Update all npm dependencies (2025-11-10)

[depfu]

This is your weekly update of all npm dependencies. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ @flexpa/link (1.0.2 → 1.1.2, minor)

↗️ @floating-ui/core (indirect, 1.6.9 → 1.7.3, minor) · Repo · Changelog

↗️ @floating-ui/dom (indirect, 1.6.13 → 1.7.4, minor) · Repo · Changelog

↗️ @floating-ui/utils (indirect, 0.2.9 → 0.2.10, minor) · Repo · Changelog

✳️ @medplum/core (3.2.27 → 3.3.0, minor) · Repo · Release · Diff

✳️ @radix-ui/react-select (2.1.2 → 2.2.6, minor) · Repo

↗️ @radix-ui/react-visually-hidden (indirect, 1.1.0 → 1.2.3, minor) · Repo

✳️ @types/node (20.17.3 → 20.19.24, minor) · Repo

✳️ class-variance-authority (0.7.0 → 0.7.1, minor) · Repo · Release · Diff

✳️ jose (5.9.6 → 5.10.0, minor) · Repo · Changelog · Release · Diff

✳️ postcss (8.4.47 → 8.5.6, minor) · Repo · Changelog · Release · Diff

↗️ react-remove-scroll (indirect, 2.6.0 → 2.7.1, minor) · Repo · Changelog · Diff

✳️ tailwind-merge (2.5.4 → 2.6.0, minor) · Repo · Release · Diff

✳️ typescript (5.6.3 → 5.9.3, minor) · Repo · Release · Diff

↗️ undici-types (indirect, 6.19.8 → 6.21.0, minor) · Repo · Release · Diff

↗️ @floating-ui/react-dom (indirect, 2.1.2 → 2.1.6, patch) · Repo · Changelog

✳️ @radix-ui/react-accordion (1.2.2 → 1.2.12, patch) · Repo

↗️ @radix-ui/react-collapsible (indirect, 1.1.2 → 1.1.12, patch) · Repo

↗️ @radix-ui/react-id (indirect, 1.1.0 → 1.1.1, patch) · Repo

↗️ @radix-ui/react-portal (indirect, 1.1.2 → 1.1.9, patch) · Repo

✳️ @radix-ui/react-scroll-area (1.2.2 → 1.2.10, patch) · Repo

✳️ @radix-ui/react-separator (1.1.0 → 1.1.8, patch) · Repo

✳️ @radix-ui/react-tabs (1.1.2 → 1.1.13, patch) · Repo

↗️ @radix-ui/react-use-callback-ref (indirect, 1.1.0 → 1.1.1, patch) · Repo

✳️ @types/react (18.3.12 → 18.3.26, patch) · Repo

✳️ @types/react-dom (18.3.1 → 18.3.7, patch) · Repo

↗️ jiti (indirect, 1.21.6 → 1.21.7, patch) · Repo · Changelog · Release · Diff

↗️ nanoid (indirect, 3.3.8 → 3.3.11, patch) · Repo · Changelog · Release · Diff

✳️ tailwindcss (3.4.14 → 3.4.18, patch) · Repo · Changelog · Release · Diff

---

👉 No CI detected

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

* [Circle CI](https://circleci.com), [Semaphore ](https://semaphoreci.com) and [Github Actions](https://docs.github.com/actions) are all excellent options. * If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github. * If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with `depfu/`.

---

Depfu will only send you the next scheduled PR once you merge or close this one.

All Depfu comment commands

@​depfu refresh

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

Go to the Depfu Dashboard to see the state of your dependencies and to customize how Depfu works.

---

Important

Update all npm dependencies to latest minor and patch versions for regular maintenance.

• Dependencies Updated:
  • Direct dependencies: @flexpa/link to 1.1.2, @medplum/core to 3.3.0, @radix-ui/react-select to 2.2.6, jose to 5.10.0, tailwind-merge to 2.6.0, typescript to 5.9.3.
  • Indirect dependencies: @floating-ui/core, @floating-ui/dom, @floating-ui/utils, @radix-ui/react-visually-hidden, react-remove-scroll, undici-types, and others.
• DevDependencies Updated:
  • @types/node to 20.19.24, @types/react to 18.3.26, @types/react-dom to 18.3.7, tailwindcss to 3.4.18.
• Misc:
  • Regular weekly update of npm dependencies.
  • No CI detected; recommendation to set up CI for testing updates.

^{This description was created by for d70589a. You can customize this summary. It will automatically update as commits are pushed.}

[ellipsis-dev]

Important

Looks good to me! 👍

Reviewed everything up to d70589a in 1 minute and 22 seconds. Click for details.

• Reviewed 48 lines of code in 1 files
• Skipped 1 files when reviewing.
• Skipped posting 7 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. package.json:11

• Draft comment:
  Updated '@flexpa/link' to 1.1.2. Please review its changelog for any API or behavioral changes.
• Reason this comment was not posted:
  Comment did not seem useful. Confidence is useful = 0% <= threshold 50% This comment is purely informative and asks the PR author to review the changelog, which is against the rules. It doesn't provide a specific suggestion or point out a potential issue with the code.

2. package.json:13

• Draft comment:
  Bumped '@medplum/core' to 3.3.0. Confirm that no breaking changes affect current usage.
• Reason this comment was not posted:
  Comment did not seem useful. Confidence is useful = 0% <= threshold 50% This comment is asking the PR author to confirm that there are no breaking changes, which is against the rules. It is not making a specific suggestion or pointing out a specific issue with the code.

3. package.json:14

• Draft comment:
  Multiple Radix UI packages updated (@radix-ui/react-accordion, react-scroll-area, react-select, react-separator, react-slot, react-tabs). Verify that UI component APIs—especially for '@radix-ui/react-slot' (now 1.2.4)—remain compatible.
• Reason this comment was not posted:
  Comment did not seem useful. Confidence is useful = 0% <= threshold 50% The comment is asking the PR author to verify compatibility of UI component APIs after updating multiple Radix UI packages. This falls under the rule of not asking the author to ensure compatibility or verify behavior, which is not allowed.

4. package.json:20

• Draft comment:
  Updated 'class-variance-authority' to 0.7.1; review usage to ensure no adjustments are needed.
• Reason this comment was not posted:
  Confidence changes required: 33% <= threshold 50% None

5. package.json:22

• Draft comment:
  Bumped 'jose' to 5.10.0. Ensure that authentication and security-related functions work as expected.
• Reason this comment was not posted:
  Comment did not seem useful. Confidence is useful = 0% <= threshold 50% This comment is related to a dependency change, specifically the version bump of the jose library. The comment asks the PR author to ensure that authentication and security-related functions work as expected, which falls under the rule of not asking the author to ensure behavior is intended or tested. Therefore, this comment should be removed.

6. package.json:27

• Draft comment:
  Upgraded 'tailwind-merge' to 2.6.0. Check that class merging behavior in Tailwind remains consistent.
• Reason this comment was not posted:
  Confidence changes required: 33% <= threshold 50% None

7. package.json:39

• Draft comment:
  Bumped 'tailwindcss' to 3.4.18 in devDependencies. Verify compatibility with existing Tailwind configurations and plugins.
• Reason this comment was not posted:
  Confidence changes required: 33% <= threshold 50% None

Workflow ID: wflow_ZJBBhQWaPxlbisIt

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}