chore(deps): bump the ui-runtime-deps group in /apps/ui with 5 updates

[dependabot]

Bumps the ui-runtime-deps group in /apps/ui with 5 updates:

Package	From	To
@azure/msal-browser	5.12.0	5.13.0
@azure/msal-react	5.4.3	5.4.4
axios	1.17.0	1.18.0
next	16.2.7	16.2.9
react-hook-form	7.78.0	7.79.0

Updates @azure/msal-browser from 5.12.0 to 5.13.0

Release notes

Sourced from @​azure/msal-browser's releases.

@​azure/msal-browser v5.13.0

5.13.0

Wed, 10 Jun 2026 22:41:33 GMT

Minor changes

• Add per-type migration telemetry counters for cache migration #8628 (thomas.norling@microsoft.com)
• Disable ServerTelemetryManager by default #8600 (thomas.norling@microsoft.com)
• Bump @​azure/msal-common to v16.8.0 (beachball)

Patches

• Fix duplicate redirect flows clearing in-flight interaction state #8637 (thomas.norling@microsoft.com)
• add logging support for normalizeUrlForComparison when executing handleRedirectPromise #8625 (lalimasharda@microsoft.com)
• Fix silent iframe redirect-bridge listener race condition by registering the response listener before navigating the iframe #8636 (thomas.norling@microsoft.com)

Commits

• faa42ab Fix migration readme (#8602) (#8638)
• b8b8da9 Fix duplicate redirect flows clearing in-flight interaction state (#8637)
• 772c6b6 Fix silent iframe redirect-bridge listener race condition (#8636)
• 5c7f986 Use in-built URL API to perform URL comparisons adhering to correct MDN and R...
• eebac50 feat: add per-type migration telemetry counters (#8628)
• 2e5a3bd Add browser-specific guidance across msal-browser docs (#8631)
• 343d36e Disable ServerTelemetryManager by default (#8600)
• 891ee17 Fix correlation cache empty key eviction (#8627)
• 188a2fc Post-release PR (#8632)
• See full diff in compare view

Updates @azure/msal-react from 5.4.3 to 5.4.4

Release notes

Sourced from @​azure/msal-react's releases.

@​azure/msal-react v5.4.4

5.4.4

Wed, 10 Jun 2026 22:41:34 GMT

Patches

• Bump @​azure/msal-browser to v5.13.0 (beachball)

Commits

• faa42ab Fix migration readme (#8602) (#8638)
• b8b8da9 Fix duplicate redirect flows clearing in-flight interaction state (#8637)
• 772c6b6 Fix silent iframe redirect-bridge listener race condition (#8636)
• 5c7f986 Use in-built URL API to perform URL comparisons adhering to correct MDN and R...
• eebac50 feat: add per-type migration telemetry counters (#8628)
• 2e5a3bd Add browser-specific guidance across msal-browser docs (#8631)
• 343d36e Disable ServerTelemetryManager by default (#8600)
• 891ee17 Fix correlation cache empty key eviction (#8627)
• 188a2fc Post-release PR (#8632)
• See full diff in compare view

Updates axios from 1.17.0 to 1.18.0

Release notes

Sourced from axios's releases.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

• Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

• Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

• Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​drori12 (#10984)
• @​eyupcanakman (#10899)
• @​Adi-Beker (#10995)

Full Changelog

Changelog

Sourced from axios's changelog.

Changelog

Commits

• 2d06f96 chore(release): prepare release 1.18.0 (#11003)
• 32fc489 fix: malformed http urls (#11000)
• b40ce49 chore(deps-dev): bump the development_dependencies group with 10 updates (#10...
• fe964f9 docs: mark proxy config as Node.js only (#10995)
• 5f229d2 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...
• fae9d4e docs: clarify package update PR policy (#10992)
• 28ab2ce chore(deps-dev): bump the development_dependencies group with 2 updates (#10989)
• a8e4f13 fix(core): keep default validateStatus when request passes undefined (#10899)
• 614f455 docs: publish v1.17.0 release notes (#10988)
• 6bb12c1 fix: custom auth headers not stripped on cross-origin redirects (#10892)
• Additional commits viewable in compare view

Updates next from 16.2.7 to 16.2.9

Release notes

Sourced from next's releases.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

Commits

• f37fad9 v16.2.9
• d9aaaed [cd] Allow tagging semver-lower releases as @latest if @latest po… (#94627)
• 6f16804 v16.2.8
• 0dbc1d5 [16.2.x][cd] Ensure release can be triggered on old branches (#94598)
• 90e3c81 [16.2.x] Align Actions dependencies with Canary (#94339)
• 83f402c [16.2.x][cd] Stop fetching all tags when searching parent tag (#94334)
• 411c455 v16.2.7
• See full diff in compare view

Updates react-hook-form from 7.78.0 to 7.79.0

Release notes

Sourced from react-hook-form's releases.

Version 7.79.0

🚷 feat: use field array disabled (#13520)

useFieldArray({ disabled, name: 'test' })

🐞 fix controller onChange promise (#13518) 🐞 fix: track visited pairs in deepEqual to avoid false positives with shared object references (#13515) 🐞 fix #12651 issue: field validation with shouldUseNativeValidation does not behave native like for radio groups (#13512) 🐞 fix #12754 createFormControl breaks with fast refresh in dev mode (#13511) 🐞 close #12709 #12750 StrictMode would remove field value & get mounted again (#13508) 🐞 fix #13505 issue: In v8 with React compiler, a change in formState errors does not cause child components to re-render (#13510)

thanks to @​DucMinhNe & @​louzhedong

Changelog

Sourced from react-hook-form's changelog.

[7.79.0] - 2026-06-13

Added

• disabled option to useFieldArray

Fixed

• Controller onChange promise return type
• deepEqual false positives with shared object references
• shouldUseNativeValidation behavior for radio groups
• createFormControl stability with fast refresh in dev mode
• StrictMode value preservation during remount
• formState.errors reactivity with React compiler

Commits

• 3f1d2bd 7.79.0
• c344c4f 📖 update changelog v7.78.0
• 351a958 🏟️ build(deps): bump joi from 17.13.3 to 18.2.1 in /app (#13521)
• e3d8172 🚷 feat: use field array disabled (#13520)
• 00f6c28 🐞 fix controller onChange promise (#13518)
• a338076 🚷 feat: add disabled option to useFieldArray (#13519)
• a2a3c9c 🐞 fix: track visited pairs in deepEqual to avoid false positives with shared ...
• 1e00a1b 🐞 fix #12651 issue: field validation with shouldUseNativeValidation does not ...
• bb2ce17 🐞 fix #12754 createFormControl breaks with fast refresh in dev mode (#13511)
• b377376 🐞 close #12709 #12750 StrictMode would remove field value & get mounted again...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: frontend. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.