[dependabot]

Bumps @rjsf/core from 6.8.0 to 6.11.0.

Release notes

Sourced from @​rjsf/core's releases.

6.11.0

New feature

• requiredBooleanDefault was added to the Experimental_DefaultFormStateBehavior

@​rjsf/core

• Fixed a schema prop change being silently dropped when it adds a property with a default, either as the parent's reply to onChange or at any point after a change to an uncontrolled form. The guard that keeps a oneOf/anyOf option switch from reverting now only applies when the form re-derives its own formData (an uncontrolled form, or a parent holding what onChange emitted, including when it reshaped the emitted value by spreading it, storing undefined as null or round-tripping it through JSON) with the same schema and experimental_defaultFormStateBehavior, and it keeps only that formData rather than dropping the rest of the prop update, fixing #5294
• Fixed switching between oneOf/anyOf options keeping a value the previous option's default put there, so a property whose value still matches that default, or a whole option that does, now picks up the new option's default the way a scalar property already did, and switching back to an option restores its own defaults. A property the new option cannot hold as it stands now picks the new default up as well instead of arriving empty — one whose type differs between the options, or a readOnly one edited away from its default. Values are compared whole, so a nested object the user has partly edited keeps the rest of the old option's defaults, and a value equal to the old default is replaced no matter who supplied it, including one passed in formData, since the two cannot be told apart, fixing #4476

@​rjsf/utils

• Updated Experimental_DefaultFormStateBehavior to add a new requiredBooleanDefault option, and updated getDefaultFormState() to honor it: skip turns off the false populated for a required boolean with no default (introduced in 6.9.0 by #5170), so a form that models an unanswered boolean as its own state can keep it undefined and let required report it. The default, populateFalse, keeps the 6.9.0+ behavior

@​rjsf/validator-ata

• Updated ata-validator from ^1.7.1 to ^1.23.0, picking up the corrected error shape for unevaluatedProperties (the error now carries params.unevaluatedProperty), the removal of a quadratic in additionalProperties: false schemas with many properties, a fix for a hang on truncated JSON input, and enforced strict-mode schema checks (#5293)

Dev / docs / playground

• Documented the requiredBooleanDefault option in form-props.md and internals.md, and added a selector for it to the playground

6.10.1

@​rjsf/core

• Fixed a dependencies/if branch switch nested inside an object property never sanitizing a sibling field's now-invalid value. The check gating sanitization only compared the root retrieved schema, which never reflects a conditional resolved deeper in the tree, so it always skipped sanitizing in that case, fixing (#5250)
• Fixed NumberField losing or misinterpreting decimal input in comma-decimal locales, and passing a locale-formatted string instead of a number to custom and format-registered widgets, fixing #5199 and #5241
• Fixed NumberField still comma-formatting the displayed value for a text widget with an explicit ui:options.inputType override in a comma-decimal locale; getInputProps() gives that override priority over the locale-based text fallback, so it rendered a native, locale-unaware <input type="number"> that rejected the comma-formatted string

@​rjsf/mantine

• Fixed BaseInputTemplate passing an undefined value straight through to NumberInput/TextInput, which let the DOM input fall out of sync with React's controlled value and retain a stray digit after clearing a multi-digit number field (#5269)
• Backported the fluid Container layout fix from the v7 Mantine 9 upgrade (#5260): GridTemplate's and ObjectFieldTemplate's root Container now use Mantine's fluid prop so forms fill their available width instead of centering at Mantine's default 960px max-width

@​rjsf/shadcn

• Fixed the documented import '@rjsf/shadcn/dist/[theme].css' failing to resolve. The prebuilt stylesheets were in the published tarball but no exports entry matched them, so Node and every bundler that honours the exports map rejected the path

@​rjsf/utils

• Fixed sanitizeDataForNewSchema() to resolve dependencies, if/then/else and allOf (not just $ref) on each property's old/new schema before comparing them, so a conditional nested inside an object property is taken into account when sanitizing its data, fixing (#5250)
• Added schemaHasNestedConditional(), which Form uses to detect a dependencies/if nested below a schema's top level (behind a $ref, patternProperties, tuple items, additionalProperties or allOf/anyOf/oneOf) so sanitization isn't skipped just because the root retrieved schema looks unchanged (#5250)
• Fixed getInputProps() defaulting type: number schemas to a native number input in locales whose decimal separator isn't ., where the browser rejects the localized value; it now defaults to a text input in those locales unless an explicit inputType is set
• Added resolveDefaultWidget(), extracting the widget-name/enumOptions fallback logic shared by @rjsf/core's StringField and NumberField so the two can no longer drift out of sync
• Upgraded @x0k/json-schema-merge to ^1.0.6, which now preserves Symbol-keyed properties (e.g. Symbol(__rjsf_ref)) when merging allOf schemas and no longer collapses distinct allOf.contains branches into one over-constrained schema; removed the corresponding Symbol-preservation and contains-extraction workarounds from retrieveSchemaInternal(), fixing (#5146)
• Fixed defaults from a dependency subschema being omitted when getDefaultFormState() is called without form data or with an empty object, fixing #5198
• Fixed computeDefaults() to merge a non-object schema's allOf when experimental_defaultFormStateBehavior.allOf is set to populateDefaults, so a $ref wrapped in a single-element allOf now populates the same defaults as the bare $ref does, fixing #5177

Dev / docs / playground

... (truncated)

Changelog

Sourced from @​rjsf/core's changelog.

6.11.0

@​rjsf/core

• Fixed a schema prop change being silently dropped when it adds a property with a default, either as the parent's reply to onChange or at any point after a change to an uncontrolled form. The guard that keeps a oneOf/anyOf option switch from reverting now only applies when the form re-derives its own formData (an uncontrolled form, or a parent holding what onChange emitted, including when it reshaped the emitted value by spreading it, storing undefined as null or round-tripping it through JSON) with the same schema and experimental_defaultFormStateBehavior, and it keeps only that formData rather than dropping the rest of the prop update, fixing #5294
• Fixed switching between oneOf/anyOf options keeping a value the previous option's default put there, so a property whose value still matches that default, or a whole option that does, now picks up the new option's default the way a scalar property already did, and switching back to an option restores its own defaults. A property the new option cannot hold as it stands now picks the new default up as well instead of arriving empty — one whose type differs between the options, or a readOnly one edited away from its default. Values are compared whole, so a nested object the user has partly edited keeps the rest of the old option's defaults, and a value equal to the old default is replaced no matter who supplied it, including one passed in formData, since the two cannot be told apart, fixing #4476

@​rjsf/utils

• Updated Experimental_DefaultFormStateBehavior to add a new requiredBooleanDefault option, and updated getDefaultFormState() to honor it: skip turns off the false populated for a required boolean with no default (introduced in 6.9.0 by #5170), so a form that models an unanswered boolean as its own state can keep it undefined and let required report it. The default, populateFalse, keeps the 6.9.0+ behavior

@​rjsf/validator-ata

• Updated ata-validator from ^1.7.1 to ^1.23.0, picking up the corrected error shape for unevaluatedProperties (the error now carries params.unevaluatedProperty), the removal of a quadratic in additionalProperties: false schemas with many properties, a fix for a hang on truncated JSON input, and enforced strict-mode schema checks (#5293)

Dev / docs / playground

• Documented the requiredBooleanDefault option in form-props.md and internals.md, and added a selector for it to the playground

6.10.1

@​rjsf/core

• Fixed a dependencies/if branch switch nested inside an object property never sanitizing a sibling field's now-invalid value. The check gating sanitization only compared the root retrieved schema, which never reflects a conditional resolved deeper in the tree, so it always skipped sanitizing in that case, fixing (#5250)
• Fixed NumberField losing or misinterpreting decimal input in comma-decimal locales, and passing a locale-formatted string instead of a number to custom and format-registered widgets, fixing #5199 and #5241
• Fixed NumberField still comma-formatting the displayed value for a text widget with an explicit ui:options.inputType override in a comma-decimal locale; getInputProps() gives that override priority over the locale-based text fallback, so it rendered a native, locale-unaware <input type="number"> that rejected the comma-formatted string

@​rjsf/mantine

• Fixed BaseInputTemplate passing an undefined value straight through to NumberInput/TextInput, which let the DOM input fall out of sync with React's controlled value and retain a stray digit after clearing a multi-digit number field (#5269)
• Backported the fluid Container layout fix from the v7 Mantine 9 upgrade (#5260): GridTemplate's and ObjectFieldTemplate's root Container now use Mantine's fluid prop so forms fill their available width instead of centering at Mantine's default 960px max-width

@​rjsf/shadcn

• Fixed the documented import '@rjsf/shadcn/dist/[theme].css' failing to resolve. The prebuilt stylesheets were in the published tarball but no exports entry matched them, so Node and every bundler that honours the exports map rejected the path

@​rjsf/utils

• Fixed sanitizeDataForNewSchema() to resolve dependencies, if/then/else and allOf (not just $ref) on each property's old/new schema before comparing them, so a conditional nested inside an object property is taken into account when sanitizing its data, fixing (#5250)
• Added schemaHasNestedConditional(), which Form uses to detect a dependencies/if nested below a schema's top level (behind a $ref, patternProperties, tuple items, additionalProperties or allOf/anyOf/oneOf) so sanitization isn't skipped just because the root retrieved schema looks unchanged (#5250)
• Fixed getInputProps() defaulting type: number schemas to a native number input in locales whose decimal separator isn't ., where the browser rejects the localized value; it now defaults to a text input in those locales unless an explicit inputType is set
• Added resolveDefaultWidget(), extracting the widget-name/enumOptions fallback logic shared by @rjsf/core's StringField and NumberField so the two can no longer drift out of sync
• Upgraded @x0k/json-schema-merge to ^1.0.6, which now preserves Symbol-keyed properties (e.g. Symbol(__rjsf_ref)) when merging allOf schemas and no longer collapses distinct allOf.contains branches into one over-constrained schema; removed the corresponding Symbol-preservation and contains-extraction workarounds from retrieveSchemaInternal(), fixing (#5146)
• Fixed defaults from a dependency subschema being omitted when getDefaultFormState() is called without form data or with an empty object, fixing #5198
• Fixed computeDefaults() to merge a non-object schema's allOf when experimental_defaultFormStateBehavior.allOf is set to populateDefaults, so a $ref wrapped in a single-element allOf now populates the same defaults as the bare $ref does, fixing #5177

Dev / docs / playground

• Fixed the size-limit report never being posted on a pull request from a fork. The comment workflow resolved the PR from its head sha, which the base repository cannot associate with a fork's commit, so it warned and skipped — leaving a green check and no comment. The measuring job now records the PR number in its artifact, and the comment workflow looks that PR up directly, accepts it only if its head sha matches the run's trusted workflow_run head sha, and fails loudly rather than skipping when the PR cannot be found
• Extended the size-limit checks to cover every released package rather than just @rjsf/core, @rjsf/utils and @rjsf/validator-ajv8. The checks are derived from each package's own package.json, so a new package or a dependency change needs no config edit; only the packages that already had budgets enforce one, the rest are measured and reported

... (truncated)

Commits

• 4aeb5fa Releasing 6.11.0
• ec97e49 Fix 4476: restore an option's defaults when switching oneOf/anyOf (#5335)
• b1e39dc feat(utils): add requiredBooleanDefault option to opt out of the required-boo...
• 4d1cb92 Fix #5294: apply schema changes that add a defaulted property after onChange ...
• 3002e47 chore(deps): bump ata-validator to ^1.23.0 in @​rjsf/validator-ata (#5293)
• 9ee0673 Releasing 6.10.1 (#5291)
• 2241afa fix: populate defaults for a $ref wrapped in a single-element allOf (#5235)
• 986d7c2 fix(utils): populate dependency defaults without form data (#5245)
• 9127f50 fix(shadcn): export the prebuilt theme stylesheets so they can be imported (#...
• 314e6f5 fix(utils): upgrade @​x0k/json-schema-merge to 1.0.6 (#5288)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ffe899ea-0d77-41ee-aefa-6bc813f150d7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​rjsf/​utils@​6.8.0 ⏵ 6.11.0	+1		+1	-1
	@​rjsf/​core@​6.8.0 ⏵ 6.11.0	+1			+1

View full report

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	66.61%	2357 / 3538
🔵	Statements	65.08%	2434 / 3740
🔵	Functions	63.57%	452 / 711
🔵	Branches	51.72%	1154 / 2231

File Coverage

No changed files found.

Generated in workflow #3120 for commit fa8168a by the Vitest Coverage Report Action