chore(deps): bump react-hook-form from 7.71.2 to 7.88.0 in /app

[dependabot]

Bumps react-hook-form from 7.71.2 to 7.88.0.

Release notes

Sourced from react-hook-form's releases.

Version 7.88.0

✨ Features

• Add Error Message component (#13472)
• Add the Error Message component for displaying validation errors from React Hook Form.

🐞 Fixes

• Fix stale validating state after resetField() (#13735)
• Fix errors and touched state remaining for rows removed by replace() (#13734)
• Fix stale resolver results updating form state after reset() during handleSubmit() (#13733)
• Fix nested registered errors being removed when trigger() targets their parent (#13732)
• Fix resolver-reported root errors being dropped during handleSubmit() (#13731)
• Fix parent errors being incorrectly set when trigger() targets a field with only nested resolver errors (#13730)
• Fix useWatch compute cache not being initialized with the initial output (#13728)
• Fix FileList being lost during flatten/expand and omit undefined values in jsonToFormData (#13725)
• Fix schemaErrorLookup reporting nested containers as exact-name errors (#13727)
• Fix isValidating not being recomputed after unregister() clears validating fields (#13723)
• Fix stale resolver state updates after reset() (#13722)
• Fix iterateFieldsByAction only breaking out of one loop level (#13718)
• Fix stale validation types surviving setError() overwrites (#13716)
• Fix reset() not clearing validating fields (#13714)
• Fix remove() leaking deleted values onto surviving field-array items (#13713)
• Fix the React Server build being unpublished (#13709)
• Fix validateField calling setCustomValidity once per key in validate-object mode (#13707)
• Fix useFieldArray focus behavior for checkboxes and radio buttons in appended rows (#13705)
• Fix getFieldState reading isValidating from the supplied form state (#13704)
• Fix unregister() stripping kept values from the submit payload (#13703)
• Fix useFormState not re-subscribing when control changes (#13702)
• Fix reset() keeping dirtyFields out of sync with isDirty when keepValues is enabled (#13701)
• Fix useForm not reconciling correctly when an Activity subtree is initially hidden (#13698)
• Fix cleared errors returning after the delayError timer fires (#13697)
• Fix cloneObject throwing when checking Blob with instanceof (#13694)
• Fix useFieldArray retaining stale fields after an Activity subtree reconnects (#13688)

🧹 Refactors

• Extend _isTracked to the remaining multi-key proxy/subscribe form-state checks (#13699)
• Extract _isTracked helper for proxy/subscribe form-state checks (#13690)
• Remove the unused abortEarly parameter from iterateFieldsByAction (#13689)
• Remove redundant optional chaining from clearErrors (#13696)

📝 Documentation

• Fix useWatch compute example variable names in JSDoc (#13700)

📦 Dependencies

• Bump joi from 18.2.1 to 18.2.5 (#13719)

... (truncated)

Changelog

Sourced from react-hook-form's changelog.

Changelog

[7.87.0] - 2026-08-30

Added

• shouldTouch option for trigger()
• OpaqueTypes registry for opaque leaf types

Fixed

• Inconsistent behavior among useController().field.onChange()-like APIs
• Controller under a null parent submitting undefined instead of a value
• ERR_MODULE_NOT_FOUND resolving react-hook-form due to a react-server declaration (Next.js builds)
• useWatch never reconciling when an Activity subtree is hidden on its first render
• resetField not recomputing isValid for subscribe-only consumers
• generateWatchOutput ignoring defaultValue for an array of names
• useFormState never reconciling when an Activity subtree is hidden on its first render

[7.86.0] - 2026-08-22

Added

• Type-safe getErrors method

Performance

• Improve createFormControl
• Improve clone object check
• Avoid cloning values in unregister without subscribers

Fixed

• Field array update leaving stale errors and touched state at the updated index
• flatten discarding File and Blob values instead of treating them as leaf nodes
• validateField not passing the field error to setCustomValidity when criteriaMode is all
• hasValidation treating falsy but valid values (min: 0, max: 0, minLength: 0, maxLength: 0, required: '') as no validation
• setValue targeting a nested leaf not notifying a Controller registered on a field array item root
• setValues not updating fields registered under an object or array value
• useWatch returning a stale value on name change when the new value is null
• unregister inverting keepDirty when broadcasting isDirty

[7.85.0] - 2026-08-08

Added

• Support <Activity />

Fixed

... (truncated)

Commits

• 28334fa 7.88.0
• 8b7e0e4 🐞 fix(setValue): compare transformed value for dirty state with valueAs/setVa...
• b5c210b 🐞 fix: cancel nested delayError timers when a parent is cleared or unregister...
• 8918788 🐞 fix: refresh criteriaMode flag when form options are updated at runtime (#1...
• 39cfba0 🐞 fix(resetField): clear stale validating state for the field (#13735)
• a448816 🐞 fix: drop errors and touched state for rows removed by replace() (#13734)
• 3756191 🐞 fix(handleSubmit): ignore stale resolver result after reset (#13733)
• d2b757f 🐞 fix(trigger): keep registered nested errors when trigger targets their pare...
• f32faed 🐞 fix(handleSubmit): keep resolver-reported root errors on submit (#13731)
• cdcbfca 🐞 fix: don't set parent error when trigger target has only nested resolver er...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 33897fb8-da5a-4d3a-a7d3-39e7b1008096

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/react-hook-form	7.88.0	🟢 6.2	Details Check Score Reason Code-Review 🟢 8 Found 25/30 approved changesets -- score normalized to 8 Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 4 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• app/package-lock.json

[barakb]

Superseded by #779, which landed this bump (and the other four open Dependabot updates) on staging in a single green CI run. The dependency is already at this version or newer in staging, so this PR is redundant.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.