Bump react-hook-form from 7.54.2 to 7.81.0 in /js

[dependabot]

Bumps react-hook-form from 7.54.2 to 7.81.0.

Release notes

Sourced from react-hook-form's releases.

Version 7.81.0

⚜️ feat: FieldArray component (#13394)

<FieldArray
  control={control}
  name="test"
  render={({ fields }) => null}
/>

🐞 fix #13538 useFieldArray min 1 item validation error changes its location in the errors object (#13539) 🐞 fix #13569 calling reset triggers subscribe with latest name instead of undefined (#13574) 🐞 fix(useController): reflect cleared parent object in controlled fields (#13550) (#13553) 🐞 fix(flatten): preserve Date values as leaf nodes (#13566) 🐛 fix(unset): guard against prototype keyword path traversal (#13559) (#13560) 🏸 improve setValue api with shrink value (#13576) 👝 close #13577 improve re-render with useFieldArray reset (#13578) 🐞 fix #13575 issue: clearErrors changes the name value from form.subscribe (#13579)

thanks to @​DakshSinghDhami, @​JSap0914, @​tran-simon & @​EduardF1

Version 7.80.0

🧄 feat: disable useFieldArray fields (#13535)

const { fields } = useFieldArray({ disabled: true });
fields[0].disabled; // contains disabled props

🛺 perf: make rhf more performant (#13524) 🐞 fix(deepEqual): empty array and empty plain object should not be equal (#13533)

thanks to @​JSap0914

Version 7.79.0

🚷 feat: use field array disabled (#13520)

useFieldArray({ disabled, name: 'test' })

🐞 fix controller onChange promise (#13518) 🐞 fix: track visited pairs in deepEqual to avoid false positives with shared object references (#13515) 🐞 fix #12651 issue: field validation with shouldUseNativeValidation does not behave native like for radio groups (#13512) 🐞 fix #12754 createFormControl breaks with fast refresh in dev mode (#13511) 🐞 close #12709 #12750 StrictMode would remove field value & get mounted again (#13508) 🐞 fix #13505 issue: In v8 with React compiler, a change in formState errors does not cause child components to re-render (#13510)

thanks to @​DucMinhNe & @​louzhedong

Version 7.78.0

... (truncated)

Changelog

Sourced from react-hook-form's changelog.

[7.81.0] - 2026-07-05

Added

• FieldArray component built on useFieldArray for controlled field-array rendering

Fixed

• clearErrors changing the name value from form.subscribe
• reset triggering subscribe with the latest name instead of undefined
• setValues leaving stale elements behind when shrinking a field array
• flatten preserving Date values as leaf nodes
• useFieldArray min length validation error changing location in the errors object
• useController not reflecting a cleared parent object in controlled fields

Security

• Harden unset() against prototype-path traversal (__proto__ / constructor / prototype), matching the existing set() guard

Performance

• Improve re-render with useFieldArray reset

[7.80.0] - 2026-06-20

Added

• disabled prop support for individual fields within useFieldArray

Fixed

• deepEqual incorrectly treating empty array [] and empty plain object {} as equal

Performance

• Improve onChange, setValid, dirty checking, setValue, and setValues performance

[7.79.0] - 2026-06-13

Added

• disabled option to useFieldArray

Fixed

• Controller onChange promise return type
• deepEqual false positives with shared object references
• shouldUseNativeValidation behavior for radio groups
• createFormControl stability with fast refresh in dev mode
• StrictMode value preservation during remount

... (truncated)

Commits

• 46b217e 7.81.0
• 6595a91 🐞 fix #13575 issue: clearErrors changes the name value from form.subscribe (#...
• cae5dfe 👝 close #13577 improve re-render with useFieldArray reset (#13578)
• 5b2b743 🏸 improve setValue api with shrink value (#13576)
• 6112441 🐞 fix #13569 calling reset triggers subscribe with latest name instead of und...
• f89388f 🐞 fix(flatten): preserve Date values as leaf nodes (#13566)
• 46381fa Revert "docs: fix grammar in demo descriptions (#13565)" (#13568)
• d4c804a Revert "test: remove duplicate UseFieldArray slug (#13564)" (#13567)
• 63ec54f test: remove duplicate UseFieldArray slug (#13564)
• 08792ad docs: fix grammar in demo descriptions (#13565)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: area/dependencies, team/ui. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The PR successfully updates react-hook-form in the Account and Admin UI applications. However, the requested update for the ui-shared library, as specified in the acceptance criteria, is missing from the submitted file list and must be included before merging.

Critically, the PR leaves several high-risk security vulnerabilities unaddressed in existing dependencies. Specifically, a high-severity Remote Code Execution vulnerability (CVE-2026-6951) was found in simple-git, and an open redirect vulnerability (CVE-2026-40181) was found in react-router-dom. These security flaws should be mitigated as part of this dependency maintenance cycle.

About this PR

• The acceptance criteria require an upgrade of react-hook-form in the js/libs/ui-shared/package.json file, but this file was not included in the PR. Please ensure all shared library dependencies are synchronized.

1 comment outside of the diff

js/pnpm-lock.yaml

_{line 310 🔴 HIGH RISK}
The version of simple-git used here is subject to a high-severity Remote Code Execution vulnerability (CVE-2026-6951). This security risk should be mitigated by updating to version 3.36.0 or higher.

Test suggestions

• Verify that form submissions and validation logic in the Account and Admin UIs remain functional with the updated library.
• Verify that the security hardening in the 'unset' function correctly prevents prototype pollution via path traversal.
• Smoke test components in the ui-shared library that depend on react-hook-form to ensure cross-package compatibility.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that form submissions and validation logic in the Account and Admin UIs remain functional with the updated library.
2. Verify that the security hardening in the 'unset' function correctly prevents prototype pollution via path traversal.
3. Smoke test components in the ui-shared library that depend on react-hook-form to ensure cross-package compatibility.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Suggestion: Update react-router-dom to address the open redirect vulnerability (CVE-2026-40181) identified in the package.

Suggested change

	"react-router-dom": "^6.29.0",
	"react-router-dom": "^6.30.4",

[codacy-production]

_{🟡 MEDIUM RISK}

Suggestion: This dependency is affected by an open redirect vulnerability (CVE-2026-40181). Upgrading to a secure version is recommended to address this security risk.

Suggested change

	"react-router-dom": "^6.29.0"
	"react-router-dom": "^6.30.4"

[dependabot]

Superseded by #201.