Skip to content

Bump the npm-minor-and-patch group across 1 directory with 7 updates - #113

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-3beb67f7e9
Open

Bump the npm-minor-and-patch group across 1 directory with 7 updates#113
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-3beb67f7e9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 7 updates in the / directory:

Package From To
@shopify/flash-list 2.0.2 2.3.3
@tanstack/react-query 5.104.1 5.104.3
i18next 26.4.2 26.4.5
react-i18next 17.0.15 17.0.17
react-native-web 0.21.3 0.21.4
@testing-library/react-native 14.0.1 14.1.0
prettier 3.9.9 3.9.10

Updates @shopify/flash-list from 2.0.2 to 2.3.3

Release notes

Sourced from @​shopify/flash-list's releases.

v2.3.3

What's Changed

  • Fix blank rows during fast scrolling when drawDistance is small (#2510).

Full Changelog: Shopify/flash-list@v2.3.2...v2.3.3

v2.3.2

What's Changed

New Contributors

Full Changelog: Shopify/flash-list@v2.3.1...v2.3.2

v2.3.1

What's Changed

New Contributors

Full Changelog: Shopify/flash-list@v2.3.0...v2.3.1

v2.3.0

What's Changed

Full Changelog: Shopify/flash-list@v2.2.3...v2.3.0

v2.2.3

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​shopify/flash-list since your current version.


Updates @tanstack/react-query from 5.104.1 to 5.104.3

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.104.3
    • @​tanstack/query-devtools@​5.104.3

@​tanstack/react-query-next-experimental@​5.104.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.104.3

@​tanstack/react-query-persist-client@​5.104.3

Patch Changes

  • Updated dependencies [ed4d849]:
    • @​tanstack/query-persist-client-core@​5.104.3
    • @​tanstack/react-query@​5.104.3

@​tanstack/react-query@​5.104.3

Patch Changes

  • Updated dependencies [0f15bc9]:
    • @​tanstack/query-core@​5.104.3

@​tanstack/react-query-devtools@​5.104.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.104.2
    • @​tanstack/react-query@​5.104.2

@​tanstack/react-query-next-experimental@​5.104.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.104.2

@​tanstack/react-query-persist-client@​5.104.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.104.2
    • @​tanstack/react-query@​5.104.2

@​tanstack/react-query@​5.104.2

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.3

Patch Changes

  • Updated dependencies [0f15bc9]:
    • @​tanstack/query-core@​5.104.3

5.104.2

Patch Changes

  • Updated dependencies [03e8c39]:
    • @​tanstack/query-core@​5.104.2
Commits
  • ee47993 ci: Version Packages (#11998)
  • 0f15bc9 fix(query-core): preserve union narrowing in setQueryData updaters (#11935)
  • b699b52 ci: Version Packages (#11849)
  • e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
  • df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
  • 833062c chore: replace prettier with oxfmt (#11939)
  • d0cfa6a chore: replace eslint with oxlint (#11938)
  • 0012ec1 docs(react-query): add JSDoc to the properties of the exported interfaces and...
  • b5e8e7b docs(react-query): add JSDoc to the exported classes, methods, and arrow func...
  • 01abab3 docs(*): note that 'throwOnError' makes the hook rethrow the errors of 'mutat...
  • Additional commits viewable in compare view

Updates i18next from 26.4.2 to 26.4.5

Release notes

Sourced from i18next's releases.

v26.4.5

  • fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

v26.4.4

  • fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
  • fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

  • perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).
Changelog

Sourced from i18next's changelog.

26.4.5

  • fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

26.4.4

  • fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. See advisory GHSA-5jr9-983r-c8x4, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
  • fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

26.4.3

  • perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).
Commits

Updates react-i18next from 17.0.15 to 17.0.17

Changelog

Sourced from react-i18next's changelog.

17.0.17

  • perf: useTranslation no longer unsubscribes and resubscribes its i18n listeners on every render. The subscribe callback handed to useSyncExternalStore depended on the merged options object, which is rebuilt whenever props is a new object: with no options (the {} default), with options passed inline (useTranslation('ns', { keyPrefix })), and through withTranslation and <Translation>. A new subscribe makes React resubscribe, so each render of each caller ran i18n.off and i18n.on in an extra effect. It now depends only on the instance and the bindI18n/bindI18nStore event names. No updates were ever missed, because React re-checks the snapshot after resubscribing; this only removes the churn, which adds up with many mounted components that re-render often. Reported via next-i18next#2349.

17.0.16

  • fix(Trans): a selector i18nKey that points into a secondary namespace of useTranslation now resolves the same way t() does. With const { t } = useTranslation(['ns1', 'ns2']), t($ => $.ns2.message) works since 17.0.7, but <Trans t={t} i18nKey={$ => $.ns2.message} /> rendered the raw key (or its children). Trans always passed an ns option to t, filled from t.ns (the primary namespace only), and an explicit ns makes i18next's fixed t skip the hook's full namespace list (scopeNs). When Trans or TransWithoutContext gets a t that carries its own namespace and no ns prop, it now leaves ns out and lets that t apply its own. String keys, keyPrefix, nsMode: 'fallback', an explicit ns prop and Trans without a t prop behave as before. Compatibility note: if the primary namespace has a nested object named like a secondary namespace (ns1 → ns2.message), Trans now resolves $ => $.ns2.message to ns2:message, as t() already does. Fixes #1933.
Commits
  • 511e1f2 17.0.17
  • 699eae3 build
  • 5a88fe6 perf(useTranslation): stop resubscribing the i18n listeners on every render
  • c4ee2c9 build
  • 606b6a5 17.0.16
  • 51b7c26 fix(Trans): resolve selector keys into useTranslation's secondary namespaces
  • 0a2f018 fix(examples): load the Swedish file in test-jest and align the ru plural tag...
  • See full diff in compare view

Updates react-native-web from 0.21.3 to 0.21.4

Release notes

Sourced from react-native-web's releases.

0.21.4

Changes

  • Add AssetRegistry export (#2885) and react-native-web/asset-registry entry point (#2886)
  • Share AssetRegistry between CJS and ESM builds (#2887)
  • Remove deprecation warnings for APIs that React Native does not deprecate (#2892)

New contributors

Full Changelog: necolas/react-native-web@0.21.3...0.21.4

Commits
  • e5f5751 0.21.4
  • a945443 Remove deprecation warnings for APIs that React Native does not deprecate (#2...
  • 3f58e6e Add AssetRegistry to babel plugin module map
  • 869a58d Add a $FlowFixMe comment
  • 5c47d7b Remove unnecessary "es6": true from eslint config
  • 1befb81 Look up AssetRegistry global object with fallbacks
  • f7924e7 Share AssetRegistry between CJS and ESM builds (#2887)
  • 20fa939 Add react-native-web/asset-registry entry point (#2886)
  • 8013b29 Upgrade Jest to v30 (#2884)
  • e9c427b Add AssetRegistry export (#2885)
  • Additional commits viewable in compare view

Updates @testing-library/react-native from 14.0.1 to 14.1.0

Release notes

Sourced from @​testing-library/react-native's releases.

v14.1.0

14.1.0 (2026-10-08)

✨ Features

🐛 Bug Fixes

📚 Documentation

Changelog

Sourced from @​testing-library/react-native's changelog.

14.1.0

Features

  • Added fireEvent.layout() to simulate the layout engine measuring an element, invoking the onLayout handler with a synthetic layout event. Unlike fireEvent(element, 'layout'), it does not bubble to parent elements.
  • fireEvent.scroll() and userEvent.scrollTo() use the size from the last layout event on the same ScrollView as the default layoutMeasurement.
  • Added userEvent.accessibilityAction() to dispatch a named accessibility action to an element, invoking its onAccessibilityAction handler.
  • Added userEvent.pullToRefresh() to simulate the pull-to-refresh gesture on a host ScrollView element, invoking the onRefresh handler of its refreshControl prop.
  • Added the eventDiagnostics configuration option. When enabled, fireEvent and userEvent log a warning when no handler is called, e.g. because the target is disabled, blocked by pointerEvents, or has no handler for the event. Off by default. See the configuration docs.
  • Added support for React 19.3 (with test-renderer@1.3) and React Native 0.88.

Bug fixes

  • userEvent.scrollTo() emits a scroll event for the last step of a drag scroll, matching native behavior, and no longer emits scroll events when the scroll offset does not change.
  • Fixed the setImmediate fallback in environments without it (e.g. jsdom) picking up Jest fake timers, which could make async utilities hang.

Deprecations

  • fireEvent warns when a direct event bubbles from a nested element to the host element that emits it, e.g. scroll from ScrollView content to the ScrollView. These events will stop bubbling in the next major version. See the fireEvent docs for the list of direct events.
Commits

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

  • Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits
  • 1172b82 Release 3.9.10
  • d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
  • 953b908 Bump Prettier dependency to 3.9.9
  • ad8a6bf Clean changelog_unreleased
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 18, 2026
@KodeStar

KodeStar commented Oct 18, 2026

Copy link
Copy Markdown
Owner

@dependabot recreate

The steward (audiosilo-meta-sync) asks Dependabot to recreate it: red CI on 91ef772 after its re-run: check (failure), suite github-actions 106079879049 (failure)

Posted by the steward (audiosilo-meta-sync).

@dependabot
Bump the npm-minor-and-patch group across 1 directory with 7 updates
19eef95 
Bumps the npm-minor-and-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@shopify/flash-list](https://github.com/Shopify/flash-list) | `2.0.2` | `2.3.3` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.104.1` | `5.104.3` |
| [i18next](https://github.com/i18next/i18next) | `26.4.2` | `26.4.5` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.15` | `17.0.17` |
| [react-native-web](https://github.com/necolas/react-native-web) | `0.21.3` | `0.21.4` |
| [@testing-library/react-native](https://github.com/callstack/react-native-testing-library) | `14.0.1` | `14.1.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` |



Updates `@shopify/flash-list` from 2.0.2 to 2.3.3
- [Release notes](https://github.com/Shopify/flash-list/releases)
- [Changelog](https://github.com/Shopify/flash-list/blob/main/CHANGELOG.md)
- [Commits](Shopify/flash-list@v2.0.2...v2.3.3)

Updates `@tanstack/react-query` from 5.104.1 to 5.104.3
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.3/packages/react-query)

Updates `i18next` from 26.4.2 to 26.4.5
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.4.2...v26.4.5)

Updates `react-i18next` from 17.0.15 to 17.0.17
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.15...v17.0.17)

Updates `react-native-web` from 0.21.3 to 0.21.4
- [Release notes](https://github.com/necolas/react-native-web/releases)
- [Commits](necolas/react-native-web@0.21.3...0.21.4)

Updates `@testing-library/react-native` from 14.0.1 to 14.1.0
- [Release notes](https://github.com/callstack/react-native-testing-library/releases)
- [Changelog](https://github.com/callstack/react-native-testing-library/blob/main/CHANGELOG.md)
- [Commits](callstack/react-native-testing-library@v14.0.1...v14.1.0)

Updates `prettier` from 3.9.9 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.9...3.9.10)

---
updated-dependencies:
- dependency-name: "@shopify/flash-list"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.104.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@testing-library/react-native"
  dependency-version: 14.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: i18next
  dependency-version: 26.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react-i18next
  dependency-version: 17.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react-native-web
  dependency-version: 0.21.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-and-patch-3beb67f7e9 branch from 91ef772 to 19eef95 Compare October 18, 2026 16:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@KodeStar