chore: version packages (rc)

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to master, this PR will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

master is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on master.

⚠️⚠️⚠️⚠️⚠️⚠️

Releases

@paper/genesis@1.0.0-rc.5

Minor Changes

• #493 5b17730 Thanks @johnleider! - feat(GnDocsExample): replace the "Show code" / "Hide code" text label on the code toggle bar with a rotating chevron indicator. The chevron is a new toggle-icon scoped slot (receives expanded) with an inline-SVG fallback matching the GnPeek idiom (chevron-down, rotates 180° when expanded). The button keeps its accessible name via a dynamic aria-label ("Show code" / "Hide code"), and the filename/language/file-count meta on the right is unchanged.

Patch Changes

• Updated dependencies [2ed9618, 49e4f8b, 5c6d087, ffc4e5a, 76ca193]:
  • @vuetify/v0@1.0.0-rc.7

@vuetify/v0@1.0.0-rc.7

Patch Changes

• #540 2ed9618 Thanks @johnleider! - perf(createRegistry): memoize reactive keys/values/entries behind a version signal

  Reactive-mode iteration reads previously bypassed the result cache and read the
  order array through its shallowReactive proxy — one trap per index and, inside
  an effect, one tracked dependency per index. Reads now touch a single version
  signal (bumped on every structural mutation) and share the non-reactive cache,
  making reactive reads O(1) between mutations and giving subscribing effects one
  dependency regardless of collection size. Mid-batch reads now always reflect
  mutations already applied instead of a stale pre-batch snapshot.

• #531 49e4f8b Thanks @johnleider! - perf(createRegistry): use O(1) ticket.index for unregister splice locate (with indexOf fallback); avoid values() allocation/copy in seek first/last; never eagerly drain reindex in unregister to preserve the lazy contract

• #489 5c6d087 Thanks @johnleider! - fix(security): apply prototype-pollution and CSS-injection guards flagged in the security review

  • useFeatures adapters (LaunchDarkly / Flagsmith / PostHog) now skip UNSAFE_KEYS (__proto__ / constructor / prototype) flag names when building the flags object, matching the guard already used by mergeDeep, usePermissions, and createTokens
  • useLocale restore() validates the persisted value with isString / isNumber guards before applying it instead of blind-casting saved as ID, completing the persist/restore sweep (useTheme and useRtl now use the same guards)
  • ThemeAdapter's UNSAFE_CSS denylist is hardened against declaration injection: it now also rejects ;, \ (CSS escape evasion), and the URL-loading functions src() / image() / image-set() / cross-fade()
  • @vuetify/paper useTheme sanitizes color keys and values before writing them into the injected <style> element, mirroring the hardened v0 ThemeAdapter SAFE_IDENT / UNSAFE_CSS guards
  • @vuetify/paper createTheme now merges options.themes into the defaults — previously they were passed as structuredClone's options bag and silently dropped, so a custom current theme threw at first render
  • V0Error filters UNSAFE_KEYS when copying caller-supplied error details onto the instance

• #500 ffc4e5a Thanks @johnleider! - fix(useRules): accept spec-compliant Standard Schema issue paths

  Widens the vendored StandardSchemaV1 issue path typing to ReadonlyArray<PropertyKey | PathSegment> per the Standard Schema v1 spec, so schemas typed with @standard-schema/spec (Valibot, Zod, ArkType) are assignable to rules again.

• #542 76ca193 Thanks @johnleider! - perf(createRegistry): skip version notification on field-only upsert

  Patching an existing ticket via upsert no longer re-notifies version-subscribed
  iterating effects — membership and order are unchanged, and field changes already
  propagate through the shallowReactive ticket proxies and the update:ticket
  event. The read cache still refreshes so event-driven snapshot consumers
  (useProxyRegistry) observe a fresh array identity. This restores the pre-#540
  iteration granularity for field patches.

@vuetify/paper@1.0.0-rc.7

Patch Changes

• #489 5c6d087 Thanks @johnleider! - fix(security): apply prototype-pollution and CSS-injection guards flagged in the security review

  • useFeatures adapters (LaunchDarkly / Flagsmith / PostHog) now skip UNSAFE_KEYS (__proto__ / constructor / prototype) flag names when building the flags object, matching the guard already used by mergeDeep, usePermissions, and createTokens
  • useLocale restore() validates the persisted value with isString / isNumber guards before applying it instead of blind-casting saved as ID, completing the persist/restore sweep (useTheme and useRtl now use the same guards)
  • ThemeAdapter's UNSAFE_CSS denylist is hardened against declaration injection: it now also rejects ;, \ (CSS escape evasion), and the URL-loading functions src() / image() / image-set() / cross-fade()
  • @vuetify/paper useTheme sanitizes color keys and values before writing them into the injected <style> element, mirroring the hardened v0 ThemeAdapter SAFE_IDENT / UNSAFE_CSS guards
  • @vuetify/paper createTheme now merges options.themes into the defaults — previously they were passed as structuredClone's options bag and silently dropped, so a custom current theme threw at first render
  • V0Error filters UNSAFE_KEYS when copying caller-supplied error details onto the instance

• Updated dependencies [2ed9618, 49e4f8b, 5c6d087, ffc4e5a, 76ca193]:

  • @vuetify/v0@1.0.0-rc.7

[pkg-pr-new]

Open in StackBlitz

commit: c626d35