Bump the frontend group with 6 updates

[dependabot]

Bumps the frontend group with 6 updates:

Package	From	To
framer-motion	12.42.0	12.42.2
xstate	5.32.2	5.32.4
@typescript/native-preview	7.0.0-dev.20260629.1	7.0.0-dev.20260706.1
eslint-plugin-boundaries	6.0.2	7.0.0
prettier	3.9.3	3.9.4
vite	8.1.0	8.1.3

Updates framer-motion from 12.42.0 to 12.42.2

Changelog

Sourced from framer-motion's changelog.

[12.42.2] 2026-07-01

Fixed

• animateView: Cropped group layers now animate border-radius from the old to new radius.

[12.42.1] 2026-06-30

Fixed

• animateView: Old layer fade out now cancelled when defining .new().

Commits

• 40e8756 v12.42.2
• 718ccc7 Merge pull request #3768 from motiondivision/view-cropped-corner-radius
• 19195a4 Dedupe corner-radius longhands; merge crop box/radii measurements
• 5299aa6 Resolve cropped-clip radius timing once; fix transition-option leak
• 937cdf3 Animate cropped view-transition group corner radius
• fd2d6f6 v12.42.1
• 2223d87 Hold the old layer when only a non-opacity .new() is set
• See full diff in compare view

Updates xstate from 5.32.2 to 5.32.4

Release notes

Sourced from xstate's releases.

xstate@5.32.4

Patch Changes

• #5589 e913eeb Thanks @​spokodev! - Fixed a bug where targeting a history state that is a direct child of a parallel state would silently do nothing when that parallel state had not been visited yet and the history state had no default target. The machine now enters the parallel state's initial configuration, matching the behavior of history states inside compound states.

  const machine = createMachine({
    initial: 'off',
    states: {
      off: { on: { GO: 'on.hist' } },
      on: {
        type: 'parallel',
        states: {
          regA: { initial: 'a1', states: { a1: {}, a2: {} } },
          regB: { initial: 'b1', states: { b1: {}, b2: {} } },
          hist: { type: 'history', history: 'deep' }
        }
      }
    }
  });
  const actor = createActor(machine).start();
  actor.send({ type: 'GO' });
  actor.getSnapshot().value; // { on: { regA: 'a1', regB: 'b1' } }

xstate@5.32.3

Patch Changes

• #5575 830db8b Thanks @​JSap0914! - Fixed initialTransition (and transition) throwing "Actor with system ID '...' already exists" when the machine contains an invoke with a systemId.

  Root cause: createInertActorScope used createActor(logic) internally, which eagerly ran getInitialSnapshot during construction and registered any systemId-carrying child actors in the system. When the caller then ran getInitialSnapshot (or transition) via the returned scope, the same system was reused, causing the duplicate-registration error.

  Fix: After creating the internal actor, createInertActorScope now replaces the actor's system reference with a freshly-created system. Child actors spawned by the subsequent caller-driven getInitialSnapshot / transition invocation therefore register into a clean system with no pre-existing entries.

  const machine = createMachine({
    initial: 'idle',
    states: {
      idle: {
        invoke: {
          src: fromPromise(async () => 42),
          systemId: 'myActor' // previously caused: "Actor with system ID 'myActor' already exists"
        }
      }
    }
  });
  // Now works correctly — returns [snapshot, actions] without throwing
  const [snapshot, actions] = initialTransition(machine);

... (truncated)

Commits

• 9297fa8 Version Packages (#5590)
• e913eeb fix(core): enter parallel default when targeting an unvisited history child (...
• ab5aa56 Version Packages (#5586)
• 830db8b fix(core): prevent 'systemId already exists' in pure transition functions (#5...
• a551a2b docs: add missing https protocol to Stately Studio link (#5585)
• cc087bf ci: pin Node to 24.16.0 (#5577)
• 806ae91 Version Packages
• bf8d327 Update changeset config
• b53dbf8 Merge branch 'main' of https://github.com/statelyai/xstate
• 2d71caa Update gitignore
• Additional commits viewable in compare view

Updates @typescript/native-preview from 7.0.0-dev.20260629.1 to 7.0.0-dev.20260706.1

Commits

• See full diff in compare view

Updates eslint-plugin-boundaries from 6.0.2 to 7.0.0

Release notes

Sourced from eslint-plugin-boundaries's releases.

Multi-dimensional Classification with File Descriptors

eslint-plugin v7.0.0

Highlights

Version 7 introduces the entity model: every file is now described along three independent dimensions — its element (architectural unit), its file (categorized on its own), and the module each dependency resolves to. This unlocks multi-dimensional classification and much more precise rules.

• Upgrade with close to zero config changes. Everything new is additive and every v6 pattern keeps working, so you can adopt features one at a time, at your own pace. See the Breaking Changes below and the v6-to-v7 migration guide for the one exception.
• File descriptors (boundaries/files). Categorize files (tests, styles, …) independently of the element they belong to. A file can carry multiple categories.
• Multi-type elements. A single element can now match several types at once (opt-in via boundaries/elements-single-type: false).
• Entity selectors in from / to. Match rules by element, file, and module properties together — e.g. scope a rule to test files, or to a module's origin.
• Advanced array matching for types and categories. element.types and file.categories now accept query objects (anyOf, allOf, noneOf, equalsTo, atIndex, hasLength) instead of just plain patterns, enabling precise rules like "must have exactly these types" or "must not share a type with the other side" — the latter via the new expand operator, which pulls values from the opposite side of the rule at match time.
• Precise control of external/core dependencies. Match by module origin and source directly in boundaries/dependencies with to.module.*.
• Richer error messages. Custom message templates can reference the full entity ({{to.file.categories}}, {{to.module.source}}, …). Default messages now include entity information too — re-record any exact-string snapshot assertions.
• Clearer vocabulary and rule names. The rules option is now policies (each with an effect), no-unknown → no-unknown-dependencies (now file-aware), and no-ignored → no-ignored-dependencies. Old names/options keep working with a deprecation warning.

Breaking Changes:

• If you use the strict config with eslint-disable comments referencing boundaries/no-ignored or boundaries/no-unknown, those comments stop suppressing violations (now reported under the new rule names) and may themselves trigger "unused eslint-disable directive" errors. Update the comments to the new rule names, or use the new strict-legacy config while you migrate them.
• Default report messages changed and no-unknown-files now considers file descriptors. If you assert exact report strings in snapshots or CI, re-record them after upgrading.

Added

• feat: Add entity abstraction layer. New EntityDescription type combines element, file, and module descriptions into a unified representation.
• feat: Add new selector types: EntitySelector with element, file, and module sub-selectors; FileSelector with path, categories, captured, isIgnored, and isUnknown; ModuleSelector with origin, source, and internalPath.
• feat: Add file descriptors system. A new files property in DescriptorsConfig allows categorizing files independently from elements. FileDescriptor supports pattern, category, and capture properties. FileDescription provides path, categories, captured, isIgnored, and isUnknown fields.
• feat: Add module origin system. New ModuleDescription type with origin ("local" | "external" | "core"), source, and internalPath properties. New matcher methods: describeModule(), isModuleMatch(), getModuleSelectorMatching(), getModuleSelectorMatchingDescription().
• feat: Support entity selectors in rules. The from and to properties of rule selectors now accept objects with element, file and module sub-selectors, allowing to match by element properties (type, types, captured, parent, etc.), file properties (path, categories, captured, etc.) and module properties (origin, source, internalPath). Legacy flat element selectors keep working and are converted internally.
• feat: Add new data to custom message templates. The from and to template properties now expose element, file and module objects, enabling template variables such as {{from.element.types}}, {{to.file.categories}}, {{to.module.origin}} or {{to.module.source}}. Templates using the previous data ({{from.type}}, {{from.elementPath}}, {{from.internalPath}}, {{from.origin}}, etc.) keep working for backward compatibility.
• feat: Support the partialMatch option in boundaries/elements descriptors (default: true). Set partialMatch: false to match the pattern against the full file path from the project root instead of a suffix. It is the recommended replacement for the deprecated mode: "full".
• feat: Array-valued selector properties accept a new array query object with anyOf, allOf, noneOf, equalsTo (ordered, exact length), atIndex ({ index, matches }, negative index supported), and hasLength operators (AND-combined). The atIndex.matches field accepts a single value or an array (OR semantics). Supported by file selector categories and element selector types.
• feat: anyOf, allOf, and noneOf items in element.types, file.categories, and parent.types / parents[*].types accept { expand: "{{ path }}" } objects in addition to plain micromatch pattern strings. The expand item resolves the Handlebars path against the template data at match time and spreads the resulting string array as individual matchers. This enables dynamic cross-side comparisons such as "to element must not share any type with from element" (noneOf: [{ expand: "{{ from.element.types }}" }]). Mixed static + expand items in the same array are supported. Empty-operand rules apply when the path resolves to null/undefined: empty noneOf always passes; empty anyOf never matches.
• feat: Add element selector parents property: an array query over the full ancestor chain (parents[0] is the closest parent). parent is unchanged and still matches the closest parent.
• feat: Add boundaries/legacy-warnings boolean setting (default true). When false, the plugin skips all legacy-pattern detection work — element descriptor deprecated-field checks and rule option deprecated-syntax scans — and suppresses the related deprecation warnings, reducing overhead at lint time.
• feat: Add the boundaries/no-unknown-dependencies rule, the file-aware successor of boundaries/no-unknown. It reports a dependency when the target is unknown, configurable through the new require option ("any" | "element" | "file" | "all", default "any"), which selects which classification axes the target must be known on to be considered valid. With the default "any" it reports only when the target is unknown on both the element and file axes; "element" reports when the element is unknown, "file" reports when the file is unknown, and "all" reports when either axis is unknown.
• feat: Add a strict-legacy config (exported as strictLegacy from eslint-plugin-boundaries/config, and available as plugin.configs["strict-legacy"]), identical to strict but enabling the deprecated boundaries/no-ignored and boundaries/no-unknown rule names instead of their boundaries/no-ignored-dependencies and boundaries/no-unknown-dependencies replacements. Use it temporarily if you use the strict config and have eslint-disable comments referencing the old rule names that you are not ready to migrate yet.

Changed

• feat(#348): Upgrade the internal @boundaries/elements library to v3, which reorganizes file analysis around entities composed of an element, a file and a module description, and adds file descriptors, module origins and multi-type elements. All of its breaking changes are absorbed by the plugin: legacy selector properties (type, category, captured, elementPath, internalPath, origin), including internalPath matching the internal path of external modules, and v6 custom message template data keep working without configuration changes.
• feat: Deprecate the category property in element descriptors and element selectors in favor of file descriptor categories, which allow assigning multiple categories to different files within the same element. It keeps working for backward compatibility, but will be removed in a future major version.
• feat: Deprecate the module property in dependency metadata selectors (dependency.module) in favor of matching the module source through entity selectors (to.module.source). It keeps working for backward compatibility.
• feat: Improve default error messages to include the new entity information. Captured values are now formatted as captured values: key="value", the module of external dependencies is reported as module with origin "external" and module source "...", and elements with multiple types report all of them. If you rely on exact report messages (e.g., in snapshots or CI assertions), you may need to update them.
• feat(#348): The no-unknown-files rule now takes file descriptors into account: a file is reported only when it does not match any file descriptor pattern and does not belong to any known element. The report message changed from "File does not match any element pattern" to "File does not match any file pattern and does not belong to any known element".
• feat(#348): The missing-classification warning now treats element and file descriptors as equally valid layers. The plugin no longer warns when only boundaries/files is configured; it warns only when neither boundaries/elements nor boundaries/files is defined, and the message now points to both settings.
• feat: Deprecate the boundaries/no-unknown rule name in favor of boundaries/no-unknown-dependencies. The old name keeps working but prints a one-time rename warning and will be removed in a future major version. The recommended (disabled either way) and strict presets now reference the new rule name; if you use strict with eslint-disable comments referencing boundaries/no-unknown, update them, or use the new strict-legacy config in the meantime.
• feat: Rename the boundaries/no-ignored rule to boundaries/no-ignored-dependencies. The behavior is unchanged. The old boundaries/no-ignored name keeps working but prints a one-time rename warning and will be removed in a future major version. The recommended (disabled either way) and strict presets now reference the new rule name; if you use strict with eslint-disable comments referencing boundaries/no-ignored, update them, or use the new strict-legacy config in the meantime.
• feat: Rename the rules option of boundaries/dependencies (and the deprecated element-types, entry-point, and external rules) to policies, aligning with the new policy/effect vocabulary: a rule contains policies, each policy has an effect (allow/disallow), and default is the default effect. This removes the "a rule contains rules" overload that motivated the change. The old rules option keeps working as a deprecated alias — when both policies and rules are set, policies wins — and using rules prints a one-time deprecation warning, suppressible by setting boundaries/legacy-warnings to false. The public TypeScript exports RulePolicy, RULE_POLICIES_MAP, isRulePolicy, DependenciesRule, EntryPointRule, and ExternalRule are kept as @deprecated aliases of RuleEffect, RULE_EFFECTS_MAP, isRuleEffect, DependenciesPolicy, EntryPointPolicy, and ExternalPolicy.
• feat: Rename the rule custom message template variable ({{rule.index}}, {{rule.selector}}) to policy ({{policy.index}}, {{policy.selector}}), matching the rules → policies rename above. The {{rule.*}} variable is kept as a deprecated alias and keeps rendering identically. The public CustomMessageTemplateRuleContext type is kept as a @deprecated alias of CustomMessageTemplatePolicyContext.
• feat: Improve performance by caching the result of merging rule policies.
• feat: Debug output now prints the full entity description (element, file and module) of each file, and the files filter of the boundaries/debug setting accepts both file selectors and entity selectors.

... (truncated)

Commits

• c8fcbd1 Merge pull request #456 from javierbrea/release
• 0a7496d Merge branch 'master' into release
• 6035b09 chore: Upgrade sonar project versions
• 6e1a59d feat: Release v7.0.0 (#455)
• c873f3e Release v7.0.0-beta.2 (#454)
• a488a3b feat: multi-dimensional classification with file descriptors (#453)
• 92bf30c chore(deps): update dependency @​babel/core to v7.29.6 [security] (#451)
• 8cfa82f Merge pull request #450 from javierbrea/release
• 9788d01 Merge branch 'master' into release
• a3bc4d1 docs(#448): Fix paths in examples
• See full diff in compare view

Updates prettier from 3.9.3 to 3.9.4

Release notes

Sourced from prettier's releases.

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.4

diff

Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

<!-- Input -->
<FancyButton [label]="title">
  @content (icon) {
    <span>Icon!</span>
  }
  @content (description) {
    <span>Description text</span>
  }
  <span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.3 -->
<FancyButton [label]="title">
@​content(icon) {
<span>Icon!</span>
}
@​content(description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.4 -->
<FancyButton [label]="title">
@​content (icon) {
<span>Icon!</span>
}
@​content (description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>

Commits

• b693cb2 Release 3.9.4
• 2e92ac0 Angular: Format @content(name) -> @content (name) to align with other blo...
• abed2c2 Bump Prettier dependency to 3.9.3
• 6cfbc00 Clean changelog_unreleased
• See full diff in compare view

Updates vite from 8.1.0 to 8.1.3

Release notes

Sourced from vite's releases.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.3 (2026-07-02)

Bug Fixes

• css: inject inlined CSS after the shebang line (#22717) (1534d36)
• deps: bump es-module-lexer to 2.3.0 (#22838) (7103c3a)
• preload css for nested dynamic imports (#22759) (2c53054)
• ssr: correct stacktrace column position for first line (#22828) (c4acd69)

8.1.2 (2026-06-30)

Bug Fixes

• deps: revert es-module-lexer to 2.1.0 (#22827) (0d3bd7c)
• restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (#22825) (efb98cc)
• revert, "fix: escape ids with multiple null bytes (#22687)" (cccef55)
• revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (cf97711)

8.1.1 (2026-06-30)

Features

• update dynamic import warning to link to Vite docs (#22823) (62bd7af)

Bug Fixes

• bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#22797) (709eb8e)
• bundled-dev: serve assets emitted during HMR/lazy compile (#22745) (5876b2c)
• bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#22778) (8f925e2)
• css: preserve dollar signs in external @import urls with lightningcss (#22718) (9fa7ab4)
• css: resolve tsconfig paths in CSS and Sass @​import (#22775) (ef0b891)
• deps: update all non-major dependencies (#22734) (e635f49)
• deps: update all non-major dependencies (#22804) (8837400)
• deps: update rolldown-related dependencies (#22591) (2ce6677)
• escape ids with multiple null bytes (#22687) (833fc30)
• hide console window when running 'net use' on Windows (#22698) (92b63f2)
• ignore bundled config temp dir (#22800) (043a810)
• invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#22809) (33895ba)
• optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#22784) (085a0ab)
• optimizer: scanner should resolve input from root (#22769) (9722b07)
• resolve pnpm .modules.yaml from workspace root instead of cwd (#22757) (2531ac7)
• return sourcemap field from some plugins that were lacking (#22782) (7e18bf8)
• server: handle malformed URI in indexHtmlMiddleware (#22781) (84f5ccc)

Miscellaneous Chores

• improve dependency optimizer messages (#22549) (092cb3b)

Code Refactoring

• css: remove lightningcss null byte bug workaround (#22822) (2dafd3b)
• use pre-defined environments variable to avoid duplicate Object.values calls (#22790) (1113acf)

... (truncated)

Commits

• 578ffb8 release: v8.1.3
• 7103c3a fix(deps): bump es-module-lexer to 2.3.0 (#22838)
• 1534d36 fix(css): inject inlined CSS after the shebang line (#22717)
• c4acd69 fix(ssr): correct stacktrace column position for first line (#22828)
• 2c53054 fix: preload css for nested dynamic imports (#22759)
• ba31193 release: v8.1.2
• 0d3bd7c fix(deps): revert es-module-lexer to 2.1.0 (#22827)
• efb98cc fix: restore, "fix: resolve pnpm .modules.yaml from workspace root instead of...
• cf97711 fix: revert, "fix: resolve pnpm .modules.yaml from workspace root instead of ...
• cccef55 fix: revert, "fix: escape ids with multiple null bytes (#22687)"
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[greptile-apps]

Greptile Summary

Dependabot group bump of 6 frontend dependencies, all patch-level except eslint-plugin-boundaries which jumps from 6.0.2 to 7.0.0. The other five updates (framer-motion, xstate, @typescript/native-preview, prettier, vite) are straightforward patch/nightly bumps with no breaking changes.

• eslint-plugin-boundaries v7 renames the inner rules option of boundaries/dependencies to policies; the existing eslint.config.js uses rules in two places, which now triggers a deprecation warning at lint time (functionality is unchanged).
• All other dependency changes are bug-fix or nightly builds with no API changes affecting this codebase.

Confidence Score: 4/5

Safe to merge — all updates are patch-level bug fixes except the eslint-plugin-boundaries major bump, which is backward-compatible and only produces deprecation warnings.

Five of the six bumps are straightforward patch fixes with no API surface changes. The eslint-plugin-boundaries 7.0.0 major bump is additive and backward-compatible for this codebase; the only observable effect is deprecation warnings emitted during linting because eslint.config.js still uses the old rules option name instead of policies.

eslint.config.js — the rules option inside boundaries/dependencies (lines 30 and 106) should be renamed to policies to clear the v7 deprecation warning.

Important Files Changed

Filename	Overview
package.json	Six dependency bumps: framer-motion (patch), xstate (patch), @typescript/native-preview (dev nightly), prettier (patch), vite (patch), and eslint-plugin-boundaries (minor → 7.0.0 major with deprecation of the rules option in favour of policies).
bun.lock	Lock file updated by dependabot to match the new package.json versions; no manual changes.

_{Reviews (1): Last reviewed commit: "Bump the frontend group with 6 updates" | Re-trigger Greptile}