From 705a371433910f4a4bb0e00612493c6d44648781 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 12:28:29 +1000
Subject: [PATCH 1/5] chore(deps): bump the npm_and_yarn group across 9
 directories with 1 update (#7324)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the npm_and_yarn group with 1 update in the
/examples/next/kitchen-sink directory:
[next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the
/examples/next/tina-self-hosted-demo directory:
[next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the
/packages/@tinacms/auth directory:
[next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the
/packages/next-tinacms-azure directory:
[next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the
/packages/next-tinacms-cloudinary directory:
[next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the
/packages/next-tinacms-dos directory:
[next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the
/packages/next-tinacms-s3 directory:
[next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the /packages/tinacms
directory: [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the
/playwright/tina-playwright directory:
[next](https://github.com/vercel/next.js).

Updates `next` from 15.5.12 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 15.5.12 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 15.5.12 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 15.5.12 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 15.5.12 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 15.5.12 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 15.5.12 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 15.5.12 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 15.5.12 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 14.2.35 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 14.2.35 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 14.2.35 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 14.2.35 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v15.5.20</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 15.5.15.</p>
<h2>15.5.19</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>[15.5.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li>
</ul>
<h3>Other</h3>
<ul>
<li>[15.5.x] Fix CI (<a
href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for
helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a>
v15.5.21</li>
<li><a
href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a>
[15.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a>
[15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a>
[15.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a>
[15.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a>
[15.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a>
[15.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a>
[15.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a>
[15.x] Performance improvements when decoding React Server function
payloads</li>
<li><a
href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a>
[15.x] Validate server reference IDs during manifest lookup</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Updates `next` from 14.2.35 to 15.5.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.21</h2>
<p>This release contains securi...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com>
Co-authored-by: kulesy <kulewidak@gmail.com>
---
 examples/next/kitchen-sink/package.json       |   2 +-
 .../next/tina-self-hosted-demo/package.json   |   2 +-
 packages/@tinacms/auth/package.json           |   2 +-
 packages/next-tinacms-azure/package.json      |   2 +-
 packages/next-tinacms-cloudinary/package.json |   2 +-
 packages/next-tinacms-dos/package.json        |   2 +-
 packages/next-tinacms-s3/package.json         |   2 +-
 packages/tinacms/package.json                 |   2 +-
 playwright/tina-playwright/package.json       |   2 +-
 pnpm-lock.yaml                                | 457 ++++++------------
 10 files changed, 153 insertions(+), 322 deletions(-)

diff --git a/examples/next/kitchen-sink/package.json b/examples/next/kitchen-sink/package.json
index 7c25590359..a5712b6dea 100644
--- a/examples/next/kitchen-sink/package.json
+++ b/examples/next/kitchen-sink/package.json
@@ -22,7 +22,7 @@
     "clsx": "^2.1.1",
     "graphql": "^15.10.1",
     "mongodb-level": "^0.0.4",
-    "next": "15.5.12",
+    "next": "15.5.21",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-icons": "^4.12.0",
diff --git a/examples/next/tina-self-hosted-demo/package.json b/examples/next/tina-self-hosted-demo/package.json
index 102aeb9ea7..9c0f8dab67 100644
--- a/examples/next/tina-self-hosted-demo/package.json
+++ b/examples/next/tina-self-hosted-demo/package.json
@@ -19,7 +19,7 @@
     "@tinacms/datalayer": "workspace:*",
     "date-fns": "^2.30.0",
     "mongodb-level": "^0.0.3",
-    "next": "14.2.35",
+    "next": "15.5.21",
     "next-auth": "^4.24.15",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
diff --git a/packages/@tinacms/auth/package.json b/packages/@tinacms/auth/package.json
index ac5b4e5b78..09260df0d3 100644
--- a/packages/@tinacms/auth/package.json
+++ b/packages/@tinacms/auth/package.json
@@ -25,7 +25,7 @@
     "@tinacms/scripts": "workspace:*",
     "@types/jest": "^29.5.14",
     "jest": "catalog:",
-    "next": "14.2.35",
+    "next": "15.5.21",
     "ts-jest": "catalog:",
     "typescript": "^5.7.3"
   },
diff --git a/packages/next-tinacms-azure/package.json b/packages/next-tinacms-azure/package.json
index 9a6d6f4dd6..66e305117a 100644
--- a/packages/next-tinacms-azure/package.json
+++ b/packages/next-tinacms-azure/package.json
@@ -40,7 +40,7 @@
     "@types/crypto-js": "^3.1.47",
     "@types/js-cookie": "^2.2.7",
     "@types/node": "^22.13.1",
-    "next": "14.2.35",
+    "next": "15.5.21",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "tinacms": "workspace:*",
diff --git a/packages/next-tinacms-cloudinary/package.json b/packages/next-tinacms-cloudinary/package.json
index 643c749ff1..8a256c8728 100644
--- a/packages/next-tinacms-cloudinary/package.json
+++ b/packages/next-tinacms-cloudinary/package.json
@@ -31,7 +31,7 @@
     "@types/crypto-js": "^3.1.47",
     "@types/js-cookie": "^2.2.7",
     "@types/node": "^22.13.1",
-    "next": "14.2.35",
+    "next": "15.5.21",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "tinacms": "workspace:*",
diff --git a/packages/next-tinacms-dos/package.json b/packages/next-tinacms-dos/package.json
index 2470a3d3f8..def9ddcd1a 100644
--- a/packages/next-tinacms-dos/package.json
+++ b/packages/next-tinacms-dos/package.json
@@ -30,7 +30,7 @@
     "@types/crypto-js": "^3.1.47",
     "@types/js-cookie": "^2.2.7",
     "@types/node": "^22.13.1",
-    "next": "14.2.35",
+    "next": "15.5.21",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "tinacms": "workspace:*",
diff --git a/packages/next-tinacms-s3/package.json b/packages/next-tinacms-s3/package.json
index 40b694ba87..c85e4bc93a 100644
--- a/packages/next-tinacms-s3/package.json
+++ b/packages/next-tinacms-s3/package.json
@@ -28,7 +28,7 @@
     "@types/js-cookie": "^2.2.7",
     "@types/node": "^22.13.1",
     "@types/react": "^18.3.18",
-    "next": "14.2.35",
+    "next": "15.5.21",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "tinacms": "workspace:*",
diff --git a/packages/tinacms/package.json b/packages/tinacms/package.json
index 3c41c95da5..596fb04c52 100644
--- a/packages/tinacms/package.json
+++ b/packages/tinacms/package.json
@@ -135,7 +135,7 @@
     "identity-obj-proxy": "catalog:",
     "jest-file-snapshot": "^0.7.0",
     "lowlight": "catalog:",
-    "next": "14.2.35",
+    "next": "15.5.21",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-is": "^18.3.1",
diff --git a/playwright/tina-playwright/package.json b/playwright/tina-playwright/package.json
index f269e882f3..f03730ba05 100644
--- a/playwright/tina-playwright/package.json
+++ b/playwright/tina-playwright/package.json
@@ -11,7 +11,7 @@
   },
   "dependencies": {
     "axios": "catalog:",
-    "next": "14.2.35",
+    "next": "15.5.21",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-is": "^18.3.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index da5327b194..84163226a0 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -958,8 +958,8 @@ importers:
         specifier: ^0.0.4
         version: 0.0.4(mongodb@4.17.2)
       next:
-        specifier: 15.5.12
-        version: 15.5.12(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+        specifier: 15.5.21
+        version: 15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
       react:
         specifier: ^18.3.1
         version: 18.3.1
@@ -1034,11 +1034,11 @@ importers:
         specifier: ^0.0.3
         version: 0.0.3
       next:
-        specifier: 14.2.35
-        version: 14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+        specifier: 15.5.21
+        version: 15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
       next-auth:
         specifier: ^4.24.15
-        version: 4.24.15(next@14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        version: 4.24.15(next@15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       react:
         specifier: ^18.3.1
         version: 18.3.1
@@ -1306,8 +1306,8 @@ importers:
         specifier: 'catalog:'
         version: 29.7.0(@types/node@22.19.17)(babel-plugin-macros@3.1.0)(ts-node@10.9.2(@types/node@22.19.17)(typescript@5.9.3))
       next:
-        specifier: 14.2.35
-        version: 14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-macros@3.1.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(sass@1.97.3)
+        specifier: 15.5.21
+        version: 15.5.21(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(sass@1.97.3)
       ts-jest:
         specifier: 'catalog:'
         version: 29.4.6(@babel/core@7.28.5)(@jest/transform@30.2.0)(@jest/types@30.2.0)(babel-jest@30.2.0(@babel/core@7.29.7))(jest-util@30.2.0)(jest@29.7.0(@types/node@22.19.17)(babel-plugin-macros@3.1.0)(ts-node@10.9.2(@types/node@22.19.17)(typescript@5.9.3)))(typescript@5.9.3)
@@ -2118,8 +2118,8 @@ importers:
         specifier: ^22.13.1
         version: 22.19.3
       next:
-        specifier: 14.2.35
-        version: 14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+        specifier: 15.5.21
+        version: 15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
       react:
         specifier: ^18.3.1
         version: 18.3.1
@@ -2155,8 +2155,8 @@ importers:
         specifier: ^22.13.1
         version: 22.19.3
       next:
-        specifier: 14.2.35
-        version: 14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+        specifier: 15.5.21
+        version: 15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
       react:
         specifier: ^18.3.1
         version: 18.3.1
@@ -2192,8 +2192,8 @@ importers:
         specifier: ^22.13.1
         version: 22.19.3
       next:
-        specifier: 14.2.35
-        version: 14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+        specifier: 15.5.21
+        version: 15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
       react:
         specifier: ^18.3.1
         version: 18.3.1
@@ -2232,8 +2232,8 @@ importers:
         specifier: ^18.3.18
         version: 18.3.27
       next:
-        specifier: 14.2.35
-        version: 14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+        specifier: 15.5.21
+        version: 15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
       react:
         specifier: ^18.3.1
         version: 18.3.1
@@ -2527,8 +2527,8 @@ importers:
         specifier: 'catalog:'
         version: 3.3.0
       next:
-        specifier: 14.2.35
-        version: 14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+        specifier: 15.5.21
+        version: 15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
       react:
         specifier: ^18.3.1
         version: 18.3.1
@@ -2980,8 +2980,8 @@ importers:
         specifier: 'catalog:'
         version: 1.7.5
       next:
-        specifier: 14.2.35
-        version: 14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+        specifier: 15.5.21
+        version: 15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
       react:
         specifier: ^18.3.1
         version: 18.3.1
@@ -3009,7 +3009,7 @@ importers:
         version: 7.32.0
       eslint-config-next:
         specifier: 12.0.3
-        version: 12.0.3(eslint@7.32.0)(next@14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(typescript@5.9.3)
+        version: 12.0.3(eslint@7.32.0)(next@15.5.21(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(typescript@5.9.3)
 
 packages:
 
@@ -5993,46 +5993,25 @@ packages:
       '@emnapi/core': ^1.7.1
       '@emnapi/runtime': ^1.7.1
 
-  '@next/env@14.2.35':
-    resolution: {integrity: sha512-DuhvCtj4t9Gwrx80dmz2F4t/zKQ4ktN8WrMwOuVzkJfBilwAwGr6v16M5eI8yCuZ63H9TTuEU09Iu2HqkzFPVQ==}
-
-  '@next/env@15.5.12':
-    resolution: {integrity: sha512-pUvdJN1on574wQHjaBfNGDt9Mz5utDSZFsIIQkMzPgNS8ZvT4H2mwOrOIClwsQOb6EGx5M76/CZr6G8i6pSpLg==}
-
   '@next/env@15.5.19':
     resolution: {integrity: sha512-sWWluFvcv5v3Fxznmf2ZfjyoVQt/64oCnYqS90inQWGzMPK1VjvekPiz3OPHKmFT30EnHrjlbyaHLt3M0vWabw==}
 
+  '@next/env@15.5.21':
+    resolution: {integrity: sha512-hjJI/GfrjWHgNguRIBzItjRRu0m3Nrz17GhxsjuHfjIvg9hyg3239REd2dpI+bpMTFuVrVprHzEQ19m++cDtbw==}
+
   '@next/eslint-plugin-next@12.0.3':
     resolution: {integrity: sha512-P7i+bMypneQcoRN+CX79xssvvIJCaw7Fndzbe7/lB0+LyRbVvGVyMUsFmLLbSxtZq4hvFMJ1p8wML/gsulMZWQ==}
 
-  '@next/swc-darwin-arm64@14.2.33':
-    resolution: {integrity: sha512-HqYnb6pxlsshoSTubdXKu15g3iivcbsMXg4bYpjL2iS/V6aQot+iyF4BUc2qA/J/n55YtvE4PHMKWBKGCF/+wA==}
-    engines: {node: '>= 10'}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@next/swc-darwin-arm64@15.5.12':
-    resolution: {integrity: sha512-RnRjBtH8S8eXCpUNkQ+543DUc7ys8y15VxmFU9HRqlo9BG3CcBUiwNtF8SNoi2xvGCVJq1vl2yYq+3oISBS0Zg==}
-    engines: {node: '>= 10'}
-    cpu: [arm64]
-    os: [darwin]
-
   '@next/swc-darwin-arm64@15.5.19':
     resolution: {integrity: sha512-jx9wWlTKueHKPvVOndyr7WuaevWCkuYqsQ8gC0TMPKAVWG3MhcdMrjfo9tvIZNXd0QOUYXXvAcZ325y8Uq7uzg==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@next/swc-darwin-x64@14.2.33':
-    resolution: {integrity: sha512-8HGBeAE5rX3jzKvF593XTTFg3gxeU4f+UWnswa6JPhzaR6+zblO5+fjltJWIZc4aUalqTclvN2QtTC37LxvZAA==}
+  '@next/swc-darwin-arm64@15.5.21':
+    resolution: {integrity: sha512-ZfjqPEdi6TRC/fWx7UDbwb1fbVgyh2uD5tVTRKIDZDlYM+UNuE/LafDG2fwuAoZilADpABh46OY/F5qf9JjqLQ==}
     engines: {node: '>= 10'}
-    cpu: [x64]
-    os: [darwin]
-
-  '@next/swc-darwin-x64@15.5.12':
-    resolution: {integrity: sha512-nqa9/7iQlboF1EFtNhWxQA0rQstmYRSBGxSM6g3GxvxHxcoeqVXfGNr9stJOme674m2V7r4E3+jEhhGvSQhJRA==}
-    engines: {node: '>= 10'}
-    cpu: [x64]
+    cpu: [arm64]
     os: [darwin]
 
   '@next/swc-darwin-x64@15.5.19':
@@ -6041,19 +6020,11 @@ packages:
     cpu: [x64]
     os: [darwin]
 
-  '@next/swc-linux-arm64-gnu@14.2.33':
-    resolution: {integrity: sha512-JXMBka6lNNmqbkvcTtaX8Gu5by9547bukHQvPoLe9VRBx1gHwzf5tdt4AaezW85HAB3pikcvyqBToRTDA4DeLw==}
+  '@next/swc-darwin-x64@15.5.21':
+    resolution: {integrity: sha512-TlCf1NpxgQLzTrexuev75xwmNCJMd1/qkJpTVP1GRRcih93hlIBn1P72hkh8T0gnRFr6BmWksQtbyG3jT6jnww==}
     engines: {node: '>= 10'}
-    cpu: [arm64]
-    os: [linux]
-    libc: [glibc]
-
-  '@next/swc-linux-arm64-gnu@15.5.12':
-    resolution: {integrity: sha512-dCzAjqhDHwmoB2M4eYfVKqXs99QdQxNQVpftvP1eGVppamXh/OkDAwV737Zr0KPXEqRUMN4uCjh6mjO+XtF3Mw==}
-    engines: {node: '>= 10'}
-    cpu: [arm64]
-    os: [linux]
-    libc: [glibc]
+    cpu: [x64]
+    os: [darwin]
 
   '@next/swc-linux-arm64-gnu@15.5.19':
     resolution: {integrity: sha512-WeH+nelQyyMeE2f8FxBRZNrGipya5zHZV2vjzfCOAYyiI6am+NbnWAAldOBFQBB2w0DjJcsvrKqoFT2b7+5YoA==}
@@ -6062,19 +6033,12 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@next/swc-linux-arm64-musl@14.2.33':
-    resolution: {integrity: sha512-Bm+QulsAItD/x6Ih8wGIMfRJy4G73tu1HJsrccPW6AfqdZd0Sfm5Imhgkgq2+kly065rYMnCOxTBvmvFY1BKfg==}
+  '@next/swc-linux-arm64-gnu@15.5.21':
+    resolution: {integrity: sha512-LXRsq1p+HvHSi7ygwNcSEEcK0zuo5jS75ZlqFHtOH+LF7qntXAJVJxah+1Pi/GyBm7EpkwU7m4EgbvIKrMqm9A==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
-    libc: [musl]
-
-  '@next/swc-linux-arm64-musl@15.5.12':
-    resolution: {integrity: sha512-+fpGWvQiITgf7PUtbWY1H7qUSnBZsPPLyyq03QuAKpVoTy/QUx1JptEDTQMVvQhvizCEuNLEeghrQUyXQOekuw==}
-    engines: {node: '>= 10'}
-    cpu: [arm64]
-    os: [linux]
-    libc: [musl]
+    libc: [glibc]
 
   '@next/swc-linux-arm64-musl@15.5.19':
     resolution: {integrity: sha512-5xTOE0lDlDCSSfp+BAif7j17VRRCjWp//ZPZy6NI0QpdrhxtQnsZguSx0xAAZ0c9XZLrLLwCe/XVe5YPrRilKw==}
@@ -6083,19 +6047,12 @@ packages:
     os: [linux]
     libc: [musl]
 
-  '@next/swc-linux-x64-gnu@14.2.33':
-    resolution: {integrity: sha512-FnFn+ZBgsVMbGDsTqo8zsnRzydvsGV8vfiWwUo1LD8FTmPTdV+otGSWKc4LJec0oSexFnCYVO4hX8P8qQKaSlg==}
+  '@next/swc-linux-arm64-musl@15.5.21':
+    resolution: {integrity: sha512-hyGixhFxpDKjqoev6l4KlcRBlt9AXWrGhDZwmwg49sMJM5tnKQPSi+SEj9+e5n+l/bthRGZUdh59GKIs6lQPRw==}
     engines: {node: '>= 10'}
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
-  '@next/swc-linux-x64-gnu@15.5.12':
-    resolution: {integrity: sha512-jSLvgdRRL/hrFAPqEjJf1fFguC719kmcptjNVDJl26BnJIpjL3KH5h6mzR4mAweociLQaqvt4UyzfbFjgAdDcw==}
-    engines: {node: '>= 10'}
-    cpu: [x64]
+    cpu: [arm64]
     os: [linux]
-    libc: [glibc]
+    libc: [musl]
 
   '@next/swc-linux-x64-gnu@15.5.19':
     resolution: {integrity: sha512-LTxRmMgqqMv05Had879W00Fm53quiJd3Zuz8h1JSNJ3nGSlbZ/7Tjs1tKyScgN3Au3t3MyPsjPlq60fMmSHLsg==}
@@ -6104,65 +6061,47 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@next/swc-linux-x64-musl@14.2.33':
-    resolution: {integrity: sha512-345tsIWMzoXaQndUTDv1qypDRiebFxGYx9pYkhwY4hBRaOLt8UGfiWKr9FSSHs25dFIf8ZqIFaPdy5MljdoawA==}
+  '@next/swc-linux-x64-gnu@15.5.21':
+    resolution: {integrity: sha512-qfE+YfOba6S2+13e8qn1/UozDVNZ2clBlrs8UtDoax4s8ediu6sq93z66OEHUYlb69Tffh5JTNkgtsAKiSuugg==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
-    libc: [musl]
+    libc: [glibc]
 
-  '@next/swc-linux-x64-musl@15.5.12':
-    resolution: {integrity: sha512-/uaF0WfmYqQgLfPmN6BvULwxY0dufI2mlN2JbOKqqceZh1G4hjREyi7pg03zjfyS6eqNemHAZPSoP84x17vo6w==}
+  '@next/swc-linux-x64-musl@15.5.19':
+    resolution: {integrity: sha512-eoNQSpA5PQfB9wBO4RA47MTDXWz1fizy9Y3Z6e4DetYIF3dvjuu8sj7aIGn/bFCU6lnFzTK34NtCaffP4NsQ7Q==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@next/swc-linux-x64-musl@15.5.19':
-    resolution: {integrity: sha512-eoNQSpA5PQfB9wBO4RA47MTDXWz1fizy9Y3Z6e4DetYIF3dvjuu8sj7aIGn/bFCU6lnFzTK34NtCaffP4NsQ7Q==}
+  '@next/swc-linux-x64-musl@15.5.21':
+    resolution: {integrity: sha512-BXLGG+EvIwp/Rrgl6HY8sqvD6BOUOIRz8/naDbeLNX7mlA5H2XRcL6MW/0IGnJISfj5BA9gNhFyJj5yOoiIDJQ==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@next/swc-win32-arm64-msvc@14.2.33':
-    resolution: {integrity: sha512-nscpt0G6UCTkrT2ppnJnFsYbPDQwmum4GNXYTeoTIdsmMydSKFz9Iny2jpaRupTb+Wl298+Rh82WKzt9LCcqSQ==}
-    engines: {node: '>= 10'}
-    cpu: [arm64]
-    os: [win32]
-
-  '@next/swc-win32-arm64-msvc@15.5.12':
-    resolution: {integrity: sha512-xhsL1OvQSfGmlL5RbOmU+FV120urrgFpYLq+6U8C6KIym32gZT6XF/SDE92jKzzlPWskkbjOKCpqk5m4i8PEfg==}
-    engines: {node: '>= 10'}
-    cpu: [arm64]
-    os: [win32]
-
   '@next/swc-win32-arm64-msvc@15.5.19':
     resolution: {integrity: sha512-6UNt2dFuCHOe446sm/Kp69nUe8/wIhnh9bm6Xcqw4qEWCOppLMOvhTBVgvM7invVUNr4SPpP6NOQsACtn2IN9Q==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@next/swc-win32-ia32-msvc@14.2.33':
-    resolution: {integrity: sha512-pc9LpGNKhJ0dXQhZ5QMmYxtARwwmWLpeocFmVG5Z0DzWq5Uf0izcI8tLc+qOpqxO1PWqZ5A7J1blrUIKrIFc7Q==}
+  '@next/swc-win32-arm64-msvc@15.5.21':
+    resolution: {integrity: sha512-tNGNOlT0Wn7E4IMsSnufjXN/l2L2/AGdLLpa2vzS89SYCBuihgLn3ngLsIrvndAnWo9nAkus+4gZHTI/Ijx9HA==}
     engines: {node: '>= 10'}
-    cpu: [ia32]
-    os: [win32]
-
-  '@next/swc-win32-x64-msvc@14.2.33':
-    resolution: {integrity: sha512-nOjfZMy8B94MdisuzZo9/57xuFVLHJaDj5e/xrduJp9CV2/HrfxTRH2fbyLe+K9QT41WBLUd4iXX3R7jBp0EUg==}
-    engines: {node: '>= 10'}
-    cpu: [x64]
+    cpu: [arm64]
     os: [win32]
 
-  '@next/swc-win32-x64-msvc@15.5.12':
-    resolution: {integrity: sha512-Z1Dh6lhFkxvBDH1FoW6OU/L6prYwPSlwjLiZkExIAh8fbP6iI/M7iGTQAJPYJ9YFlWobCZ1PHbchFhFYb2ADkw==}
+  '@next/swc-win32-x64-msvc@15.5.19':
+    resolution: {integrity: sha512-PhmojAHyqMne56HBLGu9dhDnHPuFmEjrXSQMM/nW0J6j849lk3ESrVtqNJcCk8CKOV7brpTTbaYAjwKPzKM69w==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
 
-  '@next/swc-win32-x64-msvc@15.5.19':
-    resolution: {integrity: sha512-PhmojAHyqMne56HBLGu9dhDnHPuFmEjrXSQMM/nW0J6j849lk3ESrVtqNJcCk8CKOV7brpTTbaYAjwKPzKM69w==}
+  '@next/swc-win32-x64-msvc@15.5.21':
+    resolution: {integrity: sha512-DmIdWmC9p4rdNIiQqo8ap0+Cnj6kKtTZnuSCxoYydSc8sgpDgAg9wFhxplunak9imLV0pTvc5WVCOHwm5eHLtQ==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
@@ -7728,18 +7667,12 @@ packages:
     resolution: {integrity: sha512-LnhVjMWyMQV9ZmeEy26maJk+8HTIbd59cH4F2MJ439k9DqejRisfFNGAPvRYlKETuh9LrImlS8aKsBgKjMA8WA==}
     engines: {node: '>=14'}
 
-  '@swc/counter@0.1.3':
-    resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==}
-
   '@swc/helpers@0.5.15':
     resolution: {integrity: sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==}
 
   '@swc/helpers@0.5.17':
     resolution: {integrity: sha512-5IKx/Y13RsYd+sauPb2x+U/xZikHjolzfuDgTAl/Tdf3Q8rslRvC19NKDLgAJQ6wsqADk10ntlv08nPFw/gO/A==}
 
-  '@swc/helpers@0.5.5':
-    resolution: {integrity: sha512-KGYxvIOXcceOAbEk4bi/dVLEK9z8sZ0uBB3Il5b1rhfClSpcX0yfRO0KmTkqR2cnQDymwLB+25ZyMzICg/cm/A==}
-
   '@tailwindcss/aspect-ratio@0.4.2':
     resolution: {integrity: sha512-8QPrypskfBa7QIMuKHg2TA7BqES6vhBrDLOv8Unb6FcFyd3TjKbc6lcmb9UPQHxfl24sXoJ41ux/H7qQQvfaSQ==}
     peerDependencies:
@@ -13312,26 +13245,8 @@ packages:
       nodemailer:
         optional: true
 
-  next@14.2.35:
-    resolution: {integrity: sha512-KhYd2Hjt/O1/1aZVX3dCwGXM1QmOV4eNM2UTacK5gipDdPN/oHHK/4oVGy7X8GMfPMsUTUEmGlsy0EY1YGAkig==}
-    engines: {node: '>=18.17.0'}
-    hasBin: true
-    peerDependencies:
-      '@opentelemetry/api': ^1.1.0
-      '@playwright/test': ^1.41.2
-      react: ^18.2.0
-      react-dom: ^18.2.0
-      sass: ^1.3.0
-    peerDependenciesMeta:
-      '@opentelemetry/api':
-        optional: true
-      '@playwright/test':
-        optional: true
-      sass:
-        optional: true
-
-  next@15.5.12:
-    resolution: {integrity: sha512-Fi/wQ4Etlrn60rz78bebG1i1SR20QxvV8tVp6iJspjLUSHcZoeUXCt+vmWoEcza85ElZzExK/jJ/F6SvtGktjA==}
+  next@15.5.19:
+    resolution: {integrity: sha512-xNOW6tYshGX1/Oi3F8uuk4gpDeWsSUE/1Z0G5uUMekIxaQ0xc03UXd9II0VQHYMWviMeA0OHpJFAKsHf8bTYVg==}
     engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0}
     hasBin: true
     peerDependencies:
@@ -13351,8 +13266,8 @@ packages:
       sass:
         optional: true
 
-  next@15.5.19:
-    resolution: {integrity: sha512-xNOW6tYshGX1/Oi3F8uuk4gpDeWsSUE/1Z0G5uUMekIxaQ0xc03UXd9II0VQHYMWviMeA0OHpJFAKsHf8bTYVg==}
+  next@15.5.21:
+    resolution: {integrity: sha512-/TsdBtkWLhkl+NVL3Uqws2UphNd6IPzOtzSk1fHaf+0P7GQKLZDUytyhns/Ykbzdy9+YRjwG7ONvrHaaTDdFqQ==}
     engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0}
     hasBin: true
     peerDependencies:
@@ -15016,19 +14931,6 @@ packages:
   style-value-types@5.0.0:
     resolution: {integrity: sha512-08yq36Ikn4kx4YU6RD7jWEv27v4V+PUsOGa4n/as8Et3CuODMJQ00ENeAVXAeydX4Z2j1XHZF1K2sX4mGl18fA==}
 
-  styled-jsx@5.1.1:
-    resolution: {integrity: sha512-pW7uC1l4mBZ8ugbiZrcIsiIvVx1UmTfw7UkC3Um2tmfUq9Bhk8IiyEIPl6F8agHgjzku6j0xQEZbfA5uSgSaCw==}
-    engines: {node: '>= 12.0.0'}
-    peerDependencies:
-      '@babel/core': '*'
-      babel-plugin-macros: '*'
-      react: '>= 16.8.0 || 17.x.x || ^18.0.0-0'
-    peerDependenciesMeta:
-      '@babel/core':
-        optional: true
-      babel-plugin-macros:
-        optional: true
-
   styled-jsx@5.1.6:
     resolution: {integrity: sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA==}
     engines: {node: '>= 12.0.0'}
@@ -16654,7 +16556,7 @@ snapshots:
     dependencies:
       '@types/hast': 3.0.4
       '@types/mdast': 4.0.4
-      js-yaml: 4.1.1
+      js-yaml: 4.3.1
       picomatch: 4.0.4
       retext-smartypants: 6.2.0
       shiki: 4.1.0
@@ -20927,89 +20829,60 @@ snapshots:
       '@tybys/wasm-util': 0.10.3
     optional: true
 
-  '@next/env@14.2.35': {}
-
-  '@next/env@15.5.12': {}
-
   '@next/env@15.5.19': {}
 
+  '@next/env@15.5.21': {}
+
   '@next/eslint-plugin-next@12.0.3':
     dependencies:
       glob: 7.1.7
 
-  '@next/swc-darwin-arm64@14.2.33':
-    optional: true
-
-  '@next/swc-darwin-arm64@15.5.12':
-    optional: true
-
   '@next/swc-darwin-arm64@15.5.19':
     optional: true
 
-  '@next/swc-darwin-x64@14.2.33':
-    optional: true
-
-  '@next/swc-darwin-x64@15.5.12':
+  '@next/swc-darwin-arm64@15.5.21':
     optional: true
 
   '@next/swc-darwin-x64@15.5.19':
     optional: true
 
-  '@next/swc-linux-arm64-gnu@14.2.33':
-    optional: true
-
-  '@next/swc-linux-arm64-gnu@15.5.12':
+  '@next/swc-darwin-x64@15.5.21':
     optional: true
 
   '@next/swc-linux-arm64-gnu@15.5.19':
     optional: true
 
-  '@next/swc-linux-arm64-musl@14.2.33':
-    optional: true
-
-  '@next/swc-linux-arm64-musl@15.5.12':
+  '@next/swc-linux-arm64-gnu@15.5.21':
     optional: true
 
   '@next/swc-linux-arm64-musl@15.5.19':
     optional: true
 
-  '@next/swc-linux-x64-gnu@14.2.33':
-    optional: true
-
-  '@next/swc-linux-x64-gnu@15.5.12':
+  '@next/swc-linux-arm64-musl@15.5.21':
     optional: true
 
   '@next/swc-linux-x64-gnu@15.5.19':
     optional: true
 
-  '@next/swc-linux-x64-musl@14.2.33':
-    optional: true
-
-  '@next/swc-linux-x64-musl@15.5.12':
+  '@next/swc-linux-x64-gnu@15.5.21':
     optional: true
 
   '@next/swc-linux-x64-musl@15.5.19':
     optional: true
 
-  '@next/swc-win32-arm64-msvc@14.2.33':
-    optional: true
-
-  '@next/swc-win32-arm64-msvc@15.5.12':
+  '@next/swc-linux-x64-musl@15.5.21':
     optional: true
 
   '@next/swc-win32-arm64-msvc@15.5.19':
     optional: true
 
-  '@next/swc-win32-ia32-msvc@14.2.33':
+  '@next/swc-win32-arm64-msvc@15.5.21':
     optional: true
 
-  '@next/swc-win32-x64-msvc@14.2.33':
-    optional: true
-
-  '@next/swc-win32-x64-msvc@15.5.12':
+  '@next/swc-win32-x64-msvc@15.5.19':
     optional: true
 
-  '@next/swc-win32-x64-msvc@15.5.19':
+  '@next/swc-win32-x64-msvc@15.5.21':
     optional: true
 
   '@nodelib/fs.scandir@2.1.5':
@@ -23140,8 +23013,6 @@ snapshots:
       - supports-color
       - typescript
 
-  '@swc/counter@0.1.3': {}
-
   '@swc/helpers@0.5.15':
     dependencies:
       tslib: 2.8.1
@@ -23150,11 +23021,6 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@swc/helpers@0.5.5':
-    dependencies:
-      '@swc/counter': 0.1.3
-      tslib: 2.8.1
-
   '@tailwindcss/aspect-ratio@0.4.2(tailwindcss@3.4.19(yaml@2.8.2))':
     dependencies:
       tailwindcss: 3.4.19(yaml@2.8.2)
@@ -27014,7 +26880,7 @@ snapshots:
       source-map: 0.6.1
     optional: true
 
-  eslint-config-next@12.0.3(eslint@7.32.0)(next@14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(typescript@5.9.3):
+  eslint-config-next@12.0.3(eslint@7.32.0)(next@15.5.21(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(typescript@5.9.3):
     dependencies:
       '@next/eslint-plugin-next': 12.0.3
       '@rushstack/eslint-patch': 1.15.0
@@ -27026,7 +26892,7 @@ snapshots:
       eslint-plugin-jsx-a11y: 6.10.2(eslint@7.32.0)
       eslint-plugin-react: 7.37.5(eslint@7.32.0)
       eslint-plugin-react-hooks: 4.6.2(eslint@7.32.0)
-      next: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+      next: 15.5.21(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
     optionalDependencies:
       typescript: 5.9.3
     transitivePeerDependencies:
@@ -31078,138 +30944,108 @@ snapshots:
 
   neotraverse@0.6.18: {}
 
-  next-auth@4.24.15(next@14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+  next-auth@4.24.15(next@15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3))(react-dom@18.3.1(react@19.2.3))(react@19.2.3):
     dependencies:
       '@babel/runtime': 7.29.7
       '@panva/hkdf': 1.2.1
       cookie: 0.7.2
       jose: 4.15.9
-      next: 14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+      next: 15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3)
       oauth: 0.9.15
       openid-client: 5.7.1
       preact: 10.28.3
       preact-render-to-string: 5.2.6(preact@10.28.3)
-      react: 18.3.1
-      react-dom: 18.3.1(react@18.3.1)
+      react: 19.2.3
+      react-dom: 18.3.1(react@19.2.3)
       uuid: 11.1.1
 
-  next-auth@4.24.15(next@15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3))(react-dom@18.3.1(react@19.2.3))(react@19.2.3):
+  next-auth@4.24.15(next@15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
     dependencies:
       '@babel/runtime': 7.29.7
       '@panva/hkdf': 1.2.1
       cookie: 0.7.2
       jose: 4.15.9
-      next: 15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3)
+      next: 15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
       oauth: 0.9.15
       openid-client: 5.7.1
       preact: 10.28.3
       preact-render-to-string: 5.2.6(preact@10.28.3)
-      react: 19.2.3
-      react-dom: 18.3.1(react@19.2.3)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
       uuid: 11.1.1
 
-  next@14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-macros@3.1.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(sass@1.97.3):
-    dependencies:
-      '@next/env': 14.2.35
-      '@swc/helpers': 0.5.5
-      busboy: 1.6.0
-      caniuse-lite: 1.0.30001760
-      graceful-fs: 4.2.11
-      postcss: 8.4.31
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      styled-jsx: 5.1.1(@babel/core@7.29.7)(babel-plugin-macros@3.1.0)(react@19.2.7)
-    optionalDependencies:
-      '@next/swc-darwin-arm64': 14.2.33
-      '@next/swc-darwin-x64': 14.2.33
-      '@next/swc-linux-arm64-gnu': 14.2.33
-      '@next/swc-linux-arm64-musl': 14.2.33
-      '@next/swc-linux-x64-gnu': 14.2.33
-      '@next/swc-linux-x64-musl': 14.2.33
-      '@next/swc-win32-arm64-msvc': 14.2.33
-      '@next/swc-win32-ia32-msvc': 14.2.33
-      '@next/swc-win32-x64-msvc': 14.2.33
-      '@opentelemetry/api': 1.9.0
-      '@playwright/test': 1.61.1
-      sass: 1.97.3
-    transitivePeerDependencies:
-      - '@babel/core'
-      - babel-plugin-macros
-
-  next@14.2.35(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3):
+  next@15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3):
     dependencies:
-      '@next/env': 14.2.35
-      '@swc/helpers': 0.5.5
-      busboy: 1.6.0
+      '@next/env': 15.5.19
+      '@swc/helpers': 0.5.15
       caniuse-lite: 1.0.30001760
-      graceful-fs: 4.2.11
       postcss: 8.4.31
-      react: 18.3.1
-      react-dom: 18.3.1(react@18.3.1)
-      styled-jsx: 5.1.1(@babel/core@7.29.7)(react@18.3.1)
-    optionalDependencies:
-      '@next/swc-darwin-arm64': 14.2.33
-      '@next/swc-darwin-x64': 14.2.33
-      '@next/swc-linux-arm64-gnu': 14.2.33
-      '@next/swc-linux-arm64-musl': 14.2.33
-      '@next/swc-linux-x64-gnu': 14.2.33
-      '@next/swc-linux-x64-musl': 14.2.33
-      '@next/swc-win32-arm64-msvc': 14.2.33
-      '@next/swc-win32-ia32-msvc': 14.2.33
-      '@next/swc-win32-x64-msvc': 14.2.33
+      react: 19.2.3
+      react-dom: 18.3.1(react@19.2.3)
+      styled-jsx: 5.1.6(react@19.2.3)
+    optionalDependencies:
+      '@next/swc-darwin-arm64': 15.5.19
+      '@next/swc-darwin-x64': 15.5.19
+      '@next/swc-linux-arm64-gnu': 15.5.19
+      '@next/swc-linux-arm64-musl': 15.5.19
+      '@next/swc-linux-x64-gnu': 15.5.19
+      '@next/swc-linux-x64-musl': 15.5.19
+      '@next/swc-win32-arm64-msvc': 15.5.19
+      '@next/swc-win32-x64-msvc': 15.5.19
       '@opentelemetry/api': 1.9.0
       '@playwright/test': 1.61.1
+      babel-plugin-react-compiler: 1.0.0
       sass: 1.97.3
+      sharp: 0.34.5
     transitivePeerDependencies:
       - '@babel/core'
       - babel-plugin-macros
 
-  next@14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3):
+  next@15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3):
     dependencies:
-      '@next/env': 14.2.35
-      '@swc/helpers': 0.5.5
-      busboy: 1.6.0
+      '@next/env': 15.5.21
+      '@swc/helpers': 0.5.15
       caniuse-lite: 1.0.30001760
-      graceful-fs: 4.2.11
       postcss: 8.4.31
       react: 18.3.1
       react-dom: 18.3.1(react@18.3.1)
-      styled-jsx: 5.1.1(@babel/core@7.29.7)(react@18.3.1)
-    optionalDependencies:
-      '@next/swc-darwin-arm64': 14.2.33
-      '@next/swc-darwin-x64': 14.2.33
-      '@next/swc-linux-arm64-gnu': 14.2.33
-      '@next/swc-linux-arm64-musl': 14.2.33
-      '@next/swc-linux-x64-gnu': 14.2.33
-      '@next/swc-linux-x64-musl': 14.2.33
-      '@next/swc-win32-arm64-msvc': 14.2.33
-      '@next/swc-win32-ia32-msvc': 14.2.33
-      '@next/swc-win32-x64-msvc': 14.2.33
+      styled-jsx: 5.1.6(@babel/core@7.28.5)(react@18.3.1)
+    optionalDependencies:
+      '@next/swc-darwin-arm64': 15.5.21
+      '@next/swc-darwin-x64': 15.5.21
+      '@next/swc-linux-arm64-gnu': 15.5.21
+      '@next/swc-linux-arm64-musl': 15.5.21
+      '@next/swc-linux-x64-gnu': 15.5.21
+      '@next/swc-linux-x64-musl': 15.5.21
+      '@next/swc-win32-arm64-msvc': 15.5.21
+      '@next/swc-win32-x64-msvc': 15.5.21
       '@opentelemetry/api': 1.9.0
       '@playwright/test': 1.61.1
+      babel-plugin-react-compiler: 1.0.0
       sass: 1.97.3
+      sharp: 0.34.5
     transitivePeerDependencies:
       - '@babel/core'
       - babel-plugin-macros
 
-  next@15.5.12(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3):
+  next@15.5.21(@babel/core@7.29.7)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-macros@3.1.0)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(sass@1.97.3):
     dependencies:
-      '@next/env': 15.5.12
+      '@next/env': 15.5.21
       '@swc/helpers': 0.5.15
       caniuse-lite: 1.0.30001760
       postcss: 8.4.31
-      react: 18.3.1
-      react-dom: 18.3.1(react@18.3.1)
-      styled-jsx: 5.1.6(react@18.3.1)
-    optionalDependencies:
-      '@next/swc-darwin-arm64': 15.5.12
-      '@next/swc-darwin-x64': 15.5.12
-      '@next/swc-linux-arm64-gnu': 15.5.12
-      '@next/swc-linux-arm64-musl': 15.5.12
-      '@next/swc-linux-x64-gnu': 15.5.12
-      '@next/swc-linux-x64-musl': 15.5.12
-      '@next/swc-win32-arm64-msvc': 15.5.12
-      '@next/swc-win32-x64-msvc': 15.5.12
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      styled-jsx: 5.1.6(@babel/core@7.29.7)(babel-plugin-macros@3.1.0)(react@19.2.7)
+    optionalDependencies:
+      '@next/swc-darwin-arm64': 15.5.21
+      '@next/swc-darwin-x64': 15.5.21
+      '@next/swc-linux-arm64-gnu': 15.5.21
+      '@next/swc-linux-arm64-musl': 15.5.21
+      '@next/swc-linux-x64-gnu': 15.5.21
+      '@next/swc-linux-x64-musl': 15.5.21
+      '@next/swc-win32-arm64-msvc': 15.5.21
+      '@next/swc-win32-x64-msvc': 15.5.21
       '@opentelemetry/api': 1.9.0
       '@playwright/test': 1.61.1
       babel-plugin-react-compiler: 1.0.0
@@ -31219,24 +31055,24 @@ snapshots:
       - '@babel/core'
       - babel-plugin-macros
 
-  next@15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3):
+  next@15.5.21(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3):
     dependencies:
-      '@next/env': 15.5.19
+      '@next/env': 15.5.21
       '@swc/helpers': 0.5.15
       caniuse-lite: 1.0.30001760
       postcss: 8.4.31
-      react: 19.2.3
-      react-dom: 18.3.1(react@19.2.3)
-      styled-jsx: 5.1.6(react@19.2.3)
-    optionalDependencies:
-      '@next/swc-darwin-arm64': 15.5.19
-      '@next/swc-darwin-x64': 15.5.19
-      '@next/swc-linux-arm64-gnu': 15.5.19
-      '@next/swc-linux-arm64-musl': 15.5.19
-      '@next/swc-linux-x64-gnu': 15.5.19
-      '@next/swc-linux-x64-musl': 15.5.19
-      '@next/swc-win32-arm64-msvc': 15.5.19
-      '@next/swc-win32-x64-msvc': 15.5.19
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      styled-jsx: 5.1.6(@babel/core@7.28.5)(react@18.3.1)
+    optionalDependencies:
+      '@next/swc-darwin-arm64': 15.5.21
+      '@next/swc-darwin-x64': 15.5.21
+      '@next/swc-linux-arm64-gnu': 15.5.21
+      '@next/swc-linux-arm64-musl': 15.5.21
+      '@next/swc-linux-x64-gnu': 15.5.21
+      '@next/swc-linux-x64-musl': 15.5.21
+      '@next/swc-win32-arm64-msvc': 15.5.21
+      '@next/swc-win32-x64-msvc': 15.5.21
       '@opentelemetry/api': 1.9.0
       '@playwright/test': 1.61.1
       babel-plugin-react-compiler: 1.0.0
@@ -31758,7 +31594,7 @@ snapshots:
 
   postcss@8.4.31:
     dependencies:
-      nanoid: 3.3.15
+      nanoid: 3.3.18
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
@@ -33375,25 +33211,20 @@ snapshots:
       hey-listen: 1.0.8
       tslib: 2.8.1
 
-  styled-jsx@5.1.1(@babel/core@7.29.7)(babel-plugin-macros@3.1.0)(react@19.2.7):
+  styled-jsx@5.1.6(@babel/core@7.28.5)(react@18.3.1):
     dependencies:
       client-only: 0.0.1
-      react: 19.2.7
+      react: 18.3.1
     optionalDependencies:
-      '@babel/core': 7.29.7
-      babel-plugin-macros: 3.1.0
+      '@babel/core': 7.28.5
 
-  styled-jsx@5.1.1(@babel/core@7.29.7)(react@18.3.1):
+  styled-jsx@5.1.6(@babel/core@7.29.7)(babel-plugin-macros@3.1.0)(react@19.2.7):
     dependencies:
       client-only: 0.0.1
-      react: 18.3.1
+      react: 19.2.7
     optionalDependencies:
       '@babel/core': 7.29.7
-
-  styled-jsx@5.1.6(react@18.3.1):
-    dependencies:
-      client-only: 0.0.1
-      react: 18.3.1
+      babel-plugin-macros: 3.1.0
 
   styled-jsx@5.1.6(react@19.2.3):
     dependencies:

From 543aad0589301f37549b50726a2c690408a2339e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 12:51:50 +1000
Subject: [PATCH 2/5] chore(deps): bump astro from 7.0.6 to 7.1.1 (#7329)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[astro](https://github.com/withastro/astro/tree/HEAD/packages/astro)
from 7.0.6 to 7.1.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/withastro/astro/releases">astro's
releases</a>.</em></p>
<blockquote>
<h2>astro@7.1.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/withastro/astro/pull/17399">#17399</a>
<a
href="https://github.com/withastro/astro/commit/4b0370262ce94a1f426944e659ef7a9c8773f451"><code>4b03702</code></a>
Thanks <a
href="https://github.com/matthewp"><code>@​matthewp</code></a>! - Fixes
encoded request paths being routed incorrectly when using domain-based
i18n</li>
</ul>
<h2>astro@7.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/withastro/astro/pull/17302">#17302</a>
<a
href="https://github.com/withastro/astro/commit/5f4dc0356f2c2ecf98fa88a257908c9226fac9f1"><code>5f4dc03</code></a>
Thanks <a
href="https://github.com/astrobot-houston"><code>@​astrobot-houston</code></a>!
- Adds a new <code>deferRender</code> option to the <code>glob()</code>
content loader</p>
<p>When set to <code>true</code>, renderable entries (such as Markdown)
are not rendered during content sync. Instead, rendering is deferred
until the entry is actually rendered in a page, using the same on-demand
path that <code>.mdx</code> files already use.</p>
<p>This reduces memory usage during <code>astro build</code> for large
collections whose rendered output is much larger than the source — for
example, Markdown that uses heavy rehype plugins like
<code>rehype-katex</code>. Such builds could previously run out of
memory while storing the eagerly-rendered HTML for every entry.</p>
<pre lang="js"><code>// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
<p>const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs',
deferRender: true }),
});
</code></pre></p>
<p>By default <code>deferRender</code> is <code>false</code>, preserving
the existing behavior of rendering entries eagerly during sync so their
rendered HTML can be cached across builds.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/withastro/astro/pull/17296">#17296</a>
<a
href="https://github.com/withastro/astro/commit/30698a2ed525497cdc0fce16d25d1cde0c21473c"><code>30698a2</code></a>
Thanks <a
href="https://github.com/ematipico"><code>@​ematipico</code></a>! - Adds
a new experimental <code>collectionStorage</code> option for controlling
how the content layer persists its data store</p>
<p>By default, Astro serializes the entire content layer data store to a
single file (<code>.astro/data-store.json</code>). For very large
content collections, this file can grow large enough to hit platform
file-size limits.</p>
<p>Set <code>experimental.collectionStorage: 'chunked'</code> to instead
split the data store across many smaller, content-addressed files inside
a <code>.astro/data-store/</code> directory, described by a
manifest:</p>
<pre lang="js"><code>// astro.config.mjs
import { defineConfig } from 'astro/config';
<p>export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
</code></pre></p>
<p>Because each part file is named by a hash of its contents, unchanged
parts keep the same name across builds and are not rewritten, and
identical parts are deduplicated. The default value is
<code>'single-file'</code>, which preserves the current behavior.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/withastro/astro/pull/17214">#17214</a>
<a
href="https://github.com/withastro/astro/commit/44c4989139e84951c6579db9975a659765cf2b6c"><code>44c4989</code></a>
Thanks <a
href="https://github.com/ematipico"><code>@​ematipico</code></a>! - Adds
support for the more specific CSP directives
<code>script-src-elem</code>, <code>script-src-attr</code>,
<code>style-src-elem</code>, and <code>style-src-attr</code> through a
new <code>kind</code> option.</p>
<p>Previously, <a
href="https://docs.astro.build/en/reference/configuration-reference/#securitycsp"><code>CSP</code></a>
was only scoped to generic
<code>script-src</code>/<code>style-src</code> directives. Now each
source or hash can be scoped to a narrower directive — for example, to
allow inline <code>style</code> attributes (such as those from
<code>define:vars</code> or Shiki) without loosening the policy for your
<code>&lt;style&gt;</code> and <code>&lt;link&gt;</code> elements.</p>
<h4>Scoping sources and hashes in your config</h4>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md">astro's
changelog</a>.</em></p>
<blockquote>
<h2>7.1.1</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/withastro/astro/pull/17399">#17399</a>
<a
href="https://github.com/withastro/astro/commit/4b0370262ce94a1f426944e659ef7a9c8773f451"><code>4b03702</code></a>
Thanks <a
href="https://github.com/matthewp"><code>@​matthewp</code></a>! - Fixes
encoded request paths being routed incorrectly when using domain-based
i18n</li>
</ul>
<h2>7.1.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/withastro/astro/pull/17302">#17302</a>
<a
href="https://github.com/withastro/astro/commit/5f4dc0356f2c2ecf98fa88a257908c9226fac9f1"><code>5f4dc03</code></a>
Thanks <a
href="https://github.com/astrobot-houston"><code>@​astrobot-houston</code></a>!
- Adds a new <code>deferRender</code> option to the <code>glob()</code>
content loader</p>
<p>When set to <code>true</code>, renderable entries (such as Markdown)
are not rendered during content sync. Instead, rendering is deferred
until the entry is actually rendered in a page, using the same on-demand
path that <code>.mdx</code> files already use.</p>
<p>This reduces memory usage during <code>astro build</code> for large
collections whose rendered output is much larger than the source — for
example, Markdown that uses heavy rehype plugins like
<code>rehype-katex</code>. Such builds could previously run out of
memory while storing the eagerly-rendered HTML for every entry.</p>
<pre lang="js"><code>// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
<p>const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs',
deferRender: true }),
});
</code></pre></p>
<p>By default <code>deferRender</code> is <code>false</code>, preserving
the existing behavior of rendering entries eagerly during sync so their
rendered HTML can be cached across builds.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/withastro/astro/pull/17296">#17296</a>
<a
href="https://github.com/withastro/astro/commit/30698a2ed525497cdc0fce16d25d1cde0c21473c"><code>30698a2</code></a>
Thanks <a
href="https://github.com/ematipico"><code>@​ematipico</code></a>! - Adds
a new experimental <code>collectionStorage</code> option for controlling
how the content layer persists its data store</p>
<p>By default, Astro serializes the entire content layer data store to a
single file (<code>.astro/data-store.json</code>). For very large
content collections, this file can grow large enough to hit platform
file-size limits.</p>
<p>Set <code>experimental.collectionStorage: 'chunked'</code> to instead
split the data store across many smaller, content-addressed files inside
a <code>.astro/data-store/</code> directory, described by a
manifest:</p>
<pre lang="js"><code>// astro.config.mjs
import { defineConfig } from 'astro/config';
<p>export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
</code></pre></p>
<p>Because each part file is named by a hash of its contents, unchanged
parts keep the same name across builds and are not rewritten, and
identical parts are deduplicated. The default value is
<code>'single-file'</code>, which preserves the current behavior.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/withastro/astro/pull/17214">#17214</a>
<a
href="https://github.com/withastro/astro/commit/44c4989139e84951c6579db9975a659765cf2b6c"><code>44c4989</code></a>
Thanks <a
href="https://github.com/ematipico"><code>@​ematipico</code></a>! - Adds
support for the more specific CSP directives
<code>script-src-elem</code>, <code>script-src-attr</code>,
<code>style-src-elem</code>, and <code>style-src-attr</code> through a
new <code>kind</code> option.</p>
<p>Previously, <a
href="https://docs.astro.build/en/reference/configuration-reference/#securitycsp"><code>CSP</code></a>
was only scoped to generic
<code>script-src</code>/<code>style-src</code> directives. Now each
source or hash can be scoped to a narrower directive — for example, to
allow inline <code>style</code> attributes (such as those from
<code>define:vars</code> or Shiki) without loosening the policy for your
<code>&lt;style&gt;</code> and <code>&lt;link&gt;</code> elements.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/withastro/astro/commit/91c645acdedf066ccd2b4257c92b33c49dbb7729"><code>91c645a</code></a>
[ci] release (<a
href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17403">#17403</a>)</li>
<li><a
href="https://github.com/withastro/astro/commit/4b0370262ce94a1f426944e659ef7a9c8773f451"><code>4b03702</code></a>
Normalize domain-based i18n request paths consistently (<a
href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17399">#17399</a>)</li>
<li><a
href="https://github.com/withastro/astro/commit/fdd673cc193734d7818fe5ace39c86b9500b2754"><code>fdd673c</code></a>
[ci] release (<a
href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17387">#17387</a>)</li>
<li><a
href="https://github.com/withastro/astro/commit/d9f99e19e4045da75c7f38650a0f2eeb5c79892b"><code>d9f99e1</code></a>
Preserve CSP resource defaults for element directives (<a
href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17394">#17394</a>)</li>
<li><a
href="https://github.com/withastro/astro/commit/092da560eea77ee63a3e2c583c80d8238544e42b"><code>092da56</code></a>
Add more escaping for rendered content (<a
href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17393">#17393</a>)</li>
<li><a
href="https://github.com/withastro/astro/commit/186a1e74c2eb342ea35a73fc2c0b1930b3c08921"><code>186a1e7</code></a>
fix(logger): allows setting in updateConfig() (<a
href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17391">#17391</a>)</li>
<li><a
href="https://github.com/withastro/astro/commit/4407483e6f9e159164fec83c36d66259baa87e1f"><code>4407483</code></a>
fix(logger): use <code>console</code> API in JSON logger for
cross-runtime compatibility...</li>
<li><a
href="https://github.com/withastro/astro/commit/16de02130575c61eb294b382e09bc863cf935ec3"><code>16de021</code></a>
feat(logger): allow passing entrypoint as URL (<a
href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17389">#17389</a>)</li>
<li><a
href="https://github.com/withastro/astro/commit/ed71eaf2b5eaa837de438eb252e8651a2aa086f6"><code>ed71eaf</code></a>
fix(logger): make AstroLoggerDestination not generic (<a
href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17390">#17390</a>)</li>
<li><a
href="https://github.com/withastro/astro/commit/30698a2ed525497cdc0fce16d25d1cde0c21473c"><code>30698a2</code></a>
feat: chunk data store (<a
href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17296">#17296</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/withastro/astro/commits/astro@7.1.1/packages/astro">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com>
Co-authored-by: kulesy <kulewidak@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 examples/astro/kitchen-sink/package.json   |   2 +-
 examples/astro/visual-editing/package.json |   2 +-
 packages/@tinacms/astro/package.json       |   2 +-
 pnpm-lock.yaml                             | 305 +++++++++++----------
 4 files changed, 170 insertions(+), 141 deletions(-)

diff --git a/examples/astro/kitchen-sink/package.json b/examples/astro/kitchen-sink/package.json
index ba24b21d3e..1f404d8731 100644
--- a/examples/astro/kitchen-sink/package.json
+++ b/examples/astro/kitchen-sink/package.json
@@ -22,7 +22,7 @@
     "@tailwindcss/typography": "catalog:",
     "@tailwindcss/vite": "^4.2.1",
     "@tinacms/datalayer": "workspace:*",
-    "astro": "^7.0.6",
+    "astro": "^7.1.1",
     "clsx": "^2.1.1",
     "graphql": "^15.10.1",
     "react": "^18.3.1",
diff --git a/examples/astro/visual-editing/package.json b/examples/astro/visual-editing/package.json
index f5fdcc104d..ed0c12e495 100644
--- a/examples/astro/visual-editing/package.json
+++ b/examples/astro/visual-editing/package.json
@@ -24,7 +24,7 @@
     "@tinacms/astro": "workspace:*",
     "@tinacms/datalayer": "workspace:*",
     "@tinacms/mdx": "workspace:*",
-    "astro": "^7.0.6",
+    "astro": "^7.1.1",
     "clsx": "^2.1.1",
     "graphql": "^15.10.1",
     "react-icons": "^5.6.0",
diff --git a/packages/@tinacms/astro/package.json b/packages/@tinacms/astro/package.json
index b8128e02c6..bc7782b4b9 100644
--- a/packages/@tinacms/astro/package.json
+++ b/packages/@tinacms/astro/package.json
@@ -136,7 +136,7 @@
   "devDependencies": {
     "@tinacms/scripts": "workspace:*",
     "@types/node": "^22.13.1",
-    "astro": "^7.0.6",
+    "astro": "^7.1.1",
     "typescript": "^5.7.3",
     "vite": "^8.0.0",
     "vitest": "^3.0.0"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 84163226a0..6dfdf9f769 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -716,7 +716,7 @@ importers:
     dependencies:
       '@astrojs/mdx':
         specifier: ^7.0.2
-        version: 7.0.2(@astrojs/markdown-satteri@0.3.3)(astro@7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))
+        version: 7.0.2(@astrojs/markdown-satteri@0.3.6)(astro@7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))
       '@astrojs/react':
         specifier: ^6.0.1
         version: 6.0.1(@types/node@25.1.0)(@types/react-dom@18.3.7(@types/react@18.3.27))(@types/react@18.3.27)(esbuild@0.28.1)(jiti@2.6.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
@@ -730,8 +730,8 @@ importers:
         specifier: workspace:*
         version: link:../../../packages/@tinacms/datalayer
       astro:
-        specifier: ^7.0.6
-        version: 7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
+        specifier: ^7.1.1
+        version: 7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
       clsx:
         specifier: ^2.1.1
         version: 2.1.1
@@ -795,10 +795,10 @@ importers:
     dependencies:
       '@astrojs/mdx':
         specifier: ^7.0.2
-        version: 7.0.2(@astrojs/markdown-satteri@0.3.3)(astro@7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))
+        version: 7.0.2(@astrojs/markdown-satteri@0.3.6)(astro@7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))
       '@astrojs/node':
         specifier: ^11.0.2
-        version: 11.0.2(astro@7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))
+        version: 11.0.2(astro@7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))
       '@tailwindcss/typography':
         specifier: 'catalog:'
         version: 0.5.20(tailwindcss@4.2.1)
@@ -815,8 +815,8 @@ importers:
         specifier: workspace:*
         version: link:../../../packages/@tinacms/mdx
       astro:
-        specifier: ^7.0.6
-        version: 7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
+        specifier: ^7.1.1
+        version: 7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
       clsx:
         specifier: ^2.1.1
         version: 2.1.1
@@ -1282,8 +1282,8 @@ importers:
         specifier: ^22.13.1
         version: 22.19.17
       astro:
-        specifier: ^7.0.6
-        version: 7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@22.19.17)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
+        specifier: ^7.1.1
+        version: 7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@22.19.17)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -3053,69 +3053,69 @@ packages:
     peerDependencies:
       typescript: ^5.0.0 || ^6.0.0
 
-  '@astrojs/compiler-binding-darwin-arm64@0.3.0':
-    resolution: {integrity: sha512-3n0uu+uJpnCq8b4JFi3uGDsIisAvHctxSmH+cIO9Gbei1H1Y1QXaYboXyiWJugUmprr3OEYP7+LdodzpVFzLMQ==}
+  '@astrojs/compiler-binding-darwin-arm64@0.3.2':
+    resolution: {integrity: sha512-MM8tn8CSimcfytaOla4b6acN8mKWiL/rlAA1fpT3/Wl7dNGSE4y8FjTN/zJVNnb63CsLWG5zZwCt01TXtDKh9g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@astrojs/compiler-binding-darwin-x64@0.3.0':
-    resolution: {integrity: sha512-scxNGKjOBydMo1QR4LtK0FMgh7ubQomJDv953nz2msQFkPKke/0FpPv/cQM0T/kuZdReZQFU8Oz3iOrP/6WHEg==}
+  '@astrojs/compiler-binding-darwin-x64@0.3.2':
+    resolution: {integrity: sha512-2lXOlzf8xb7jLomRsf/aswh61/NnGusynB2OwFkK6k4pmOtpfXMYnG0PLfXrEvxXYj69NdCnmUYXtHDd+JOOag==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@astrojs/compiler-binding-linux-arm64-gnu@0.3.0':
-    resolution: {integrity: sha512-NZrWLolVUANmrnl0zrFK/Sx5Sock1gEUT49ALfMTTCA5Ya2ec/BoJXMIg4KgE+wZcrdXJ8e+WyEhM7YLk/FJkA==}
+  '@astrojs/compiler-binding-linux-arm64-gnu@0.3.2':
+    resolution: {integrity: sha512-BmU3kWj7qnLrd4vzm49zFEPJ5oFnn1tCT4Vt9hZbqdU5Cmb8GZl7fn6VFsnNfe7B18a2gIFtVzbLINtYl5kBjQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@astrojs/compiler-binding-linux-arm64-musl@0.3.0':
-    resolution: {integrity: sha512-PjwRmKgMFDsFhg82g0poXlIY8Qn3fMA3hXjaR0coJWJzTJsRH9ATU0j2ocigjtU1h3vL/yR7yLUxGj/lTCq73g==}
+  '@astrojs/compiler-binding-linux-arm64-musl@0.3.2':
+    resolution: {integrity: sha512-f0heT9ZZEseSu5bHCeb80eL2DH07ArE6U9xi1WT/PEusNjzPmEr3GJsjG1tRLo5VYUUYX7h3ScaqGmGrMOVGmw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@astrojs/compiler-binding-linux-x64-gnu@0.3.0':
-    resolution: {integrity: sha512-Dr69VJYlnSfyL8gzELW6S4mE41P7TDPn1IKjwMnjdZ7+dxgJI50oMLFSk1LVe26bHmWB3ktuh8fDVK1THI9e9A==}
+  '@astrojs/compiler-binding-linux-x64-gnu@0.3.2':
+    resolution: {integrity: sha512-M8fOUt0itRpqiGyoEA/ij184s8O+hqbCz3+YozRusOOM3osgGljpDThhbKAJjqh82wOo6FioQ4w8PBvU1XMD5Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@astrojs/compiler-binding-linux-x64-musl@0.3.0':
-    resolution: {integrity: sha512-AEt+bRw8PfImCcyRH1lpXVB8CdmQ1K/wPo5u99iec4/U/XdNvQZ715YVuNzIJpbJXelgQeZ5H2+Ea7XwRyWY5g==}
+  '@astrojs/compiler-binding-linux-x64-musl@0.3.2':
+    resolution: {integrity: sha512-/Kebk8sO6HnLeSd691JkaAPfN7CqR9/KEXmWvyNPkaKNGmj8rTZ/lf2uXtnPu92Lan84UrKdIKVPy1fSo2encQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@astrojs/compiler-binding-wasm32-wasi@0.3.0':
-    resolution: {integrity: sha512-U80tA1j8V6LjhiTZzVCtG4E8hrNVVNXDGV5fCgJ94q8FU9CPH+XwdDDhLzBybfWhKfyItXmQiZNRPTiPCYTpVg==}
+  '@astrojs/compiler-binding-wasm32-wasi@0.3.2':
+    resolution: {integrity: sha512-pUA6xbcOSB7DhfzIArB8BCAkFfAIqriiR7zl5zOStd6oU2G0kIKj+GUdGnyXyhfiv881Hffyk5tC0mR18sDjDw==}
     engines: {node: '>=14.0.0'}
     cpu: [wasm32]
 
-  '@astrojs/compiler-binding-win32-arm64-msvc@0.3.0':
-    resolution: {integrity: sha512-CpY1RII2r1XMpOUVD1VR/F2wtuRsiOCkFULS10Khyj8/DFZMtxVuUCAWGw+CW2Ka0h6eP3Xc1CA+glFlvXMPxA==}
+  '@astrojs/compiler-binding-win32-arm64-msvc@0.3.2':
+    resolution: {integrity: sha512-ESruf+6Qkl1trHUFxI6GSf6t52j8yN2kCNSzMWdzt7V/T09tFHrYzrVaJQohb2C9bJUH76pNvX6Zb51+xCQc9Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@astrojs/compiler-binding-win32-x64-msvc@0.3.0':
-    resolution: {integrity: sha512-qmFbs769oeeGrRebAnCW7aBk8m71vf85W/dX/jddfx5Z06/w0wf7TZCfJPOX1Fld2t+4N+iXzfGEJG+zJQ+bzg==}
+  '@astrojs/compiler-binding-win32-x64-msvc@0.3.2':
+    resolution: {integrity: sha512-wzzVrEbOwbsLWOdEbocskjMRx2aZPxJ7ZbmL+jnpBamFwmigm+2M/wzuM6JWncocgYwLic1csSpalBh96kQKXA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
 
-  '@astrojs/compiler-binding@0.3.0':
-    resolution: {integrity: sha512-zlsOT5COD9hRwplJCgQhS21unxON5AKirf0vgt1ijXwuseYIaZdm2ZOpF8fsz+DY9EyXx+I/ukxtg7uoBep68A==}
+  '@astrojs/compiler-binding@0.3.2':
+    resolution: {integrity: sha512-8w/9CWmYrAJJ8N0SY3O43ws2BgxoW6u3QsD8u2mE140lMYAlwh+tlNoUeSBq22wVheFuiBbR212l6ixZ2IIgCQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
 
-  '@astrojs/compiler-rs@0.3.0':
-    resolution: {integrity: sha512-J2qEVHtIDjEM9TxwmwuebOGmZNwhKu/dR7P7qBpnJKGmBBX0vdweQ/4cEXhj8fBbWVUB5V12xWChri3CgKNULQ==}
+  '@astrojs/compiler-rs@0.3.2':
+    resolution: {integrity: sha512-xlx/T7JovIKduu4ucbTQUxQ5+Q8wxkHxhLjnZk3VlJbhbQ9RLvvuDk1p2YYFYFQ5y14dVm3FGGO4isQXa4F+Tg==}
     engines: {node: '>=22.12.0'}
 
   '@astrojs/compiler@2.13.1':
@@ -3124,6 +3124,9 @@ packages:
   '@astrojs/internal-helpers@0.10.1':
     resolution: {integrity: sha512-5phcroT/vmOOrYuuAxtkbPixy5hePtlz9i8K4OeDv3dNK6/UQRuXPOSRTxIOBbUY5Sonw2UaxjbuVc43Mcir6Q==}
 
+  '@astrojs/internal-helpers@0.10.3':
+    resolution: {integrity: sha512-HIx/t1NywcqSTFaVwZh15n8JsC3YQdCaJZDaTS/aurYTEvNiWDXUGS3Z9uQX3bFB+B1pCgN/nljckkzYTpHZ2w==}
+
   '@astrojs/language-server@2.16.8':
     resolution: {integrity: sha512-yg1pZF6hs9FaKr2fgXMOGbW7pDLgFexFjuhWilPAc8VybTU+WSnbfbhYaUL1exm6dAK4sM3aKXGcfVwss+HXbg==}
     hasBin: true
@@ -3139,8 +3142,8 @@ packages:
   '@astrojs/markdown-remark@7.2.1':
     resolution: {integrity: sha512-jPVNIqTvk+yKviikszv/Y1U4jGUSKpp/Nw48QZV4qjWgp70j4Lkq3lhSDRbWwCfgKvEyO9GHuVbV1dM2WYXy1w==}
 
-  '@astrojs/markdown-satteri@0.3.3':
-    resolution: {integrity: sha512-Lje33Ittd8UQGgbIIWQvhPkj5X5c4b1sZnZWX3JQV/AWpfbuQGxVi2ONt6+ScydcwfR4egilslEWyczMclrJ1g==}
+  '@astrojs/markdown-satteri@0.3.6':
+    resolution: {integrity: sha512-kkeWP4Lh6Do/qz2R0DIAtPWCh6WPr1J4UrzDItVmHMK1HwyLHxG4JxM8uBNavhD7ivGOO9BUTsAP5D7ppa68CA==}
 
   '@astrojs/mdx@7.0.2':
     resolution: {integrity: sha512-l+sJY5U1KkGZUdr+bIL4Y6BefeS549qoSHVSkUSs6A9INwdCND+/0+vN0NroPBXwl5Vcg5u78t7VQRsJjePxbw==}
@@ -3170,8 +3173,8 @@ packages:
       react: ^17.0.2 || ^18.0.0 || ^19.0.0
       react-dom: ^17.0.2 || ^18.0.0 || ^19.0.0
 
-  '@astrojs/telemetry@3.3.2':
-    resolution: {integrity: sha512-j8DNruA8ors99Al39RYZPJK4DC1bKkoNm93mAMuBhY9TCNC4R8n1q7ovFnJ5qhGh5Lsh7pa1gpQVpYpsJPeTHQ==}
+  '@astrojs/telemetry@3.3.3':
+    resolution: {integrity: sha512-C1TLn5sPJr0x4vk56piHWKbnqlEB8BKyte5Y45V02U+D7BGO5eMqZDH5aPjnkXQWJggvmsTXxH03QMZ9NgWLzQ==}
     engines: {node: 18.20.8 || ^20.3.0 || >=22.0.0}
 
   '@astrojs/yaml2ts@0.2.3':
@@ -5993,6 +5996,13 @@ packages:
       '@emnapi/core': ^1.7.1
       '@emnapi/runtime': ^1.7.1
 
+  '@napi-rs/wasm-runtime@1.2.3':
+    resolution: {integrity: sha512-UMduMbqO5s5zF2NkNacMT/yK5Y5QiKvWr2+50bzIIxFDwVJ2h49b+oyjaCGPhJxd2/gC2x39EHv/gHVuu36x2Q==}
+    engines: {node: ^20.19.0 || ^22.13.0 || >=23.5.0}
+    peerDependencies:
+      '@emnapi/core': ^1.7.1 || ^2.0.0-alpha.4
+      '@emnapi/runtime': ^1.7.1 || ^2.0.0-alpha.4
+
   '@next/env@15.5.19':
     resolution: {integrity: sha512-sWWluFvcv5v3Fxznmf2ZfjyoVQt/64oCnYqS90inQWGzMPK1VjvekPiz3OPHKmFT30EnHrjlbyaHLt3M0vWabw==}
 
@@ -9209,12 +9219,12 @@ packages:
     resolution: {integrity: sha512-LElXdjswlqjWrPpJFg1Fx4wpkOCxj1TDHlSV4PlaRxHGWko024xICaa97ZkMfs6DRKlCguiAI+rbXv5GWwXIkg==}
     hasBin: true
 
-  astro@7.0.6:
-    resolution: {integrity: sha512-Myw0sFia+zs/Y0yqfZEsUYXfDPh3ELcLf1f0Q/qQzVXBh/af1qO62WNT+P89DCcfGVV51nMoQhEfkBYqJmoUOQ==}
+  astro@7.2.3:
+    resolution: {integrity: sha512-CDf55Cw2nOev5BAM72yn7JQMpK/ByTY5tLSybbHbtZNSiMKk0OeyvCjA2foEUXfHXbATpHQQPBgfuXL8PdofcA==}
     engines: {node: '>=22.12.0', npm: '>=9.6.5', pnpm: '>=7.1.0'}
     hasBin: true
     peerDependencies:
-      '@astrojs/markdown-remark': 7.2.1
+      '@astrojs/markdown-remark': 7.2.3
     peerDependenciesMeta:
       '@astrojs/markdown-remark':
         optional: true
@@ -9737,6 +9747,10 @@ packages:
     resolution: {integrity: sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==}
     engines: {node: '>=18'}
 
+  commander@14.0.3:
+    resolution: {integrity: sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==}
+    engines: {node: '>=20'}
+
   commander@2.20.3:
     resolution: {integrity: sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==}
 
@@ -9814,9 +9828,9 @@ packages:
     resolution: {integrity: sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==}
     engines: {node: '>= 0.6'}
 
-  cookie@1.1.1:
-    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
-    engines: {node: '>=18'}
+  cookie@2.0.1:
+    resolution: {integrity: sha512-yuToqVvRrj6pfDXREyQAAv8SkAEk/8GS3jQRTiUMm66TVtBYmqQeoEjL2Lmq8Rpo6271vH76InTChTitEAm65w==}
+    engines: {node: '>=22'}
 
   copy-to-clipboard@3.3.3:
     resolution: {integrity: sha512-2KV8NhB5JqC3ky0r9PMCAZKbUHSwtEo4CwCs0KXgruG43gX5PMqDEBbVU4OUzw2MuAWUfsuFmWvEKG5QRfSnJA==}
@@ -10924,6 +10938,10 @@ packages:
     resolution: {integrity: sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==}
     engines: {node: '>= 0.8'}
 
+  find-process@2.1.1:
+    resolution: {integrity: sha512-SrQDx3QhlmHM90iqn9rdjCQcw/T+WlpOkHFsjoRgB+zTpDfltNA1VSNYeYELwhUTJy12UFxqjWhmhOrJc+o4sA==}
+    hasBin: true
+
   find-root@1.1.0:
     resolution: {integrity: sha512-NKfW6bec6GfKc0SGx1e07QZY9PE99u0Bft/0rzSD5k3sO/vwkVUpDUKVm5Gpp5Ue3YfShPFTX2070tDs5kB9Ng==}
 
@@ -11529,11 +11547,6 @@ packages:
   is-decimal@2.0.1:
     resolution: {integrity: sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==}
 
-  is-docker@3.0.0:
-    resolution: {integrity: sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==}
-    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
-    hasBin: true
-
   is-docker@4.0.0:
     resolution: {integrity: sha512-LHE+wROyG/Y/0ZnbktRCoTix2c1RhgWaZraMZ8o1Q7zCh0VSrICJQO5oqIIISrcSBtrXv0o233w1IYwsWCjTzA==}
     engines: {node: '>=20'}
@@ -11576,11 +11589,6 @@ packages:
   is-hotkey@0.2.0:
     resolution: {integrity: sha512-UknnZK4RakDmTgz4PI1wIph5yxSs/mvChWs9ifnlXsKuXgWmOkY/hAE0H/k2MIqH0RlRye0i1oC07MCRSD28Mw==}
 
-  is-inside-container@1.0.0:
-    resolution: {integrity: sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==}
-    engines: {node: '>=14.16'}
-    hasBin: true
-
   is-interactive@2.0.0:
     resolution: {integrity: sha512-qP1vozQRI+BMOPcjFzrjXuQvdak2pHNUMZoeG2eRbiSqyvbEf/wQtEOTOX1guk6E3t36RkaqiSt8A/6YElNxLQ==}
     engines: {node: '>=12'}
@@ -11696,10 +11704,6 @@ packages:
     resolution: {integrity: sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==}
     engines: {node: '>=0.10.0'}
 
-  is-wsl@3.1.1:
-    resolution: {integrity: sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==}
-    engines: {node: '>=16'}
-
   isarray@2.0.5:
     resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
 
@@ -12472,6 +12476,10 @@ packages:
     resolution: {integrity: sha512-i24m8rpwhmPIS4zscNzK6MSEhk0DUWa/8iYQWxhffV8jkI4Phvs3F+quL5xvS0gdQR0FyTCMMH33Y78dDTzzIw==}
     engines: {node: '>=18'}
 
+  loglevel@1.9.2:
+    resolution: {integrity: sha512-HgMmCqIJSAKqo68l0rS2AanEWfkxaZ5wNiEFb5ggm08lDs9Xl2KxBlX3PTcaD2chBM1gXAYf491/M2Rv8Jwayg==}
+    engines: {node: '>= 0.6.0'}
+
   long@5.3.2:
     resolution: {integrity: sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==}
 
@@ -12533,6 +12541,9 @@ packages:
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
+  magic-string@1.2.0:
+    resolution: {integrity: sha512-ptco+HFxTLgjafSLim2LojBSwfg5feBjd+SqyiwdGkzC38UPdZy3zgrHMI2CoTf5fJL38tbHMYWVzIH8BxGqJw==}
+
   magicast@0.3.5:
     resolution: {integrity: sha512-L0WhttDl+2BOsybvEOLK7fW3UA0OQ0IQ2d6Zl2x/a6vVRs3bAY0ECOSHHeL5jD+SbOpOCUEi0y1DgHEn9Qn1AQ==}
 
@@ -13227,8 +13238,8 @@ packages:
   neo-async@2.6.2:
     resolution: {integrity: sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==}
 
-  neotraverse@0.6.18:
-    resolution: {integrity: sha512-Z4SmBUweYa09+o6pG+eASabEpP6QkQ70yHj351pQoEXIs8uHbaU2DWVmzBANKgflPa47A50PtB2+NgRpQvr7vA==}
+  neotraverse@1.0.1:
+    resolution: {integrity: sha512-WmmLty1YWwJl9yZi77v2dVIV6X2kuYV8YYBI/G3LWGKdGHmHUvL1z7FW0iDvEvGAwNEoc5x1tOOOyDnf5jJw/w==}
     engines: {node: '>= 10'}
 
   next-auth@4.24.15:
@@ -15475,6 +15486,10 @@ packages:
   undici-types@7.16.0:
     resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==}
 
+  undici@8.10.0:
+    resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==}
+    engines: {node: '>=22.19.0'}
+
   unicode-canonical-property-names-ecmascript@2.0.1:
     resolution: {integrity: sha512-dA8WbNeb2a6oQzAQ55YlT5vQAWGV9WXOsi3SskE3bcCdM0P4SDd+24zS/OCacdRq5BkdsRj9q3Pg6YyQoxIGqg==}
     engines: {node: '>=4'}
@@ -15500,8 +15515,8 @@ packages:
   unified@9.2.2:
     resolution: {integrity: sha512-Sg7j110mtefBD+qunSLO1lqOEKdrwBFBrR6Qd8f4uwkhWNlbkaqwHse6e7QvD3AP/MNoJdEDLaf8OxYyoWgorQ==}
 
-  unifont@0.7.4:
-    resolution: {integrity: sha512-oHeis4/xl42HUIeHuNZRGEvxj5AaIKR+bHPNegRq5LV1gdc3jundpONbjglKpihmJf+dswygdMJn3eftGIMemg==}
+  unifont@0.7.5:
+    resolution: {integrity: sha512-ULe/Cs+ZIsq+dcFofNkhqielCrUJnb5mr+Yc4EBM2VlL+6OZR6+cjtI2mT1bJvRBrVncqHAbLURxmPLcCXzWMg==}
 
   unist-util-find-after@5.0.0:
     resolution: {integrity: sha512-amQa0Ep2m6hE2g72AugUItjbuM8X8cGQnFoHk0pGfrFeT9GZhzN5SW8nRsiGKK7Aif4CrACPENkA6P/Lw6fHGQ==}
@@ -16240,10 +16255,6 @@ packages:
     resolution: {integrity: sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==}
     engines: {node: '>= 0.4'}
 
-  which-pm-runs@1.1.0:
-    resolution: {integrity: sha512-n1brCuqClxfFfq/Rb0ICg9giSZqCS+pLtccdag6C2HyufBrh3fBOiy9nb6ggRMvWOVH5GrdJskj5iGTZNxd7SA==}
-    engines: {node: '>=4'}
-
   which-typed-array@1.1.19:
     resolution: {integrity: sha512-rEvr90Bck4WZt9HHFC4DJMsjvu7x+r6bImz0/BrbWb7A2djJ8hnZMrWnHo9F8ssv0OMErasDhftrfROTyqSDrw==}
     engines: {node: '>= 0.4'}
@@ -16496,56 +16507,56 @@ snapshots:
       - prettier
       - prettier-plugin-astro
 
-  '@astrojs/compiler-binding-darwin-arm64@0.3.0':
+  '@astrojs/compiler-binding-darwin-arm64@0.3.2':
     optional: true
 
-  '@astrojs/compiler-binding-darwin-x64@0.3.0':
+  '@astrojs/compiler-binding-darwin-x64@0.3.2':
     optional: true
 
-  '@astrojs/compiler-binding-linux-arm64-gnu@0.3.0':
+  '@astrojs/compiler-binding-linux-arm64-gnu@0.3.2':
     optional: true
 
-  '@astrojs/compiler-binding-linux-arm64-musl@0.3.0':
+  '@astrojs/compiler-binding-linux-arm64-musl@0.3.2':
     optional: true
 
-  '@astrojs/compiler-binding-linux-x64-gnu@0.3.0':
+  '@astrojs/compiler-binding-linux-x64-gnu@0.3.2':
     optional: true
 
-  '@astrojs/compiler-binding-linux-x64-musl@0.3.0':
+  '@astrojs/compiler-binding-linux-x64-musl@0.3.2':
     optional: true
 
-  '@astrojs/compiler-binding-wasm32-wasi@0.3.0(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)':
+  '@astrojs/compiler-binding-wasm32-wasi@0.3.2(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)':
     dependencies:
-      '@napi-rs/wasm-runtime': 1.1.6(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
+      '@napi-rs/wasm-runtime': 1.2.3(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
     transitivePeerDependencies:
       - '@emnapi/core'
       - '@emnapi/runtime'
     optional: true
 
-  '@astrojs/compiler-binding-win32-arm64-msvc@0.3.0':
+  '@astrojs/compiler-binding-win32-arm64-msvc@0.3.2':
     optional: true
 
-  '@astrojs/compiler-binding-win32-x64-msvc@0.3.0':
+  '@astrojs/compiler-binding-win32-x64-msvc@0.3.2':
     optional: true
 
-  '@astrojs/compiler-binding@0.3.0(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)':
+  '@astrojs/compiler-binding@0.3.2(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)':
     optionalDependencies:
-      '@astrojs/compiler-binding-darwin-arm64': 0.3.0
-      '@astrojs/compiler-binding-darwin-x64': 0.3.0
-      '@astrojs/compiler-binding-linux-arm64-gnu': 0.3.0
-      '@astrojs/compiler-binding-linux-arm64-musl': 0.3.0
-      '@astrojs/compiler-binding-linux-x64-gnu': 0.3.0
-      '@astrojs/compiler-binding-linux-x64-musl': 0.3.0
-      '@astrojs/compiler-binding-wasm32-wasi': 0.3.0(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
-      '@astrojs/compiler-binding-win32-arm64-msvc': 0.3.0
-      '@astrojs/compiler-binding-win32-x64-msvc': 0.3.0
+      '@astrojs/compiler-binding-darwin-arm64': 0.3.2
+      '@astrojs/compiler-binding-darwin-x64': 0.3.2
+      '@astrojs/compiler-binding-linux-arm64-gnu': 0.3.2
+      '@astrojs/compiler-binding-linux-arm64-musl': 0.3.2
+      '@astrojs/compiler-binding-linux-x64-gnu': 0.3.2
+      '@astrojs/compiler-binding-linux-x64-musl': 0.3.2
+      '@astrojs/compiler-binding-wasm32-wasi': 0.3.2(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
+      '@astrojs/compiler-binding-win32-arm64-msvc': 0.3.2
+      '@astrojs/compiler-binding-win32-x64-msvc': 0.3.2
     transitivePeerDependencies:
       - '@emnapi/core'
       - '@emnapi/runtime'
 
-  '@astrojs/compiler-rs@0.3.0(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)':
+  '@astrojs/compiler-rs@0.3.2(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)':
     dependencies:
-      '@astrojs/compiler-binding': 0.3.0(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
+      '@astrojs/compiler-binding': 0.3.2(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
     transitivePeerDependencies:
       - '@emnapi/core'
       - '@emnapi/runtime'
@@ -16563,6 +16574,17 @@ snapshots:
       smol-toml: 1.6.0
       unified: 11.0.5
 
+  '@astrojs/internal-helpers@0.10.3':
+    dependencies:
+      '@types/hast': 3.0.4
+      '@types/mdast': 4.0.4
+      js-yaml: 4.3.1
+      picomatch: 4.0.4
+      retext-smartypants: 6.2.0
+      shiki: 4.1.0
+      smol-toml: 1.6.0
+      unified: 11.0.5
+
   '@astrojs/language-server@2.16.8(prettier@3.8.3)(typescript@5.9.3)':
     dependencies:
       '@astrojs/compiler': 2.13.1
@@ -16610,20 +16632,21 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@astrojs/markdown-satteri@0.3.3':
+  '@astrojs/markdown-satteri@0.3.6':
     dependencies:
-      '@astrojs/internal-helpers': 0.10.1
+      '@astrojs/internal-helpers': 0.10.3
       '@astrojs/prism': 4.0.2
       github-slugger: 2.0.0
+      hast-util-from-html: 2.0.3
       satteri: 0.9.4
 
-  '@astrojs/mdx@7.0.2(@astrojs/markdown-satteri@0.3.3)(astro@7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))':
+  '@astrojs/mdx@7.0.2(@astrojs/markdown-satteri@0.3.6)(astro@7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))':
     dependencies:
       '@astrojs/internal-helpers': 0.10.1
       '@astrojs/markdown-remark': 7.2.1
       '@mdx-js/mdx': 3.1.1
       acorn: 8.16.0
-      astro: 7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
+      astro: 7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
       es-module-lexer: 2.1.0
       estree-util-visit: 2.0.0
       hast-util-to-html: 9.0.5
@@ -16635,14 +16658,14 @@ snapshots:
       unist-util-visit: 5.1.0
       vfile: 6.0.3
     optionalDependencies:
-      '@astrojs/markdown-satteri': 0.3.3
+      '@astrojs/markdown-satteri': 0.3.6
     transitivePeerDependencies:
       - supports-color
 
-  '@astrojs/node@11.0.2(astro@7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))':
+  '@astrojs/node@11.0.2(astro@7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))':
     dependencies:
       '@astrojs/internal-helpers': 0.10.1
-      astro: 7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
+      astro: 7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
       send: 1.2.1
       server-destroy: 1.0.1
     transitivePeerDependencies:
@@ -16678,13 +16701,12 @@ snapshots:
       - tsx
       - yaml
 
-  '@astrojs/telemetry@3.3.2':
+  '@astrojs/telemetry@3.3.3':
     dependencies:
       ci-info: 4.4.0
       dset: 3.1.4
       is-docker: 4.0.0
-      is-wsl: 3.1.1
-      which-pm-runs: 1.1.0
+      package-manager-detector: 1.6.0
 
   '@astrojs/yaml2ts@0.2.3':
     dependencies:
@@ -19011,7 +19033,7 @@ snapshots:
   '@changesets/parse@0.4.2':
     dependencies:
       '@changesets/types': 6.1.0
-      js-yaml: 4.1.1
+      js-yaml: 4.3.1
 
   '@changesets/pre@2.0.2':
     dependencies:
@@ -20829,6 +20851,13 @@ snapshots:
       '@tybys/wasm-util': 0.10.3
     optional: true
 
+  '@napi-rs/wasm-runtime@1.2.3(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)':
+    dependencies:
+      '@emnapi/core': 1.11.1
+      '@emnapi/runtime': 1.11.1
+      '@tybys/wasm-util': 0.10.3
+    optional: true
+
   '@next/env@15.5.19': {}
 
   '@next/env@15.5.21': {}
@@ -25052,40 +25081,40 @@ snapshots:
 
   astring@1.9.0: {}
 
-  astro@7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@22.19.17)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2):
+  astro@7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@22.19.17)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2):
     dependencies:
-      '@astrojs/compiler-rs': 0.3.0(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
-      '@astrojs/internal-helpers': 0.10.1
-      '@astrojs/markdown-satteri': 0.3.3
-      '@astrojs/telemetry': 3.3.2
+      '@astrojs/compiler-rs': 0.3.2(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
+      '@astrojs/internal-helpers': 0.10.3
+      '@astrojs/markdown-satteri': 0.3.6
+      '@astrojs/telemetry': 3.3.3
       '@capsizecss/unpack': 4.0.0
       '@clack/prompts': 1.4.0
       '@oslojs/encoding': 1.1.0
-      '@rollup/pluginutils': 5.3.0(rollup@4.53.4)
       am-i-vibing: 0.4.0
       aria-query: 5.3.2
       axobject-query: 4.1.0
       ci-info: 4.4.0
       clsx: 2.1.1
       common-ancestor-path: 2.0.0
-      cookie: 1.1.1
+      cookie: 2.0.1
       devalue: 5.8.1
       diff: 8.0.3
       dset: 3.1.4
       es-module-lexer: 2.1.0
       esbuild: 0.28.1
+      find-process: 2.1.1
       flattie: 1.1.1
       fontace: 0.4.1
       get-tsconfig: 5.0.0-beta.4
       github-slugger: 2.0.0
       html-escaper: 3.0.3
       http-cache-semantics: 4.2.0
-      js-yaml: 4.1.1
+      js-yaml: 4.3.1
       jsonc-parser: 3.3.1
-      magic-string: 0.30.21
+      magic-string: 1.2.0
       magicast: 0.5.2
       mrmime: 2.0.1
-      neotraverse: 0.6.18
+      neotraverse: 1.0.1
       obug: 2.1.1
       p-limit: 7.3.0
       p-queue: 9.3.0
@@ -25100,7 +25129,7 @@ snapshots:
       tinyexec: 1.2.2
       tinyglobby: 0.2.17
       ultrahtml: 1.6.0
-      unifont: 0.7.4
+      unifont: 0.7.5
       unstorage: 1.17.5(@azure/storage-blob@12.29.1)
       vite: 8.1.3(@types/node@22.19.17)(esbuild@0.28.1)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
       vitefu: 1.1.2(vite@8.1.3(@types/node@22.19.17)(esbuild@0.28.1)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))
@@ -25108,7 +25137,6 @@ snapshots:
       yargs-parser: 22.0.0
       zod: 4.4.3
     optionalDependencies:
-      '@astrojs/markdown-remark': 7.2.1
       sharp: 0.34.5
     transitivePeerDependencies:
       - '@azure/app-configuration'
@@ -25135,7 +25163,6 @@ snapshots:
       - ioredis
       - jiti
       - less
-      - rollup
       - sass
       - sass-embedded
       - stylus
@@ -25145,40 +25172,40 @@ snapshots:
       - uploadthing
       - yaml
 
-  astro@7.0.6(@astrojs/markdown-remark@7.2.1)(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(rollup@4.53.4)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2):
+  astro@7.2.3(@azure/storage-blob@12.29.1)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)(@types/node@25.1.0)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2):
     dependencies:
-      '@astrojs/compiler-rs': 0.3.0(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
-      '@astrojs/internal-helpers': 0.10.1
-      '@astrojs/markdown-satteri': 0.3.3
-      '@astrojs/telemetry': 3.3.2
+      '@astrojs/compiler-rs': 0.3.2(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
+      '@astrojs/internal-helpers': 0.10.3
+      '@astrojs/markdown-satteri': 0.3.6
+      '@astrojs/telemetry': 3.3.3
       '@capsizecss/unpack': 4.0.0
       '@clack/prompts': 1.4.0
       '@oslojs/encoding': 1.1.0
-      '@rollup/pluginutils': 5.3.0(rollup@4.53.4)
       am-i-vibing: 0.4.0
       aria-query: 5.3.2
       axobject-query: 4.1.0
       ci-info: 4.4.0
       clsx: 2.1.1
       common-ancestor-path: 2.0.0
-      cookie: 1.1.1
+      cookie: 2.0.1
       devalue: 5.8.1
       diff: 8.0.3
       dset: 3.1.4
       es-module-lexer: 2.1.0
       esbuild: 0.28.1
+      find-process: 2.1.1
       flattie: 1.1.1
       fontace: 0.4.1
       get-tsconfig: 5.0.0-beta.4
       github-slugger: 2.0.0
       html-escaper: 3.0.3
       http-cache-semantics: 4.2.0
-      js-yaml: 4.1.1
+      js-yaml: 4.3.1
       jsonc-parser: 3.3.1
-      magic-string: 0.30.21
+      magic-string: 1.2.0
       magicast: 0.5.2
       mrmime: 2.0.1
-      neotraverse: 0.6.18
+      neotraverse: 1.0.1
       obug: 2.1.1
       p-limit: 7.3.0
       p-queue: 9.3.0
@@ -25193,7 +25220,7 @@ snapshots:
       tinyexec: 1.2.2
       tinyglobby: 0.2.17
       ultrahtml: 1.6.0
-      unifont: 0.7.4
+      unifont: 0.7.5
       unstorage: 1.17.5(@azure/storage-blob@12.29.1)
       vite: 8.1.3(@types/node@25.1.0)(esbuild@0.28.1)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2)
       vitefu: 1.1.2(vite@8.1.3(@types/node@25.1.0)(esbuild@0.28.1)(jiti@2.6.1)(sass@1.97.3)(terser@5.46.0)(yaml@2.8.2))
@@ -25201,7 +25228,6 @@ snapshots:
       yargs-parser: 22.0.0
       zod: 4.4.3
     optionalDependencies:
-      '@astrojs/markdown-remark': 7.2.1
       sharp: 0.34.5
     transitivePeerDependencies:
       - '@azure/app-configuration'
@@ -25228,7 +25254,6 @@ snapshots:
       - ioredis
       - jiti
       - less
-      - rollup
       - sass
       - sass-embedded
       - stylus
@@ -25852,6 +25877,8 @@ snapshots:
 
   commander@12.1.0: {}
 
+  commander@14.0.3: {}
+
   commander@2.20.3:
     optional: true
 
@@ -25911,7 +25938,7 @@ snapshots:
 
   cookie@0.7.2: {}
 
-  cookie@1.1.1: {}
+  cookie@2.0.1: {}
 
   copy-to-clipboard@3.3.3:
     dependencies:
@@ -27406,6 +27433,12 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  find-process@2.1.1:
+    dependencies:
+      chalk: 4.1.2
+      commander: 14.0.3
+      loglevel: 1.9.2
+
   find-root@1.1.0: {}
 
   find-up@4.1.0:
@@ -28128,8 +28161,6 @@ snapshots:
 
   is-decimal@2.0.1: {}
 
-  is-docker@3.0.0: {}
-
   is-docker@4.0.0: {}
 
   is-extendable@0.1.1: {}
@@ -28162,10 +28193,6 @@ snapshots:
 
   is-hotkey@0.2.0: {}
 
-  is-inside-container@1.0.0:
-    dependencies:
-      is-docker: 3.0.0
-
   is-interactive@2.0.0: {}
 
   is-map@2.0.3: {}
@@ -28257,10 +28284,6 @@ snapshots:
 
   is-windows@1.0.2: {}
 
-  is-wsl@3.1.1:
-    dependencies:
-      is-inside-container: 1.0.0
-
   isarray@2.0.5: {}
 
   isexe@2.0.0: {}
@@ -29577,6 +29600,8 @@ snapshots:
       chalk: 5.6.2
       is-unicode-supported: 1.3.0
 
+  loglevel@1.9.2: {}
+
   long@5.3.2: {}
 
   longest-streak@2.0.4: {}
@@ -29638,6 +29663,10 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  magic-string@1.2.0:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+
   magicast@0.3.5:
     dependencies:
       '@babel/parser': 7.29.7
@@ -30942,7 +30971,7 @@ snapshots:
 
   neo-async@2.6.2: {}
 
-  neotraverse@0.6.18: {}
+  neotraverse@1.0.1: {}
 
   next-auth@4.24.15(next@15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3))(react-dom@18.3.1(react@19.2.3))(react@19.2.3):
     dependencies:
@@ -33861,6 +33890,8 @@ snapshots:
 
   undici-types@7.16.0: {}
 
+  undici@8.10.0: {}
+
   unicode-canonical-property-names-ecmascript@2.0.1: {}
 
   unicode-match-property-ecmascript@2.0.0:
@@ -33902,11 +33933,11 @@ snapshots:
       trough: 1.0.5
       vfile: 4.2.1
 
-  unifont@0.7.4:
+  unifont@0.7.5:
     dependencies:
       css-tree: 3.2.1
-      ofetch: 1.5.1
       ohash: 2.0.11
+      undici: 8.10.0
 
   unist-util-find-after@5.0.0:
     dependencies:
@@ -34860,8 +34891,6 @@ snapshots:
       is-weakmap: 2.0.2
       is-weakset: 2.0.4
 
-  which-pm-runs@1.1.0: {}
-
   which-typed-array@1.1.19:
     dependencies:
       available-typed-arrays: 1.0.7

From 4f9080666308063332e16d96d00a75ff7348c011 Mon Sep 17 00:00:00 2001
From: "Matt Wicks [SSW]" <wicksipedia@users.noreply.github.com>
Date: Thu, 20 Aug 2026 13:12:14 +1000
Subject: [PATCH 3/5] perf(mdx): ship one copy of acorn instead of three
 (#7407)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`@tinacms/mdx` bundles the acorn parser three times. This collapses it
to one, with no source change to the package and no change to emitted
output.

### The two causes

1. **`pnpm-workspace.yaml` pinned `acorn: 8.8.2`** while
`micromark-extension-mdxjs` pulls `^8.0.0`, resolving to 8.16.0 — two
8.x copies side by side. Aligned to `^8.16.0` (a caret, not an exact
pin: `micromark-extension-mdxjs` declares a range, so an exact pin would
re-split the moment a lockfile refresh moved it to 8.17.0).
2. **`acorn-jsx` reaches acorn via `require`**, which acorn's export map
answers with the CJS build while every other importer gets ESM — so
esbuild bundled `acorn.js` *and* `acorn.mjs`. The `@tinacms/mdx` esbuild
config now aliases `acorn` to the ESM entry acorn itself declares in its
`module` field.

### Measured

| Entry | raw before | raw after | Δ | gzip before | gzip after | Δ |
|---|---:|---:|---:|---:|---:|---:|
| `index.browser.js` | 1,976,421 | 1,578,764 | **−397,657 (−20.1%)** |
440,787 | 356,471 | **−84,316 (−19.1%)** |
| `index.js` | 2,013,419 | 1,615,828 | −397,591 (−19.7%) | 452,063 |
367,630 | −84,433 (−18.7%) |

Acorn versions in the browser bundle: `8.8.2` + `8.16.0` before,
`8.16.0` alone after.

### Output is unchanged

All 64 `src/next/tests/*` fixtures round-tripped through `parseMDX` →
`serializeMDX` from the old and new bundles produce **one identical
SHA-256**, across both the node and browser entries.

That check was mutation-proved. The first mutant survived — acorn's
module-level `parseExpressionAt` wrapper is never called, because
`micromark-extension-mdxjs` passes `Parser.extend(acornJsx())` and
reaches the **static** method (39 calls, measured). Unreachable by
construction, not a hole. Mutating the entry that *is* called flipped
the digest and changed 12 of 64 fixtures.

**What it does not cover:** only markdown/MDX fixtures in this repo — no
`parser.type: 'slatejson'`, no consumer-side integration, and the
browser bundle ran under node+jsdom rather than a real browser engine.

### Verification

`pnpm types` forced cold: 46/46. `pnpm test`: 60/60. `pnpm lint` and
`pnpm format` clean. Lockfile diff is 13 lines across 4 hunks — the
catalog entry, the mdx importer, and `acorn@8.8.2` dropped from both
sections.

No other published package changes size: `@tinacms/graphql` and
`packages/tinacms` externalise `@tinacms/mdx`, and `@tinacms/app` has no
build step. `packages/v4/**` are all `private: true`.

### Left alone

A **fourth** acorn (~138 KB) is vendored inside prettier's own
pre-bundled dist. esbuild cannot dedupe it — it is baked into prettier's
published bundle. It goes away with the prettier replacement stacked on
top of this PR.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 .changeset/dedupe-acorn-in-mdx-bundle.md |  6 ++++++
 packages/@tinacms/scripts/src/index.ts   | 17 +++++++++++++++++
 pnpm-lock.yaml                           | 13 +++----------
 pnpm-workspace.yaml                      |  2 +-
 4 files changed, 27 insertions(+), 11 deletions(-)
 create mode 100644 .changeset/dedupe-acorn-in-mdx-bundle.md

diff --git a/.changeset/dedupe-acorn-in-mdx-bundle.md b/.changeset/dedupe-acorn-in-mdx-bundle.md
new file mode 100644
index 0000000000..e0051f3b2a
--- /dev/null
+++ b/.changeset/dedupe-acorn-in-mdx-bundle.md
@@ -0,0 +1,6 @@
+---
+"@tinacms/scripts": patch
+"@tinacms/mdx": patch
+---
+
+Ship one copy of the `acorn` parser in `@tinacms/mdx` instead of three, cutting `dist/index.browser.js` from 1,976,421 to 1,578,764 bytes (440,787 to 356,471 gzipped) and `dist/index.js` from 2,013,419 to 1,615,828 bytes (452,063 to 367,630 gzipped). The catalog pinned `acorn` to 8.8.2 while `micromark-extension-mdxjs` pulled 8.16.0, so two 8.x copies were bundled side by side; separately, `acorn-jsx` reaches `acorn` through `require`, which acorn's export map answers with its CJS build while every other importer gets the ESM build, bundling the parser a second time. Aligning the catalog to `^8.16.0` and aliasing `acorn` to its ESM entry in the `@tinacms/mdx` esbuild config collapses all three into one. Parser and serializer output is unchanged — `parseMDX`/`serializeMDX` round-trips over the package's 64 markdown fixtures produce byte-identical results from the old and new bundles.
diff --git a/packages/@tinacms/scripts/src/index.ts b/packages/@tinacms/scripts/src/index.ts
index 6db22db296..bdb1f2ec88 100644
--- a/packages/@tinacms/scripts/src/index.ts
+++ b/packages/@tinacms/scripts/src/index.ts
@@ -1,5 +1,6 @@
 import * as fs from 'fs';
 import { exec } from 'node:child_process';
+import { createRequire } from 'node:module';
 import path from 'node:path';
 import chalk from 'chalk';
 import chokidar from 'chokidar';
@@ -424,6 +425,20 @@ export class BuildTina {
         });
       } else if (['@tinacms/mdx'].includes(packageJSON.name)) {
         const peerDeps = packageJSON.peerDependencies;
+
+        // acorn-jsx reaches acorn with `require`, which acorn's export map
+        // answers with the CJS build, while every other importer gets the ESM
+        // build. Without this the whole parser is bundled twice.
+        const acornManifest = createRequire(
+          path.join(process.cwd(), 'package.json')
+        ).resolve('acorn/package.json');
+        const alias = {
+          acorn: path.join(
+            path.dirname(acornManifest),
+            JSON.parse(fs.readFileSync(acornManifest, 'utf8')).module
+          ),
+        };
+
         await esbuild({
           entryPoints: [path.join(process.cwd(), entry)],
           bundle: true,
@@ -432,6 +447,7 @@ export class BuildTina {
           format: 'esm',
           outfile: path.join(process.cwd(), 'dist', 'index.js'),
           external: Object.keys({ ...peerDeps }),
+          alias,
         });
 
         // The ES version is targeting the browser. This is used by the rich-text's raw mode
@@ -446,6 +462,7 @@ export class BuildTina {
           // and includes "development" export maps which actually throw errors during
           // development, which we don't want to expose our users to.
           external: Object.keys({ ...peerDeps }),
+          alias,
         });
       } else {
         await esbuild({
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 6dfdf9f769..51569d2d3c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -310,8 +310,8 @@ catalogs:
       specifier: ^1.0.4
       version: 1.0.4
     acorn:
-      specifier: 8.8.2
-      version: 8.8.2
+      specifier: ^8.16.0
+      version: 8.16.0
     altair-express-middleware:
       specifier: ^7.3.6
       version: 7.3.6
@@ -1724,7 +1724,7 @@ importers:
         version: link:../schema-tools
       acorn:
         specifier: 'catalog:'
-        version: 8.8.2
+        version: 8.16.0
       ccount:
         specifier: 'catalog:'
         version: 2.0.1
@@ -9034,11 +9034,6 @@ packages:
     engines: {node: '>=0.4.0'}
     hasBin: true
 
-  acorn@8.8.2:
-    resolution: {integrity: sha512-xjIYgE8HBrkpd/sJqOGNspf8uHG+NOHGOw6a/Urj8taM2EXfdNAH2oFcPeIFfsv3+kz/mJrS5VuMqbNLjCa2vw==}
-    engines: {node: '>=0.4.0'}
-    hasBin: true
-
   adm-zip@0.5.16:
     resolution: {integrity: sha512-TGw5yVi4saajsSEgz25grObGHEUaDrniwvA2qwSC060KfqGPdglhvPMA2lPIoxs3PQIItj2iag35fONcQqgUaQ==}
     engines: {node: '>=12.0'}
@@ -24887,8 +24882,6 @@ snapshots:
 
   acorn@8.16.0: {}
 
-  acorn@8.8.2: {}
-
   adm-zip@0.5.16: {}
 
   agent-base@7.1.4: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 1dd8830667..ffdf7c0979 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -142,7 +142,7 @@ catalog:
     "@vercel/stega": ^0.0.5
     "@vitejs/plugin-react": ^4.7.0
     abstract-level: ^1.0.4
-    acorn: 8.8.2
+    acorn: ^8.16.0
     altair-express-middleware: ^7.3.6
     auto-bind: ^4.0.0
     autoprefixer: ^10.4.20

From f32ad27481ededaa04a6d5e1474bb1820294e25e Mon Sep 17 00:00:00 2001
From: "Matt Wicks [SSW]" <wicksipedia@users.noreply.github.com>
Date: Thu, 20 Aug 2026 15:05:27 +1000
Subject: [PATCH 4/5] =?UTF-8?q?=F0=9F=A7=AA=20First=20production-build=20a?=
 =?UTF-8?q?dmin=20browser=20suite=20+=20hostile=20fixture=20(#7317)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #7239 · Part of #7237 (Phase 0 — baselines land before any risky
work)

The repo's first Playwright suite that runs against a **production**
`tinacms build` output — every existing suite boots `tinacms dev`, which
is structurally blind to bugs that only exist in production bundles.
This baselines today's vite-built admin; #7243 will rerun the identical
suite with the prebuilt flag on.

## The hostile fixture (`playwright/prebuilt-admin/`)

All seven ingredients from the issue, each guarding a named failure
class:

- custom field component colocated with the schema
- a component importing `next/image` (CJS dep → CJS `require('react')`
against the bundle's React)
- `aspect-w-9` (class the admin never uses) + `bg-blue-500` (must
resolve to Tina's themed `rgb(0,132,255)`)
- real `media.loadCustomStore` behind a dynamic `import()`
- `UsernamePasswordAuthJSProvider` from `tinacms-authjs/dist/tinacms`
(drags CJS `next-auth/react`); runtime-selected against
`LocalAuthProvider` so both stay in the bundle while specs choose which
is active
- `cmsCallback` registering a `createScreen` screen (react-router path)
- `build.basePath: 'my-site'`

## Specs (8 files, 12 tests)

`boot` (collection list; exactly one React renderer via an injected
devtools-hook stub — production React has no hook; zero console errors),
`custom-field` (save round-trips to disk), `screen` (navigates to the
registered screen **through the admin's own sidebar nav**, so
`useNavigate`/`NavLink` actually execute rather than a URL deep-link),
`tailwind` (computed styles for both probe classes), `basepath` (**with
and without** trailing slash), `media`, `auth`, plus a setup
**meta-assertion** that greps the built chunks for
`next/image`/custom-store/`next-auth`/screen markers — so the fixture
can never go tame silently.

`webServer` recipe: `tinacms build --local` emits the production SPA
into `public/admin` and keeps the local GraphQL/media server on :4001; a
zero-dep static server (`serve-admin.mjs`) serves the built SPA under
`/my-site/admin` (bare + trailing slash) on :3000.

## Notes for a reviewer

**The renderer-count + console-error check runs on the edit form, not
just the list.** That check is the suite's sharpest instrument, but
`FixtureField` — the component importing `next/image` — only mounts on
the edit form. Scoped to the collection list it would miss a render-time
throw from the very ingredient it exists to catch. Factored into
`trackConsoleErrors` / `assertHealthyRender`
(`e2e/utils/admin-helpers.ts`) and called from every spec that reaches
the form.

**The mutating spec is isolated and resets per attempt.** `custom-field`
writes to disk, so it owns `content/post/roundtrip.mdx`; the read-only
specs use `hello.mdx`. Snapshot/restore is `beforeEach`/`afterEach`, not
`beforeAll`/`afterAll` — with `retries: 2`, an attempt that saves
successfully then times out on the disk read would otherwise leave the
file mutated and make the retry fail deterministically, turning a
transient flake into a guaranteed red.

**`next` is pinned to 15.5.21.** 14.2.35 carries seven high-severity
advisories and `dependency-review` reads the fixture's manifest like any
other. `next/image` is still CJS and still does `require('react')` in
15, so the trap is intact; React stays on 18.3.1.

## Verified

- **CI green**, `prebuilt-admin-e2e` included, on the current head
- 12/12 green on repeated clean runs
- Trap re-introduction: breaking bare-path serving turns `basepath.spec`
red; removing the `next/image` import turns the meta-assertion red
- Workflow path-filtered on `packages/@tinacms/{cli,app}/**`,
`packages/tinacms/**`, `playwright/prebuilt-admin/**`; traces and the
HTML report upload on failure

## Finding (feeds #7243)

`tinacms build --local` does **not** bake the local apiUrl into the
admin — `buildProductionSpa` always uses `codegen.productionUrl`, so
with an empty clientId the SPA crashes on boot. The fixture works around
it with `contentApiUrlOverride: 'http://localhost:4001/graphql'`
(documented in its README). Worth an independent check on whether
kitchen-sink local builds are similarly pointed at TinaCloud.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 .../workflows/playwright-prebuilt-admin.yml   |  57 ++++++++
 playwright/prebuilt-admin/.gitignore          |  17 +++
 playwright/prebuilt-admin/README.md           |  83 ++++++++++++
 .../prebuilt-admin/content/post/hello.mdx     |   6 +
 .../prebuilt-admin/content/post/roundtrip.mdx |   8 ++
 playwright/prebuilt-admin/e2e/auth.spec.ts    |  27 ++++
 .../prebuilt-admin/e2e/basepath.spec.ts       |  28 ++++
 playwright/prebuilt-admin/e2e/boot.spec.ts    |  31 +++++
 .../prebuilt-admin/e2e/custom-field.spec.ts   |  74 +++++++++++
 playwright/prebuilt-admin/e2e/media.spec.ts   |  22 ++++
 playwright/prebuilt-admin/e2e/screen.spec.ts  |  38 ++++++
 playwright/prebuilt-admin/e2e/setup.spec.ts   |  64 +++++++++
 .../prebuilt-admin/e2e/tailwind.spec.ts       |  55 ++++++++
 .../prebuilt-admin/e2e/utils/admin-helpers.ts | 123 ++++++++++++++++++
 playwright/prebuilt-admin/package.json        |  25 ++++
 .../prebuilt-admin/playwright.config.ts       |  45 +++++++
 playwright/prebuilt-admin/serve-admin.mjs     | 109 ++++++++++++++++
 .../prebuilt-admin/tina/collections/post.ts   |  33 +++++
 playwright/prebuilt-admin/tina/config.tsx     |  73 +++++++++++
 .../tina/fields/fixture-field.tsx             |  36 +++++
 .../tina/media/fixture-media-store.ts         |  42 ++++++
 playwright/prebuilt-admin/tsconfig.json       |  16 +++
 pnpm-lock.yaml                                |  54 +++++++-
 23 files changed, 1065 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/playwright-prebuilt-admin.yml
 create mode 100644 playwright/prebuilt-admin/.gitignore
 create mode 100644 playwright/prebuilt-admin/README.md
 create mode 100644 playwright/prebuilt-admin/content/post/hello.mdx
 create mode 100644 playwright/prebuilt-admin/content/post/roundtrip.mdx
 create mode 100644 playwright/prebuilt-admin/e2e/auth.spec.ts
 create mode 100644 playwright/prebuilt-admin/e2e/basepath.spec.ts
 create mode 100644 playwright/prebuilt-admin/e2e/boot.spec.ts
 create mode 100644 playwright/prebuilt-admin/e2e/custom-field.spec.ts
 create mode 100644 playwright/prebuilt-admin/e2e/media.spec.ts
 create mode 100644 playwright/prebuilt-admin/e2e/screen.spec.ts
 create mode 100644 playwright/prebuilt-admin/e2e/setup.spec.ts
 create mode 100644 playwright/prebuilt-admin/e2e/tailwind.spec.ts
 create mode 100644 playwright/prebuilt-admin/e2e/utils/admin-helpers.ts
 create mode 100644 playwright/prebuilt-admin/package.json
 create mode 100644 playwright/prebuilt-admin/playwright.config.ts
 create mode 100644 playwright/prebuilt-admin/serve-admin.mjs
 create mode 100644 playwright/prebuilt-admin/tina/collections/post.ts
 create mode 100644 playwright/prebuilt-admin/tina/config.tsx
 create mode 100644 playwright/prebuilt-admin/tina/fields/fixture-field.tsx
 create mode 100644 playwright/prebuilt-admin/tina/media/fixture-media-store.ts
 create mode 100644 playwright/prebuilt-admin/tsconfig.json

diff --git a/.github/workflows/playwright-prebuilt-admin.yml b/.github/workflows/playwright-prebuilt-admin.yml
new file mode 100644
index 0000000000..4416201e91
--- /dev/null
+++ b/.github/workflows/playwright-prebuilt-admin.yml
@@ -0,0 +1,57 @@
+name: Playwright — prebuilt admin (production build)
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'packages/@tinacms/cli/**'
+      - 'packages/@tinacms/app/**'
+      - 'packages/tinacms/**'
+      - 'packages/@tinacms/schema-tools/**'
+      - 'packages/@tinacms/mdx/**'
+      - 'packages/@tinacms/graphql/**'
+      - 'playwright/prebuilt-admin/**'
+      - '.github/workflows/playwright-prebuilt-admin.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  e2e:
+    name: prebuilt-admin-e2e
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Setup Node.js environment
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          package_json_file: package.json
+          run_install: false
+      - name: Install dependencies
+        run: pnpm install
+      - name: Build workspace packages
+        run: pnpm build
+      - name: Install Playwright browsers
+        working-directory: playwright/prebuilt-admin
+        run: npx playwright install --with-deps chromium
+      - name: Run prebuilt-admin Playwright tests
+        working-directory: playwright/prebuilt-admin
+        run: npx playwright test
+        env:
+          CI: true
+      - name: Upload traces and test results
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: prebuilt-admin-playwright-report
+          path: |
+            playwright/prebuilt-admin/test-results/
+            playwright/prebuilt-admin/playwright-test-results.json
+          retention-days: 7
+          if-no-files-found: ignore
diff --git a/playwright/prebuilt-admin/.gitignore b/playwright/prebuilt-admin/.gitignore
new file mode 100644
index 0000000000..dc0ddf02b9
--- /dev/null
+++ b/playwright/prebuilt-admin/.gitignore
@@ -0,0 +1,17 @@
+# dependencies
+/node_modules
+
+# generated tina client + admin build output
+/tina/__generated__
+/public/admin
+
+# playwright
+/test-results/
+/playwright-report/
+/blob-report/
+/playwright/.cache/
+/playwright-test-results.json
+
+# misc
+.DS_Store
+*.log
diff --git a/playwright/prebuilt-admin/README.md b/playwright/prebuilt-admin/README.md
new file mode 100644
index 0000000000..9d1a0994f3
--- /dev/null
+++ b/playwright/prebuilt-admin/README.md
@@ -0,0 +1,83 @@
+# prebuilt-admin
+
+The repo's first Playwright suite that runs against a **production `tinacms build`
+output** instead of `tinacms dev`. It is driven by a deliberately hostile fixture
+config so that a browser-only, production-only regression in the admin bundle
+fails here instead of slipping through CI.
+
+Green on `main` today is the baseline. Issue #7243 will rerun this identical
+suite with the prebuilt flag on; the specs are written to be **mode-agnostic**.
+
+## How the webServer works
+
+`pnpm serve:prod` runs:
+
+```
+tinacms build --local --skip-cloud-checks --noTelemetry -c "node serve-admin.mjs"
+```
+
+1. `tinacms build --local` builds the **production** admin SPA into
+   `public/admin/` (minified vite build — the same output a real deploy ships)
+   **and** keeps a local GraphQL + media server alive on `:4001`.
+2. The `-c` sub-command starts `serve-admin.mjs`, a tiny static server that
+   serves the built SPA under `/my-site/admin/` on `:3456`.
+
+The browser loads the production bundle from `:3456`; the admin queries the API
+cross-origin on `:4001` (localhost origins are CORS-allowed by the dev server).
+Playwright waits for `http://localhost:3456/my-site/admin/` before running.
+
+### Why `contentApiUrlOverride` is set
+
+`tinacms build` bakes `codegen.productionUrl` (the TinaCloud content URL) into
+the SPA **regardless of `--local`** — `--local` only affects the generated
+client SDK and runs a local server for build-time indexing. Without an override
+the admin would point at `https://content.tinajs.io/...` (with this fixture's
+empty clientId/branch that URL is even malformed and the admin crashes on boot).
+Setting `contentApiUrlOverride: 'http://localhost:4001/graphql'` redirects the
+baked SPA at the local server. This diverges from the issue brief's assumption
+that "in local mode the baked apiUrl points at the local GraphQL server"; it
+does not, and the override is the fix.
+
+## The hostile fixture (seven ingredients)
+
+Each guards a class of production-only bundling bug. `e2e/setup.spec.ts` greps
+the built chunks to prove they actually reached the bundle (guards against an
+accidentally-tame fixture).
+
+| Ingredient | Where |
+|---|---|
+| Custom field component colocated with the schema | `tina/fields/fixture-field.tsx` |
+| Component importing `next/image` (CJS `require('react')`) | `tina/fields/fixture-field.tsx` |
+| Arbitrary Tailwind class `aspect-w-9` + themed `bg-blue-500` | `tina/fields/fixture-field.tsx` |
+| Real `media.loadCustomStore` via dynamic `import()` | `tina/media/fixture-media-store.ts` |
+| `UsernamePasswordAuthJSProvider` from `tinacms-authjs/dist/tinacms` | `tina/config.tsx` |
+| `cmsCallback` registering a screen plugin | `tina/config.tsx` |
+| `build.basePath: 'my-site'` | `tina/config.tsx` |
+
+The auth provider is selected at runtime: `window.__TINA_FIXTURE_AUTHJS__`
+(set by `auth.spec` before boot) activates `UsernamePasswordAuthJSProvider` so
+its custom login screen renders; every other spec boots the local provider and
+clicks through the "Enter Edit Mode" dialog. Both providers are referenced so
+the bundler keeps `tinacms-authjs` (and its CJS `next-auth/react`) in the build
+either way.
+
+## Specs
+
+- `boot.spec` — collection list renders; single React reconciler; zero console errors on boot
+- `custom-field.spec` — custom field renders and a save round-trips to disk (its own document, `roundtrip.mdx`, isolated from the read-only specs)
+- `tailwind.spec` — `bg-blue-500` computes to Tina's `rgb(0, 132, 255)`; `aspect-w-9` compiled; also re-asserts the single-React/zero-console-error health check, since this is where `next/image` actually renders
+- `basepath.spec` — admin boots at `/my-site/admin/` **and** the bare `/my-site/admin`
+- `media.spec` — media manager lists via the custom store
+- `auth.spec` — the custom AuthJS login screen appears
+- `screen.spec` — navigates through the admin nav (not a deep link) to the `cmsCallback` screen plugin, guarding a second react-router-dom instance
+- `setup.spec` — meta-assertion: the CJS module, custom store and screen plugin are present in the built chunks
+
+## Running locally
+
+```
+pnpm install          # from repo root
+pnpm build            # build the workspace packages the fixture consumes
+cd playwright/prebuilt-admin
+npx playwright install chromium
+npx playwright test
+```
diff --git a/playwright/prebuilt-admin/content/post/hello.mdx b/playwright/prebuilt-admin/content/post/hello.mdx
new file mode 100644
index 0000000000..9d8d865ca7
--- /dev/null
+++ b/playwright/prebuilt-admin/content/post/hello.mdx
@@ -0,0 +1,6 @@
+---
+title: Hello Prebuilt
+marker: initial-marker
+---
+
+Hello from the prebuilt-admin fixture.
diff --git a/playwright/prebuilt-admin/content/post/roundtrip.mdx b/playwright/prebuilt-admin/content/post/roundtrip.mdx
new file mode 100644
index 0000000000..3112cde5ed
--- /dev/null
+++ b/playwright/prebuilt-admin/content/post/roundtrip.mdx
@@ -0,0 +1,8 @@
+---
+title: Roundtrip Fixture
+marker: initial-marker
+---
+
+Dedicated document for custom-field.spec's save round-trip. Kept separate
+from hello.mdx (read by boot.spec and tailwind.spec) so the mutating spec
+never races a read-only spec over the same file.
diff --git a/playwright/prebuilt-admin/e2e/auth.spec.ts b/playwright/prebuilt-admin/e2e/auth.spec.ts
new file mode 100644
index 0000000000..b682d811a4
--- /dev/null
+++ b/playwright/prebuilt-admin/e2e/auth.spec.ts
@@ -0,0 +1,27 @@
+import { expect, test } from '@playwright/test';
+import { ADMIN_ROOT } from './utils/admin-helpers';
+
+// The `UsernamePasswordAuthJSProvider` ingredient drags the ESM entry that
+// requires CJS `next-auth/react` into the bundle. When that provider is the
+// active one, the admin must render its custom username/password login screen
+// instead of the local edit-mode flow — proving next-auth/react loaded and ran
+// in the browser. The fixture selects this provider at runtime when
+// `window.__TINA_FIXTURE_AUTHJS__` is set before boot.
+test('custom AuthJS login screen appears', async ({ page }) => {
+  await page.addInitScript(() => {
+    (
+      window as unknown as { __TINA_FIXTURE_AUTHJS__: boolean }
+    ).__TINA_FIXTURE_AUTHJS__ = true;
+  });
+
+  await page.goto(ADMIN_ROOT, { waitUntil: 'domcontentloaded' });
+
+  // The username/password modal from UsernamePasswordAuthJSProvider.
+  await expect(page.getByPlaceholder('Username')).toBeVisible({
+    timeout: 30000,
+  });
+  await expect(page.getByPlaceholder('Password')).toBeVisible();
+  await expect(
+    page.getByRole('button', { name: 'Login', exact: true })
+  ).toBeVisible();
+});
diff --git a/playwright/prebuilt-admin/e2e/basepath.spec.ts b/playwright/prebuilt-admin/e2e/basepath.spec.ts
new file mode 100644
index 0000000000..f4b07e8919
--- /dev/null
+++ b/playwright/prebuilt-admin/e2e/basepath.spec.ts
@@ -0,0 +1,28 @@
+import { expect, test } from '@playwright/test';
+import { waitForAdminShell } from './utils/admin-helpers';
+
+// `build.basePath: 'my-site'` must serve a bootable admin at BOTH the
+// trailing-slash and bare forms. The bare form is the spike's trap: without
+// a trailing slash, `document.baseURI` drops the last segment and every
+// relative asset 404s. Assets are absolute in the production build, so the
+// bare form must still boot — this locks that in.
+for (const path of ['/my-site/admin/', '/my-site/admin']) {
+  test(`admin boots at "${path}"`, async ({ page }) => {
+    const consoleErrors: string[] = [];
+    page.on('console', (msg) => {
+      if (msg.type() === 'error') consoleErrors.push(msg.text());
+    });
+
+    await page.goto(path, { waitUntil: 'domcontentloaded' });
+    await waitForAdminShell(page);
+
+    // The shell mounted into #root (assets resolved).
+    const rootChildren = await page.evaluate(
+      () => document.getElementById('root')?.childElementCount ?? 0
+    );
+    expect(rootChildren).toBeGreaterThan(0);
+
+    // The build's inline asset-load guard never fired.
+    expect(consoleErrors.join('\n')).not.toContain('Failed to load assets');
+  });
+}
diff --git a/playwright/prebuilt-admin/e2e/boot.spec.ts b/playwright/prebuilt-admin/e2e/boot.spec.ts
new file mode 100644
index 0000000000..6558de7dd5
--- /dev/null
+++ b/playwright/prebuilt-admin/e2e/boot.spec.ts
@@ -0,0 +1,31 @@
+import { expect, test } from '@playwright/test';
+import {
+  ADMIN_INDEX,
+  DEVTOOLS_HOOK_STUB,
+  assertHealthyRender,
+  enterEditMode,
+  trackConsoleErrors,
+  waitForAdminShell,
+} from './utils/admin-helpers';
+
+// Boots the PRODUCTION admin bundle and asserts the health invariants that a
+// broken bundling of the hostile config would violate: the collection list
+// renders, exactly one React reconciler is live, and nothing logs an error
+// while the shell comes up.
+test('admin boots clean: collection list, single React, zero console errors', async ({
+  page,
+}) => {
+  await page.addInitScript(DEVTOOLS_HOOK_STUB);
+  const consoleErrors = trackConsoleErrors(page);
+
+  await page.goto(`${ADMIN_INDEX}#/collections/post`, {
+    waitUntil: 'domcontentloaded',
+  });
+  await waitForAdminShell(page);
+  await enterEditMode(page);
+
+  // Collection list renders — the seeded document appears in the table.
+  await expect(page.getByText('Hello Prebuilt')).toBeVisible();
+
+  await assertHealthyRender(page, consoleErrors);
+});
diff --git a/playwright/prebuilt-admin/e2e/custom-field.spec.ts b/playwright/prebuilt-admin/e2e/custom-field.spec.ts
new file mode 100644
index 0000000000..bc68707bfb
--- /dev/null
+++ b/playwright/prebuilt-admin/e2e/custom-field.spec.ts
@@ -0,0 +1,74 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { expect, test } from '@playwright/test';
+import {
+  ADMIN_INDEX,
+  DEVTOOLS_HOOK_STUB,
+  assertHealthyRender,
+  clickSave,
+  enterEditMode,
+  trackConsoleErrors,
+  waitForAdminShell,
+} from './utils/admin-helpers';
+
+// This is the only spec that mutates fixture content on disk. It has its own
+// document (roundtrip.mdx) — separate from hello.mdx, which boot.spec and
+// tailwind.spec read — so it never races a read-only spec over the same file
+// under `fullyParallel: true`.
+const ROUNDTRIP_PATH = join(
+  __dirname,
+  '..',
+  'content',
+  'post',
+  'roundtrip.mdx'
+);
+
+// The colocated custom field component must render through the schema seam in
+// the production bundle, and a save must round-trip its value to disk.
+test.describe('custom field', () => {
+  let original: string;
+
+  // Snapshot/restore per attempt, not just per suite: with CI's `retries: 2`,
+  // an attempt that saves successfully and then fails a later assertion (a
+  // slow disk write racing `toPass`) would otherwise leave the file mutated
+  // going into the retry, turning a transient flake into a deterministic
+  // failure of the `toHaveValue('initial-marker')` assertion below.
+  test.beforeEach(() => {
+    original = readFileSync(ROUNDTRIP_PATH, 'utf8');
+  });
+
+  test.afterEach(() => {
+    writeFileSync(ROUNDTRIP_PATH, original, 'utf8');
+  });
+
+  test('renders and round-trips a save to disk', async ({ page }) => {
+    await page.addInitScript(DEVTOOLS_HOOK_STUB);
+    const consoleErrors = trackConsoleErrors(page);
+
+    await page.goto(`${ADMIN_INDEX}#/collections/edit/post/roundtrip`, {
+      waitUntil: 'domcontentloaded',
+    });
+    await waitForAdminShell(page);
+    await enterEditMode(page);
+
+    const input = page.getByTestId('fixture-field-input');
+    await expect(input).toBeVisible({ timeout: 30000 });
+    await expect(input).toHaveValue('initial-marker');
+
+    // The killer trap (next/image dragging a second React copy) only fires
+    // once FixtureField actually renders, which only happens on this edit
+    // form — boot.spec's collection list never mounts it.
+    await assertHealthyRender(page, consoleErrors);
+
+    const nextValue = `roundtrip-${Date.now()}`;
+    await input.fill(nextValue);
+    await clickSave(page);
+
+    // The mutation writes back through the filesystem bridge; give the write a
+    // beat then assert the new value is on disk.
+    await expect(async () => {
+      const onDisk = readFileSync(ROUNDTRIP_PATH, 'utf8');
+      expect(onDisk).toContain(`marker: ${nextValue}`);
+    }).toPass({ timeout: 10000 });
+  });
+});
diff --git a/playwright/prebuilt-admin/e2e/media.spec.ts b/playwright/prebuilt-admin/e2e/media.spec.ts
new file mode 100644
index 0000000000..5863048e8a
--- /dev/null
+++ b/playwright/prebuilt-admin/e2e/media.spec.ts
@@ -0,0 +1,22 @@
+import { expect, test } from '@playwright/test';
+import {
+  ADMIN_INDEX,
+  enterEditMode,
+  waitForAdminShell,
+} from './utils/admin-helpers';
+
+// The media library is backed by `media.loadCustomStore`'s dynamic import.
+// The Media Manager screen must list the item the custom store returns. We
+// route to the screen directly (`slugify('Media Manager') === 'media_manager'`)
+// so the assertion doesn't depend on the responsive nav drawer.
+test('media manager lists via the custom store', async ({ page }) => {
+  await page.goto(`${ADMIN_INDEX}#/screens/media_manager`, {
+    waitUntil: 'domcontentloaded',
+  });
+  await waitForAdminShell(page);
+  await enterEditMode(page);
+
+  await expect(page.getByText('prebuilt-fixture-media.png')).toBeVisible({
+    timeout: 30000,
+  });
+});
diff --git a/playwright/prebuilt-admin/e2e/screen.spec.ts b/playwright/prebuilt-admin/e2e/screen.spec.ts
new file mode 100644
index 0000000000..f32854d8cf
--- /dev/null
+++ b/playwright/prebuilt-admin/e2e/screen.spec.ts
@@ -0,0 +1,38 @@
+import { expect, test } from '@playwright/test';
+import {
+  ADMIN_INDEX,
+  enterEditMode,
+  trackConsoleErrors,
+  waitForAdminShell,
+} from './utils/admin-helpers';
+
+// The `cmsCallback` ingredient (tina/config.tsx) registers a screen plugin via
+// the raw `{ __type: 'screen' }` literal. It exists to catch a second
+// react-router-dom instance breaking `useNavigate`/`NavLink` — a bundling bug
+// that only shows up on a real navigation through the admin's own router, not
+// when the URL is deep-linked directly. So this spec drives the sidebar nav
+// (open the menu, click the screen link) rather than going straight to
+// `#/screens/fixture_screen`.
+test('screen plugin renders after navigating through the admin nav', async ({
+  page,
+}) => {
+  const consoleErrors = trackConsoleErrors(page);
+
+  await page.goto(`${ADMIN_INDEX}#/collections/post`, {
+    waitUntil: 'domcontentloaded',
+  });
+  await waitForAdminShell(page);
+  await enterEditMode(page);
+
+  await page.getByRole('button', { name: 'Toggle navigation menu' }).click();
+  await page.getByRole('link', { name: 'Fixture Screen' }).click();
+
+  await expect(page.getByTestId('fixture-screen')).toBeVisible({
+    timeout: 30000,
+  });
+
+  expect(
+    consoleErrors,
+    `console errors navigating to the screen:\n${consoleErrors.join('\n')}`
+  ).toEqual([]);
+});
diff --git a/playwright/prebuilt-admin/e2e/setup.spec.ts b/playwright/prebuilt-admin/e2e/setup.spec.ts
new file mode 100644
index 0000000000..43148af278
--- /dev/null
+++ b/playwright/prebuilt-admin/e2e/setup.spec.ts
@@ -0,0 +1,64 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { expect, test } from '@playwright/test';
+
+// Meta-assertion: guard against an accidentally-tame fixture. If the hostile
+// ingredients ever stop reaching the production bundle, the browser specs could
+// pass forever while real-world configs die. This greps the built admin chunks
+// to prove the risky modules actually made it in.
+const ASSETS_DIR = join(__dirname, '..', 'public', 'admin', 'assets');
+
+function readBuiltJs(): string {
+  expect(
+    existsSync(ASSETS_DIR),
+    `Built admin assets not found at ${ASSETS_DIR} — did the webServer run "tinacms build"?`
+  ).toBe(true);
+  return readdirSync(ASSETS_DIR)
+    .filter((f) => f.endsWith('.js'))
+    .map((f) => readFileSync(join(ASSETS_DIR, f), 'utf8'))
+    .join('\n');
+}
+
+test.describe('built bundle contains the hostile ingredients', () => {
+  test('next/image (CJS require(react)) is bundled', () => {
+    const js = readBuiltJs();
+    // next/image internals that survive minification.
+    const nextImageTokens = [
+      'imageConfigDefault',
+      'deviceSizes',
+      'VALID_LOADERS',
+      '__NEXT_IMAGE',
+    ];
+    const present = nextImageTokens.filter((t) => js.includes(t));
+    expect(
+      present.length,
+      `Expected next/image markers in the build, found none of: ${nextImageTokens.join(', ')}`
+    ).toBeGreaterThan(0);
+  });
+
+  test('custom media store is bundled', () => {
+    const js = readBuiltJs();
+    expect(js).toContain('prebuilt-fixture-media');
+  });
+
+  test('tinacms-authjs / next-auth is bundled', () => {
+    const js = readBuiltJs();
+    // Two next-auth-specific string literals (minification-proof): the client
+    // logger's error constant and the default API basePath. Both must be
+    // present — a loose substring like 'next-auth' could match incidentally.
+    expect(js).toContain('CLIENT_FETCH_ERROR');
+    expect(js).toContain('/api/auth');
+  });
+
+  // Without this, screen.spec's nav-click + zero-console-errors assertion
+  // would be meaningless: it would pass vacuously if the `cmsCallback` plugin
+  // registration were ever dropped from the bundle (e.g. tree-shaken), since
+  // there'd simply be no "Fixture Screen" link to find. This proves the
+  // screen actually reached the built chunk, so a real react-router-dom
+  // duplication is what the runtime spec is left to catch.
+  test('screen plugin (react-router-dom singleton guard) is bundled', () => {
+    const js = readBuiltJs();
+    expect(js).toContain('fixture-screen');
+    expect(js).toContain('Fixture Screen');
+  });
+});
diff --git a/playwright/prebuilt-admin/e2e/tailwind.spec.ts b/playwright/prebuilt-admin/e2e/tailwind.spec.ts
new file mode 100644
index 0000000000..3505eae6c4
--- /dev/null
+++ b/playwright/prebuilt-admin/e2e/tailwind.spec.ts
@@ -0,0 +1,55 @@
+import { expect, test } from '@playwright/test';
+import {
+  ADMIN_INDEX,
+  DEVTOOLS_HOOK_STUB,
+  assertHealthyRender,
+  enterEditMode,
+  trackConsoleErrors,
+  waitForAdminShell,
+} from './utils/admin-helpers';
+
+// The admin build runs a second Tailwind pass over the colocated field code.
+// This proves that pass ran AND that it used Tina's theme rather than stock
+// Tailwind: `aspect-w-9` only exists because @tailwindcss/aspect-ratio was in
+// the pass, and `bg-blue-500` resolves to Tina's blue, not #3b82f6.
+test('fixture Tailwind classes compile with Tina theme', async ({ page }) => {
+  await page.addInitScript(DEVTOOLS_HOOK_STUB);
+  const consoleErrors = trackConsoleErrors(page);
+
+  await page.goto(`${ADMIN_INDEX}#/collections/edit/post/hello`, {
+    waitUntil: 'domcontentloaded',
+  });
+  await waitForAdminShell(page);
+  await enterEditMode(page);
+
+  // The custom field renders once the form loads; its text input is the
+  // reliable "form is ready" signal.
+  await expect(page.getByTestId('fixture-field-input')).toBeVisible({
+    timeout: 30000,
+  });
+
+  // The killer trap (next/image dragging a second React copy) only fires
+  // once FixtureField actually renders, which only happens on this edit
+  // form — boot.spec's collection list never mounts it.
+  await assertHealthyRender(page, consoleErrors);
+
+  // The probe is an empty aspect-ratio div (0 height), so assert attachment
+  // rather than visibility — computed styles read fine either way.
+  const probe = page.getByTestId('tw-probe');
+  await expect(probe).toBeAttached();
+
+  const styles = await probe.evaluate((el) => {
+    const cs = getComputedStyle(el);
+    return {
+      backgroundColor: cs.backgroundColor,
+      position: cs.position,
+      aspectW: cs.getPropertyValue('--tw-aspect-w').trim(),
+    };
+  });
+
+  // Tina's blue.500 is #0084FF.
+  expect(styles.backgroundColor).toBe('rgb(0, 132, 255)');
+  // aspect-w-9 from @tailwindcss/aspect-ratio.
+  expect(styles.position).toBe('relative');
+  expect(styles.aspectW).toBe('9');
+});
diff --git a/playwright/prebuilt-admin/e2e/utils/admin-helpers.ts b/playwright/prebuilt-admin/e2e/utils/admin-helpers.ts
new file mode 100644
index 0000000000..5a0425be15
--- /dev/null
+++ b/playwright/prebuilt-admin/e2e/utils/admin-helpers.ts
@@ -0,0 +1,123 @@
+import { type Page, expect } from '@playwright/test';
+
+// The fixture sets `build.basePath: 'my-site'`, so the admin lives under
+// /my-site/admin/. Hash routes hang off index.html.
+export const ADMIN_ROOT = '/my-site/admin/';
+export const ADMIN_INDEX = '/my-site/admin/index.html';
+
+/**
+ * A minimal React DevTools global hook. Production React only calls
+ * `__REACT_DEVTOOLS_GLOBAL_HOOK__.inject(...)` if the hook already exists —
+ * the browser extension normally supplies it. Injecting this stub via
+ * `addInitScript` (before any bundle runs) lets us count how many react-dom
+ * instances register: exactly one on a healthy single-React build.
+ */
+export const DEVTOOLS_HOOK_STUB = `
+  (() => {
+    const renderers = new Map();
+    let id = 0;
+    window.__REACT_DEVTOOLS_GLOBAL_HOOK__ = {
+      supportsFiber: true,
+      isDisabled: false,
+      renderers,
+      inject(renderer) { const rid = ++id; renderers.set(rid, renderer); return rid; },
+      onCommitFiberRoot() {},
+      onCommitFiberUnmount() {},
+      onPostCommitFiberRoot() {},
+      on() {}, off() {}, emit() {}, sub() { return () => {}; },
+      checkDCE() {}, getFiberRoots() { return new Set(); },
+    };
+  })();
+`;
+
+/**
+ * Wait until the admin shell has mounted (the "local mode" chrome and the
+ * left-hand collection nav are both reliable signals across screens).
+ */
+export async function waitForAdminShell(page: Page): Promise<void> {
+  await expect(page.getByText('You are in local mode').first()).toBeVisible({
+    timeout: 30000,
+  });
+}
+
+/**
+ * In local mode the LocalAuthProvider gates the admin behind an "Enter Edit
+ * Mode" dialog on first visit per browser context (it sets a localStorage
+ * flag). Click through it so the GraphQL-backed content renders. Safe to call
+ * when the dialog isn't shown.
+ */
+export async function enterEditMode(page: Page): Promise<void> {
+  const btn = page.getByRole('button', {
+    name: 'Enter Edit Mode',
+    exact: true,
+  });
+  const appeared = await btn
+    .waitFor({ state: 'visible', timeout: 10000 })
+    .then(() => true)
+    .catch(() => false);
+  if (appeared) {
+    await btn.click();
+    await btn.waitFor({ state: 'hidden', timeout: 10000 }).catch(() => {});
+  }
+}
+
+/**
+ * Click Save and wait for the GraphQL mutation to resolve. The API is served
+ * cross-origin on :4001, so match on the /graphql suffix + 200.
+ */
+export async function clickSave(page: Page): Promise<void> {
+  const saved = page.waitForResponse(
+    (resp) => resp.url().includes('/graphql') && resp.status() === 200,
+    { timeout: 15000 }
+  );
+  await page.getByRole('button', { name: 'Save', exact: true }).click();
+  await saved;
+}
+
+/**
+ * Start collecting console errors and page errors. Call before `page.goto`
+ * so nothing during boot is missed, then hand the returned array to
+ * `assertHealthyRender`.
+ */
+export function trackConsoleErrors(page: Page): string[] {
+  const consoleErrors: string[] = [];
+  page.on('console', (msg) => {
+    if (msg.type() === 'error') consoleErrors.push(msg.text());
+  });
+  page.on('pageerror', (err) => {
+    consoleErrors.push(`pageerror: ${err.message}`);
+  });
+  return consoleErrors;
+}
+
+/**
+ * The "killer trap" health check (single React reconciler + zero console
+ * errors), factored out so every spec that renders the hostile bundle —
+ * not just boot.spec's collection list — can assert it. `FixtureField`
+ * (which imports `next/image`) only mounts on the edit form, so the
+ * custom-field and tailwind specs must call this too: the collection list
+ * alone never exercises next/image's render, only its module import.
+ *
+ * Requires `DEVTOOLS_HOOK_STUB` to have been injected via `addInitScript`
+ * before `page.goto`, and `consoleErrors` to come from `trackConsoleErrors`.
+ */
+export async function assertHealthyRender(
+  page: Page,
+  consoleErrors: string[]
+): Promise<void> {
+  // Exactly one react-dom registered with the DevTools hook. A second React
+  // dragged in through a CJS dep (e.g. next/image) would push this to 2.
+  const renderers = await page.evaluate(
+    () =>
+      (
+        window as unknown as {
+          __REACT_DEVTOOLS_GLOBAL_HOOK__: { renderers: Map<number, unknown> };
+        }
+      ).__REACT_DEVTOOLS_GLOBAL_HOOK__.renderers.size
+  );
+  expect(renderers).toBe(1);
+
+  expect(consoleErrors, `console errors:\n${consoleErrors.join('\n')}`).toEqual(
+    []
+  );
+}
diff --git a/playwright/prebuilt-admin/package.json b/playwright/prebuilt-admin/package.json
new file mode 100644
index 0000000000..02f5d15a24
--- /dev/null
+++ b/playwright/prebuilt-admin/package.json
@@ -0,0 +1,25 @@
+{
+  "name": "playwright-prebuilt-admin",
+  "private": true,
+  "version": "0.0.0",
+  "scripts": {
+    "build:admin": "tinacms build --local --skip-cloud-checks --noTelemetry",
+    "serve:prod": "tinacms build --local --skip-cloud-checks --noTelemetry -c \"node serve-admin.mjs\"",
+    "test:e2e": "playwright test"
+  },
+  "dependencies": {
+    "next": "15.5.21",
+    "next-auth": "^4.24.11",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "react-is": "^18.3.1",
+    "tinacms": "workspace:*",
+    "tinacms-authjs": "workspace:*"
+  },
+  "devDependencies": {
+    "@playwright/test": "catalog:",
+    "@tinacms/cli": "workspace:*",
+    "@types/node": "^22.13.1",
+    "@types/react": "^18.3.18"
+  }
+}
diff --git a/playwright/prebuilt-admin/playwright.config.ts b/playwright/prebuilt-admin/playwright.config.ts
new file mode 100644
index 0000000000..afc1fd6eb3
--- /dev/null
+++ b/playwright/prebuilt-admin/playwright.config.ts
@@ -0,0 +1,45 @@
+import { defineConfig, devices } from '@playwright/test';
+
+/**
+ * Playwright config for the prebuilt-admin fixture.
+ *
+ * Unlike every other suite in the repo, the webServer here serves a PRODUCTION
+ * `tinacms build` output — never `tinacms dev`. `pnpm serve:prod` runs
+ * `tinacms build --local` (which builds the static admin SPA into
+ * public/admin AND keeps the local GraphQL/media server alive on :4001) with a
+ * `-c` sub-command that serves the built SPA under /my-site/admin/. The browser
+ * therefore loads the production bundle; the API is reached cross-origin on
+ * :4001. See README.md.
+ */
+export default defineConfig({
+  testDir: './e2e',
+  timeout: 60000,
+  expect: { timeout: 30000 },
+  reporter: [
+    ['list', { printSteps: true }],
+    ['json', { outputFile: 'playwright-test-results.json' }],
+  ],
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  workers: process.env.CI ? 1 : undefined,
+  use: {
+    baseURL: 'http://localhost:3456',
+    trace: 'on-first-retry',
+    screenshot: 'only-on-failure',
+  },
+  projects: [
+    {
+      name: 'chromium',
+      use: { ...devices['Desktop Chrome'] },
+    },
+  ],
+  webServer: {
+    command: 'pnpm serve:prod',
+    url: 'http://localhost:3456/my-site/admin/',
+    // Never reuse: the command rebuilds the production SPA, so a reused
+    // server would serve a stale public/admin from an earlier run.
+    reuseExistingServer: false,
+    timeout: 180000,
+  },
+});
diff --git a/playwright/prebuilt-admin/serve-admin.mjs b/playwright/prebuilt-admin/serve-admin.mjs
new file mode 100644
index 0000000000..c97e7a6920
--- /dev/null
+++ b/playwright/prebuilt-admin/serve-admin.mjs
@@ -0,0 +1,109 @@
+// Minimal static file server for the PRODUCTION `tinacms build` output.
+//
+// The fixture sets `build.basePath: 'my-site'`, so the built admin references
+// its assets at absolute `/my-site/admin/...` URLs and expects to be served
+// under that prefix. This server:
+//   - serves files from ./public/admin under /my-site/admin/
+//   - returns index.html for BOTH /my-site/admin/ and the bare /my-site/admin
+//     (the trailing-slash bug the spike hit: document.baseURI drops a segment)
+//   - falls back to index.html for unknown sub-paths (SPA hash routing)
+//
+// It never touches the GraphQL/media API — that is served cross-origin by the
+// `tinacms build --local` dev server on :4001, which this process keeps alive.
+
+import { readFile, stat } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { extname, join, normalize, sep } from 'node:path';
+import { dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ADMIN_ROOT = join(__dirname, 'public', 'admin');
+const BASE_PREFIX = '/my-site/admin';
+const PORT = Number(process.env.PORT || 3456);
+
+const CONTENT_TYPES = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.ico': 'image/x-icon',
+  '.woff': 'font/woff',
+  '.woff2': 'font/woff2',
+  '.ttf': 'font/ttf',
+  '.map': 'application/json; charset=utf-8',
+  '.txt': 'text/plain; charset=utf-8',
+  '.webmanifest': 'application/manifest+json',
+};
+
+async function serveFile(res, absPath, fallbackToIndex) {
+  try {
+    const info = await stat(absPath);
+    if (info.isFile()) {
+      const body = await readFile(absPath);
+      res.writeHead(200, {
+        'Content-Type':
+          CONTENT_TYPES[extname(absPath)] || 'application/octet-stream',
+        'Cache-Control': 'no-store',
+      });
+      res.end(body);
+      return true;
+    }
+  } catch {
+    // fall through
+  }
+  if (fallbackToIndex) {
+    const index = await readFile(join(ADMIN_ROOT, 'index.html'));
+    res.writeHead(200, {
+      'Content-Type': CONTENT_TYPES['.html'],
+      'Cache-Control': 'no-store',
+    });
+    res.end(index);
+    return true;
+  }
+  return false;
+}
+
+const server = createServer(async (req, res) => {
+  try {
+    const url = decodeURIComponent((req.url || '/').split('?')[0]);
+
+    // Bare form (no trailing slash) and the root both boot the SPA.
+    if (url === BASE_PREFIX || url === `${BASE_PREFIX}/`) {
+      await serveFile(res, join(ADMIN_ROOT, 'index.html'), true);
+      return;
+    }
+
+    if (url.startsWith(`${BASE_PREFIX}/`)) {
+      const rel = url.slice(`${BASE_PREFIX}/`.length);
+      // Prevent path traversal outside the admin root.
+      const abs = normalize(join(ADMIN_ROOT, rel));
+      if (!(abs === ADMIN_ROOT || abs.startsWith(ADMIN_ROOT + sep))) {
+        res.writeHead(403);
+        res.end('Forbidden');
+        return;
+      }
+      await serveFile(res, abs, /* fallbackToIndex */ true);
+      return;
+    }
+
+    res.writeHead(404, { 'Content-Type': 'text/plain' });
+    res.end(`Not found. Admin is served under ${BASE_PREFIX}/`);
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'text/plain' });
+    res.end(`Server error: ${err}`);
+  }
+});
+
+server.listen(PORT, () => {
+  // eslint-disable-next-line no-console
+  console.log(
+    `prebuilt-admin static server: http://localhost:${PORT}${BASE_PREFIX}/`
+  );
+});
diff --git a/playwright/prebuilt-admin/tina/collections/post.ts b/playwright/prebuilt-admin/tina/collections/post.ts
new file mode 100644
index 0000000000..d3b3bce0d7
--- /dev/null
+++ b/playwright/prebuilt-admin/tina/collections/post.ts
@@ -0,0 +1,33 @@
+import type { Collection } from 'tinacms';
+import { FixtureField } from '../fields/fixture-field';
+
+export const post: Collection = {
+  label: 'Posts',
+  name: 'post',
+  path: 'content/post',
+  format: 'mdx',
+  fields: [
+    {
+      type: 'string',
+      name: 'title',
+      label: 'Title',
+      isTitle: true,
+      required: true,
+    },
+    {
+      // Colocated custom field component (JSX through the schema seam).
+      type: 'string',
+      name: 'marker',
+      label: 'Marker',
+      ui: {
+        component: FixtureField,
+      },
+    },
+    {
+      type: 'rich-text',
+      name: 'body',
+      label: 'Body',
+      isBody: true,
+    },
+  ],
+};
diff --git a/playwright/prebuilt-admin/tina/config.tsx b/playwright/prebuilt-admin/tina/config.tsx
new file mode 100644
index 0000000000..7cb95859dc
--- /dev/null
+++ b/playwright/prebuilt-admin/tina/config.tsx
@@ -0,0 +1,73 @@
+import React from 'react';
+import { LocalAuthProvider, defineConfig } from 'tinacms';
+import { UsernamePasswordAuthJSProvider } from 'tinacms-authjs/dist/tinacms';
+import { post } from './collections/post';
+
+/**
+ * Runtime-selected auth provider.
+ *
+ * Both providers are referenced here so the bundler keeps `tinacms-authjs`
+ * — and the ESM entry that drags in CJS `next-auth/react` — inside the
+ * production build (the ingredient that guards the CJS-drag trap). Which one
+ * is *active* is decided in the browser: `auth.spec` sets
+ * `window.__TINA_FIXTURE_AUTHJS__` before boot to exercise the AuthJS login
+ * screen; every other spec boots the local provider and enters edit mode.
+ *
+ * At build time (`typeof window === 'undefined'`) the local provider is used —
+ * the value is irrelevant to the build, only the schema is.
+ */
+const selectAuthProvider = () => {
+  if (
+    typeof window !== 'undefined' &&
+    (window as unknown as { __TINA_FIXTURE_AUTHJS__?: boolean })
+      .__TINA_FIXTURE_AUTHJS__
+  ) {
+    return new UsernamePasswordAuthJSProvider();
+  }
+  return new LocalAuthProvider();
+};
+
+const FixtureScreenIcon = () => <span aria-hidden='true'>★</span>;
+
+export default defineConfig({
+  branch: '',
+  clientId: '',
+  token: '',
+  // Point the PRODUCTION admin bundle at the local GraphQL server that
+  // `tinacms build --local` keeps alive on :4001. Without this override
+  // `tinacms build` bakes the TinaCloud content URL into the SPA regardless
+  // of `--local` (it builds from `codegen.productionUrl`), so the admin can
+  // never reach the local API. See fixture README.
+  contentApiUrlOverride: 'http://localhost:4001/graphql',
+  authProvider: selectAuthProvider(),
+  build: {
+    publicFolder: 'public',
+    outputFolder: 'admin',
+    // Every URL bug the spike hit was basePath-shaped.
+    basePath: 'my-site',
+  },
+  media: {
+    // Real custom store behind a dynamic import (no `media.tina`).
+    loadCustomStore: async () => {
+      const pack = await import('./media/fixture-media-store');
+      return pack.FixtureMediaStore;
+    },
+  },
+  cmsCallback: (cms) => {
+    // Registering a screen plugin exercises the admin's screen/react-router
+    // path — it catches a second react-router-dom if the ABI misses it.
+    cms.plugins.add({
+      __type: 'screen',
+      name: 'Fixture Screen',
+      Icon: FixtureScreenIcon,
+      layout: 'popup',
+      Component: () => (
+        <div data-testid='fixture-screen'>Prebuilt fixture screen</div>
+      ),
+    });
+    return cms;
+  },
+  schema: {
+    collections: [post],
+  },
+});
diff --git a/playwright/prebuilt-admin/tina/fields/fixture-field.tsx b/playwright/prebuilt-admin/tina/fields/fixture-field.tsx
new file mode 100644
index 0000000000..3a2649781e
--- /dev/null
+++ b/playwright/prebuilt-admin/tina/fields/fixture-field.tsx
@@ -0,0 +1,36 @@
+import Image from 'next/image';
+import React from 'react';
+import { wrapFieldsWithMeta } from 'tinacms';
+
+// PREBUILT_FIXTURE_NEXT_IMAGE — a component that pulls `next/image` (a CJS
+// dependency that `require('react')`) into the admin bundle. If the production
+// build hands next/image its own React copy instead of the deduped one, this
+// field throws the classic "two copies of React" error at render time. A
+// 1x1 transparent PNG data URI keeps next/image self-contained (no Next
+// runtime image config needed).
+const PIXEL =
+  'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==';
+
+export const FixtureField = wrapFieldsWithMeta(({ input }: any) => {
+  return (
+    <div>
+      <input type='text' data-testid='fixture-field-input' {...input} />
+      {/*
+        Tailwind trap: `aspect-w-9` is a class the admin shell never uses (it
+        only exists because the second Tailwind pass runs @tailwindcss/aspect-ratio
+        over the co-located field code), and `bg-blue-500` must resolve to Tina's
+        themed blue (rgb(0,132,255)), not stock Tailwind's.
+      */}
+      <div data-testid='tw-probe' className='aspect-w-9 bg-blue-500' />
+      <Image
+        data-testid='fixture-next-image'
+        src={PIXEL}
+        alt=''
+        width={9}
+        height={9}
+        unoptimized
+        loader={({ src }) => src}
+      />
+    </div>
+  );
+});
diff --git a/playwright/prebuilt-admin/tina/media/fixture-media-store.ts b/playwright/prebuilt-admin/tina/media/fixture-media-store.ts
new file mode 100644
index 0000000000..510787229b
--- /dev/null
+++ b/playwright/prebuilt-admin/tina/media/fixture-media-store.ts
@@ -0,0 +1,42 @@
+import type {
+  Media,
+  MediaList,
+  MediaListOptions,
+  MediaStore,
+  MediaUploadOptions,
+} from 'tinacms';
+
+// PREBUILT_FIXTURE_MEDIA_STORE — a real custom media store loaded through
+// `media.loadCustomStore`'s dynamic `import()`. esbuild has to code-split this
+// into its own chunk in the production bundle; the setup meta-assertion greps
+// for that chunk to prove the fixture isn't accidentally tame.
+export class FixtureMediaStore implements MediaStore {
+  accept = '*';
+  isStatic = true;
+
+  async persist(_files: MediaUploadOptions[]): Promise<Media[]> {
+    return [];
+  }
+
+  async delete(_media: Media): Promise<void> {
+    // read-only fixture store
+  }
+
+  async list(_options?: MediaListOptions): Promise<MediaList> {
+    return {
+      items: [
+        {
+          type: 'file',
+          id: 'prebuilt-fixture-media',
+          filename: 'prebuilt-fixture-media.png',
+          directory: '',
+          src: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==',
+        },
+      ],
+    };
+  }
+
+  parse(media: Media): string {
+    return media.src ?? '';
+  }
+}
diff --git a/playwright/prebuilt-admin/tsconfig.json b/playwright/prebuilt-admin/tsconfig.json
new file mode 100644
index 0000000000..7756505237
--- /dev/null
+++ b/playwright/prebuilt-admin/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "resolveJsonModule": true,
+    "types": ["node"]
+  },
+  "include": ["tina", "e2e", "serve-admin.mjs", "playwright.config.ts"]
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 51569d2d3c..5fdee8c67f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -2974,6 +2974,43 @@ importers:
         specifier: 'catalog:'
         version: 1.61.1
 
+  playwright/prebuilt-admin:
+    dependencies:
+      next:
+        specifier: 15.5.21
+        version: 15.5.21(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+      next-auth:
+        specifier: ^4.24.11
+        version: 4.24.15(next@15.5.21(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react:
+        specifier: ^18.3.1
+        version: 18.3.1
+      react-dom:
+        specifier: ^18.3.1
+        version: 18.3.1(react@18.3.1)
+      react-is:
+        specifier: ^18.3.1
+        version: 18.3.1
+      tinacms:
+        specifier: workspace:*
+        version: link:../../packages/tinacms
+      tinacms-authjs:
+        specifier: workspace:*
+        version: link:../../packages/tinacms-authjs
+    devDependencies:
+      '@playwright/test':
+        specifier: 'catalog:'
+        version: 1.61.1
+      '@tinacms/cli':
+        specifier: workspace:*
+        version: link:../../packages/@tinacms/cli
+      '@types/node':
+        specifier: ^22.13.1
+        version: 22.19.17
+      '@types/react':
+        specifier: ^18.3.18
+        version: 18.3.27
+
   playwright/tina-playwright:
     dependencies:
       axios:
@@ -18891,7 +18928,7 @@ snapshots:
     dependencies:
       '@emnapi/core': 1.11.1
       '@emnapi/runtime': 1.11.1
-      '@napi-rs/wasm-runtime': 1.1.6(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
+      '@napi-rs/wasm-runtime': 1.2.3(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)
     optional: true
 
   '@bruits/satteri-win32-arm64-msvc@0.9.4':
@@ -30996,6 +31033,21 @@ snapshots:
       react-dom: 18.3.1(react@18.3.1)
       uuid: 11.1.1
 
+  next-auth@4.24.15(next@15.5.21(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      '@babel/runtime': 7.29.7
+      '@panva/hkdf': 1.2.1
+      cookie: 0.7.2
+      jose: 4.15.9
+      next: 15.5.21(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.97.3)
+      oauth: 0.9.15
+      openid-client: 5.7.1
+      preact: 10.28.3
+      preact-render-to-string: 5.2.6(preact@10.28.3)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      uuid: 11.1.1
+
   next@15.5.19(@opentelemetry/api@1.9.0)(@playwright/test@1.61.1)(babel-plugin-react-compiler@1.0.0)(react-dom@18.3.1(react@19.2.3))(react@19.2.3)(sass@1.97.3):
     dependencies:
       '@next/env': 15.5.19

From ce88510356f243addffd0d859716a9c6e2325f7a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 16:10:51 +1000
Subject: [PATCH 5/5] chore(deps): bump react-router-dom from 6.30.3 to 7.0.0
 (#7325)

Bumps
[react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom)
from 6.30.3 to 7.0.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/remix-run/react-router/blob/react-router-dom@7.0.0/packages/react-router-dom/CHANGELOG.md">react-router-dom's
changelog</a>.</em></p>
<blockquote>
<h2>7.0.0</h2>
<h3>Major Changes</h3>
<ul>
<li>
<p>Remove the original <code>defer</code> implementation in favor of
using raw promises via single fetch and <code>turbo-stream</code>. This
removes these exports from React Router: (<a
href="https://redirect.github.com/remix-run/react-router/pull/11744">#11744</a>)</p>
<ul>
<li><code>defer</code></li>
<li><code>AbortedDeferredError</code></li>
<li><code>type TypedDeferredData</code></li>
<li><code>UNSAFE_DeferredData</code></li>
<li><code>UNSAFE_DEFERRED_SYMBOL</code>,</li>
</ul>
</li>
<li>
<p>Use <code>createRemixRouter</code>/<code>RouterProvider</code> in
<code>entry.client</code> instead of <code>RemixBrowser</code> (<a
href="https://redirect.github.com/remix-run/react-router/pull/11469">#11469</a>)</p>
</li>
<li>
<p>Remove single_fetch future flag. (<a
href="https://redirect.github.com/remix-run/react-router/pull/11522">#11522</a>)</p>
</li>
<li>
<p>Remove <code>future.v7_startTransition</code> flag (<a
href="https://redirect.github.com/remix-run/react-router/pull/11696">#11696</a>)</p>
</li>
<li>
<p>Remove <code>future.v7_normalizeFormMethod</code> future flag (<a
href="https://redirect.github.com/remix-run/react-router/pull/11697">#11697</a>)</p>
</li>
<li>
<p>Allow returning <code>undefined</code> from actions and loaders (<a
href="https://redirect.github.com/remix-run/react-router/pull/11680">#11680</a>)</p>
</li>
<li>
<p>update minimum node version to 18 (<a
href="https://redirect.github.com/remix-run/react-router/pull/11690">#11690</a>)</p>
</li>
<li>
<p>Remove <code>future.v7_prependBasename</code> from the ionternalized
<code>@remix-run/router</code> package (<a
href="https://redirect.github.com/remix-run/react-router/pull/11726">#11726</a>)</p>
</li>
<li>
<p>Remove <code>future.v7_throwAbortReason</code> from internalized
<code>@remix-run/router</code> package (<a
href="https://redirect.github.com/remix-run/react-router/pull/11728">#11728</a>)</p>
</li>
<li>
<p>Add <code>exports</code> field to all packages (<a
href="https://redirect.github.com/remix-run/react-router/pull/11675">#11675</a>)</p>
</li>
<li>
<p>node package no longer re-exports from react-router (<a
href="https://redirect.github.com/remix-run/react-router/pull/11702">#11702</a>)</p>
</li>
<li>
<p>updates the minimum React version to 18 (<a
href="https://redirect.github.com/remix-run/react-router/pull/11689">#11689</a>)</p>
</li>
<li>
<ul>
<li>Remove the <code>future.v7_partialHydration</code> flag (<a
href="https://redirect.github.com/remix-run/react-router/pull/11725">#11725</a>)
<ul>
<li>This also removes the <code>&lt;RouterProvider
fallbackElement&gt;</code> prop
<ul>
<li>To migrate, move the <code>fallbackElement</code> to a
<code>hydrateFallbackElement</code>/<code>HydrateFallback</code> on your
root route</li>
</ul>
</li>
<li>Also worth nothing there is a related breaking changer with this
future flag:
<ul>
<li>Without <code>future.v7_partialHydration</code> (when using
<code>fallbackElement</code>), <code>state.navigation</code> was
populated during the initial load</li>
<li>With <code>future.v7_partialHydration</code>,
<code>state.navigation</code> remains in an
<code>&quot;idle&quot;</code> state during the initial load</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
<li>
<p>Remove <code>future.v7_fetcherPersist</code> flag (<a
href="https://redirect.github.com/remix-run/react-router/pull/11731">#11731</a>)</p>
</li>
</ul>
<h3>Minor Changes</h3>
<ul>
<li>Add prefetching support to <code>Link</code>/<code>NavLink</code>
when using Remix SSR (<a
href="https://redirect.github.com/remix-run/react-router/pull/11402">#11402</a>)</li>
<li>Enhance <code>ScrollRestoration</code> so it can restore properly on
an SSR'd document load (<a
href="https://redirect.github.com/remix-run/react-router/pull/11401">#11401</a>)</li>
<li>Add built-in Remix-style hydration support to
<code>RouterProvider</code>. When running from a Remix-SSR'd HTML
payload with the proper <code>window</code> variables
(<code>__remixContext</code>, <code>__remixManifest</code>,
<code>__remixRouteModules</code>), you don't need to pass a
<code>router</code> prop and <code>RouterProvider</code> will create the
<code>router</code> for you internally. (<a
href="https://redirect.github.com/remix-run/react-router/pull/11396">#11396</a>)
(<a
href="https://redirect.github.com/remix-run/react-router/pull/11400">#11400</a>)</li>
</ul>
<h3>Patch Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/remix-run/react-router/commit/e8e3b004d94a949372e77ce97a543bff5bc6fb89"><code>e8e3b00</code></a>
chore: Update version for release (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12344">#12344</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/1499f3e43fa51370be698fc84a78150b13bd7535"><code>1499f3e</code></a>
chore: Update version for release (pre) (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12315">#12315</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/995bcbb7e480a5a481475825957b20c89f7f0201"><code>995bcbb</code></a>
chore: Update version for release (pre) (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12235">#12235</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/0e9b34690d532340b3cf3b304d0b8612c7638a11"><code>0e9b346</code></a>
chore: Update version for release (pre) (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12205">#12205</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/6576bd0714830b75d2dcd6556bd22a68f1c4da0e"><code>6576bd0</code></a>
chore: Update version for release (pre) (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12202">#12202</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/8daac72b0ec5e909ff691ecb05d7c3397bfe407f"><code>8daac72</code></a>
Merge branch 'dev' into release-next</li>
<li><a
href="https://github.com/remix-run/react-router/commit/2d5924f567f35fe1aec13165d8a8c601bddf5bd9"><code>2d5924f</code></a>
feat: configure export conditions properly (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12136">#12136</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/18dc8b8ead6d161a1f5aa13220d4f21fb26d069a"><code>18dc8b8</code></a>
chore: Update version for release (pre) (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12184">#12184</a>)</li>
<li><a
href="https://github.com/remix-run/react-router/commit/fde69511bbfddf5a04e00d8c8bb9a7702a32b9bf"><code>fde6951</code></a>
Merge branch 'dev' into release-next</li>
<li><a
href="https://github.com/remix-run/react-router/commit/813497a10eefbf0fdd3049baddeace6139268744"><code>813497a</code></a>
Drop support for Node 18 and installGlobals (<a
href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12171">#12171</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/remix-run/react-router/commits/react-router-dom@7.0.0/packages/react-router-dom">compare
view</a></li>
</ul>
</details>
<details>
<summary>Attestation changes</summary>
<p>This version has no provenance attestation, while the previous
version (6.30.3) was attested. Review the <a
href="https://www.npmjs.com/package/react-router-dom?activeTab=versions">package
versions</a> before updating.</p>
</details>
<br />

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com>
Co-authored-by: kulesy <kulewidak@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 examples/react/kitchen-sink/package.json |  2 +-
 pnpm-lock.yaml                           | 46 ++++++++++++++++++++++--
 2 files changed, 45 insertions(+), 3 deletions(-)

diff --git a/examples/react/kitchen-sink/package.json b/examples/react/kitchen-sink/package.json
index 9a82e38c67..862f0ebeb3 100644
--- a/examples/react/kitchen-sink/package.json
+++ b/examples/react/kitchen-sink/package.json
@@ -20,7 +20,7 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-icons": "^4.12.0",
-    "react-router-dom": "^6.28.0",
+    "react-router-dom": "^7.0.0",
     "tailwind-merge": "^2.6.0",
     "tinacms": "workspace:*"
   },
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5fdee8c67f..a6038a6473 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1131,8 +1131,8 @@ importers:
         specifier: ^4.12.0
         version: 4.12.0(react@18.3.1)
       react-router-dom:
-        specifier: ^6.28.0
-        version: 6.30.3(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+        specifier: ^7.0.0
+        version: 7.18.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
       tailwind-merge:
         specifier: ^2.6.0
         version: 2.6.0
@@ -9860,6 +9860,10 @@ packages:
     resolution: {integrity: sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==}
     engines: {node: '>= 0.6'}
 
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
   cookie@2.0.1:
     resolution: {integrity: sha512-yuToqVvRrj6pfDXREyQAAv8SkAEk/8GS3jQRTiUMm66TVtBYmqQeoEjL2Lmq8Rpo6271vH76InTChTitEAm65w==}
     engines: {node: '>=22'}
@@ -14157,12 +14161,29 @@ packages:
       react: '>=16.8'
       react-dom: '>=16.8'
 
+  react-router-dom@7.18.2:
+    resolution: {integrity: sha512-AIKJ/jgGlFb3EbfCXk5Gzshiwt+l3mqbCrNjmEWMMjqQxNJ3svBa6bgzFyCC2Sw3RA0VWF1kg3uQf2OFhxb8hw==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      react: '>=18'
+      react-dom: '>=18'
+
   react-router@6.30.3:
     resolution: {integrity: sha512-XRnlbKMTmktBkjCLE8/XcZFlnHvr2Ltdr1eJX4idL55/9BbORzyZEaIkBFDhFGCEWBBItsVrDxwx3gnisMitdw==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
       react: '>=16.8'
 
+  react-router@7.18.2:
+    resolution: {integrity: sha512-aUVMjFm3GAPTTZL7oYr5E7ETiqfQCHRLH+B+5afnICvf0r7kkK4eR6SMuwbSTJw/7t+12khT/Kahij49fqOCIg==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      react: '>=18'
+      react-dom: '>=18'
+    peerDependenciesMeta:
+      react-dom:
+        optional: true
+
   react-style-singleton@2.2.3:
     resolution: {integrity: sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ==}
     engines: {node: '>=10'}
@@ -14596,6 +14617,9 @@ packages:
   server-destroy@1.0.1:
     resolution: {integrity: sha512-rb+9B5YBIEzYcD6x2VKidaa+cqYBJQKnU4oe4E3ANwRRN56yk/ua1YCJT1n21NTS8w6CcOclAKNP3PhdCXKYtQ==}
 
+  set-cookie-parser@2.7.2:
+    resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
+
   set-function-length@1.2.2:
     resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
     engines: {node: '>= 0.4'}
@@ -25968,6 +25992,8 @@ snapshots:
 
   cookie@0.7.2: {}
 
+  cookie@1.1.1: {}
+
   cookie@2.0.1: {}
 
   copy-to-clipboard@3.3.3:
@@ -32064,6 +32090,12 @@ snapshots:
       react-dom: 19.2.7(react@19.2.7)
       react-router: 6.30.3(react@19.2.7)
 
+  react-router-dom@7.18.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      react-router: 7.18.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+
   react-router@6.30.3(react@18.3.1):
     dependencies:
       '@remix-run/router': 1.23.2
@@ -32074,6 +32106,14 @@ snapshots:
       '@remix-run/router': 1.23.2
       react: 19.2.7
 
+  react-router@7.18.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      cookie: 1.1.1
+      react: 18.3.1
+      set-cookie-parser: 2.7.2
+    optionalDependencies:
+      react-dom: 18.3.1(react@18.3.1)
+
   react-style-singleton@2.2.3(@types/react@18.3.27)(react@18.3.1):
     dependencies:
       get-nonce: 1.0.1
@@ -32758,6 +32798,8 @@ snapshots:
 
   server-destroy@1.0.1: {}
 
+  set-cookie-parser@2.7.2: {}
+
   set-function-length@1.2.2:
     dependencies:
       define-data-property: 1.1.4