fix(deps): update dependency @testing-library/user-event (14.6.7 → 14.6.8)

[its-miso]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@testing-library/user-event	14.6.7 → 14.6.8

---

Release Notes

testing-library/user-event (@​testing-library/user-event)

v14.6.8

Compare Source

Bug Fixes

• treat programmatic null input values as empty string (#​1329) (1951eb7)

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3 (anthropic) — primary route · pr-reviewer-action v3.4.1

Recommendation

Approve. This is a single-package patch bump (@testing-library/user-event 14.6.7 → 14.6.8) confined to package-lock.json, with all 12 CI checks passing on the head commit.

Change-by-change findings

package-lock.json (+3 / -3) — only the three listed keys under node_modules/@testing-library/user-event change: version (14.6.7 → 14.6.8), resolved (tarball URL now points to user-event-14.6.8.tgz), and integrity (new sha512 hash). The "dev": true flag is preserved, the engines, license, and peerDependencies blocks are unchanged, and no other top-level dependency entry is modified. git diff --name-only and the diff stat both confirm a single-file diff.

Manifest consistency — package.json lists @testing-library/user-event exclusively in devDependencies (^14.6.1), with no production entry and no override. The package-lock.json dev: true field matches. A grep for 14.6.7 across the repo finds only the historical CHANGELOG.md line from the previous bump (PR 911); nothing else retains the old version.

Upstream release verification

The upstream compare testing-library/user-event@v14.6.7...v14.6.8 shows exactly one commit (1951eb7) modifying one source file (src/document/interceptor.ts) plus a test file. The release body lists a single entry under Bug Fixes: treat programmatic null input values as empty string. The diff narrows the value interceptor to coerce null to '' before sanitizeValue / trackOrSetValue, matching the [LegacyNullToEmptyString] DOMString spec semantics. This is a narrow behavioral change that aligns the library with the platform's own coercion rules; it does not add or remove public API and does not change the return contract of userEvent.setup() or any other method called by the five consumer test files in this repo.

Claims disposition

• Claim 1 (only those three fields change; no other files modified) — held: 3/3. git diff --name-only and the stat both show package-lock.json only, and the diff hunk edits exactly version, resolved, and integrity for @testing-library/user-event.
• Claim 2 (exclusive 14.6.7 → 14.6.8 single patch bump) — held: 2/2. No remaining 14.6.7 reference in the lockfile (only the historical CHANGELOG entry from the prior bump); the new tarball URL path contains 14.6.8.
• Claim 3 (devDependency only, prod resolution unaffected) — held: 1/1. The dev: true flag in the lockfile entry is preserved, and package.json lists the package solely in devDependencies with no production-side overrides entry.
• Claim 4 (exactly one upstream bug fix: null input values treated as empty string) — held: 1/1. The compare metadata shows one commit and one source-file change with the stated semantics; the release body lists only this bug fix entry.

CI evidence

All 12 checks on the head commit succeed: Docker Build (main + MCP), npm audit, Database migrations, smoke, Build, Lint, Coverage, Database integration, Tests, Workflow lint, and Typecheck. The must_check items from the PR classification are addressed: no breaking API changes are present in this 14.6.x → 14.6.x patch (the diff is a single internal coercion in the value interceptor, and the package's public surface is unchanged), and the full test suite has been run and is green on the head commit.

Unknowns or Needs Verification

• I could not fetch raw.githubusercontent.com or the JS-rendered compare page directly (the harness returns only HTML chrome for github.com URLs, and the raw host is not allowlisted). The conclusions about upstream changes therefore rest on the structured GitHub compare/release metadata the harness surfaced (commit list, file list, patch), which is sufficient to confirm Claim 4.