Bump @xyflow/react from 12.11.1 to 12.11.3

[dependabot]

Bumps @xyflow/react from 12.11.1 to 12.11.3.

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.11.3

Patch Changes

• #5902 393d951 - Allow middle-mouse viewport panning to start from a selection rectangle.

• #5889 ff126a0 - Fix extent: 'parent' not immediately resolving when parent has width or initialWidth.

• #5943 d1def59 - Invoke an error if handle can not be found

• #5947 2ba040f - Use correct nodeExtent for internal setNodes.

• #5918 c5d7442 - Fix selection box appearing when dragging the pane via touch. Prefer touch panning over drag selection when selectionOnDrag is combined with mouse-button-specific panOnDrag settings.

• #5922 392da00 - Allow Control to activate pane panning with a primary-button drag.

• #5929 4c5d7d2 - Allow key combinations of three or more keys (e.g. 'Meta+Shift+s') for useKeyPress.

• #5938 91a052f - Fix <Background /> pattern offset miscalculation.

• Updated dependencies [393d951, ff126a0, e5d86bd, 392da00]:

  • @​xyflow/system@​0.0.80

@​xyflow/react@​12.11.2

Patch Changes

• #5825 5072914 - Only create an XYDrag instance for draggable nodes.

• #5847 742860c - Stop the MiniMap from re-rendering on every store update.

• #5846 17c64a1 - Apply the viewport pan/zoom transform imperatively so the Viewport component only renders once.

• Updated dependencies [c707267, 0c0cebc, 56cf3b0, a01bb6b, 9b3f390, cdfcbeb]:

  • @​xyflow/system@​0.0.79

Changelog

Sourced from @​xyflow/react's changelog.

12.11.3

Patch Changes

• #5902 393d951 - Allow middle-mouse viewport panning to start from a selection rectangle.

• #5889 ff126a0 - Fix extent: 'parent' not immediately resolving when parent has width or initialWidth.

• #5943 d1def59 - Invoke an error if handle can not be found

• #5947 2ba040f - Use correct nodeExtent for internal setNodes.

• #5918 c5d7442 - Fix selection box appearing when dragging the pane via touch. Prefer touch panning over drag selection when selectionOnDrag is combined with mouse-button-specific panOnDrag settings.

• #5922 392da00 - Allow Control to activate pane panning with a primary-button drag.

• #5929 4c5d7d2 - Allow key combinations of three or more keys (e.g. 'Meta+Shift+s') for useKeyPress.

• #5938 91a052f - Fix <Background /> pattern offset miscalculation.

• Updated dependencies [393d951, ff126a0, e5d86bd, 392da00]:

  • @​xyflow/system@​0.0.80

12.11.2

Patch Changes

• #5825 5072914 - Only create an XYDrag instance for draggable nodes.

• #5847 742860c - Stop the MiniMap from re-rendering on every store update.

... (truncated)

Commits

• 359f70c chore(packages): bump
• e90a1b6 Merge pull request #5938 from Feyyus/fix/background-offset-precedence
• 2ba040f fix(react): use the current nodeExtent in setNodes
• 42f367e Merge pull request #5922 from Skyline-23/fix/control-pan-activation
• d7dbd57 Merge pull request #5929 from Jian-Zhang08/fix/usekeypress-multi-key-combination
• bdcf89a fix(edge-wrapper): pass onError prop closes #5936, closes #5932
• 91a052f fix(react): correct offset math in Background pattern
• 4c5d7d2 fix(react): make useKeyPress work with combinations of three or more keys
• 392da00 fix(system): allow Control key to activate pane panning
• c5d7442 fix(pane): prefer touch panning over drag selection
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​xyflow/​react@​12.11.1 ⏵ 12.11.3	+1			+2

View full report

[amacsmith]

### APPROVE — Automated evidence-backed PR review · 2026-08-18

**@xyflow/react 12.11.1 → 12.11.3** — clean patch bump on a template repo.

- **Diff:** 2 files, +9/-9 (lockfile + package.json only)

- **Socket security:** Supply chain 99 (improved +1), vulnerability 100, quality 100, maintenance 94 (improved +2), license 100 — no flags

- **Scope:** Patch-level bump on a template/demo repository; no production application logic at risk

- **CI:** No CI configured on this repo

- **Linear:** No linked issues — expected for template repo maintenance

No blockers. Safe to merge.

_Automated review · Evidence-Backed GitHub PR Review routine_