Bump react-virtuoso from 4.5.0 to 4.18.12

[dependabot]

Bumps react-virtuoso from 4.5.0 to 4.18.12.

Release notes

Sourced from react-virtuoso's releases.

react-virtuoso@4.18.12

Patch Changes

• #1487 d975e6c Thanks @​petyosi! - Measure window-scrolling lists before they enter the viewport so their estimated height is included in the document layout.

react-virtuoso@4.18.10

Patch Changes

• fca20fa Thanks @​petyosi! - Fix explicit undefined initial top-most item index values crashing when empty data updates to an object-form initial index.

react-virtuoso@4.18.9

Patch Changes

• #1444 0c68e81 Thanks @​Luccas-carvalho! - Harden scroll-target and initial-index handling:
  • Clamp the initial top-most item index to the available range, so an out-of-range initialTopMostItemIndex (for example after the data set shrinks) no longer starts the list at a blank or mid-list position.
  • Stop mutating the location object passed to scrollToIndex; normalizeIndexLocation now applies its defaults to a shallow copy.
  • Treat a default-positioned initialTopMostItemIndex of { index: 0 } the same as 0, avoiding a redundant initial scroll and a delayed followOutput.

react-virtuoso@4.18.8

Patch Changes

• #1442 6b1467c Thanks @​Luccas-carvalho! - Clamp out-of-range scroll target indexes to the last available item.

react-virtuoso@4.18.7

Patch Changes

• #1399 1fca093 Thanks @​petyosi! - Fix horizontal Virtuoso item positioning and scrolling in RTL layouts.

react-virtuoso@4.18.6

Patch Changes

• #1393 fa9dd31 Thanks @​petyosi! - Fix useWindowScroll SSR layout collapse by rendering the window viewport in normal flow while preserving sticky top items.

react-virtuoso@4.18.5

Patch Changes

• #1388 5871779 Thanks @​petyosi! - Fix useSyncExternalStore detection for React 19+

  The version check used startsWith('18') which excluded React 19, causing it to fall back to the legacy useState+useLayoutEffect subscription path. This could cause tearing issues in concurrent rendering scenarios. Changed to parseInt(React.version) >= 18 to correctly use useSyncExternalStore for React 18 and above.

react-virtuoso@4.18.4

Patch Changes

• #1375 620b260 Thanks @​marcospassos! - Fix atBottomStateChange in useWindowScroll lists when the Virtuoso instance is rendered below other page content.

react-virtuoso@4.18.3

Patch Changes

• 161db63 Thanks @​petyosi! - Use changeset publish for proper git tagging and GitHub release creation

... (truncated)

Changelog

Sourced from react-virtuoso's changelog.

4.18.12

Patch Changes

• #1487 d975e6c Thanks @​petyosi! - Measure window-scrolling lists before they enter the viewport so their estimated height is included in the document layout.

4.18.11

Patch Changes

• #1458 0d5214a Thanks @​wanxiankai! - Handle horizontal list direction changes between LTR and RTL without remounting the list.

4.18.10

Patch Changes

• fca20fa Thanks @​petyosi! - Fix explicit undefined initial top-most item index values crashing when empty data updates to an object-form initial index.

4.18.9

Patch Changes

• #1444 0c68e81 Thanks @​Luccas-carvalho! - Harden scroll-target and initial-index handling:
  • Clamp the initial top-most item index to the available range, so an out-of-range initialTopMostItemIndex (for example after the data set shrinks) no longer starts the list at a blank or mid-list position.
  • Stop mutating the location object passed to scrollToIndex; normalizeIndexLocation now applies its defaults to a shallow copy.
  • Treat a default-positioned initialTopMostItemIndex of { index: 0 } the same as 0, avoiding a redundant initial scroll and a delayed followOutput.

4.18.8

Patch Changes

• #1442 6b1467c Thanks @​Luccas-carvalho! - Clamp out-of-range scroll target indexes to the last available item.

4.18.7

Patch Changes

• #1399 1fca093 Thanks @​petyosi! - Fix horizontal Virtuoso item positioning and scrolling in RTL layouts.

4.18.6

Patch Changes

• #1393 fa9dd31 Thanks @​petyosi! - Fix useWindowScroll SSR layout collapse by rendering the window viewport in normal flow while preserving sticky top items.

4.18.5

Patch Changes

... (truncated)

Commits

• 5c55535 Version Packages (#1488)
• d975e6c Measure off-screen window lists before display (#1487)
• d646def Version Packages (#1459)
• 0d5214a fix: handle dynamic horizontal direction changes (#1458)
• b324bbc fix invalid React Virtuoso skill examples (#1455)
• 2c68507 Version Packages
• fca20fa fix: handle undefined initial topmost index
• 7cf51b6 Version Packages (#1449)
• 0c68e81 fix: harden scroll-target and initial-index handling (#1444)
• 0af9e75 Version Packages (#1443)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-virtuoso since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
Large jump in the virtualization dependency used by NFT and VC grid UIs; regressions would show up as scroll position, blank rows, or performance issues without compile-time failures.

Overview
Upgrades react-virtuoso in @chia-network/gui from 4.5.0 to 4.18.12, with matching package-lock.json updates (including React 19 in peer dependency ranges and removal of the library’s Node engines constraint).

There are no application source changes; virtualized grids in the NFT gallery and VC list still use VirtuosoGrid as before. The newer release line mainly brings scroll/index clamping fixes, window-scroll layout improvements, and React 18+ useSyncExternalStore behavior.

The lockfile also pins validator and @types/validator to exact versions (dropping ^) in several workspace entries—incidental to the lock refresh, not a deliberate product change.

^{Reviewed by Cursor Bugbot for commit 1a027ac. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream react-virtuoso bump against the malware checklist, starting with the scanner report, package scripts, and the actual changed files.I'll check tags, lifecycle scripts, and the changed source for obfuscation, unexpected network I/O, and eval-style payloads.Verdict: benign

The scanner warn findings are false positives for compromise, not payload evidence. ghost_version_or_missing_tag on 4.18.12 is explained by this repo’s changeset tags (react-virtuoso@4.18.12) rather than a v4.18.12 git tag; the version is published on npm (react-virtuoso-4.18.12.tgz with a normal sha512 integrity), matches package.json / CHANGELOG, and has GitHub release notes. version_jump_anomaly (4.5.0 → 4.18.12) is a same-major catch-up across many 4.x patches, not a skipped-identity release.

Checklist: No obfuscation, eval/Function payloads, unexpected hosts, persistence, process spawn, or hidden Unicode (scanner unicode/confusable/IOC: empty). No preinstall/postinstall/install scripts; no runtime dependencies (React peers only). Changed files are list/scroll/RTL/window-scroll source, tests, docs, and skills copies—no workflows, lockfile hash weirdness, or new transitives. “GitHub Actions” as npm publisher matches the documented changeset provenance publish (4.18.3), not a hijack.

Compatibility Analysis

I'll inspect local usage of react-virtuoso and compare it against the 4.5.0 → 4.18.12 upstream changes.Next I’ll read the two VirtuosoGrid call sites and the upstream changelog/API diffs from 4.5.0 through 4.18.12.Recommendation: merge-with-caveats

Same-major jump (4.5.0 → 4.18.12). Changelog has no breaking changes. This repo only uses VirtuosoGrid with a small, stable prop surface. Smoke-test the two gallery screens because of the version span and the custom OverlayScrollbars scroller.

Where it is used

Declared in packages/gui/package.json (react-virtuoso 4.18.12 on this PR). Runtime usage is only:

Site	Component	Props
packages/gui/src/components/nfts/gallery/NFTGallery.tsx	VirtuosoGrid	data, overscan={2000}, computeItemKey, components, itemContent, scrollerRef, isScrolling
packages/gui/src/components/vcs/VCList.tsx	VirtuosoGrid	data, components, itemContent, scrollerRef

Both wrap a contained scroller (height: 100% in an absolutely positioned box) and inject:

• Item / List custom wrappers
• Scroller: ScrollbarVirtuoso (packages/core/src/components/Scrollbar/ScrollbarVirtuoso.tsx), which remaps OverlayScrollbars’ viewport onto Virtuoso’s ref

App React is 18.3.1, which matches the package peer range.

Not used: Virtuoso, GroupedVirtuoso, TableVirtuoso, useWindowScroll, initialTopMostItemIndex, scrollToIndex / followOutput, atBottomStateChange, horizontal/RTL, LogLevel.

Intersection with changed APIs

Highlighted 4.18.x notes (window-scroll measurement, SSR collapse, atBottomStateChange, RTL, initialTopMostItemIndex / scrollToIndex clamping, React 19 useSyncExternalStore detection) do not match these call sites.

Minor additions in the range (minOverscanItemCount, heightEstimates, grouping, scrollIntoViewOnChange) are opt-in and unused here.

Indirect overlap:

• Upstream still touches grid internals (gridSystem.ts, VirtuosoGrid.ts, initial-index / scroll-target systems). Clamping and measurement fixes can change scroll/layout even without those props.
• Custom components typing now always includes context. Runtime extra props go through ...rest on ScrollbarVirtuoso and NFT ItemContainer. VCList ItemContainer still does not forward style / data-index / ref — pre-existing, not introduced by this bump.
• 4.18.2 LogLevel enum → const object is irrelevant (unused).

Risks / unknowns

1. Custom OverlayScrollbars scroller is the main integration risk. Window-scroll / scroller-system patches should not apply, but any change in how Scroller refs or viewport measurement work could break NFT/VC scrolling or scrollerRef restore.
2. NFT gallery scroll restore (isScrolling → persist scrollTop, restore on mount). Confirm it still saves/restores after a long jump.
3. Large catch-up (many 4.x patches). Internal layout/overscan behavior can shift without an API break.
4. Build: webpack 5 + exports (types / import / require) is the expected consumer path. Unlikely to fail; CI build:react is the check.
5. Types: ScrollbarVirtuoso only types children; extra Virtuoso scroller props are untyped. Unlikely to fail compile unless COMPONENTS is later typed as GridComponents.

Merge checklist

• NFT gallery: load a large set, scroll, leave/re-enter, confirm position restore and card layout at xs/sm/lg/xl widths.
• Verifiable credentials list: same scroll/layout pass.
• Confirm OverlayScrollbars still drives the Virtuoso viewport (no empty grid / stuck scroll).
• CI webpack/typecheck for @chia-network/gui.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 39
• Resolution strategy: commit_list
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=9d2f347695a8338d459b7d4bc54db1f59bc8fc71 to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• react-virtuoso:0 ghost_version_or_missing_tag :: 4.18.12
• react-virtuoso:0 version_jump_anomaly :: 4.5.0->4.18.12

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react-virtuoso@​4.5.0 ⏵ 4.18.12	+1		+1	+1

View full report