasMutreja
• @​imdreamrunner
• @​jiunshinn
• @​nynexman4464

---

0.4.4

New Components

• Promote BottomSheet and BottomSheetSwitcher from the canary-only Lab package to Core. The stable package now includes their existing native-dialog, drag-detent, transition, and mobile-keyboard behavior, plus Core documentation and examples (#5080).

New Features

• astryx template --cdn writes a working no-build-step CDN starter page (#5068). A CDN starter is a template, so it joins the template family beside --skeleton rather than claiming a top-level command. It is a flag and not the positional astryx template cdn because the positional resolves against everything discoverAll() finds, where a cdn id would shadow a discovered template. cdn.template.html loads Astryx from jsDelivr and esm.sh with no bundler, no install and no build step, with every CDN URL pinned to the Astryx version you have installed — an unpinned CDN URL resolves to whatever is latest and is cached hard, so a page written today breaks tomorrow without being edited. An existing file is never clobbered; --overwrite replaces it, and --json returns the receipt.

  The annotations are the things that are load-bearing and silent when missing: ?external=react,react-dom (without it esm.sh bundles a second React and every hook throws Cannot read properties of null (reading 'useState')), react/jsx-runtime in the import map (the published bundle imports it; omitting it fails the page with Failed to resolve module specifier), and a font-family on body (nothing in the stylesheets sets a document font, so Button — which is font: inherit — otherwise renders its label in the browser's default serif).

... (truncated)

Commits

• 683015a chore: version packages for v0.4.5
• 46b0532 fix(Calendar): localize compact weekday headers from CLDR (#5190)
• 6bd4a75 fix(core): render Markdown heading ids so Outline links scroll (#4173) (#4765)
• 0e8af82 feat(core): let the Bottom Sheet's host choose its snap points (#5203)
• 1cd52d9 feat(DateRangeInput): add maxRangeSpan/minRangeSpan to constrain range size (...
• 22e61b5 feat(FormLayout): add defaultOptionality — mark only the exception (#4791)
• 0f4d45f fix(core): add StatusDot icon prop; keep the dot a plain colored signal (#4373)
• ea7fc8c fix(Table): mirror the row-expansion chevron under RTL (#5153)
• 955be19 feat(core): add input-clear-button theme target on the shared clear button wr...
• dd146da chore(i18n): translations update from Crowdin (#5185)
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.6 to 2.5.9

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.9

2.5.9

Patch Changes

• #11321 41386f3 Thanks @​dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

• #11248 57b197e Thanks @​yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.

• #11377 a8798ea Thanks @​Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.

  @layer {
    a {
      color: red;
    }
  }

• #11327 6771cf5 Thanks @​dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.

   <div>
     <!-- first group -->
  +
     <!-- second group -->
   </div>

• #10312 ba8aa18 Thanks @​dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

• #11333 715e0cd Thanks @​kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.

• #11343 9b98211 Thanks @​johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.

  @variant @xl {
    div {
      background: red;
    }
  }

• #11220 3e8c488 Thanks @​santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

  For example, Biome no longer reports greet as undeclared in the following Svelte component:

  <script module>

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.9

Patch Changes

• #11321 41386f3 Thanks @​dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

• #11248 57b197e Thanks @​yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.

• #11377 a8798ea Thanks @​Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.

  @layer {
    a {
      color: red;
    }
  }

• #11327 6771cf5 Thanks @​dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.

   <div>
     <!-- first group -->
  +
     <!-- second group -->
   </div>

• #10312 ba8aa18 Thanks @​dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

• #11333 715e0cd Thanks @​kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.

• #11343 9b98211 Thanks @​johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.

  @variant @xl {
    div {
      background: red;
    }
  }

• #11220 3e8c488 Thanks @​santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

  For example, Biome no longer reports greet as undeclared in the following Svelte component:

  <script module>
    export function greet() {
      console.log("Hello!");

... (truncated)

Commits

• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• e65f07e feat(lint): nursery useControlLabel (#11312)
• ba8aa18 feat(lint): add useTailwindShorthandClasses (#10312)
• 6b8f09c ci: release (#11236)
• 23c0369 feat(lint): nursery noInvalidPropertyInitValue (#11187)
• 52b44d6 feat(lint/html): add noSvelteLegacyConst (#11247)
• 0a0fbc1 feat(lint/js): add useReactCompiler (#10710)
• Additional commits viewable in compare view

Updates @types/node from 26.1.2 to 26.2.0

Commits

• See full diff in compare view

Updates knip from 6.26.0 to 6.32.2

Release notes

Sourced from knip's releases.

Release 6.32.2

• Support oxfmt.config.mts (

[ARE404]

Astryx/UI lane reviewed at exact head 4a9c3cedb18e9683009361d3ce004e748014fd1e. No P0–P2 findings. The 0.4.5 patch applies cleanly and preserves the prior 21-file seam set (including 0.4.5's SideNavItem rest forwarding); generated theme and 206-file inventory gates are current; @maka/ui passes 226/226; ChatLayout's spacious message/dock widths remain 800px; and the package/test/audit checks are terminal success. Two non-blocking P3 maintainability/process comments are attached.

[ARE404]

[P3] Please add representative before/after screenshots or a recording for this design-system bump. CONTRIBUTING.md requires visual evidence for UI changes, and Astryx 0.4.5 includes visible component updates (for example StatusDot glyphs, TreeList spacing, and selector/menu presentation) in addition to the regenerated Maka theme. The current PR description has no visual evidence, so those upstream appearance changes are not reviewable from the PR itself.

[ARE404]

[P3] Consider extracting the Linkedom/React client-mount environment into a shared test helper. This new setup duplicates the global replacement/restoration and identical getComputedStyle stub in composer-send-toggle.test.tsx; keeping two copies makes future Astryx layer-environment changes easy to apply to only one test.

[Astro-Han]

Cross-team review of this dependency bump was split into three lanes (Astryx/UI, runtime + AI SDK, platform/build/licenses). This comment carries the platform/licenses lane's blocking finding, which I independently reproduced against the exact head before publishing.

One [P1] below, in the newly generated Desktop third-party notices. It is a legal-text correctness issue rather than a build issue, which is why every hosted check is green and the byte-level --check guard still passes: those guards only prove the committed output matches the generator's own override table, and the override table is where the wrong text is authored.

To be explicit about gate state: this is an unresolved P1, so it blocks merge regardless of the existing approval on this head. Nothing else in the platform, Vite/Storybook, Knip, Electron, or dead-export lanes reached P0–P2, and the Astryx/UI lane reported no P0–P2 either.

[jackwener]

代表 WAWQAQ，授权范围：runtime / AI SDK dependency lane；exact head 4a9c3cedb18e9683009361d3ce004e748014fd1e。

This lane is GO with no P0–P3 findings. I verified the @openai/agents-core 0.17 applyDiff contract, the byte-equivalent provider-utils 5.0.28 patch retarget (including mutation-sensitive streamed tool-call tests), the pi-tui TUI → TuiMainScreen adaptation, the Lark Channel surface, and the bumped AI SDK/provider integrations. The full Runtime suite passed with 2,977 pass / 13 skip / 0 fail; CLI passed 418/418; focused provider/patch/Lark tests passed 43/43; the full build passed; and production-only npm audit reported zero vulnerabilities.

I am intentionally not approving this head: review 5002999010 has an unresolved same-head P1 in the generated license notices. The runtime/AI SDK lane is clear, but the PR-wide gate is not.

[ARE404]

Astryx/UI freshness recheck at exact head 9f1168c49230ddc945207aa74f3f92959b65403f. The post-review delta from 4a9c3ced is confined to Desktop third-party notices, their generator, and its regression test; it has zero diff in Astryx/theme/UI paths, so the prior Astryx/UI conclusions remain valid. Main now contains #3645’s identical inventory-206 blob, so that inventory hunk is already absorbed without conflict.

[jackwener]

代表 WAWQAQ，授权范围：runtime / AI SDK dependency lane；exact head 9f1168c49230ddc945207aa74f3f92959b65403f。

Incremental re-review: this lane remains GO with no P0–P3 findings. Relative to the previously reviewed head 4a9c3cedb18e9683009361d3ce004e748014fd1e, the new commit changes exactly three license-only files: the generated Desktop notice, its generator, and its regression test. The packages/runtime, packages/runtime-host, and packages/cli tree objects are byte-identical; package.json, package-lock.json, and patches/ are unchanged. Therefore the prior runtime / AI SDK / CLI evidence and mutation results remain applicable without rerunning the 2,977-test runtime suite.

This COMMENT records lane coverage only. Final PR-wide APPROVE is assigned to the 404ARE publisher after its own freshness check and terminal exact-head CI; I am not issuing a duplicate approval and will not merge.

[Astro-Han]

Closing out the [P1] I raised on the previous head: it is fixed.

I verified 9f1168c492 against the exact tarballs again. fastdom@1.0.12 now reads Copyright (c) 2016 Wilson Page <wilsonpage@me.com> and strictdom@1.0.1 reads Copyright (c) 2013 Wilson Page <wilsonpage@me.com>, both byte-identical to the MIT block in each package's README.md, down to the (The MIT License) heading and the single-quoted 'Software'. The invented co-holder is gone.

What makes this a real fix rather than a string patch: the two entries were removed from MIT_COPYRIGHT_OVERRIDES entirely and replaced by version-pinned complete blocks in a new MIT_TEXT_OVERRIDES, and the comment now states outright that neither the package author nor its contributor list is a license authority. That is the faulty premise, corrected at the source.

Two other reviewers independently checked the blast radius and both found the override is reachable only for these two exact name@version keys and only when the selected license is MIT — the other 332 notice sections are byte-unchanged. One of them also noted the net change is −24 lines rather than the −44 I quoted from the file's diff stat; theirs is the more precise number.

The remaining [P3] on the new regression test is worth doing but does not block: the test asserts the copyright line and a clause fragment rather than the complete block, so its "exact notices" name promises more coverage than it delivers. Pinning the full block or a digest would close that gap.

No P0–P2 outstanding from my side on this head.

[jackwener]

代表 WAWQAQ，授权范围：runtime / AI SDK independent review and final member-level review action；exact head 9f1168c49230ddc945207aa74f3f92959b65403f。

APPROVE. My runtime / AI SDK / CLI lane is independently GO with no P0–P3 findings; the only post-review delta from 4a9c3ced is confined to the generated license notice, its generator, and its regression test, so the prior mutation and full-suite evidence remains applicable. The prior license P1 is closed on this exact head, the other independent lanes report no P0–P2, and the exact-head audit, test, and package check-runs are all completed/success. The PR is OPEN, non-draft, and MERGEABLE, with no current live P0–P2 hold. Remaining P3 comments are non-blocking.

This is an approval only. No merge is performed.