[dependabot]

Bumps the minor-and-patch group with 8 updates:

Package	From	To
@tanstack/react-query	5.104.1	5.104.2
i18next	26.4.2	26.4.4
@testing-library/user-event	14.6.7	14.6.8
prettier	3.9.9	3.9.10
typescript-eslint	8.71.1	8.71.2
vite	8.3.3	8.3.4
vitest	5.0.3	5.0.4
zod	4.6.5	4.6.7

Updates @tanstack/react-query from 5.104.1 to 5.104.2

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.2

Patch Changes

• Updated dependencies [03e8c39]:
  • @​tanstack/query-core@​5.104.2

Commits

• b699b52 ci: Version Packages (#11849)
• e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
• df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
• 833062c chore: replace prettier with oxfmt (#11939)
• d0cfa6a chore: replace eslint with oxlint (#11938)
• 0012ec1 docs(react-query): add JSDoc to the properties of the exported interfaces and...
• b5e8e7b docs(react-query): add JSDoc to the exported classes, methods, and arrow func...
• 01abab3 docs(*): note that 'throwOnError' makes the hook rethrow the errors of 'mutat...
• b42166e docs(react-query): add JSDoc to the exported interfaces and type aliases (#11...
• 205d422 docs(*): add missing JSDoc descriptions and enforce 'jsdoc/require-descriptio...
• Additional commits viewable in compare view

Updates i18next from 26.4.2 to 26.4.4

Release notes

Sourced from i18next's releases.

v26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
• fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

• perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

Changelog

Sourced from i18next's changelog.

26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. See advisory GHSA-5jr9-983r-c8x4, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
• fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

26.4.3

• perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

Commits

• f6a7746 26.4.4
• 25988d5 build
• c9f8eba fix(security): nesting regexp ReDoS on unclosed $t( and single-pass nest(), c...
• 0d2845a 26.4.3
• a2dbe15 build
• e75843f perf: cache non-empty bundles in hasLanguageSomeTranslations, changelog v26.4.3
• edaea71 Fix TypeScript examples build and update them to i18next v26 (#2448)
• 4ebd19d docs: "For AI assistants" paragraph in the README and a fuller saveMissing JSDoc
• See full diff in compare view

Updates @testing-library/user-event from 14.6.7 to 14.6.8

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.8

14.6.8 (2026-10-13)

Bug Fixes

• treat programmatic null input values as empty string (#1329) (1951eb7)

Commits

• 1951eb7 fix: treat programmatic null input values as empty string (#1329)
• See full diff in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• See full diff in compare view

Updates typescript-eslint from 8.71.1 to 8.71.2

Release notes

Sourced from typescript-eslint's releases.

v8.71.2

8.71.2 (2026-10-12)

🩹 Fixes

• eslint-plugin: [no-unused-vars] avoid false-positives when not using our parser (#12989)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type templates (#12974)
• eslint-plugin: [no-unused-vars] ignore type-only refs for after-used (#12977)
• eslint-plugin: [no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements (#12995)
• eslint-plugin: [prefer-optional-chain] safe fix when the chain ends with a strict null comparison (#12805)
• type-utils: match linked packages and packages with missing version in TypeOrValueSpecifier (#12948)

❤️ Thank You

• Abraham Guo
• Brad Zacher @​bradzacher
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Vinccool96
• Younsang Na @​nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.71.2 (2026-10-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 7488d68 chore(release): publish 8.71.2
• See full diff in compare view

Updates vite from 8.3.3 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

Commits

• b6c20f6 release: v8.3.4 (#23702)
• b28db28 fix(server): match static aliases on path boundaries (#23643)
• bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
• fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
• 2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
• 3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
• facc2fb fix: remove input option unescaping for now (#23694)
• 70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
• cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
• fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
• Additional commits viewable in compare view

Updates vitest from 5.0.3 to 5.0.4

Release notes

Sourced from vitest's releases.

v5.0.4

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in vitest-dev/vitest#11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in vitest-dev/vitest#11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in vitest-dev/vitest#11424 (a2336)
  • Add an option to cache dependencies instead of statically parsing them  -  by @​sheremet-va in vitest-dev/vitest#11515 (c0601)
  • Add fit and zoom controls to trace viewer  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

• Fail the run on git and location filter errors  -  by @​sheremet-va in vitest-dev/vitest#11430 (30d03)
• Enable fsModuleCache by default  -  by @​sheremet-va in vitest-dev/vitest#11435 (ad208)
• Track project files and mocks with --changed  -  by @​sheremet-va in vitest-dev/vitest#11432 (b0f2b)
• Refactor caching, fix : in project and change the shape of results cache  -  by @​sheremet-va in vitest-dev/vitest#11453 (9673c)
• Keep full $ string values when taskTitleValueFormatTruncate is 0  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)
• Resolve node builtins in client environments  -  by @​sheremet-va in vitest-dev/vitest#11417 (56b31)
• Fix module graph builtin externals after #11421  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)
• Wrap module mocks during in-source testing  -  by @​sheremet-va in vitest-dev/vitest#11505 (36d19)
• Handle line endings in snapshot  -  by @​sheremet-va in vitest-dev/vitest#11522 (4c468)
• Respect root in projects  -  by @​sheremet-va in vitest-dev/vitest#11521 (26642)
• Resolve mocks in directories with spaces  -  by @​sheremet-va in vitest-dev/vitest#11539 (caaef)
• api:
  • Publish the api token atomically  -  by @​umairnawaz333 in vitest-dev/vitest#11323 (6f990)
• browser:
  • Close the mock route interception race  -  by @​cplieger and @​sheremet-va in vitest-dev/vitest#8339 and vitest-dev/vitest#11083 (d6620)
  • Allow toHaveTextContent without arguments  -  by @​nomadical in vitest-dev/vitest#11425 (8ebcf)
  • Apply API options without browser config  -  by @​sheremet-va in vitest-dev/vitest#10852 (ad055)
  • Preserve undefined command arguments  -  by @​sheremet-va and @​AriPerkkio in vitest-dev/vitest#11497 (1576d)
  • Wait for setup mocks before importing a test file  -  by @​kasperpeulen in vitest-dev/vitest#11520 (b61d1)
  • Avoid extra scroll outside the iframe  -  by @​sheremet-va in vitest-dev/vitest#11523 (662e8)
  • Run browser instances as workers  -  by @​sheremet-va in vitest-dev/vitest#11525 (bf04b)
    • ⚠️ This can degrade performance if you have a custom maxWorkers setting. Previously, it was applied incorrectly and could lead to Vitest using too many resources. For example, a lower number would still open too many browsers. Fixing it means Vitest opens less instances by default now.
  • Open one cdp session per tester  -  by @​sheremet-va in vitest-dev/vitest#11542 (69e63)
  • Clean up unmocked and pending mocks  -  by @​sheremet-va in vitest-dev/vitest#11537 (5c955)
• coverage:
  • V8 browser memory leak between test files  -  by @​AriPerkkio in vitest-dev/vitest#11466 (2297d)
  • allowExternal fails to include uncovered files  -  by @​AriPerkkio in vitest-dev/vitest#11513 (4ef00)
  • Filenames containing brackets incorrectly showing as uncovered  -  by @​AriPerkkio in vitest-dev/vitest#11531 (0fa80)
  • Istanbul coverage wrong when module transform warmups  -  by @​AriPerkkio in vitest-dev/vitest#11529 (9f61d)
• deps:
  • Update all non-major dependencies  -  by @​sheremet-va in vitest-dev/vitest#11167 (c74e0)
• expect:
  • Fix Map and Set deep equality in some assertions  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11402 (b4e79)
  • Check value in chai-style returned  -  by @​sheremet-va in vitest-dev/vitest#11500 (1aca0)
• mocker:
  • Fix native loader mocking edge cases  -  by @​sheremet-va in vitest-dev/vitest#11540 (cd423)
• pretty-format:

... (truncated)

Commits

• 6a11cf6 chore: release v5.0.4 (#11554)
• 58c86ed chore(deps): update all non-major dependencies (#11550)
• 0fa80f5 fix(coverage): filenames containing brackets incorrectly showing as uncovered...
• bf04b9c fix(browser): run browser instances as workers (#11525)
• 3e3624c refactor: resolve maxWorkers once in config (#11524)
• 26642f7 fix: respect root in projects (#11521)
• c06012a feat(experimental): add an option to cache dependencies instead of statically...
• 4ef000a fix(coverage): allowExternal fails to include uncovered files (#11513)
• 1da6640 feat: support test.ui.theme option (#11499)
• b618afd fix(vm): bind this to module.exports (#11504)
• Additional commits viewable in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

• b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

• b500a2e 4.6.7
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions