chore(deps-dev): Bump @testing-library/react from 16.3.0 to 16.3.1

[dependabot]

Bumps @testing-library/react from 16.3.0 to 16.3.1.

Release notes

Sourced from @​testing-library/react's releases.

v16.3.1

16.3.1 (2025-12-15)

Bug Fixes

• Switch to trusted publishing (#1437) (a2d37ff)

Commits

• a2d37ff fix: Switch to trusted publishing (#1437)
• cd6a175 chore: fix action permissions (#1436)
• 22b8c28 chore: fix release (#1435)
• d996673 chore: new release workflow (#1434)
• 205ce17 chore: fix typo in jest.config.js (#1427)
• aba5740 [test] Fix tests for react@experimental (#1424)
• 590bc18 [test] Fix npm run typecheck (#1423)
• 1c931a6 chore(deps): use npm-run-all2 (#1411)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​testing-library/react since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[claude]

Claude finished @mchestr's task in 41s —— View job

---

Review: @testing-library/react 16.3.0 → 16.3.1

• Gather context and understand the request
• Review the dependency bump changes
• Post final review feedback

Summary

This is a routine Dependabot patch bump for a dev-only dependency.

• package.json: version range for @testing-library/react bumped from ^16.3.0 to ^16.3.1 (1 line changed).
• package-lock.json: lockfile updated to resolve the new version, plus a batch of "peer": true flag churn on unrelated packages (e.g. next-auth, zod, pg, react, typescript, etc.) and a few peer flags removed elsewhere (e.g. lz-string, react-is, @types/aria-query). This churn is expected noise from npm regenerating peer-dependency metadata when the lockfile is resolved with a different npm/Node version than what originally generated it — it's not something this PR introduced deliberately, and it doesn't affect installed package versions.

Findings

• Code quality / bugs: None — no application code changed, only dependency manifests.
• Security: Per the upstream release notes, 16.3.1 is a maintenance-only release ("Switch to trusted publishing", fix: Switch to trusted publishing testing-library/react-testing-library#1437) — no CVEs or security-relevant behavior changes. Trusted publishing actually improves supply-chain security for the package's own release pipeline.
• Performance: No impact; test-only dependency, not part of the production bundle.
• Test coverage: N/A — this bump doesn't touch test files. Since @testing-library/react is used across the existing Jest test suite, the main risk is a subtle behavioral change in rendering/query helpers, but the CI test suite (Build workflow) will catch any regressions before merge. CI was still queued/in-progress at the time of this review — worth confirming it passes (particularly npm test) before merging.
• Best practices: Fine to merge once CI is green. No manual changes needed here.

Recommendation: Safe to merge once CI passes. No code changes required.