Bump the major-updates group across 1 directory with 15 updates

Bumps the major-updates group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@floating-ui/vue](https://github.com/floating-ui/floating-ui/tree/HEAD/packages/vue) | `1.1.11` | `2.0.1` |
| [@tanstack/vue-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/vue-query-devtools) | `5.91.0` | `6.1.38` |
| [@tanstack/vue-table](https://github.com/TanStack/table/tree/HEAD/packages/vue-table) | `8.21.3` | `9.1.2` |
| [pinia](https://github.com/vuejs/pinia) | `3.0.4` | `4.0.3` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `2.6.1` | `3.6.0` |
| [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.4` | `10.0.1` |
| [@inertiajs/vue3](https://github.com/inertiajs/inertia/tree/HEAD/packages/vue3) | `2.3.23` | `3.6.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.19` | `26.2.0` |
| [laravel-vite-plugin](https://github.com/laravel/vite-plugin) | `2.1.0` | `3.2.0` |
| [postcss-import](https://github.com/postcss/postcss-import) | `15.1.0` | `17.0.0` |
| [postcss-nesting](https://github.com/csstools/postcss-plugins/tree/HEAD/plugins/postcss-nesting) | `12.1.5` | `14.0.1` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `3.4.19` | `4.3.3` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.3` | `8.2.1` |
| [vite-plugin-dts](https://github.com/qmhc/unplugin-dts/tree/HEAD/packages/vite-plugin-dts) | `4.5.4` | `5.0.3` |



Updates `@floating-ui/vue` from 1.1.11 to 2.0.1
- [Release notes](https://github.com/floating-ui/floating-ui/releases)
- [Changelog](https://github.com/floating-ui/floating-ui/blob/master/packages/vue/CHANGELOG.md)
- [Commits](https://github.com/floating-ui/floating-ui/commits/@floating-ui/vue@2.0.1/packages/vue)

Updates `@tanstack/vue-query-devtools` from 5.91.0 to 6.1.38
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/vue-query-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/vue-query-devtools@6.1.38/packages/vue-query-devtools)

Updates `@tanstack/vue-table` from 8.21.3 to 9.1.2
- [Release notes](https://github.com/TanStack/table/releases)
- [Changelog](https://github.com/TanStack/table/blob/main/packages/vue-table/CHANGELOG.md)
- [Commits](https://github.com/TanStack/table/commits/@tanstack/vue-table@9.1.2/packages/vue-table)

Updates `pinia` from 3.0.4 to 4.0.3
- [Release notes](https://github.com/vuejs/pinia/releases)
- [Commits](https://github.com/vuejs/pinia/compare/v3.0.4...v4.0.3)

Updates `tailwind-merge` from 2.6.1 to 3.6.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](https://github.com/dcastil/tailwind-merge/compare/v2.6.1...v3.6.0)

Updates `@eslint/js` from 9.39.4 to 10.0.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js)

Updates `@inertiajs/vue3` from 2.3.23 to 3.6.1
- [Release notes](https://github.com/inertiajs/inertia/releases)
- [Changelog](https://github.com/inertiajs/inertia/blob/3.x/CHANGELOG.md)
- [Commits](https://github.com/inertiajs/inertia/commits/v3.6.1/packages/vue3)

Updates `@types/node` from 22.19.19 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `laravel-vite-plugin` from 2.1.0 to 3.2.0
- [Release notes](https://github.com/laravel/vite-plugin/releases)
- [Changelog](https://github.com/laravel/vite-plugin/blob/3.x/CHANGELOG.md)
- [Upgrade guide](https://github.com/laravel/vite-plugin/blob/3.x/UPGRADE.md)
- [Commits](https://github.com/laravel/vite-plugin/compare/v2.1.0...v3.2.0)

Updates `postcss-import` from 15.1.0 to 17.0.0
- [Release notes](https://github.com/postcss/postcss-import/releases)
- [Changelog](https://github.com/postcss/postcss-import/blob/master/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss-import/compare/15.1.0...17.0.0)

Updates `postcss-nesting` from 12.1.5 to 14.0.1
- [Changelog](https://github.com/csstools/postcss-plugins/blob/main/plugins/postcss-nesting/CHANGELOG.md)
- [Commits](https://github.com/csstools/postcss-plugins/commits/HEAD/plugins/postcss-nesting)

Updates `tailwindcss` from 3.4.19 to 4.3.3
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss)

Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/compare/v5.9.3...v7.0.2)

Updates `vite` from 7.3.3 to 8.2.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite)

Updates `vite-plugin-dts` from 4.5.4 to 5.0.3
- [Release notes](https://github.com/qmhc/unplugin-dts/releases)
- [Changelog](https://github.com/qmhc/unplugin-dts/blob/main/packages/vite-plugin-dts/CHANGELOG.md)
- [Commits](https://github.com/qmhc/unplugin-dts/commits/vite-plugin-dts@5.0.3/packages/vite-plugin-dts)

---
updated-dependencies:
- dependency-name: "@eslint/js"
  dependency-version: 10.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@floating-ui/vue"
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@inertiajs/vue3"
  dependency-version: 3.6.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@tanstack/vue-query-devtools"
  dependency-version: 6.1.38
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@tanstack/vue-table"
  dependency-version: 9.1.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: laravel-vite-plugin
  dependency-version: 3.1.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: pinia
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: postcss-import
  dependency-version: 16.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: postcss-nesting
  dependency-version: 14.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: tailwind-merge
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: tailwindcss
  dependency-version: 4.3.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: vite
  dependency-version: 8.2.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: vite-plugin-dts
  dependency-version: 5.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/VOUCHED.td

@@ -18,6 +18,7 @@ bufferhead-code
 candideu
 kasparrosin
 korridor
+nikbucher tasks table sorting
 onatcer
 shrootbuck
 smilebeda

app/Providers/RouteServiceProvider.php

@@ -33,8 +33,8 @@ class RouteServiceProvider extends ServiceProvider
             }
 
             return $request->user()
-                ? Limit::perMinute(200)->by($request->user()->id)
+                ? Limit::perMinute(config('app.api_rate_limit_authenticated_per_minute'))->by($request->user()->id)
-                : Limit::perMinute(60)->by($request->ip());
+                : Limit::perMinute(config('app.api_rate_limit_guest_per_minute'))->by($request->ip());
         });
 
         $this->routes(function (): void {

app/Service/LocalizationService.php

@@ -155,9 +155,10 @@ class LocalizationService
     }
 
     /**
-     * Time group types have no server-side descriptor; Day and Week keys are ISO dates and
+     * Time group types have no server-side descriptor; their keys are ISO dates and are
      * formatted here instead. A Week key is the first day of that week, so it renders as the
-     * range it covers.
+     * range it covers. A Year key is already a bare year, so it is returned unchanged - it must
+     * not be parsed, Carbon reads a four digit string as a time of day.
      */
     public function formatTimeGroupKey(?string $key, TimeEntryAggregationType $groupType): ?string
     {
@@ -175,6 +176,13 @@ class LocalizationService
             return $this->formatDate($weekStart).' - '.$this->formatDate($weekStart->copy()->addDays(6));
         }
 
+        if ($groupType === TimeEntryAggregationType::Month) {
+            // Note: the leading "!" resets all fields the format does not name. Without it the
+            // day of the month is taken from today, and a day that the parsed month does not
+            // have overflows the date into the next month.
+            return Carbon::createFromFormat('!Y-m', $key)->format('F Y');
+        }
+
         return $key;
     }
 

config/app.php

@@ -158,6 +158,21 @@ return [
 
     'pagination_per_page_default' => (int) env('PAGINATION_PER_PAGE_DEFAULT', 15),
 
+    /*
+    |--------------------------------------------------------------------------
+    | API Rate Limiting
+    |--------------------------------------------------------------------------
+    |
+    | The number of API requests allowed per minute, counted per user for
+    | authenticated requests and per IP address for guest requests. These
+    | limits are only enforced when the application runs in production.
+    |
+    */
+
+    'api_rate_limit_authenticated_per_minute' => (int) (env('API_RATE_LIMIT_AUTH_PER_MINUTE') ?: 200),
+
+    'api_rate_limit_guest_per_minute' => (int) (env('API_RATE_LIMIT_GUEST_PER_MINUTE') ?: 60),
+
     /*
     |--------------------------------------------------------------------------
     | Encryption Key

package.json

@@ -26,13 +26,13 @@
     },
     "devDependencies": {
         "@eslint/eslintrc": "^3.3.5",
-        "@eslint/js": "^9.39.4",
+        "@eslint/js": "^10.0.1",
-        "@inertiajs/vue3": "^2.3.23",
+        "@inertiajs/vue3": "^3.6.1",
         "@playwright/test": "^1.60.0",
         "@tailwindcss/forms": "^0.5.11",
         "@tailwindcss/typography": "^0.5.19",
         "@types/chroma-js": "^3.1.2",
-        "@types/node": "^22.19.19",
+        "@types/node": "^26.2.0",
         "@vitejs/plugin-vue": "^6.0.6",
         "@vue/test-utils": "^2.4.6",
         "@vue/tsconfig": "^0.8.1",
@@ -40,14 +40,14 @@
         "axios": "^1.16.0",
         "eslint-plugin-unused-imports": "^4.4.1",
         "happy-dom": "^20.8.9",
-        "laravel-vite-plugin": "^2.1.0",
+        "laravel-vite-plugin": "^3.2.0",
         "openapi-zod-client": "^1.18.3",
         "postcss": "^8.5.14",
-        "postcss-import": "^15.1.0",
+        "postcss-import": "^17.0.0",
-        "postcss-nesting": "^12.1.5",
+        "postcss-nesting": "^14.0.1",
-        "tailwindcss": "^3.4.19",
+        "tailwindcss": "^4.3.3",
-        "typescript": "^5.9.3",
+        "typescript": "^7.0.2",
-        "vite": "^7.3.3",
+        "vite": "^8.2.1",
         "vite-plugin-checker": "^0.12.0",
         "vitest": "^4.1.4",
         "vue": "^3.5.34",
@@ -55,15 +55,15 @@
     },
     "dependencies": {
         "@floating-ui/core": "^1.7.5",
-        "@floating-ui/vue": "^1.1.11",
+        "@floating-ui/vue": "^2.0.1",
         "@heroicons/vue": "^2.2.0",
         "@lucide/vue": "^1.14.0",
         "@rushstack/eslint-patch": "^1.16.1",
         "@tailwindcss/container-queries": "^0.1.1",
         "@tanstack/vue-form": "^1.32.0",
         "@tanstack/vue-query": "^5.100.10",
-        "@tanstack/vue-query-devtools": "^5.91.0",
+        "@tanstack/vue-query-devtools": "^6.1.38",
-        "@tanstack/vue-table": "^8.21.3",
+        "@tanstack/vue-table": "^9.1.2",
         "@tanstack/vue-virtual": "^3.13.24",
         "@vue/eslint-config-prettier": "^10.2.0",
         "@vue/eslint-config-typescript": "^14.7.0",
@@ -77,10 +77,10 @@
         "echarts": "^6.0.0",
         "focus-trap": "^8.2.0",
         "parse-duration": "^2.1.6",
-        "pinia": "^3.0.4",
+        "pinia": "^4.0.3",
         "radix-vue": "^1.9.17",
         "reka-ui": "^2.9.7",
-        "tailwind-merge": "^2.6.1",
+        "tailwind-merge": "^3.6.0",
         "tailwindcss-animate": "^1.0.7",
         "vue-draggable-plus": "^0.6.1",
         "vue-echarts": "^8.0.1",

resources/js/packages/api/package.json

@@ -29,7 +29,7 @@
     "author": "solidtime",
     "license": "AGPL-3.0",
     "devDependencies": {
-        "vite-plugin-dts": "^4.5.4"
+        "vite-plugin-dts": "^5.0.3"
     },
     "peerDependencies": {
         "@zodios/core": "^10.9.6",

resources/js/packages/ui/package.json

@@ -50,7 +50,7 @@
     "devDependencies": {
         "@types/chroma-js": "^3.1.2",
         "@zodios/core": "^10.9.6",
-        "vite-plugin-dts": "^4.5.4",
+        "vite-plugin-dts": "^5.0.3",
         "zod": "^3.25.76"
     },
     "peerDependencies": {

resources/js/packages/ui/src/dialog/DialogContent.vue

@@ -31,7 +31,7 @@ const forwarded = useForwardPropsEmits(delegatedProps, emits);
         <div
             :class="
                 cn(
-                    'fixed top-0 left-0 z-50 pointer-events-none w-screen h-screen flex items-start px-2 pt-3 md:pt-14 xl:pt-24 justify-center overflow-auto'
+                    'fixed top-0 left-0 z-50 pointer-events-none w-screen h-screen [height:100dvh] flex items-start px-2 py-3 md:py-14 xl:py-24 justify-center overflow-y-auto overscroll-contain'
                 )
             ">
             <DialogContent

resources/js/packages/ui/src/utils/time.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, test } from 'vitest';
-import { formatHumanReadableDuration, formatReportingDuration, formatWeekRange } from './time';
+import {
+    formatHumanReadableDuration,
+    formatMonth,
+    formatReportingDuration,
+    formatWeekRange,
+} from './time';
 
 const seconds = 14 * 3600 + 45 * 60 + 6; // 14h 45m 06s
 
@@ -60,3 +65,9 @@ describe('formatWeekRange', () => {
         );
     });
 });
+
+describe('formatMonth', () => {
+    test('renders the name of the month that the key covers', () => {
+        expect(formatMonth('2001-02')).toBe('February 2001');
+    });
+});

resources/js/packages/ui/src/utils/time.ts

@@ -245,6 +245,15 @@ export function formatWeekRange(date: string, format?: DateFormat): string {
     return `${formatDate(date, format)} - ${formatDate(end, format)}`;
 }
 
+/*
+ * Returns the month that the given key falls in. There is no `DateFormat` variant for a
+ * month, so this is not affected by the organization date format.
+ * @param date - a month, in the format of 'YYYY-MM'
+ */
+export function formatMonth(date: string): string {
+    return getDayJsInstance()(date).format('MMMM YYYY');
+}
+
 /*
  * Returns a human readable date format.
  * @param date - date in the format of 'YYYY-MM-DD'

resources/js/utils/useReporting.ts

@@ -15,7 +15,12 @@ import {
 } from '@heroicons/vue/16/solid';
 import { Coffee } from '@lucide/vue';
 import BillableIcon from '@/packages/ui/src/Icons/BillableIcon.vue';
-import { type DateFormat, formatDate, formatWeekRange } from '@/packages/ui/src/utils/time';
+import {
+    type DateFormat,
+    formatDate,
+    formatMonth,
+    formatWeekRange,
+} from '@/packages/ui/src/utils/time';
 
 export type GroupingOption =
     | 'project'
@@ -27,7 +32,9 @@ export type GroupingOption =
     | 'tag'
     | 'type'
     | 'day'
-    | 'week';
+    | 'week'
+    | 'month'
+    | 'year';
 
 export const useReportingStore = defineStore('reporting', () => {
     // Cache query composables to avoid creating new subscriptions on every call
@@ -94,6 +101,10 @@ export const useReportingStore = defineStore('reporting', () => {
         if (type === 'week') {
             return formatWeekRange(key, dateFormat);
         }
+        if (type === 'month') {
+            return formatMonth(key);
+        }
+        // A `year` key is already a bare year, so it falls through unchanged.
         return key;
     }
 

tests/Unit/Service/LocalizationServiceTest.php

@@ -364,14 +364,27 @@ class LocalizationServiceTest extends TestCaseWithDatabase
         $this->assertSame('29/12/2025 - 04/01/2026', $formatted);
     }
 
-    public function test_format_time_group_key_does_not_change_month_year_and_entity_group_types(): void
+    public function test_format_time_group_key_formats_a_month_key_and_does_not_change_year_and_entity_group_types(): void
     {
         // Arrange
         $this->localizationService->setDateFormat(DateFormat::SlashSeparatedDDMMYYYY);
 
         // Act & Assert
-        $this->assertSame('2001-02', $this->localizationService->formatTimeGroupKey('2001-02', TimeEntryAggregationType::Month));
+        $this->assertSame('February 2001', $this->localizationService->formatTimeGroupKey('2001-02', TimeEntryAggregationType::Month));
         $this->assertSame('2001', $this->localizationService->formatTimeGroupKey('2001', TimeEntryAggregationType::Year));
         $this->assertSame('some-uuid', $this->localizationService->formatTimeGroupKey('some-uuid', TimeEntryAggregationType::Project));
     }
+
+    public function test_format_time_group_key_formats_a_month_key_independently_of_the_current_day_of_month(): void
+    {
+        // Arrange
+        // Note: the current day of the month must not leak into the parsed month. The 31st does
+        // not exist in April, so a leaked day overflows the date into the following month.
+        $this->travelTo(Carbon::create(2026, 8, 31, 12, 0, 0, 'UTC'));
+
+        // Act & Assert
+        $this->assertSame('February 2001', $this->localizationService->formatTimeGroupKey('2001-02', TimeEntryAggregationType::Month));
+        $this->assertSame('April 2026', $this->localizationService->formatTimeGroupKey('2026-04', TimeEntryAggregationType::Month));
+        $this->assertSame('December 2026', $this->localizationService->formatTimeGroupKey('2026-12', TimeEntryAggregationType::Month));
+    }
 }