chore(deps): update zag-js monorepo to v1.43.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@zag-js/combobox (source)	1.43.0 → 1.43.1
@zag-js/dialog (source)	1.43.0 → 1.43.1
@zag-js/listbox (source)	1.43.0 → 1.43.1
@zag-js/pagination (source)	1.43.0 → 1.43.1
@zag-js/tabs (source)	1.43.0 → 1.43.1

---

Release Notes

chakra-ui/zag (@​zag-js/combobox)

v1.43.1

Compare Source

Fixed

• Auto Resize: Fix an XSS vector in autoResizeInput(). The hidden ghost element used to measure width assigned the
  input's value with innerHTML, so a value containing markup was parsed and could execute. It now uses textContent.

• Cascade Select, Listbox: Fix keyboard navigation losing the highlighted item when scrolling shifts content beneath
  a resting pointer. The pointer events fired by that scroll were treated as a real hover and overrode the keyboard
  highlight. Affects listboxes with highlightOnHover and cascade selects with highlightTrigger: "hover".

• Combobox, Menu, Select: Fix keyboard navigation clearing or moving the highlighted item while the mouse rests over
  scrollable content. Scrolling the item into view moved the content under the cursor, and the resulting pointerleave
  (or pointermove in Safari) was treated as a real hover.

• Core: Fix getExitEnterStates() throwing during state transitions in browsers without Array.prototype.at(),
  such as Safari below 15.4.

• Date Picker

  • Fix the translations prop requiring every message to be supplied. It's now typed as Partial<IntlTranslations>,
    so you can override a single message and let the rest fall back to the defaults.
  • Fix the aria-label from getViewTriggerProps() naming the wrong view. In day view it announced "Switch to year
    view" while the trigger actually switches to month view. translations.viewTrigger now receives the resolved next
    view, and the trigger disables itself once there's no further view to switch to.
  • Fix translations.dayCell() announcing the generic "Choose" label for dates between a selected range's start and
    end. It now announces "In range".

• Dismissable: Fix Escape being ignored right after a dismissable layer opens. trackDismissableElement deferred
  handler registration to the next animation frame, so a dialog, popover or menu was painted and focus-trapped while its
  layer was not yet on the stack. Under CPU load that gap grew well past one frame and swallowed the keypress. Handlers
  now register as soon as the node commits.

• Drawer, Navigation Menu, Steps, Tour: Add type="button" to getTriggerProps() (steps, navigation-menu) and
  getCloseTriggerProps() (drawer, tour). Without it these buttons defaulted to type="submit" and submitted an
  ancestor form on click.

• Floating Panel

  • Fix closing a panel not removing it from the stack, so the next panel now becomes topmost.
  • Fix stack order not applying to the positioner, so focusing a panel raises it above its siblings.

• Focus Visible

  • Fix the interaction modality being reported as pointer when content scrolls under a resting cursor. Safari emits
    move events at an unchanged position in that case.
  • Fix trackFocusVisible() classifying pointer focus as virtual when activating a label briefly moves focus to an
    overlay container. Clicking a checkbox, radio or switch label added data-focus-visible to the control.

• Image Cropper: Fix fixedCropArea: true disabling all keyboard interaction on the crop selection. It removed the
  element from the tab order and ignored every key, including the +/- zoom shortcuts that still apply in fixed mode.
  The selection is now always focusable. Arrow keys pan the image, since there's nothing to move or resize, and
  Alt+Arrow is a no-op.

• QR Code: Include the rendered overlay in getDataUrl() and in the file produced by getDownloadTriggerProps().
  The export previously contained only the QR matrix, so a logo or badge placed over the code was dropped.

• Splitter: Fix the element from getResizeTriggerProps() matching :focus-visible after a pointer drag. It still
  takes focus, so keyboard resizing keeps working, but no longer shows the focus ring.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	design	601b11b	Commit Preview URL Branch Preview URL	Aug 23 2026, 09:02 PM

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​zag-js/​dialog@​1.43.1
	@​zag-js/​pagination@​1.43.1
	@​zag-js/​tabs@​1.43.1
	@​zag-js/​listbox@​1.43.1
	@​zag-js/​combobox@​1.43.1

View full report