Update non-dev dependencies to patch security advisories (#2017)

* Update non-dev dependencies and patch transitive advisories

* Fix cva wrapper for beta.8 required config property

* Migrate zod schemas to v4 error API

* Update snapshots for base-ui id counter changes

Author: kylemh

package.json

@@ -34,39 +34,39 @@
     "vitest": "cross-env vitest --config ./vitest.config.mts"
   },
   "dependencies": {
-    "@base-ui/react": "^1.4.1",
-    "@hookform/resolvers": "^5.2.2",
+    "@base-ui/react": "^1.6.0",
+    "@hookform/resolvers": "^5.4.3",
     "@mdx-js/loader": "^3.1.1",
     "@mdx-js/react": "^3.1.1",
-    "@next/bundle-analyzer": "^16.2.6",
-    "@next/mdx": "^16.2.6",
-    "@radix-ui/react-dialog": "1.1.15",
-    "@radix-ui/react-tabs": "1.1.13",
-    "@sentry/nextjs": "^10.52.0",
+    "@next/bundle-analyzer": "^16.2.11",
+    "@next/mdx": "^16.2.11",
+    "@radix-ui/react-dialog": "1.1.23",
+    "@radix-ui/react-tabs": "1.1.21",
+    "@sentry/nextjs": "^10.68.0",
     "@types/airtable": "^0.10.5",
-    "@types/mdx": "^2.0.13",
+    "@types/mdx": "^2.0.14",
     "airtable": "^0.12.2",
-    "axios": "^1.15.2",
-    "cva": "^1.0.0-beta.4",
-    "fast-xml-parser": "^5.7.0",
+    "axios": "^1.18.1",
+    "cva": "1.0.0-beta.8",
+    "fast-xml-parser": "^5.10.1",
     "fingerprintjs2": "^2.1.4",
     "fontfaceobserver": "^2.3.0",
     "lodash": "^4.18.1",
     "logrocket": "^12.1.1",
-    "logrocket-react": "^7.0.0",
-    "lucide-react": "^1.14.0",
-    "next": "^16.2.6",
+    "logrocket-react": "^7.0.1",
+    "lucide-react": "^1.26.0",
+    "next": "^16.2.11",
     "next-sitemap": "^4.2.3",
     "object-hash": "^3.0.0",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
-    "react-hook-form": "^7.75.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "react-hook-form": "^7.83.0",
     "react-player": "^3.4.0",
     "react-select": "^5.10.2",
     "remark-gfm": "^4.0.1",
     "tailwind-merge": "^3.6.0",
     "tw-animate-css": "^1.4.0",
-    "zod": "^3.25.76"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@eslint-react/eslint-plugin": "^4.2.3",

pnpm-lock.yaml

@@ -34,3 +34,10 @@ allowBuilds:
 
 overrides:
   vite: '^8.0.0'
+  # Security patches for transitive deps flagged by `pnpm audit` whose parents
+  # have not yet released a bump. Remove an entry once the parent pulls it in.
+  'brace-expansion@5': '>=5.0.8' # via @sentry/nextjs (build). Only the 5.x copy.
+  fast-uri: '^3.1.4' # via @hookform/resolvers>ajv. Stay on 3.x for ajv compat.
+  postcss: '^8.5.18' # via next / @mdx-js/loader>webpack.
+  sharp: '^0.35.0' # via next image optimization (runtime).
+  valibot: '^1.4.2' # via @hookform/resolvers (unused resolver).

pnpm-workspace.yaml

@@ -6,7 +6,7 @@ import type { DefaultValues, Resolver } from 'react-hook-form';
 import { useForm, FormProvider } from 'react-hook-form';
 import { zodResolver } from '@hookform/resolvers/zod';
 import type { AxiosError } from 'axios';
-import type { ZodTypeAny } from 'zod';
+import type { ZodType } from 'zod';
 import {
   MULTI_STEP_STEP_BUTTON,
   MULTI_STEP_SUBMIT_BUTTON,
@@ -24,7 +24,7 @@ export interface StepComponent<T extends Record<string, unknown>> extends Functi
   title: string;
   initialValues: Partial<T>;
   submitHandler?: (values: Partial<T>) => Promise<void>;
-  validationSchema: ZodTypeAny;
+  validationSchema: ZodType<Record<string, unknown>, Record<string, unknown>>;
 }
 
 interface MultiStepFormProps<T extends Record<string, unknown>> {
@@ -123,7 +123,7 @@ function StepFormInner<T extends Record<string, unknown>>({
               className={cn('group', isFirstStep && 'w-full')}
             >
               <span className="flex items-center justify-center gap-x-2">
-                {formState.isSubmitting && <InlineLoadingSpinner className="-mt-[0.325rem]" />}
+                {formState.isSubmitting && <InlineLoadingSpinner className="mt-[-0.325rem]" />}
                 <span>Next →</span>
               </span>
             </Button>

src/components/Form/MultiStepForm.tsx

@@ -29,10 +29,10 @@ const registrationSchema = z
     lastName: z.string().trim().min(1, validationErrorMessages.required),
     zipcode: z.string().trim().min(1, validationErrorMessages.required),
     codeOfConduct: z.literal(true, {
-      errorMap: () => ({ message: validationErrorMessages.codeOfConduct }),
+      error: validationErrorMessages.codeOfConduct,
     }),
     slackGuidelines: z.literal(true, {
-      errorMap: () => ({ message: validationErrorMessages.slackGuidelines }),
+      error: validationErrorMessages.slackGuidelines,
     }),
   })
   .refine((data) => data.email === data['confirm-email'], {

src/components/Forms/RegistrationForm/RegistrationForm.tsx

@@ -31,7 +31,7 @@ exports[`NavMobile > should render 1`] = `
       data-base-ui-click-trigger=""
       data-slot="sheet-trigger"
       data-testid="Hamburger Button"
-      id="base-ui-_r_2_"
+      id="base-ui-_r_1_"
       name="dropdown"
       tabindex="0"
       type="button"

src/components/Nav/NavMobile/__tests__/__snapshots__/NavMobile.test.tsx.snap

@@ -31,7 +31,7 @@ exports[`Nav > should render with no props passed 1`] = `
       data-base-ui-click-trigger=""
       data-slot="sheet-trigger"
       data-testid="Hamburger Button"
-      id="base-ui-_r_2_"
+      id="base-ui-_r_1_"
       name="dropdown"
       tabindex="0"
       type="button"

src/components/Nav/__tests__/__snapshots__/Nav.test.tsx.snap

@@ -59,7 +59,7 @@ exports[`TimelineNav > should render with no props passed passed 1`] = `
         aria-haspopup="menu"
         class="w-full cursor-pointer rounded-lg border border-border bg-background px-4 py-2 text-left text-lg font-bold"
         data-slot="dropdown-menu-trigger"
-        id="base-ui-_r_4_"
+        id="base-ui-_r_3_"
         tabindex="0"
         type="button"
       >

src/components/Timeline/TimelineNav/__tests__/__snapshots__/TimelineNav.test.tsx.snap

@@ -20,10 +20,8 @@ export const cn = (...classes: ClassValue[]) => twMerge(clsx(...classes));
  */
 export const cva: CVA = (props) => {
   const cvaFn = cvaOriginal(props);
-  return (...args: Parameters<typeof cvaFn>) => {
-    const result = cvaFn(...args);
-    return twMerge(result);
-  };
+  const component = (...args: Parameters<typeof cvaFn>) => twMerge(cvaFn(...args));
+  return Object.assign(component, { config: cvaFn.config });
 };
 
 // eslint-disable-next-line no-barrel-files/no-barrel-files