Update all non-major dependencies (master)#1518
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
Conversation
renovate
Bot
force-pushed
the
renovate/master-all-minor-patch
branch
2 times, most recently
from
918d0a7 to
c249b22
Compare
renovate
Bot
force-pushed
the
renovate/master-all-minor-patch
branch
from
c249b22 to
b730b5f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.0.0→5.1.05.2.05.0.0→5.1.05.2.05.0.0→5.1.05.2.05.99.0→5.99.25.100.5(+5)5.99.0→5.99.25.100.5(+5)3.13.23→3.13.243.4.0→3.4.126.0.5→26.0.626.0.8(+1)1.53.2→1.56.41.56.7(+2)18.0.1→18.0.23.9.14-eclipse-temurin-25→3.9.15-eclipse-temurin-2510.33.0→10.33.110.33.28.0.8→8.0.98.0.104.1.4→4.1.5Release Notes
lerna-lite/lerna-lite (@lerna-lite/cli)
v5.1.0Compare Source
Features
--no-shellfor lerna exec/watch to avoid DEP0190 warning (#1309) (7b7e61c) - by @ghiscodinglerna-lite/lerna-lite (@lerna-lite/publish)
v5.1.0Compare Source
Note: Version bump only for package @lerna-lite/publish
lerna-lite/lerna-lite (@lerna-lite/version)
v5.1.0Compare Source
Bug Fixes
TanStack/query (@tanstack/react-query)
v5.99.2Compare Source
Patch Changes
v5.99.1Compare Source
Patch Changes
TanStack/query (@tanstack/react-query-devtools)
v5.99.2Compare Source
Patch Changes
v5.99.1Compare Source
Patch Changes
TanStack/virtual (@tanstack/react-virtual)
v3.13.24Compare Source
Patch Changes
97a204d]:cure53/DOMPurify (dompurify)
v3.4.1: DOMPurify 3.4.1Compare Source
font-face,color-profile,missing-glyph,font-face-src,font-face-uri,font-face-format,font-face-name) under permissiveCUSTOM_ELEMENT_HANDLINGannotation-xmlcheck that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML modeSANITIZE_NAMED_PROPSrepeatedly prefixing already-prefixedidandnamevalues on subsequent sanitizationIN_PLACEroot-node check to explicitly guard against non-stringnodeName(DOM-clobbering robustness)slotentry from the default HTML attribute allow-listSANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fireSAFE_FOR_TEMPLATESgreedy scrub, hook-added attribute handling)3.xand2.xmaintenance branchesi18next/i18next (i18next)
v26.0.6Compare Source
Security release — all issues found via an internal audit.
escapeValue: falsewith interpolated variables inside a$t(key, { ... "{{var}}" ... })nesting-options block. In that narrow combination, attacker-controlled string values containing"can break out of the JSON options literal and inject additional nesting options (e.g. redirectlng/ns). The defaultescapeValue: trueconfiguration is unaffected because HTML-escaping neutralises the quote beforeJSON.parse. See the security note in the Nesting docs for the full pattern and mitigationsregexEscapetounescapePrefix/unescapeSuffixon par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the{{- var}}syntax when the delimiter contains characters like(,[,..env*and*.pem/*.keyfiles in.gitignorei18next/i18next-cli (i18next-cli)
v1.56.4Compare Source
<Trans>bare-identifier diagnostic added in 1.56.3 now useslogger.errorand is prefixed withError:, matching the conventionestablished in
#200 so build
tooling that watches for errors (or grep for
Error:) can treat itas fatal. Behaviour and message are otherwise unchanged.
Follow-up to #246.
v1.56.3Compare Source
extractnow resolves constant identifiers passed as the namespace orkeyPrefix argument to
i18next.getFixedT(...). Previously, only stringliterals were recognised, so
const NS = "my-ns"; const t = i18next.getFixedT("en", NS, "prefix")silently fell back to the default namespace, while the equivalent
useTranslation(NS)form worked correctly. ThegetFixedThandlersnow reuse the same resolution logic as
useTranslation(local/sharedstring constants via
Identifier, constant-object property access viaMemberExpression, interpolation-freeTemplateLiteral, and TSwrappers like
as const/satisfies), so both forms behaveconsistently. Fixes #245.
extractnow warns when a<Trans>component contains a bareidentifier JSX child such as
<Trans>Hello <b>{cat}</b></Trans>.react-i18next inlines the value at runtime (producing a key like
"Hello <1>meow</1>"), but the extractor serialises the identifiername as
"Hello <1>{{cat}}</1>"— the two never match, and even withan explicit
i18nKeythe placeholder cannot be interpolated without avalues={{ cat }}prop, so it renders literally. The warning pointsusers at the correct
{{cat}}double-brace form with avaluesprop.Extraction output is unchanged so existing projects that paired the
{{cat}}output with a matchingvaluesprop keep working.Addresses #246.
v1.56.2Compare Source
lintnow detects hardcoded strings wrapped in JSX expressioncontainers. Previously, string literals like
<div>{"Hello"}</div>orbraced attribute values like
<img alt={"Logo"} />were silentlyskipped because the walker only inspected
StringLiteralnodes whosedirect parent was a
JSXAttribute. The linter now also recognisesStringLiteralnodes whose parent is aJSXExpressionContainer,treating them as JSX child text or attribute values depending on the
grandparent, and applying the same
acceptedTags/acceptedAttributes/
ignoredTags/i18next-instrument-ignorerules as raw text.Fixes #244.
v1.56.1Compare Source
statusnow detects keys reachable only through$t(...)nestedreferences in the primary translation file. Previously, keys like
boys_one/boys_other— referenced only from"girlsAndBoys": "$t(boys, {\"count\": ...})"— were preserved byextractbut never included in thestatuscheck, so empty values insecondary locales were silently ignored. Status now scans primary
translation values for
$t(...)references and includes the referencedkeys (plus their per-locale plural and context variants) in the report,
so translation gaps surface correctly.
Follow-up to #241.
v1.56.0Compare Source
$t(...)nested referencesinside existing translation values. Previously, when
removeUnusedKeyswasenabled, keys like
boys_one/boys_otherreferenced only from"girlsAndBoys": "$t(boys, {\"count\": {{boys}} })"were deleted becausethe AST-based extractor never sees them. The extractor now also scans
existing translation values, treats referenced keys (and their
plural / context variants) as used, and — for secondary locales — expands
them into the correct per-locale CLDR plural skeleton on first extract.
Fixes #241.
when
preserveContextVariantsis enabled. Previously, dynamic contextusage like
t('exportType', { context: type })preserved the variants(
exportType_gas,exportType_water) only in the primary language file;secondary languages never received them. They are now copied to every
locale with empty placeholders so translators and
syncsee the same keyskeleton everywhere. Existing secondary values are left untouched.
Fixes #242.
statusnow detects context variants when source code uses a dynamiccontext value. Previously,
t('key', { context: type })registered onlythe base key and tagged it as accepting context, so status had no way to
count the actual variants (
key_a,key_b) — empty values in secondarylocales were silently ignored. Status now scans the primary translation
file for context variants of each accepting-context base key and includes
them in the per-locale translation report.
Fixes #243.
v1.55.0Compare Source
annotation is present, so
t(fn())andt(`...${x}...`)withconst x = fn()expand to all statically-resolvable return values. Worksacross files via a shared cross-file table populated during the pre-scan
pass (alongside enums), so imported functions resolve just like in-file
ones. Explicit annotations remain authoritative:
: stringstill returnsno keys rather than falling back to body inference.
extract --cifails because files would be updated. Makes CI failures actionable without
needing to reproduce locally.
Thanks to @LudvigHz for both changes
(#240).
v1.54.2Compare Source
defaultNsandkeyPrefixfrom a custom translation hook toinner
t()calls accessed via a member expression (e.g.const obj = useMyHook('auth'); obj.t('key')). Previously the scope wasstored on the outer variable but the call-site lookup used the full
obj.tname and missed it, causing keys to fall back to the defaultnamespace. The lookup now also tries the object part(s) of the member
expression.
Fixes #239.
v1.54.1Compare Source
--sync-allunexpectedly clearing secondary locale translations forkeys with explicit defaults (e.g.
t('my-key', 'my message')) when thecode-provided default still matches the primary locale value. Secondary
translations are now only reset when the primary value has actually
diverged from the code default, matching the behavior already in place
for trusted derived defaults.
Fixes #235.
v1.54.0Compare Source
Resourcesinterface as a single combinedexport default interface Resources { ... }declaration, and import it inthe generated i18next module augmentation file using
import type. Thismakes the generated type files compatible with TypeScript's
verbatimModuleSyntaxcompiler option. The interface's type identity isunchanged, so consumers importing
Resourcesfrom the resources filecontinue to work without modification.
Fixes #238.
i18next-resources-for-tsto2.1.0for the new interface outputformat.
markedjs/marked (marked)
v18.0.2Compare Source
Bug Fixes
pnpm/pnpm (pnpm)
v10.33.1: pnpm 10.33.1Compare Source
Patch Changes
packageManagerfield selects pnpm v11 or newer, commands that v10 would have passed through to npm (version,login,logout,publish,unpublish,deprecate,dist-tag,docs,ping,search,star,stars,unstar,whoami, etc.) are now handed over to the wanted pnpm, which implements them natively. Previously they silently shelled out to npm — making, for example,pnpm version --helpprint npm's help on a project withpackageManager: pnpm@11.0.0-rc.3#11328.Platinum Sponsors
Gold Sponsors
vitejs/vite (vite)
v8.0.9Compare Source
Features
Bug Fixes
watchChangehook (#22188) (fc08bda)?rawimports (#22148) (3ec9cda)Documentation
Miscellaneous Chores
vitest-dev/vitest (vitest)
v4.1.5Compare Source
🚀 Experimental Features
instrumenteroption - by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)🐞 Bug Fixes
vi.defineHelpercalled as object method - by @hi-ogawa in #10163 (122c2)agentreporter tominimal- by @sheremet-va in #10157 (663b9)View changes on GitHub
Configuration
📅 Schedule: (in timezone Europe/Zurich)
* * * * 0,6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.