ashatora/editor
1
0
Fork 0
mirror of https://github.com/maputnik/editor.git synced 2026-11-06 18:23:45 +00:00
Code Issues Projects Releases Wiki Activity
2,981 Commits 5 Branches 33 Tags
main
Commit Graph
2981 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] 1adc23448b chore(deps): Bump the codeql-action group with 3 updates (#2301) 
Bumps the codeql-action group with 3 updates:
[github/codeql-action/init](https://github.com/github/codeql-action),
[github/codeql-action/autobuild](https://github.com/github/codeql-action)
and
[github/codeql-action/analyze](https://github.com/github/codeql-action).

Updates `github/codeql-action/init` from 4.39.1 to 4.39.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.39.2</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li>
<li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier
were discontinued on 16 October 2026 alongside GitHub Enterprise Server
3.18, and will be unsupported by the next minor release of the CodeQL
Action. Added a deprecation warning for customers using these versions
of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li>
<li>Starting with macOS 27 and Xcode 27, traced analyses are
unsupported. See <a
href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this
blog post for more information</a>. The CodeQL Action will now try to
identify if a workflow is about to perform a traced analysis on version
27 or above of macOS or Xcode. If so, the CodeQL Action will emit a
corresponding warning that will also be visible on the <a
href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool
Status Page</a>. This check will be rolled out following this release of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable has been removed, as announced in the release notes for CodeQL
Action 4.35.2. The <code>analyze</code> Action now warns if this
environment variable is set. If you used TRAP cache cleanup to limit
Actions cache usage, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.3 - 04 Nov 2026</h2>
<ul>
<li>Fixed diff-informed alert filtering incorrectly removing alerts in
changed files whose paths contain spaces, special characters, or
non-ASCII characters. <a
href="https://redirect.github.com/github/codeql-action/pull/4283">#4283</a></li>
</ul>
<h2>4.39.2 - 03 Nov 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li>
<li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier
were discontinued on 16 October 2026 alongside GitHub Enterprise Server
3.18, and will be unsupported by the next minor release of the CodeQL
Action. Added a deprecation warning for customers using these versions
of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li>
<li>Starting with macOS 27 and Xcode 27, traced analyses are
unsupported. See <a
href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this
blog post for more information</a>. The CodeQL Action will now try to
identify if a workflow is about to perform a traced analysis on version
27 or above of macOS or Xcode. If so, the CodeQL Action will emit a
corresponding warning that will also be visible on the <a
href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool
Status Page</a>. This check will be rolled out following this release of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable has been removed, as announced in the release notes for CodeQL
Action 4.35.2. The <code>analyze</code> Action now warns if this
environment variable is set. If you used TRAP cache cleanup to limit
Actions cache usage, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li>
</ul>
<h2>4.39.1 - 21 Oct 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/1fc58d04a4d4374f921bdac573c3811c240f9c26"><code>1fc58d0</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4286">#4286</a>
from github/update-v4.39.2-c05042115</li>
<li><a
href="https://github.com/github/codeql-action/commit/d9984814e484244a9abd81ad96a4646ca1c4122a"><code>d998481</code></a>
Update changelog for v4.39.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/c050421152f5bd3d7e4d8ece8dbd46d93ca0f926"><code>c050421</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4284">#4284</a>
from github/update-bundle/codeql-bundle-v2.27.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/750fe8feea49cd7d09db1a11def08c3bd812d810"><code>750fe8f</code></a>
Merge branch 'main' into update-bundle/codeql-bundle-v2.27.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/adfcd5ffb8f15a420edbc24cce8056e2626d76bd"><code>adfcd5f</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/2ef3b622017573270975effb6820567f855245aa"><code>2ef3b62</code></a>
Update default bundle to codeql-bundle-v2.27.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/b35c6c6aaefc0489db8249a1adea322ed8011094"><code>b35c6c6</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4251">#4251</a>
from github/mbg/refactor-util/errors</li>
<li><a
href="https://github.com/github/codeql-action/commit/ac9f25761184d85ea2864c1e40de96afc64337bb"><code>ac9f257</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/refactor-util/errors</li>
<li><a
href="https://github.com/github/codeql-action/commit/52cf1852265d99e9bea071b03366fc777a602909"><code>52cf185</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4278">#4278</a>
from github/mbg/macos27/xcode-detection</li>
<li><a
href="https://github.com/github/codeql-action/commit/95dd6bfbc42487e3e3695e9c9cb52f3a4b3fcd4f"><code>95dd6bf</code></a>
Fix new test not providing typical input</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/autobuild` from 4.39.1 to 4.39.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's
releases</a>.</em></p>
<blockquote>
<h2>v4.39.2</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li>
<li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier
were discontinued on 16 October 2026 alongside GitHub Enterprise Server
3.18, and will be unsupported by the next minor release of the CodeQL
Action. Added a deprecation warning for customers using these versions
of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li>
<li>Starting with macOS 27 and Xcode 27, traced analyses are
unsupported. See <a
href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this
blog post for more information</a>. The CodeQL Action will now try to
identify if a workflow is about to perform a traced analysis on version
27 or above of macOS or Xcode. If so, the CodeQL Action will emit a
corresponding warning that will also be visible on the <a
href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool
Status Page</a>. This check will be rolled out following this release of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable has been removed, as announced in the release notes for CodeQL
Action 4.35.2. The <code>analyze</code> Action now warns if this
environment variable is set. If you used TRAP cache cleanup to limit
Actions cache usage, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.3 - 04 Nov 2026</h2>
<ul>
<li>Fixed diff-informed alert filtering incorrectly removing alerts in
changed files whose paths contain spaces, special characters, or
non-ASCII characters. <a
href="https://redirect.github.com/github/codeql-action/pull/4283">#4283</a></li>
</ul>
<h2>4.39.2 - 03 Nov 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li>
<li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier
were discontinued on 16 October 2026 alongside GitHub Enterprise Server
3.18, and will be unsupported by the next minor release of the CodeQL
Action. Added a deprecation warning for customers using these versions
of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li>
<li>Starting with macOS 27 and Xcode 27, traced analyses are
unsupported. See <a
href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this
blog post for more information</a>. The CodeQL Action will now try to
identify if a workflow is about to perform a traced analysis on version
27 or above of macOS or Xcode. If so, the CodeQL Action will emit a
corresponding warning that will also be visible on the <a
href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool
Status Page</a>. This check will be rolled out following this release of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable has been removed, as announced in the release notes for CodeQL
Action 4.35.2. The <code>analyze</code> Action now warns if this
environment variable is set. If you used TRAP cache cleanup to limit
Actions cache usage, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li>
</ul>
<h2>4.39.1 - 21 Oct 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/1fc58d04a4d4374f921bdac573c3811c240f9c26"><code>1fc58d0</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4286">#4286</a>
from github/update-v4.39.2-c05042115</li>
<li><a
href="https://github.com/github/codeql-action/commit/d9984814e484244a9abd81ad96a4646ca1c4122a"><code>d998481</code></a>
Update changelog for v4.39.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/c050421152f5bd3d7e4d8ece8dbd46d93ca0f926"><code>c050421</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4284">#4284</a>
from github/update-bundle/codeql-bundle-v2.27.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/750fe8feea49cd7d09db1a11def08c3bd812d810"><code>750fe8f</code></a>
Merge branch 'main' into update-bundle/codeql-bundle-v2.27.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/adfcd5ffb8f15a420edbc24cce8056e2626d76bd"><code>adfcd5f</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/2ef3b622017573270975effb6820567f855245aa"><code>2ef3b62</code></a>
Update default bundle to codeql-bundle-v2.27.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/b35c6c6aaefc0489db8249a1adea322ed8011094"><code>b35c6c6</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4251">#4251</a>
from github/mbg/refactor-util/errors</li>
<li><a
href="https://github.com/github/codeql-action/commit/ac9f25761184d85ea2864c1e40de96afc64337bb"><code>ac9f257</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/refactor-util/errors</li>
<li><a
href="https://github.com/github/codeql-action/commit/52cf1852265d99e9bea071b03366fc777a602909"><code>52cf185</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4278">#4278</a>
from github/mbg/macos27/xcode-detection</li>
<li><a
href="https://github.com/github/codeql-action/commit/95dd6bfbc42487e3e3695e9c9cb52f3a4b3fcd4f"><code>95dd6bf</code></a>
Fix new test not providing typical input</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.39.1 to 4.39.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.39.2</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li>
<li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier
were discontinued on 16 October 2026 alongside GitHub Enterprise Server
3.18, and will be unsupported by the next minor release of the CodeQL
Action. Added a deprecation warning for customers using these versions
of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li>
<li>Starting with macOS 27 and Xcode 27, traced analyses are
unsupported. See <a
href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this
blog post for more information</a>. The CodeQL Action will now try to
identify if a workflow is about to perform a traced analysis on version
27 or above of macOS or Xcode. If so, the CodeQL Action will emit a
corresponding warning that will also be visible on the <a
href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool
Status Page</a>. This check will be rolled out following this release of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable has been removed, as announced in the release notes for CodeQL
Action 4.35.2. The <code>analyze</code> Action now warns if this
environment variable is set. If you used TRAP cache cleanup to limit
Actions cache usage, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.3 - 04 Nov 2026</h2>
<ul>
<li>Fixed diff-informed alert filtering incorrectly removing alerts in
changed files whose paths contain spaces, special characters, or
non-ASCII characters. <a
href="https://redirect.github.com/github/codeql-action/pull/4283">#4283</a></li>
</ul>
<h2>4.39.2 - 03 Nov 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4">2.27.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4284">#4284</a></li>
<li><em>Upcoming breaking change</em>: CodeQL version 2.22.3 and earlier
were discontinued on 16 October 2026 alongside GitHub Enterprise Server
3.18, and will be unsupported by the next minor release of the CodeQL
Action. Added a deprecation warning for customers using these versions
of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4266">#4266</a></li>
<li>Starting with macOS 27 and Xcode 27, traced analyses are
unsupported. See <a
href="https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/">this
blog post for more information</a>. The CodeQL Action will now try to
identify if a workflow is about to perform a traced analysis on version
27 or above of macOS or Xcode. If so, the CodeQL Action will emit a
corresponding warning that will also be visible on the <a
href="https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning">Tool
Status Page</a>. This check will be rolled out following this release of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/4221">#4221</a></li>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable has been removed, as announced in the release notes for CodeQL
Action 4.35.2. The <code>analyze</code> Action now warns if this
environment variable is set. If you used TRAP cache cleanup to limit
Actions cache usage, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/4243">#4243</a></li>
</ul>
<h2>4.39.1 - 21 Oct 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/1fc58d04a4d4374f921bdac573c3811c240f9c26"><code>1fc58d0</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4286">#4286</a>
from github/update-v4.39.2-c05042115</li>
<li><a
href="https://github.com/github/codeql-action/commit/d9984814e484244a9abd81ad96a4646ca1c4122a"><code>d998481</code></a>
Update changelog for v4.39.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/c050421152f5bd3d7e4d8ece8dbd46d93ca0f926"><code>c050421</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4284">#4284</a>
from github/update-bundle/codeql-bundle-v2.27.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/750fe8feea49cd7d09db1a11def08c3bd812d810"><code>750fe8f</code></a>
Merge branch 'main' into update-bundle/codeql-bundle-v2.27.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/adfcd5ffb8f15a420edbc24cce8056e2626d76bd"><code>adfcd5f</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/2ef3b622017573270975effb6820567f855245aa"><code>2ef3b62</code></a>
Update default bundle to codeql-bundle-v2.27.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/b35c6c6aaefc0489db8249a1adea322ed8011094"><code>b35c6c6</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4251">#4251</a>
from github/mbg/refactor-util/errors</li>
<li><a
href="https://github.com/github/codeql-action/commit/ac9f25761184d85ea2864c1e40de96afc64337bb"><code>ac9f257</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/refactor-util/errors</li>
<li><a
href="https://github.com/github/codeql-action/commit/52cf1852265d99e9bea071b03366fc777a602909"><code>52cf185</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4278">#4278</a>
from github/mbg/macos27/xcode-detection</li>
<li><a
href="https://github.com/github/codeql-action/commit/95dd6bfbc42487e3e3695e9c9cb52f3a4b3fcd4f"><code>95dd6bf</code></a>
Fix new test not providing typical input</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-06 14:03:14 +00:00
Harel M 997f3445b5 chore: update dependencies to latest version (#2299) 
See title.
Removed the deprecated RTL text plugin.

## Launch Checklist

<!-- Thanks for the PR! Feel free to add or remove items from the
checklist. -->


 - [x] Briefly describe the changes in this PR.
 - [ ] Link to related issues.
- [ ] Include before/after visuals or gifs if this PR includes visual
changes.
 - [ ] Write tests for all new functionality.
 - [x] Add an entry to `CHANGELOG.md` under the `## main` section.
 2026-11-03 15:46:16 +00:00
dependabot[bot] 7605a4cfaa chore(deps): Bump actions/setup-node from 7.0.0 to 7.1.0 (#2225) 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from
7.0.0 to 7.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-node/releases">actions/setup-node's
releases</a>.</em></p>
<blockquote>
<h2>v7.1.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements:</h3>
<ul>
<li>Add support for mise.toml file by <a
href="https://github.com/gperdomor"><code>@​gperdomor</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1421">actions/setup-node#1421</a></li>
<li>Support absolute paths in node-version-file by <a
href="https://github.com/v-mahabaleshwars"><code>@​v-mahabaleshwars</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1633">actions/setup-node#1633</a></li>
</ul>
<h3>Bug fixes:</h3>
<ul>
<li>Add Node version validation and manifest fetch retry by <a
href="https://github.com/v-jitenderpalsingh"><code>@​v-jitenderpalsingh</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1580">actions/setup-node#1580</a></li>
</ul>
<h3>Documentation updates:</h3>
<ul>
<li>README.md: bump actions/checkout to latest version 7 by <a
href="https://github.com/deining"><code>@​deining</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1578">actions/setup-node#1578</a></li>
<li>docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by <a
href="https://github.com/v-gowridurgad"><code>@​v-gowridurgad</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1593">actions/setup-node#1593</a></li>
<li>Fixed cache recommendation syntax by <a
href="https://github.com/SubJunk"><code>@​SubJunk</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1603">actions/setup-node#1603</a></li>
</ul>
<h3>Dependency updates:</h3>
<ul>
<li>Update workflow pins and migrate Node matrices to modern versions by
<a
href="https://github.com/v-HarithaVattikuti"><code>@​v-HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1583">actions/setup-node#1583</a></li>
<li>Upgrade <code>@​actions/cache</code> to 6.2.0 by <a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1584">actions/setup-node#1584</a></li>
<li>Pin <code>@​types/node</code> to v24 by <a
href="https://github.com/v-priyagupta108"><code>@​v-priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1585">actions/setup-node#1585</a></li>
<li>Override brace-expansion to 5.0.8 by <a
href="https://github.com/v-priyagupta108"><code>@​v-priyagupta108</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-node/pull/1599">actions/setup-node#1599</a></li>
<li>Upgrade actions/checkout from 7.0.0 to 7.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1598">actions/setup-node#1598</a></li>
<li>Upgrade prettier from 3.8.4 to 3.9.6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1590">actions/setup-node#1590</a></li>
<li>Upgrade <code>@​vercel/ncc</code> from 0.44.0 to 0.45.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1610">actions/setup-node#1610</a></li>
<li>Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1602">actions/setup-node#1602</a></li>
<li>Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1629">actions/setup-node#1629</a></li>
<li>Upgrade <code>@​types/semver</code> from 7.7.1 to 7.8.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1616">actions/setup-node#1616</a></li>
<li>Upgrade <code>@​typescript-eslint/parser</code> from 8.62.0 to
8.70.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1615">actions/setup-node#1615</a></li>
<li>Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1631">actions/setup-node#1631</a></li>
<li>Upgrade jest-each from 30.4.1 to 30.5.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1636">actions/setup-node#1636</a></li>
<li>Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1638">actions/setup-node#1638</a></li>
<li>Update dependencies and add license files by <a
href="https://github.com/v-HarithaVattikuti"><code>@​v-HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1642">actions/setup-node#1642</a></li>
<li>Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to
7.1.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1635">actions/setup-node#1635</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/v-jitenderpalsingh"><code>@​v-jitenderpalsingh</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1580">actions/setup-node#1580</a></li>
<li><a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1584">actions/setup-node#1584</a></li>
<li><a href="https://github.com/gperdomor"><code>@​gperdomor</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1421">actions/setup-node#1421</a></li>
<li><a href="https://github.com/SubJunk"><code>@​SubJunk</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1603">actions/setup-node#1603</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-node/compare/v7.0.0...v7.1.0">https://github.com/actions/setup-node/compare/v7.0.0...v7.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-node/commit/949feb2413d6458794dcd2491c4babbbce0c15c1"><code>949feb2</code></a>
Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0
(<a
href="https://redirect.github.com/actions/setup-node/issues/1635">#1635</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/7207c4f1189c7ee83ddf20c7c68bd1af6fdd751c"><code>7207c4f</code></a>
chore: update dependencies and add license files (<a
href="https://redirect.github.com/actions/setup-node/issues/1642">#1642</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/54337e0d02de9202d0948aaff36ad556375497b9"><code>54337e0</code></a>
Bump eslint-plugin-n from 18.1.0 to 18.3.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1638">#1638</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/fb54fa8c14c63410cc752f0ae3b7b3ca6af161fc"><code>fb54fa8</code></a>
Bump jest-each from 30.4.1 to 30.5.2 (<a
href="https://redirect.github.com/actions/setup-node/issues/1636">#1636</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/7f84f1d52d0c56afb45c62fee31a93b843cea4d6"><code>7f84f1d</code></a>
Bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1631">#1631</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/0c54c7b07420dcba69a7d832587f55ebdf771c9e"><code>0c54c7b</code></a>
Bump <code>@​typescript-eslint/parser</code> from 8.62.0 to 8.70.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1615">#1615</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/a8294190049a9c296f01b9a432aff41dd83d8284"><code>a829419</code></a>
Bump <code>@​types/semver</code> from 7.7.1 to 7.8.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1616">#1616</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/680d1e489b82f1243de15bc7665c0007e3c9a860"><code>680d1e4</code></a>
Support absolute paths in node-version-file (<a
href="https://redirect.github.com/actions/setup-node/issues/1633">#1633</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/db0fb3a98ed314b69026b6e8c9be26a7e2fe65a8"><code>db0fb3a</code></a>
Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (<a
href="https://redirect.github.com/actions/setup-node/issues/1629">#1629</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/94196ee1d15439c1b6651cd87ef14e88ec435966"><code>94196ee</code></a>
Bump pnpm/action-setup from 6.0.9 to 6.0.10 (<a
href="https://redirect.github.com/actions/setup-node/issues/1602">#1602</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-node&package-manager=github_actions&previous-version=7.0.0&new-version=7.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-03 17:23:09 +02:00
shkomg 2ff1a62d19 Show boolean properties that default to true as checked (#2298) 
Fixes #747

Boolean properties that default to `true` (`fill-antialias`,
`text-keep-upright`, `fill-extrusion-vertical-gradient`) showed an empty
checkbox when unset, so the first click wrote `true` and nothing changed
on the map. `InputCheckbox` now falls back to the spec default that
`InputSpec` already passes (as `InputEnum` does), and a click toggles
from what is shown. The Cluster checkbox in the sources modal passes no
default, so it behaves as before.

## Launch Checklist

 - [x] Briefly describe the changes in this PR.
 - [x] Link to related issues.
- [x] Include before/after visuals or gifs if this PR includes visual
changes.
 - [x] Write tests for all new functionality.
 - [x] Add an entry to `CHANGELOG.md` under the `## main` section.

Added two e2e tests on `fill-antialias` (checked when unset, one click
writes `false`).

## Screenshots

"Extrusion vertical gradient" on a `fill-extrusion` layer with the
property unset, before and after:

| Before | After |
| --- | --- |
|
![before](https://github.com/user-attachments/assets/a2f4f4d2-9b1e-4b1b-89db-2a6a1f0b922a)
|
![after](https://github.com/user-attachments/assets/64e79b7b-1a9c-40e6-8040-9ac082ef998c)
|
| ![before,
zoomed](https://github.com/user-attachments/assets/482cb984-4927-4e32-81cb-2fce75c3a25d)
| ![after,
zoomed](https://github.com/user-attachments/assets/5d135d3d-910a-49ff-9837-b931132e7a30)
|

## Video

The video shows the same row on a small extrusion style, and one click
turning the gradient off.


https://github.com/user-attachments/assets/8ebc2f5a-923b-4022-82da-07cbd1eda783

Fix written with Claude Code; video is an automated browser run of this
branch recorded by User Stories Bot.
 2026-11-03 17:22:41 +02:00
dependabot[bot] 9ccf742131 chore(deps-dev): Bump sass from 1.107.0 to 1.107.1 (#2296) 
Bumps [sass](https://github.com/sass/dart-sass) from 1.107.0 to 1.107.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sass/dart-sass/releases">sass's
releases</a>.</em></p>
<blockquote>
<h2>Dart Sass 1.107.1</h2>
<p>To install Sass 1.107.1, download one of the packages below and <a
href="https://katiek2.github.io/path-doc/">add it to your PATH</a>, or
see <a href="https://sass-lang.com/install">the Sass website</a> for
full installation instructions.</p>
<h1>Changes</h1>
<ul>
<li>Properly report the embedded protocol version as 3.4.0.</li>
</ul>
<p>See the <a
href="https://github.com/sass/dart-sass/blob/master/CHANGELOG.md#11071">full
changelog</a> for changes in earlier releases.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/sass/dart-sass/blob/main/CHANGELOG.md">sass's
changelog</a>.</em></p>
<blockquote>
<h2>1.107.1</h2>
<ul>
<li>Properly report the embedded protocol version as 3.4.0.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sass/dart-sass/commit/059beb7a8ecde742320bbff23304bcc3ce343e7b"><code>059beb7</code></a>
Release <a
href="https://redirect.github.com/sass/sass/issues/4266">sass/sass#4266</a>
(<a
href="https://redirect.github.com/sass/dart-sass/issues/2904">#2904</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/2726cf03ac01cfa926b3e509857882acba547c43"><code>2726cf0</code></a>
Expose <code>toCssIdentifier()</code> through <code>sass_api</code> (<a
href="https://redirect.github.com/sass/dart-sass/issues/2903">#2903</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/4e4a0426fbcf2f365236fe87ec943e8106ab9dc7"><code>4e4a042</code></a>
Merge pull request <a
href="https://redirect.github.com/sass/dart-sass/issues/2902">#2902</a>
from sass/zizmor</li>
<li><a
href="https://github.com/sass/dart-sass/commit/9156ddfb41e00fa00321a7aab0273491bc4ddeb8"><code>9156ddf</code></a>
Fix zizmor findings</li>
<li><a
href="https://github.com/sass/dart-sass/commit/5f2c1364df16cc424e9e638b7b8daa7dd4efd891"><code>5f2c136</code></a>
Use full version numbers for all GitHub actions</li>
<li><a
href="https://github.com/sass/dart-sass/commit/8de571bdfe3faae23110b9faf1b7f1809e80a196"><code>8de571b</code></a>
Fail CI if Zizmor has findings</li>
<li><a
href="https://github.com/sass/dart-sass/commit/1f895ca5bff617fd45ac77d7a66e9c43d7ece159"><code>1f895ca</code></a>
Add a message explaining why dependabot auto-merge may not happen (<a
href="https://redirect.github.com/sass/dart-sass/issues/2900">#2900</a>)</li>
<li>See full diff in <a
href="https://github.com/sass/dart-sass/compare/1.107.0...1.107.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sass&package-manager=npm_and_yarn&previous-version=1.107.0&new-version=1.107.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-03 13:56:37 +00:00
dependabot[bot] 5df6a82cae chore(deps-dev): Bump eslint from 10.13.0 to 10.14.0 (#2295) 
Bumps [eslint](https://github.com/eslint/eslint) from 10.13.0 to
10.14.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.14.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/d23a7f9eed78e2733fa2d17d7d7dbb9891bbb692"><code>d23a7f9</code></a>
feat: fix property descriptor handling in
<code>func-name-matching</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21400">#21400</a>)
(xbinaryx)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4a12580eefdb240bd9b6ae83428638120e9a5f66"><code>4a12580</code></a>
fix: require minimatch <code>10.2.6</code> to avoid vulnerable
brace-expansion (<a
href="https://redirect.github.com/eslint/eslint/issues/21460">#21460</a>)
(lumir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/827a8f3cca710d3efd76c1d7088d894deff08434"><code>827a8f3</code></a>
fix: <code>no-restricted-globals</code> crash on global objects as
property values (<a
href="https://redirect.github.com/eslint/eslint/issues/21449">#21449</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/161558ae1391a8649a8d69a8b2c2e555b40121b9"><code>161558a</code></a>
fix: handle LS, PS and empty hashbang comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21419">#21419</a>)
(lumir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6194939873960e605b9df3892aa1f5acd648df34"><code>6194939</code></a>
fix: <code>no-invalid-this</code> crash on <code>accessor</code> fields
without initializer (<a
href="https://redirect.github.com/eslint/eslint/issues/21442">#21442</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9155e14781bf0a5549f9a747691f7d98c8c66dcd"><code>9155e14</code></a>
fix: Update <code>@​humanfs/node</code> dependency version (<a
href="https://redirect.github.com/eslint/eslint/issues/21434">#21434</a>)
(Nicholas C. Zakas)</li>
<li><a
href="https://github.com/eslint/eslint/commit/cb2b9d47a1a14e287ffd473083e97370801ea21e"><code>cb2b9d4</code></a>
fix: avoid invalid object-shorthand fixes for super methods (<a
href="https://redirect.github.com/eslint/eslint/issues/21323">#21323</a>)
(dvd233)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5ee39156b5abb606170a289844cd25aebda6d302"><code>5ee3915</code></a>
fix: yoda invalid autofix at statement start (<a
href="https://redirect.github.com/eslint/eslint/issues/21424">#21424</a>)
(Daniel Pinto)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/0f94f47b3cf188534d6ac24c0ef4108dd004492b"><code>0f94f47</code></a>
docs: remove <code>zh-hans</code> from docs language switcher (<a
href="https://redirect.github.com/eslint/eslint/issues/21437">#21437</a>)
(lumir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/dab466e5cd43f4b9156a4d00b3423be2ed0088cc"><code>dab466e</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/97431f86d5dc7cd60ade6415393b906cf08fe46c"><code>97431f8</code></a>
docs: replace <code>--rulesdir</code> with a virtual plugin in custom
rules docs (<a
href="https://redirect.github.com/eslint/eslint/issues/21452">#21452</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/76975502cb1370f2ae4d9427fa1daf7effabe909"><code>7697550</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0c699d52d2c4596a56e8f8aa0c8f5732558cf552"><code>0c699d5</code></a>
docs: Remove Tidelift commercial support (<a
href="https://redirect.github.com/eslint/eslint/issues/21416">#21416</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/088066663aae84ad6edfa902a27a90c4c08785f3"><code>0880666</code></a>
docs: update loadESLint() documentation for v10 (<a
href="https://redirect.github.com/eslint/eslint/issues/21374">#21374</a>)
(Minseon Kim)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e06fe87c41cc6210269260a097c61cefb92f456a"><code>e06fe87</code></a>
docs: Revise AI acknowledgment options in PR template (<a
href="https://redirect.github.com/eslint/eslint/issues/21414">#21414</a>)
(Nicholas C. Zakas)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/0e2ab702714a66829fe2798c77190b48a3a88645"><code>0e2ab70</code></a>
ci: disable <code>eslint-plugin-unicorn</code> ecosystem test (<a
href="https://redirect.github.com/eslint/eslint/issues/21462">#21462</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6e3f9888cca518fbb9ba399e88b3033577d9f4ad"><code>6e3f988</code></a>
chore: update github/codeql-action action to v4.39.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21450">#21450</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/a031c40da3c2185279ca8f1f7961fff01fb7b8ff"><code>a031c40</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21445">#21445</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/67d2ca2d246bf0311d4a60f58282a7b246c44cba"><code>67d2ca2</code></a>
chore: add troubleshooting page URL to circular fixes warning message
(<a
href="https://redirect.github.com/eslint/eslint/issues/21429">#21429</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/276021d5190f62c873002f7aa08cdcb345135bbe"><code>276021d</code></a>
chore: update github/codeql-action action to v4.39.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21432">#21432</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/449724e95bfa013fa32c29375925b4111d3924e4"><code>449724e</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21420">#21420</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8ffeb8c023bea91a5cfa01b1413a52a83838a59a"><code>8ffeb8c</code></a>
chore: update dependency prettier to v3.9.10 (<a
href="https://redirect.github.com/eslint/eslint/issues/21417">#21417</a>)
(renovate[bot])</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/12cbff4125db3f6446f72fa0c48c46b92b120427"><code>12cbff4</code></a>
10.14.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/6b696e79c5b054ed95bf7eae878370076b3810c1"><code>6b696e7</code></a>
Build: changelog update for 10.14.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/0e2ab702714a66829fe2798c77190b48a3a88645"><code>0e2ab70</code></a>
ci: disable <code>eslint-plugin-unicorn</code> ecosystem test (<a
href="https://redirect.github.com/eslint/eslint/issues/21462">#21462</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4a12580eefdb240bd9b6ae83428638120e9a5f66"><code>4a12580</code></a>
fix: require minimatch <code>10.2.6</code> to avoid vulnerable
brace-expansion (<a
href="https://redirect.github.com/eslint/eslint/issues/21460">#21460</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0f94f47b3cf188534d6ac24c0ef4108dd004492b"><code>0f94f47</code></a>
docs: remove <code>zh-hans</code> from docs language switcher (<a
href="https://redirect.github.com/eslint/eslint/issues/21437">#21437</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/dab466e5cd43f4b9156a4d00b3423be2ed0088cc"><code>dab466e</code></a>
docs: Update README</li>
<li><a
href="https://github.com/eslint/eslint/commit/827a8f3cca710d3efd76c1d7088d894deff08434"><code>827a8f3</code></a>
fix: <code>no-restricted-globals</code> crash on global objects as
property values (<a
href="https://redirect.github.com/eslint/eslint/issues/21449">#21449</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/97431f86d5dc7cd60ade6415393b906cf08fe46c"><code>97431f8</code></a>
docs: replace <code>--rulesdir</code> with a virtual plugin in custom
rules docs (<a
href="https://redirect.github.com/eslint/eslint/issues/21452">#21452</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6e3f9888cca518fbb9ba399e88b3033577d9f4ad"><code>6e3f988</code></a>
chore: update github/codeql-action action to v4.39.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21450">#21450</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/161558ae1391a8649a8d69a8b2c2e555b40121b9"><code>161558a</code></a>
fix: handle LS, PS and empty hashbang comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21419">#21419</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.13.0...v10.14.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=eslint&package-manager=npm_and_yarn&previous-version=10.13.0&new-version=10.14.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-03 13:53:49 +00:00
dependabot[bot] 5f60157855 chore(deps-dev): Bump i18next-cli from 1.80.6 to 1.80.7 (#2297) 
Bumps [i18next-cli](https://github.com/i18next/i18next-cli) from 1.80.6
to 1.80.7.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md">i18next-cli's
changelog</a>.</em></p>
<blockquote>
<h2>1.80.7</h2>
<ul>
<li>fix(extract): <code>keyof typeof MAP</code> and
<code>Object.keys(MAP)</code> now yield all keys of the object, also
when its values are
objects or arrays. Only keys with a string value were recorded, so a
registry like
<code>const CONTENT = { social_planner: { image: 'a.webp' } } as
const</code> with <code>t(`addons.${name}.heading`)</code> and
<code>name: keyof typeof CONTENT</code> extracted nothing, in the same
file or imported, and a map that mixes string and object
values only yielded its string-valued keys. Value lookups like
<code>t(MAP[k])</code> still only use the string values.
Fixes <a
href="https://redirect.github.com/i18next/i18next-cli/issues/317">#317</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-cli/commit/552c59395e9bb5754508480cdb3f1b83a61e633a"><code>552c593</code></a>
1.80.7</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/a76c140d6e4fe66a3c3b2fa7e3ad64f67b088d3c"><code>a76c140</code></a>
docs: changelog for 1.80.7</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/b10c68c479b82874bd36dedd723d86fd7a879cfe"><code>b10c68c</code></a>
docs: fix code span in the changelog</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/89c99780adbd94b9849b2d94e89a2d445175ff1a"><code>89c9978</code></a>
fix(extract): keyof typeof and Object.keys yield all keys of an object
map (#...</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-cli/compare/v1.80.6...v1.80.7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next-cli&package-manager=npm_and_yarn&previous-version=1.80.6&new-version=1.80.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-03 13:53:02 +00:00
dependabot[bot] 53466e8f89 chore(deps): Bump react-resizable-panels from 4.15.2 to 4.15.3 in the react group (#2294) 
Bumps the react group with 1 update:
[react-resizable-panels](https://github.com/bvaughn/react-resizable-panels).

Updates `react-resizable-panels` from 4.15.2 to 4.15.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/releases">react-resizable-panels's
releases</a>.</em></p>
<blockquote>
<h2>4.15.3</h2>
<ul>
<li>Fix unused components not being removed by some bundlers (e.g.
esbuild), so an application that only imports <code>Group</code> no
longer includes <code>Grid</code>. Components now set their
<code>displayName</code> within a pure-annotated expression, and
<code>package.json</code> declares <code>&quot;sideEffects&quot;:
false</code>. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/779">#779</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md">react-resizable-panels's
changelog</a>.</em></p>
<blockquote>
<h2>4.15.3</h2>
<ul>
<li>Fix unused components not being removed by some bundlers (e.g.
esbuild), so an application that only imports <code>Group</code> no
longer includes <code>Grid</code>. Components now set their
<code>displayName</code> within a pure-annotated expression, and
<code>package.json</code> declares <code>&quot;sideEffects&quot;:
false</code>. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/779">#779</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/c61a77b4b079e86039282e988f1c46a2ad4e6d78"><code>c61a77b</code></a>
4.15.2 -&gt; 4.15.3</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/e3fd635bd7d1b6a92875ca5e8c2cdddf45a7b7df"><code>e3fd635</code></a>
Set <code>displayName</code> via pure-annotated declarations instead of
a build plugin (...</li>
<li>See full diff in <a
href="https://github.com/bvaughn/react-resizable-panels/compare/4.15.2...4.15.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-resizable-panels&package-manager=npm_and_yarn&previous-version=4.15.2&new-version=4.15.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-03 13:51:19 +00:00
shkomg 3f3ca9a13b Fix debug modal options missing for the mbgljs renderer (#2293) 
Fixes #1548

The Debug modal only listed the map options for `mlgljs`, so an `mbgljs`
style got an empty "Options". It now checks `renderer !== "ol"`, as
suggested in the issue, which is how `App.tsx` picks the map anyway.

## Launch Checklist

 - [x] Briefly describe the changes in this PR.
 - [x] Link to related issues.
- [x] Include before/after visuals or gifs if this PR includes visual
changes.
 - [x] Write tests for all new functionality.
 - [x] Add an entry to `CHANGELOG.md` under the `## main` section.

Added an e2e case with a small `mbgljs` fixture.

## Video

Debug modal for an `mbgljs` style on this branch:


https://github.com/user-attachments/assets/41a7bc71-85cf-44ae-a56e-91af7fbb3904

Fix written with Claude Code; video is an automated browser run of this
branch recorded by User Stories Bot.
 2026-11-03 08:16:19 +02:00
dependabot[bot] 22af313516 chore(deps): Bump i18next-browser-languagedetector from 8.2.3 to 8.2.4 (#2292) 
Bumps
[i18next-browser-languagedetector](https://github.com/i18next/i18next-browser-languageDetector)
from 8.2.3 to 8.2.4.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-browser-languageDetector/blob/master/CHANGELOG.md">i18next-browser-languagedetector's
changelog</a>.</em></p>
<blockquote>
<h3>8.2.4</h3>
<ul>
<li>fix: <code>lookupFromSubdomainIndex</code> counts hostname labels
again, so with <code>1</code>, <code>dev.en.example.com</code> is
detected as <code>en</code>. Since 6.1.5 the index picked a regex group
instead, and any index other than <code>0</code> returned a part of the
domain (<code>en.exampl</code>, <code>example.com</code>). Index
<code>0</code> (the default) works as before. Thanks <a
href="https://github.com/lprnmns"><code>@​lprnmns</code></a> <a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/pull/329">329</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/4c6a50dcc02f94a93a9fae09c0b2166cb152d187"><code>4c6a50d</code></a>
8.2.4</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/e79235c87ec713bff73004edbcdff32df994609d"><code>e79235c</code></a>
release</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/5c5f03248df145bbe309894df20c10841a4de19f"><code>5c5f032</code></a>
chore: update dev dependencies to clear the Dependabot alerts</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/797ecfe3ecac5a5e0a8fd3f33fde047b611400f3"><code>797ecfe</code></a>
changelog for unreleased <a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/issues/329">#329</a></li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/9303da40b454a4b83a109c905b5eb861532f130f"><code>9303da4</code></a>
fix: honor subdomain lookup index (<a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/issues/329">#329</a>)</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-browser-languageDetector/compare/v8.2.3...v8.2.4">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-02 14:04:27 +00:00
dependabot[bot] aea488cac1 chore(deps-dev): Bump sass from 1.106.1 to 1.107.0 (#2291) 
Bumps [sass](https://github.com/sass/dart-sass) from 1.106.1 to 1.107.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sass/dart-sass/releases">sass's
releases</a>.</em></p>
<blockquote>
<h2>Dart Sass 1.107.0</h2>
<p>To install Sass 1.107.0, download one of the packages below and <a
href="https://katiek2.github.io/path-doc/">add it to your PATH</a>, or
see <a href="https://sass-lang.com/install">the Sass website</a> for
full installation instructions.</p>
<h1>Changes</h1>
<h3>Command-Line Interface</h3>
<ul>
<li>
<p>The <code>--fatal-deprecation</code> flag can now exclude
deprecations that would otherwise be included by passing a version
number. To exclude a deprecation, add <code>-</code> before its name.
For example, <code>--fatal-deprecation=1.107.0,-import</code> includes
all deprecations that were present in Dart Sass 1.107.0 <em>except</em>
for the <code>@import</code> deprecation.</p>
</li>
<li>
<p>The <code>--fatal-deprecation</code> flag now takes the special value
<code>dart-sass-2</code>, which treats as fatal all deprecations that
will become fatal in Dart Sass 2.0.0.</p>
</li>
</ul>
<h3>JavaScript API</h3>
<ul>
<li>
<p><code>Options.fatalDeprecations</code> can now take a
<code>DeprecationSelectorDifference</code> object of the form
<code>{include: ..., except: ...}</code>, where the <code>include</code>
field lists deprecations to mark fatal (which can be version numbers)
and the <code>except</code> field lists deprecations <em>not</em> to
mark fatal. The <code>except</code> field takes precedence over
<code>include</code>.</p>
</li>
<li>
<p>Add a (non-enumerable) <code>sass.deprecations.dartSass2</code>
property which can be passed to <code>Options.fatalDeprecations</code>
to mark as fatal exactly the deprecations that will become fatal in Dart
Sass 2.0.0. This can be combined with other deprecations or used in a
<code>DeprecationSelectorDifference</code> to modify exactly which
deprecations it covers.</p>
</li>
<li>
<p>Passing a version number beyond the current Dart Sass version to
<code>Options.fatalDeprecations</code> is now deprecated. See <a
href="https://sass-lang.com/d/deprecation-version">the Sass website</a>
for details.</p>
</li>
</ul>
<h3>Dart API</h3>
<ul>
<li>
<p>Add a <code>Deprecation.dartSass2</code> property which returns
exactly the set of deprecations that will become fatal in Dart Sass
2.0.0.</p>
</li>
<li>
<p>Passing a version number beyond the current Dart Sass version to
<code>Deprecation.forVersion</code> is now deprecated.</p>
</li>
</ul>
<h3>Embedded Protocol</h3>
<ul>
<li>Add a <code>CompileRequest.fatal_deprecation_except</code> field
which excludes deprecations from being considered fatal if they would
have been enabled by <code>CompileRequest.fatal_deprecation</code>.</li>
</ul>
<p>See the <a
href="https://github.com/sass/dart-sass/blob/master/CHANGELOG.md#11070">full
changelog</a> for changes in earlier releases.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/sass/dart-sass/blob/main/CHANGELOG.md">sass's
changelog</a>.</em></p>
<blockquote>
<h2>1.107.0</h2>
<h3>Command-Line Interface</h3>
<ul>
<li>
<p>The <code>--fatal-deprecation</code> flag can now exclude
deprecations that would
otherwise be included by passing a version number. To exclude a
deprecation,
add <code>-</code> before its name. For example,
<code>--fatal-deprecation=1.107.0,-import</code>
includes all deprecations that were present in Dart Sass 1.107.0
<em>except</em> for
the <code>@import</code> deprecation.</p>
</li>
<li>
<p>The <code>--fatal-deprecation</code> flag now takes the special value
<code>dart-sass-2</code>,
which treats as fatal all deprecations that will become fatal in Dart
Sass
2.0.0.</p>
</li>
</ul>
<h3>JavaScript API</h3>
<ul>
<li>
<p><code>Options.fatalDeprecations</code> can now take a
<code>DeprecationSelectorDifference</code>
object of the form <code>{include: ..., except: ...}</code>, where the
<code>include</code> field
lists deprecations to mark fatal (which can be version numbers) and the
<code>except</code> field lists deprecations <em>not</em> to mark fatal.
The <code>except</code> field
takes precedence over <code>include</code>.</p>
</li>
<li>
<p>Add a (non-enumerable) <code>sass.deprecations.dartSass2</code>
property which can be
passed to <code>Options.fatalDeprecations</code> to mark as fatal
exactly the
deprecations that will become fatal in Dart Sass 2.0.0. This can be
combined
with other deprecations or used in a
<code>DeprecationSelectorDifference</code> to modify
exactly which deprecations it covers.</p>
</li>
<li>
<p>Passing a version number beyond the current Dart Sass version to
<code>Options.fatalDeprecations</code> is now deprecated. See <a
href="https://sass-lang.com/d/deprecation-version">the Sass
website</a> for details.</p>
</li>
</ul>
<h3>Dart API</h3>
<ul>
<li>
<p>Add a <code>Deprecation.dartSass2</code> property which returns
exactly the set of
deprecations that will become fatal in Dart Sass 2.0.0.</p>
</li>
<li>
<p>Passing a version number beyond the current Dart Sass version to
<code>Deprecation.forVersion</code> is now deprecated.</p>
</li>
</ul>
<h3>Embedded Protocol</h3>
<ul>
<li>Add a <code>CompileRequest.fatal_deprecation_except</code> field
which excludes
deprecations from being considered fatal if they would have been enabled
by
<code>CompileRequest.fatal_deprecation</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sass/dart-sass/commit/455cbc0508b3fb9952a6fc0bb000a58e46ef8574"><code>455cbc0</code></a>
[Deprecations Except] Implement the change (<a
href="https://redirect.github.com/sass/dart-sass/issues/2895">#2895</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/0cc2fa2324b034b82fd3f383add45eb2ddb101c0"><code>0cc2fa2</code></a>
Bump postcss from 8.5.30 to 8.5.31 in /pkg/sass-parser (<a
href="https://redirect.github.com/sass/dart-sass/issues/2899">#2899</a>)</li>
<li>See full diff in <a
href="https://github.com/sass/dart-sass/compare/1.106.1...1.107.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sass&package-manager=npm_and_yarn&previous-version=1.106.1&new-version=1.107.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-02 13:56:25 +00:00
dependabot[bot] 627dafb367 chore(deps-dev): Bump i18next-cli from 1.80.5 to 1.80.6 (#2290) 
Bumps [i18next-cli](https://github.com/i18next/i18next-cli) from 1.80.5
to 1.80.6.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md">i18next-cli's
changelog</a>.</em></p>
<blockquote>
<h2>1.80.6</h2>
<ul>
<li>fix(extract): a function parameter no longer resolves to a variable
of the same name declared elsewhere.
<code>const getLabel = (options, value, t) =&gt;
t(options[value])</code> extracted <code>GET</code> as a key because
another file had a
<code>const options = { method: 'GET' }</code>. Inside a function, its
parameters now hide same-named variables, object maps,
enums, functions and string constants from the module, other functions
and other files, also when the value goes
through a local (<code>const key = options[value]; t(key)</code>) or a
function's return value. This also fixes custom hooks
like <code>useT(ns) { const { t } = useTranslation(ns) }</code>, whose
keys went to the namespace of any <code>const ns = 'admin'</code>
in the project (the same for <code>keyPrefix</code>). Parameters with a
default value or typed with a union or an interface
still resolve as before. Fixes <a
href="https://redirect.github.com/i18next/i18next-cli/issues/316">#316</a>.</li>
<li>chore(deps): <code>ora</code>, <code>execa</code> and
<code>inquirer</code> are replaced by <code>yocto-spinner</code>,
<code>nano-spawn</code> and the single
<code>@inquirer/input</code>, <code>@inquirer/select</code>,
<code>@inquirer/confirm</code> and <code>@inquirer/password</code>
prompts. Prompts, spinners and
the <code>locize</code>, <code>git</code> and browser-opener
subprocesses behave as before. The install tree no longer contains
<code>is-interactive</code>, <code>is-unicode-supported</code>,
<code>safer-buffer</code>, <code>iconv-lite</code>,
<code>@inquirer/external-editor</code>, <code>path-key</code> and
<code>get-east-asian-width</code>, including the three packages Socket
rated as high-severity alerts.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-cli/commit/33f0154d0eac3e80e60f433f6006a73de193260e"><code>33f0154</code></a>
1.80.6</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/7abf5fd6dbd18ff4c3072b0868f3b847b2a18179"><code>7abf5fd</code></a>
docs: changelog for 1.80.6</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/740a925c2a2b93e37c427bfd1a798708e68b7431"><code>740a925</code></a>
docs: changelog for the dependency replacement</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/05774e32d2f1b24467ea314d7642d122800da194"><code>05774e3</code></a>
fix(extract): a function parameter hides same-named values declared
elsewhere...</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/99a5c173e4ab475fa059378fb470b07fdf430533"><code>99a5c17</code></a>
docs: add Socket badge to README</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/d99dbe6b93eebef82ca6b521ceed3908b627a5dd"><code>d99dbe6</code></a>
chore(deps): replace ora, execa and inquirer with lighter packages</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-cli/compare/v1.80.5...v1.80.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next-cli&package-manager=npm_and_yarn&previous-version=1.80.5&new-version=1.80.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-02 13:55:43 +00:00
dependabot[bot] 8cb71b48ff chore(deps): Bump react-resizable-panels from 4.15.0 to 4.15.2 in the react group (#2287) 
Bumps the react group with 1 update:
[react-resizable-panels](https://github.com/bvaughn/react-resizable-panels).

Updates `react-resizable-panels` from 4.15.0 to 4.15.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/releases">react-resizable-panels's
releases</a>.</em></p>
<blockquote>
<h2>4.15.2</h2>
<ul>
<li>Fix <code>vh</code>, <code>vw</code>, and <code>em</code> panel
sizes (e.g. <code>defaultSize=&quot;25vw&quot;</code>) being resolved
against the global <code>window</code> instead of the panel's own
window, so a <code>Group</code> rendered into another window (e.g. a
<code>window.open</code> popout via a portal, or an iframe) was sized
against the opener's viewport. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/777">#777</a></li>
</ul>
<h2>4.15.1</h2>
<ul>
<li>Declare <code>@types/react</code> as an optional peer dependency.
Under strict package linkers (e.g. pnpm with a global virtual store,
Yarn PnP, or Bun isolated installs), TypeScript could fail to resolve it
from this package, silently typing props built on React types as
<code>any</code>. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/776">#776</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md">react-resizable-panels's
changelog</a>.</em></p>
<blockquote>
<h2>4.15.2</h2>
<ul>
<li>Fix <code>vh</code>, <code>vw</code>, and <code>em</code> panel
sizes (e.g. <code>defaultSize=&quot;25vw&quot;</code>) being resolved
against the global <code>window</code> instead of the panel's own
window, so a <code>Group</code> rendered into another window (e.g. a
<code>window.open</code> popout via a portal, or an iframe) was sized
against the opener's viewport. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/777">#777</a></li>
</ul>
<h2>4.15.1</h2>
<ul>
<li>Declare <code>@types/react</code> as an optional peer dependency.
Under strict package linkers (e.g. pnpm with a global virtual store,
Yarn PnP, or Bun isolated installs), TypeScript could fail to resolve it
from this package, silently typing props built on React types as
<code>any</code>. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/776">#776</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/1d3a15660e146748065a7996cd5afee4b3121591"><code>1d3a156</code></a>
4.15.1 -&gt; 4.15.2</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/3b7c44f2631bfe3fd06e48a83938d12fde84efe5"><code>3b7c44f</code></a>
Resolve vh/vw sizes against the panel's own window (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/777">#777</a>)</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/a4996128c387d5d15bb69803c39e7b9906439cd6"><code>a499612</code></a>
4.15.0 -&gt; 4.15.1</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/44d77fb1a90a1630dcc374a72b107624d8a643e4"><code>44d77fb</code></a>
Declare <code>@​types/react</code> as an optional peer dependency (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/776">#776</a>)</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/14743f1b153c813ca9fc18c7accbf7f96d8b076b"><code>14743f1</code></a>
Polished the Accordion demo</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/7f087d3b6fdaa6b98166f52110e0d3341ee72444"><code>7f087d3</code></a>
Update react-lib-tools to 0.0.70; support light theme</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/d51bd68153d32e4d031398a1df7811a7d213c8cc"><code>d51bd68</code></a>
Update react-lib-tools to 0.0.69</li>
<li>See full diff in <a
href="https://github.com/bvaughn/react-resizable-panels/compare/4.15.0...4.15.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-resizable-panels&package-manager=npm_and_yarn&previous-version=4.15.0&new-version=4.15.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-02 13:55:14 +00:00
dependabot[bot] 26c110c5b2 chore(deps): Bump @maplibre/maplibre-gl-style-spec from 26.5.0 to 26.5.1 (#2288) 
Bumps
[@maplibre/maplibre-gl-style-spec](https://github.com/maplibre/maplibre-style-spec)
from 26.5.0 to 26.5.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/maplibre/maplibre-style-spec/releases">@​maplibre/maplibre-gl-style-spec's
releases</a>.</em></p>
<blockquote>
<h2>v26.5.1</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Add the experimental <code>emptyResponse</code> property to vector,
raster and raster-dem sources, and the same key for the TileJSON they
load (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1869">#1869</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
</ul>
<h3>🐞 Bug fixes</h3>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/maplibre/maplibre-style-spec/blob/main/CHANGELOG.md">@​maplibre/maplibre-gl-style-spec's
changelog</a>.</em></p>
<blockquote>
<h2>26.5.1</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Add the experimental <code>emptyResponse</code> property to vector,
raster and raster-dem sources, and the same key for the TileJSON they
load (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1869">#1869</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
</ul>
<h3>🐞 Bug fixes</h3>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/c25cc5da789337fca2df8d0eaaeeecd5eea7f634"><code>c25cc5d</code></a>
Bump js version to 26.5.1 (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1952">#1952</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/2aea7c584b1d91b876adbc904876ec50020bf08d"><code>2aea7c5</code></a>
feat: add the experimental emptyResponse source property and document
MapLibr...</li>
<li>See full diff in <a
href="https://github.com/maplibre/maplibre-style-spec/compare/v26.5.0...v26.5.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@maplibre/maplibre-gl-style-spec&package-manager=npm_and_yarn&previous-version=26.5.0&new-version=26.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-02 13:52:18 +00:00
dependabot[bot] 8c816c2a23 chore(deps): Bump i18next from 26.5.11 to 26.5.12 (#2289) 
Bumps [i18next](https://github.com/i18next/i18next) from 26.5.11 to
26.5.12.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.5.12</h2>
<ul>
<li>fix: with <code>keySeparator: false</code> or a custom separator
like <code>'::'</code>, a nested interpolation value that is
<code>0</code>, <code>false</code> or <code>''</code> is now inserted.
<code>'You have {{stats.unread}} unread messages'</code> with <code>{
stats: { unread: 0 } }</code> kept the raw <code>{{stats.unread}}</code>
placeholder (or became <code>''</code> with <code>skipOnVariables:
false</code>), also for formatted values like <code>{{order.total,
currency(USD)}}</code> and for nested <code>defaultVariables</code>: a
falsy value was looked up again with the configured separator, which
does not split <code>stats.unread</code>. The default <code>'.'</code>
separator was not affected. When the same name exists both nested and as
a flat dotted key (<code>{ a: { b: 0 }, 'a.b': 'flat' }</code>), the
nested <code>0</code>, <code>false</code> or <code>''</code> now wins,
as a truthy one already did; a nested <code>null</code> still falls back
to the flat key. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2464">#2464</a>).</li>
<li>fix: <code>cloneInstance({ forkResourceStore: true })</code> no
longer changes the options object it is given. It deleted
<code>forkResourceStore</code> from it, so reusing the same object for a
second clone silently shared the parent's resource store (adding a
resource to that clone also changed the parent), and frozen options
threw a <code>TypeError</code>. Clones without
<code>forkResourceStore</code> are unchanged. Thanks <a
href="https://github.com/edsonsims"><code>@​edsonsims</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2463">#2463</a>).</li>
<li>perf(types): a selector <code>t(($) =&gt; ...)</code>
(<code>enableSelector: true</code> / <code>'strict'</code>) no longer
filters the whole namespace, and no longer does it again for every
distinct <code>context</code> value. To drop keys without anything to
select, the filtered type looked at the filtered keys of every nested
object, down to the leaves, also for the branches the selector does not
read. It now decides from the source value. With 10,000 keys in 100
groups, one call went from 3.3M type instantiations (1.7s) to 0.85M
(0.8s), and ten calls with ten contexts from 21.7M (8.8s) to 1.05M
(0.9s), on TypeScript 6. Selected values are unchanged for context,
plural, ordinal, nested and array keys, with three side effects: a type
error on a selector now shows the type as <code>FilterKeysObject&lt;{
...source keys }, Context&gt;</code> instead of the filtered object, an
object whose values are all <code>null</code> or <code>undefined</code>
(<code>{ x: null }</code>) is kept as <code>{}</code> instead of being
dropped, and a <code>null</code> key next to its plural forms
(<code>foo: null</code>, <code>foo_one</code>, <code>foo_other</code>)
is typed as the plural value instead of <code>never</code>. Thanks <a
href="https://github.com/GabrielVooDB"><code>@​GabrielVooDB</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/issues/2462">#2462</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.5.12</h2>
<ul>
<li>fix: with <code>keySeparator: false</code> or a custom separator
like <code>'::'</code>, a nested interpolation value that is
<code>0</code>, <code>false</code> or <code>''</code> is now inserted.
<code>'You have {{stats.unread}} unread messages'</code> with <code>{
stats: { unread: 0 } }</code> kept the raw <code>{{stats.unread}}</code>
placeholder (or became <code>''</code> with <code>skipOnVariables:
false</code>), also for formatted values like <code>{{order.total,
currency(USD)}}</code> and for nested <code>defaultVariables</code>: a
falsy value was looked up again with the configured separator, which
does not split <code>stats.unread</code>. The default <code>'.'</code>
separator was not affected. When the same name exists both nested and as
a flat dotted key (<code>{ a: { b: 0 }, 'a.b': 'flat' }</code>), the
nested <code>0</code>, <code>false</code> or <code>''</code> now wins,
as a truthy one already did; a nested <code>null</code> still falls back
to the flat key. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2464">#2464</a>).</li>
<li>fix: <code>cloneInstance({ forkResourceStore: true })</code> no
longer changes the options object it is given. It deleted
<code>forkResourceStore</code> from it, so reusing the same object for a
second clone silently shared the parent's resource store (adding a
resource to that clone also changed the parent), and frozen options
threw a <code>TypeError</code>. Clones without
<code>forkResourceStore</code> are unchanged. Thanks <a
href="https://github.com/edsonsims"><code>@​edsonsims</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2463">#2463</a>).</li>
<li>perf(types): a selector <code>t(($) =&gt; ...)</code>
(<code>enableSelector: true</code> / <code>'strict'</code>) no longer
filters the whole namespace, and no longer does it again for every
distinct <code>context</code> value. To drop keys without anything to
select, the filtered type looked at the filtered keys of every nested
object, down to the leaves, also for the branches the selector does not
read. It now decides from the source value. With 10,000 keys in 100
groups, one call went from 3.3M type instantiations (1.7s) to 0.85M
(0.8s), and ten calls with ten contexts from 21.7M (8.8s) to 1.05M
(0.9s), on TypeScript 6. Selected values are unchanged for context,
plural, ordinal, nested and array keys, with three side effects: a type
error on a selector now shows the type as <code>FilterKeysObject&lt;{
...source keys }, Context&gt;</code> instead of the filtered object, an
object whose values are all <code>null</code> or <code>undefined</code>
(<code>{ x: null }</code>) is kept as <code>{}</code> instead of being
dropped, and a <code>null</code> key next to its plural forms
(<code>foo: null</code>, <code>foo_one</code>, <code>foo_other</code>)
is typed as the plural value instead of <code>never</code>. Thanks <a
href="https://github.com/GabrielVooDB"><code>@​GabrielVooDB</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/issues/2462">#2462</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next/commit/83f35e40bba9651be07450be3c37dc3978c74479"><code>83f35e4</code></a>
26.5.12</li>
<li><a
href="https://github.com/i18next/i18next/commit/a2a354e1ac49b76b91b7b98914547152e7844f78"><code>a2a354e</code></a>
build</li>
<li><a
href="https://github.com/i18next/i18next/commit/b6447c16fde133dc2c5d2e6f0e7b48767a3f41e7"><code>b6447c1</code></a>
changelog for 26.5.12</li>
<li><a
href="https://github.com/i18next/i18next/commit/8bab707c3049899fa45b9394907969c6a1a6a45f"><code>8bab707</code></a>
changelog for unreleased <a
href="https://redirect.github.com/i18next/i18next/issues/2464">#2464</a></li>
<li><a
href="https://github.com/i18next/i18next/commit/5c43d884f2ef13ae15612fbd1fd53b56ab8d483a"><code>5c43d88</code></a>
fix: a nested null interpolation value still falls back to a flat
key</li>
<li><a
href="https://github.com/i18next/i18next/commit/1b7b734f2ca737b4da7cadb18dfafe0ce16c4574"><code>1b7b734</code></a>
fix: keep nested 0, false and '' interpolation values with a custom
keySepara...</li>
<li><a
href="https://github.com/i18next/i18next/commit/4184f91b778ceecb40c10e4a8a763dc6472f941c"><code>4184f91</code></a>
changelog for unreleased <a
href="https://redirect.github.com/i18next/i18next/issues/2463">#2463</a></li>
<li><a
href="https://github.com/i18next/i18next/commit/4af40e53a07e5e263fce32181d35987f45127733"><code>4af40e5</code></a>
fix: preserve caller options when forking instances (<a
href="https://redirect.github.com/i18next/i18next/issues/2463">#2463</a>)</li>
<li><a
href="https://github.com/i18next/i18next/commit/42af8308faffe19bc921d6ce5df54f8c41b39c9d"><code>42af830</code></a>
chore: update dev dependencies to clear the Dependabot alerts</li>
<li><a
href="https://github.com/i18next/i18next/commit/39bdcfe8ef20b1f8f1cc5ee9b2240c0fe935f3dd"><code>39bdcfe</code></a>
perf(types): selector t() no longer filters the whole namespace (<a
href="https://redirect.github.com/i18next/i18next/issues/2462">#2462</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/i18next/i18next/compare/v26.5.11...v26.5.12">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next&package-manager=npm_and_yarn&previous-version=26.5.11&new-version=26.5.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-11-02 13:52:09 +00:00
dependabot[bot] e2440b336f chore(deps-dev): Bump i18next-cli from 1.80.4 to 1.80.5 (#2286) 
Bumps [i18next-cli](https://github.com/i18next/i18next-cli) from 1.80.4
to 1.80.5.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md">i18next-cli's
changelog</a>.</em></p>
<blockquote>
<h2>1.80.5</h2>
<ul>
<li>fix(extract): Svelte and Vue files with a generic arrow function in
<code>&lt;script lang=&quot;ts&quot;&gt;</code> are no longer skipped.
Plugin output is parsed as TSX, where <code>&lt;T&gt;(value: T) =&gt;
value</code> reads as a JSX tag, so the file failed with
<code>Skipping file due to error</code> and all its keys were missing.
When TSX rejects plugin output, it is now parsed as plain
TypeScript. <a
href="https://redirect.github.com/i18next/i18next-cli/pull/314">#314</a></li>
<li>fix(extract): with <code>sort: false</code>, arrays read with
<code>returnObjects</code> stay arrays. <code>extract</code> wrote
<code>{ &quot;faq&quot;: [{ … }] }</code> back as <code>{
&quot;faq&quot;: { &quot;0&quot;: { … } } }</code>, so <code>extract
--ci</code> always failed for such a project.
<a
href="https://redirect.github.com/i18next/i18next-cli/pull/315">#315</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-cli/commit/2464c038433b3d5f6c58f169c033745d8ab91131"><code>2464c03</code></a>
1.80.5</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/9397f51065beec5e523cc327f260fa23aeb73c73"><code>9397f51</code></a>
docs: changelog for 1.80.5</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/cabacf5f5765dfba697731707a1877ee6ac0deaa"><code>cabacf5</code></a>
fix(extract): keep arrays when sort is false (<a
href="https://redirect.github.com/i18next/i18next-cli/issues/315">#315</a>)</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/b4a0979932189bca3fef66ae793fdfd3e5de01f0"><code>b4a0979</code></a>
fix(extract): parse plugin output as TypeScript when TSX rejects it (<a
href="https://redirect.github.com/i18next/i18next-cli/issues/314">#314</a>)</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-cli/compare/v1.80.4...v1.80.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next-cli&package-manager=npm_and_yarn&previous-version=1.80.4&new-version=1.80.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-30 14:02:01 +00:00
dependabot[bot] ff9222586a chore(deps-dev): Bump postcss from 8.5.31 to 8.5.32 (#2284) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.31 to
8.5.32.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.32</h2>
<ul>
<li>Fixed <code>Input#origin()</code> without <code>opts.from</code> (by
<a href="https://github.com/wleeaf"><code>@​wleeaf</code></a>).</li>
<li>Fixed final-word lookup without source offsets (by <a
href="https://github.com/Don-Yin"><code>@​Don-Yin</code></a>).</li>
<li>Fixed explicit <code>start</code> in <code>Warning#toString()</code>
(by <a
href="https://github.com/Don-Yin"><code>@​Don-Yin</code></a>).</li>
<li>Fixed <code>Promise</code> semantics in
<code>LazyResult#finally()</code> (by <a
href="https://github.com/Don-Yin"><code>@​Don-Yin</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.32</h2>
<ul>
<li>Fixed <code>Input#origin()</code> without <code>opts.from</code> (by
<a href="https://github.com/wleeaf"><code>@​wleeaf</code></a>).</li>
<li>Fixed final-word lookup without source offsets (by <a
href="https://github.com/Don-Yin"><code>@​Don-Yin</code></a>).</li>
<li>Fixed explicit <code>start</code> in <code>Warning#toString()</code>
(by <a
href="https://github.com/Don-Yin"><code>@​Don-Yin</code></a>).</li>
<li>Fixed <code>Promise</code> semantics in
<code>LazyResult#finally()</code> (by <a
href="https://github.com/Don-Yin"><code>@​Don-Yin</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/2455ac8212fe66bc3248aa01186a52c27c87da5a"><code>2455ac8</code></a>
Release 8.5.32 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/e367106f999956dd82799228f5d3fe52c17e2b9f"><code>e367106</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/f70f586c4b44520cce83036669ab92fc1cf72b41"><code>f70f586</code></a>
Fix <code>Input#origin()</code> without <code>from</code> or with
relative <code>sourceRoot</code> (<a
href="https://redirect.github.com/postcss/postcss/issues/2179">#2179</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/eb28619f747991b223f68f2559ac63343df89936"><code>eb28619</code></a>
Fix final-word lookup without source offsets (<a
href="https://redirect.github.com/postcss/postcss/issues/2178">#2178</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/095654b83ed13b1465eddd07f1d2747832fbf290"><code>095654b</code></a>
Preserve explicit start in Warning#toString() (<a
href="https://redirect.github.com/postcss/postcss/issues/2177">#2177</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/9b3d8b8f92d571e73df89936d420b54cf473f39b"><code>9b3d8b8</code></a>
Preserve Promise semantics in result finally() (<a
href="https://redirect.github.com/postcss/postcss/issues/2176">#2176</a>)</li>
<li>See full diff in <a
href="https://github.com/postcss/postcss/compare/8.5.31...8.5.32">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.31&new-version=8.5.32)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-30 14:01:39 +00:00
dependabot[bot] ad1638d89c chore(deps-dev): Bump typescript-eslint from 8.72.0 to 8.72.1 (#2285) 
Bumps
[typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)
from 8.72.0 to 8.72.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.1</h2>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062">#13062</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039">#13039</a>)</li>
<li><strong>typescript-estree:</strong> use one Program per tsconfig for
the project service in single-run mode (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12988">#12988</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
<li>Josh Ghoulberg 👻</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.1 (2026-10-26)</h2>
<p>This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4ad6b7553781fa3c93fc26642d7219d2e6624504"><code>4ad6b75</code></a>
chore(release): publish 8.72.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/77576945345c1537635e617ea0d4b34b003b15ff"><code>7757694</code></a>
chore: cleanup typecheck &amp; build and fix race condition (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint/issues/13071">#13071</a>)</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=typescript-eslint&package-manager=npm_and_yarn&previous-version=8.72.0&new-version=8.72.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-30 14:01:36 +00:00
dependabot[bot] af58cccb29 chore(deps): Bump i18next-browser-languagedetector from 8.2.2 to 8.2.3 (#2282) 
Bumps
[i18next-browser-languagedetector](https://github.com/i18next/i18next-browser-languageDetector)
from 8.2.2 to 8.2.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-browser-languageDetector/blob/master/CHANGELOG.md">i18next-browser-languagedetector's
changelog</a>.</em></p>
<blockquote>
<h3>8.2.3</h3>
<ul>
<li>fix: the subdomain detector now detects language tags with script
and region subtags, so <code>pt-BR.site.com</code>,
<code>zh-Hans-CN.site.com</code>, <code>es-419.site.com</code> and
<code>sr-Latn.site.com</code> are detected as <code>pt-BR</code>,
<code>zh-Hans-CN</code>, <code>es-419</code> and <code>sr-Latn</code>.
The pattern only accepted 2 to 5 word characters, without hyphens. Other
subdomains like <code>staging</code> or preview deployment labels
(<code>myapp-git-branch-team.vercel.app</code>) are still not taken for
a language, and everything detected before is still detected. Thanks <a
href="https://github.com/lprnmns"><code>@​lprnmns</code></a> <a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/pull/328">328</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/fa81be3fd6e8d38939fcc16b2e3f9c90b47c7ce0"><code>fa81be3</code></a>
8.2.3</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/dbe4ee281972c57eba8464c4c8d7aa9476ba284c"><code>dbe4ee2</code></a>
release</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/4435b3dffb5489ea42eb24b221ef41d31aaa9d3c"><code>4435b3d</code></a>
fix: only take language-tag shaped subdomains for a language</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/ceef464a7873ac3e779bf691b7cf48acb68be83d"><code>ceef464</code></a>
fix: detect hyphenated locales in subdomains (<a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/issues/328">#328</a>)</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-browser-languageDetector/compare/v8.2.2...v8.2.3">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-29 14:08:52 +00:00
dependabot[bot] 982181f693 chore(deps): Bump react-i18next from 17.1.8 to 17.1.9 in the react group (#2280) 
Bumps the react group with 1 update:
[react-i18next](https://github.com/i18next/react-i18next).

Updates `react-i18next` from 17.1.8 to 17.1.9
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md">react-i18next's
changelog</a>.</em></p>
<blockquote>
<h2>17.1.9</h2>
<ul>
<li>fix(useTranslation): namespaces added to or removed from the
<code>ns</code> array are now picked up. The hook used the array itself
as the <code>useMemo</code> dependency list, and React only compares the
entries both lists have in common when its length changes, so going from
<code>useTranslation(['nsA'])</code> to <code>useTranslation(['nsA',
'nsB'])</code> kept returning <code>['nsA']</code>: React warned that
the dependency array changed size, <code>nsB</code> was never loaded,
and with <code>nsMode: 'fallback'</code> keys only in <code>nsB</code>
rendered as the key. Removing a namespace kept the old list the same
way. The namespaces are now compared by content, so a growing list loads
the new namespace (suspending until it is loaded, as switching from
<code>'nsA'</code> to <code>'nsB'</code> already does) and
<code>t</code> uses it. Lists that keep their length behave as before.
Thanks <a href="https://github.com/lprnmns"><code>@​lprnmns</code></a>
(<a
href="https://redirect.github.com/i18next/react-i18next/pull/1945">#1945</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/react-i18next/commit/4f4236ddf3a6fecccac1effee3cf0da8c7739a99"><code>4f4236d</code></a>
17.1.9</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/e1a69455814a5bc699d2445193c4c026c5f9b6ae"><code>e1a6945</code></a>
build</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/8e9b59e255946e830155bd7bb2c3e2dd00cc524f"><code>8e9b59e</code></a>
changelog for 17.1.9</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/46564b65f9c934d04992c433856af65073d727a9"><code>46564b6</code></a>
fix: refresh translations when namespaces are added (<a
href="https://redirect.github.com/i18next/react-i18next/issues/1945">#1945</a>)</li>
<li>See full diff in <a
href="https://github.com/i18next/react-i18next/compare/v17.1.8...v17.1.9">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-i18next&package-manager=npm_and_yarn&previous-version=17.1.8&new-version=17.1.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-29 13:57:55 +00:00
dependabot[bot] 8d14871986 chore(deps-dev): Bump stylelint-scss from 7.3.0 to 7.4.0 (#2283) 
Bumps [stylelint-scss](https://github.com/stylelint-scss/stylelint-scss)
from 7.3.0 to 7.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/stylelint-scss/stylelint-scss/releases">stylelint-scss's
releases</a>.</em></p>
<blockquote>
<h2>7.4.0</h2>
<ul>
<li>Added: <code>function-no-unknown</code> allow sass() conditions in
CSS-style if() (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1365">#1365</a>).</li>
<li>Fixed: <code>dollar-variable-no-missing-interpolation</code> fix
imported vars in custom properties (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1373">#1373</a>).</li>
<li>Fixed: <code>at-root-no-redundant</code> autofix for bare
<code>@at-root</code> blocks (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1375">#1375</a>).</li>
<li>Fixed: <code>load-no-partial-leading-underscore</code> false
positive on <code>@use</code> 'dir/_' as alias-with-hyphen (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1377">#1377</a>).</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/stylelint-scss/stylelint-scss/compare/v7.3.0...v7.4.0">https://github.com/stylelint-scss/stylelint-scss/compare/v7.3.0...v7.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/stylelint-scss/stylelint-scss/blob/master/CHANGELOG.md">stylelint-scss's
changelog</a>.</em></p>
<blockquote>
<h1>7.4.0</h1>
<ul>
<li>Added: <code>function-no-unknown</code> allow sass() conditions in
CSS-style if() (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1365">#1365</a>).</li>
<li>Fixed: <code>dollar-variable-no-missing-interpolation</code> fix
imported vars in custom properties (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1373">#1373</a>).</li>
<li>Fixed: <code>at-root-no-redundant</code> autofix for bare
<code>@at-root</code> blocks (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1375">#1375</a>).</li>
<li>Fixed: <code>load-no-partial-leading-underscore</code> false
positive on <code>@use</code> 'dir/_' as alias-with-hyphen (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1377">#1377</a>).</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/stylelint-scss/stylelint-scss/compare/v7.3.0...v7.4.0">https://github.com/stylelint-scss/stylelint-scss/compare/v7.3.0...v7.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/stylelint-scss/stylelint-scss/commit/25fae33879c00e682c47aab9679d1b87869016ea"><code>25fae33</code></a>
7.4.0</li>
<li><a
href="https://github.com/stylelint-scss/stylelint-scss/commit/914f16b286beb2d22e5d7b3cc8f73e61edbedf17"><code>914f16b</code></a>
Prepare version 7.4.0 (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1379">#1379</a>)</li>
<li><a
href="https://github.com/stylelint-scss/stylelint-scss/commit/50c35bcd1daabb39746fb8620c0b3098cce598af"><code>50c35bc</code></a>
Update contributors list (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1378">#1378</a>)</li>
<li><a
href="https://github.com/stylelint-scss/stylelint-scss/commit/51c7712c0afdfdf29471a8c3b64707f916606384"><code>51c7712</code></a>
load-no-partial-leading-underscore false positive on <a
href="https://github.com/use"><code>@​use</code></a> 'dir/_' as
alias-wi...</li>
<li><a
href="https://github.com/stylelint-scss/stylelint-scss/commit/85693e15e58f9629e71ef397f93d50a50e376452"><code>85693e1</code></a>
build(deps-dev): bump eslint-config-stylelint from 27.0.0 to 28.0.0 (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1376">#1376</a>)</li>
<li><a
href="https://github.com/stylelint-scss/stylelint-scss/commit/be7b0baed96349c2b5ce25b27fc775a68af60dca"><code>be7b0ba</code></a>
Fix at-root-no-redundant autofix for bare <a
href="https://github.com/at-root"><code>@​at-root</code></a> blocks.
Fixes <a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1368">#1368</a>.
(<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1375">#1375</a>)</li>
<li><a
href="https://github.com/stylelint-scss/stylelint-scss/commit/e55d4648eab050191e3832487d8c5a2352a9ada2"><code>e55d464</code></a>
build(deps-dev): bump the development-dependencies group across 1
directory w...</li>
<li><a
href="https://github.com/stylelint-scss/stylelint-scss/commit/7d0e19265b9e3eb8eca37d0792f317e6bc66b8c3"><code>7d0e192</code></a>
build(deps-dev): bump undici from 6.29.0 to 6.29.1 (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1372">#1372</a>)</li>
<li><a
href="https://github.com/stylelint-scss/stylelint-scss/commit/c233dbcd6c30d144cf31f96d6a9d63ab79d72491"><code>c233dbc</code></a>
build(deps): bump fast-uri from 3.1.7 to 3.1.9 (<a
href="https://redirect.github.com/stylelint-scss/stylelint-scss/issues/1371">#1371</a>)</li>
<li><a
href="https://github.com/stylelint-scss/stylelint-scss/commit/b861124a9add01cdb657fa1b081e3d4f06cedc05"><code>b861124</code></a>
Fix dollar-variable-no-missing-interpolation for imported vars in custom
prop...</li>
<li>Additional commits viewable in <a
href="https://github.com/stylelint-scss/stylelint-scss/compare/v7.3.0...v7.4.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=stylelint-scss&package-manager=npm_and_yarn&previous-version=7.3.0&new-version=7.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-29 13:56:53 +00:00
dependabot[bot] 0e934b3ba3 chore(deps): Bump i18next from 26.5.10 to 26.5.11 (#2281) 
Bumps [i18next](https://github.com/i18next/i18next) from 26.5.10 to
26.5.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.5.11</h2>
<ul>
<li>fix: a nested <code>false</code>, <code>0</code> or <code>''</code>
is now returned when a flat key with the same dotted name also exists.
With <code>{ a: { b: false }, 'a.b': 'flat' }</code>,
<code>getResource('en', 'translation', 'a.b')</code> and
<code>t('a.b')</code> returned <code>'flat'</code>: the nested result
was checked for truthiness, so these present values fell through to the
flat-key lookup. Without such a flat key they were already returned. A
nested <code>null</code>, which is not a valid lookup by default
(<code>returnNull: false</code>), still falls back to the flat key.
Thanks <a href="https://github.com/lprnmns"><code>@​lprnmns</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2461">#2461</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.5.11</h2>
<ul>
<li>fix: a nested <code>false</code>, <code>0</code> or <code>''</code>
is now returned when a flat key with the same dotted name also exists.
With <code>{ a: { b: false }, 'a.b': 'flat' }</code>,
<code>getResource('en', 'translation', 'a.b')</code> and
<code>t('a.b')</code> returned <code>'flat'</code>: the nested result
was checked for truthiness, so these present values fell through to the
flat-key lookup. Without such a flat key they were already returned. A
nested <code>null</code>, which is not a valid lookup by default
(<code>returnNull: false</code>), still falls back to the flat key.
Thanks <a href="https://github.com/lprnmns"><code>@​lprnmns</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2461">#2461</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next/commit/a0ab5e992120d62b353d6f75e4f63a39e0eb6e44"><code>a0ab5e9</code></a>
26.5.11</li>
<li><a
href="https://github.com/i18next/i18next/commit/a08cf9e2c95ccee198ecd1b4b3f5f39d2af214b5"><code>a08cf9e</code></a>
build</li>
<li><a
href="https://github.com/i18next/i18next/commit/81677f99c468ffa8e946986707af34abc7535fc0"><code>81677f9</code></a>
changelog for 26.5.11</li>
<li><a
href="https://github.com/i18next/i18next/commit/a92934eacf5740ce40767bb82f2df9cf5e36867d"><code>a92934e</code></a>
fix: keep a nested null falling back to a flat key</li>
<li><a
href="https://github.com/i18next/i18next/commit/ad6e1ac337cdd7ab952e5e22598e0fe50b23e568"><code>ad6e1ac</code></a>
fix: preserve falsy nested resource values (<a
href="https://redirect.github.com/i18next/i18next/issues/2461">#2461</a>)</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next/compare/v26.5.10...v26.5.11">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next&package-manager=npm_and_yarn&previous-version=26.5.10&new-version=26.5.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-29 13:54:11 +00:00
dependabot[bot] 8a298d4d13 chore(deps): Bump qs from 6.16.0 to 6.17.0 (#2279) 
Bumps [qs](https://github.com/ljharb/qs) from 6.16.0 to 6.17.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.17.0</strong></h2>
<ul>
<li>[New] <code>stringify</code>: add <code>WHATWG</code> format (<a
href="https://redirect.github.com/ljharb/qs/issues/623">#623</a>)</li>
<li>[Fix] <code>stringify</code>: do not sort the caller's
<code>filter</code> array in place (<a
href="https://redirect.github.com/ljharb/qs/issues/637">#637</a>)</li>
<li>[Fix] <code>parse</code>: copy an own <code>__proto__</code> key as
data (<a
href="https://redirect.github.com/ljharb/qs/issues/636">#636</a>)</li>
<li>[Fix] <code>parse</code>: decode percent-encoded dots
case-insensitively (<a
href="https://redirect.github.com/ljharb/qs/issues/635">#635</a>)</li>
<li>[Fix] <code>stringify</code>: encode keys when
<code>allowEmptyArrays</code> is set (<a
href="https://redirect.github.com/ljharb/qs/issues/561">#561</a>)</li>
<li>[Fix] <code>parse</code>: preserve comma arrays when interpreting
numeric entities (<a
href="https://redirect.github.com/ljharb/qs/issues/630">#630</a>)</li>
<li>[Fix] <code>parse</code>: allow scalar fields with a zero array
limit (<a
href="https://redirect.github.com/ljharb/qs/issues/627">#627</a>)</li>
<li>[Fix] <code>parse</code>: do not count an existing comma array
toward <code>arrayLimit</code> when <code>duplicates</code> discards or
replaces it</li>
<li>[Fix] <code>utils</code>: <code>encode</code>: encode lone
surrogates as U+FFFD instead of consuming the next code unit (<a
href="https://redirect.github.com/ljharb/qs/issues/624">#624</a>)</li>
<li>[eslint] fix indentation</li>
<li>[readme] document the encoder's <code>format</code> argument</li>
<li>[meta] add changelog acknowledgement</li>
<li>[meta] fix changelog indents</li>
<li>[Dev Deps] update <code>eslint</code>, <code>evalmd</code>,
<code>npmignore</code></li>
<li>[Tests] <code>stringify</code>: pin <code>allowEmptyArrays</code>
output for keys that need no encoding</li>
<li>[Tests] <code>stringify</code>: pin <code>sort</code> order for
nested keys selected by an array <code>filter</code></li>
<li>[Tests] <code>parse</code>: cover
<code>interpretNumericEntities</code> across value shapes, keys, and the
charset sentinel</li>
<li>[Tests] <code>parse</code>: cover more input that builds no array at
a zero or negative <code>arrayLimit</code></li>
<li>[Tests] <code>parse</code>: cover <code>comma</code> with a zero or
negative <code>arrayLimit</code>, and combining a full comma array</li>
<li>[Tests] <code>parse</code>: pin the behavior of a zero or negative
<code>arrayLimit</code></li>
<li>[Tests] <code>utils</code>/<code>stringify</code>: pin
<code>~</code>, <code>*</code>, and parens encoding in RFC3986 and
RFC1738</li>
</ul>
<h2><strong>6.16.2</strong></h2>
<ul>
<li>[Fix] <code>stringify</code>: encode keys when
<code>allowEmptyArrays</code> is set (<a
href="https://redirect.github.com/ljharb/qs/issues/561">#561</a>)</li>
<li>[meta] use double quotes for better OS support</li>
<li>[Dev Deps] update <code>evalmd</code>, <code>npmignore</code></li>
<li>[Tests] <code>stringify</code>: pin <code>allowEmptyArrays</code>
output for keys that need no encoding</li>
</ul>
<h2><strong>6.16.1</strong></h2>
<ul>
<li>[Fix] <code>parse</code>: do not mutate an object input</li>
<li>[Fix] <code>stringify</code>: stop re-encoding structural separator
dots when <code>encodeDotInKeys</code> is set (<a
href="https://redirect.github.com/ljharb/qs/issues/564">#564</a>)</li>
<li>[Fix] <code>stringify</code>: <code>arrayFormat: 'comma'</code>:
pass the full encoder arguments with <code>encodeValuesOnly</code></li>
<li>[Fix] <code>utils</code>: encode <code>+</code> as <code>%2B</code>
in iso-8859-1 mode so values round-trip (<a
href="https://redirect.github.com/ljharb/qs/issues/565">#565</a>)</li>
<li>[Fix] parse: only convert top-level dots to brackets when allowDots
is on (<a
href="https://redirect.github.com/ljharb/qs/issues/621">#621</a>)</li>
<li>[Fix] <code>stringify</code>: ignore inherited array format names
(<a
href="https://redirect.github.com/ljharb/qs/issues/622">#622</a>)</li>
<li>[Fix] <code>stringify</code>: <code>arrayFormat: 'comma'</code>: do
not throw on elements with no callable <code>toString</code></li>
<li>[Fix] <code>utils</code>: <code>merge</code>: seed an overflow
container's index from its own keys, not just the source</li>
<li>[Fix] <code>utils</code>: <code>merge</code>: keep a
<code>strictMerge</code> conflict container's index and
<code>arrayLimit</code> correct</li>
<li>[Fix] <code>parse</code>: only treat <code>[]</code> as array syntax
when it ends the key</li>
<li>[Perf] <code>decode</code>: skip decoders when there is no percent
sign (<a
href="https://redirect.github.com/ljharb/qs/issues/583">#583</a>)</li>
<li>[Robustness] <code>utils</code>: <code>merge</code>: apply
<code>arrayLimit</code> to the two-element array built for colliding
values</li>
<li>[Robustness] <code>parse</code>: bound the nesting added by repeated
<code>strictMerge</code> conflicts (credit <a
href="https://github.com/Yeaseen"><code>@​Yeaseen</code></a>)</li>
<li>[Docs] document that <code>qs</code> and flat parsers disagree about
parameter names</li>
<li>[Docs] clarify that <code>throwOnLimitExceeded</code> limits each
array, not the total number of values</li>
<li>[Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (<a
href="https://redirect.github.com/ljharb/qs/issues/567">#567</a>, <a
href="https://redirect.github.com/ljharb/qs/issues/568">#568</a>)</li>
<li>[meta] fix changelog indents</li>
<li>[actions] set least-privilege <code>cache-mode</code></li>
<li>[Tests] <code>utils</code>: <code>decode</code>: add missing
cases</li>
<li>[Tests] <code>parse</code>: characterize the <code>]=</code> split
when an <code>=</code> precedes any bracket group (<a
href="https://redirect.github.com/ljharb/qs/issues/620">#620</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ljharb/qs/commit/bebfa1ab2ed4e5d6cd9317d42a65609296ebd2cb"><code>bebfa1a</code></a>
v6.17.0</li>
<li><a
href="https://github.com/ljharb/qs/commit/574a28be4cb190a3f3249b6fd325b16cd146b762"><code>574a28b</code></a>
[Dev Deps] update <code>eslint</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/54f7f3b7b8df3d59a05255be1ef81208fdee1412"><code>54f7f3b</code></a>
[Fix] <code>stringify</code>: do not sort the caller's
<code>filter</code> array in place</li>
<li><a
href="https://github.com/ljharb/qs/commit/a2667af367b13fe0e5cc5bc8aad176ea57160f8b"><code>a2667af</code></a>
[Fix] <code>parse</code>: copy an own <code>__proto__</code> key as
data</li>
<li><a
href="https://github.com/ljharb/qs/commit/05a875552a31829825c3ebf8899f280011aa06be"><code>05a8755</code></a>
[Fix] <code>parse</code>: decode percent-encoded dots
case-insensitively</li>
<li><a
href="https://github.com/ljharb/qs/commit/234d5051f5071efaa025a7ca9e4d34a56a460a1b"><code>234d505</code></a>
[Fix] <code>stringify</code>: encode keys when
<code>allowEmptyArrays</code> is set</li>
<li><a
href="https://github.com/ljharb/qs/commit/5d9999948fb2718acfa4436b9d6a8ac181812873"><code>5d99999</code></a>
[Tests] <code>stringify</code>: pin <code>allowEmptyArrays</code> output
for keys that need no enco...</li>
<li><a
href="https://github.com/ljharb/qs/commit/feafd1517d5304cf07675c7a5efa5f2b1a905067"><code>feafd15</code></a>
[Tests] <code>stringify</code>: pin <code>sort</code> order for nested
keys selected by an array `f...</li>
<li><a
href="https://github.com/ljharb/qs/commit/b43b1cf8d0747d8520746d8cf6998d568431816a"><code>b43b1cf</code></a>
[Fix] <code>parse</code>: preserve comma arrays when interpreting
numeric entities</li>
<li><a
href="https://github.com/ljharb/qs/commit/81e7a2251d5a7f4c38e8ea77a31a285ab16d1822"><code>81e7a22</code></a>
[Tests] <code>parse</code>: cover <code>interpretNumericEntities</code>
across value shapes, keys, ...</li>
<li>Additional commits viewable in <a
href="https://github.com/ljharb/qs/compare/v6.16.0...v6.17.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-28 14:07:42 +00:00
dependabot[bot] 81ec4207e1 chore(deps-dev): Bump i18next-cli from 1.80.1 to 1.80.4 (#2278) 
Bumps [i18next-cli](https://github.com/i18next/i18next-cli) from 1.80.1
to 1.80.4.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md">i18next-cli's
changelog</a>.</em></p>
<blockquote>
<h2>1.80.4</h2>
<ul>
<li>fix(rename-key): calls with a string default value are renamed in
the source. <code>t('key', 'Default')</code> and
<code>t('key', 'Default', { … })</code> were left untouched while the
translation files were renamed, so the next <code>extract</code>
brought the old key back. Moving such a key to another namespace keeps
the default value:
<code>t('key', 'Default', { ns: 'ns2' })</code>.</li>
<li>fix(extract): plural forms of a key stored flat stay flat in
secondary locales. With <code>&quot;Loading..._one&quot;</code> in
<code>ru/translation.json</code>, <code>extract</code> also wrote a
nested copy, <code>{ &quot;Loading&quot;: { &quot;&quot;: {
&quot;&quot;: { &quot;_one&quot;: … } } } }</code>; the same
happened for generated forms (<code>_few</code>, <code>_many</code>),
preserved <code>_zero</code> forms, context variants and
<code>preservePatterns</code>.
A file that already has these nested copies loses them on the next
<code>extract</code>.</li>
</ul>
<h2>1.80.3</h2>
<ul>
<li>fix(rename-key): keys the extractor stores flat are renamed in the
translation files. Renaming <code>&quot;Loading...&quot;</code> to
<code>&quot;Saving...&quot;</code> left the old key in place and wrote
<code>{ &quot;Saving&quot;: { &quot;&quot;: { &quot;&quot;: {
&quot;&quot;: &quot;Loading...&quot; } } } }</code>; renaming
<code>common.ok</code> to <code>&quot;Okay, thanks.&quot;</code> wrote
<code>{ &quot;Okay, thanks&quot;: { &quot;&quot;: &quot;OK&quot; }
}</code>. The new key is now written where the next
<code>extract</code> puts it (flat for
<code>&quot;Loading...&quot;</code>, natural-language and
<code>&lt;Trans&gt;</code> keys), and the old key is removed however
the file stores it. <a
href="https://redirect.github.com/i18next/i18next-cli/pull/311">#311</a></li>
</ul>
<h2>1.80.2</h2>
<ul>
<li>fix(sync): flat keys that contain the key separator keep their
translations. The extractor writes keys like
<code>&quot;Loading...&quot;</code> or <code>&quot;Hello world.
Bye&quot;</code> as one flat key, but <code>sync</code> split them on
the separator, so a secondary file
with <code>{ &quot;Loading...&quot;: &quot;Lädt...&quot; }</code> became
<code>{ &quot;Loading&quot;: { &quot;&quot;: { &quot;&quot;: {
&quot;&quot;: &quot;&quot; } } } }</code> and the translation was lost.
<code>sync</code> now writes them flat, and <code>status</code>,
<code>localize</code> and <code>rename-key</code> find their values too.
A secondary file
already broken this way gets its flat key back (with an empty value) on
the next <code>sync</code>.
<a
href="https://redirect.github.com/i18next/i18next-cli/pull/310">#310</a></li>
<li>fix(types): placeholders with spaces on one side only (<code>{{
name}}</code>) are trimmed, and <code>enableSelector</code> no longer
throws on plural keys whose base name is <code>constructor</code>,
<code>toString</code>, … or also an object
(i18next-resources-for-ts 2.1.2).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-cli/commit/be52852303d5aa80738a2cef279e4c5ea223eb5e"><code>be52852</code></a>
1.80.4</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/c77cae2bdb8efd9e3627f4818d3ffe8d8d97cd63"><code>c77cae2</code></a>
fix(rename-key, extract): rename calls with a default value, keep plural
form...</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/a8830f9eddff0f937cb39bd7c841e8a6e996baa6"><code>a8830f9</code></a>
1.80.3</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/63d076fecfd151f7548375c2f9597388c7c30d16"><code>63d076f</code></a>
docs: changelog for 1.80.3, fix flat-key example in comments</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/43d27c0a71f080e77109c4018f97f8756dec422c"><code>43d27c0</code></a>
fix(rename-key): rename keys the extractor stores flat (<a
href="https://redirect.github.com/i18next/i18next-cli/issues/311">#311</a>)</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/7e741735b237259f2f763b6872f8366f3e38dba3"><code>7e74173</code></a>
1.80.2</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/8cbed126445c98422fe41ff2656c781290734965"><code>8cbed12</code></a>
chore(deps): i18next-resources-for-ts 2.1.2, changelog</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/108a745a73ba1c5622f6d7bd92da682931f77713"><code>108a745</code></a>
fix(sync): keep flat keys that contain the key separator (<a
href="https://redirect.github.com/i18next/i18next-cli/issues/310">#310</a>)</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-cli/compare/v1.80.1...v1.80.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next-cli&package-manager=npm_and_yarn&previous-version=1.80.1&new-version=1.80.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-28 13:56:01 +00:00
dependabot[bot] 2a9f305fc4 chore(deps): Bump maplibre-gl from 6.15.0 to 6.16.0 (#2276) 
Bumps [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) from
6.15.0 to 6.16.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/maplibre/maplibre-gl-js/releases">maplibre-gl's
releases</a>.</em></p>
<blockquote>
<h2>v6.16.0</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Allow <code>Map#setMaxBounds</code> to constrain one geographic axis
without constraining the other (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/6148">#6148</a>)
(by <a
href="https://github.com/erenbati"><code>@​erenbati</code></a>)</li>
<li>Allow calling <code>new Map({ transformStyle: { ... }})</code> to
provide a style transformation function similar to the same option in
<code>setStyle</code> (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8786">#8786</a>)
(by <a
href="https://github.com/hiddewie"><code>@​hiddewie</code></a>)</li>
<li>Add accept headers for MLT according to the current capabilities (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/7483">#7483</a>)
(by <a
href="https://github.com/CommanderStorm"><code>@​CommanderStorm</code></a>)</li>
</ul>
<h3>🐞 Bug fixes</h3>
<ul>
<li>Fix expired vector tiles erroring on their next reload, e.g. after
<code>setFilter()</code>, when the server returns an unchanged ETag (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8771">#8771</a>)
(by <a
href="https://github.com/DoFabien"><code>@​DoFabien</code></a>)</li>
<li>Fix <code>GeoJSONSource.getBounds</code> throwing when a feature has
a <code>null</code> geometry (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8814">#8814</a>)
(by <a
href="https://github.com/auraseb"><code>@​auraseb</code></a>)</li>
<li>Fix characters covered by <code>font-faces</code> switching to
glyphs from the glyphs URL once their PBF range is downloaded (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8490">#8490</a>)
(by <a
href="https://github.com/NEKOYASAN"><code>@​NEKOYASAN</code></a>)</li>
<li>Fix the map shrinking to a single stretched pixel for good when it
resizes after the WebGL context is lost but before
<code>webglcontextlost</code> fires, e.g. when a mobile browser returns
from the background (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8837">#8837</a>)
(by <a href="https://github.com/lazerg"><code>@​lazerg</code></a>)</li>
<li>Fix <code>TypeError: Cannot read properties of undefined (reading
'0')</code> when drawing a line layer with a constant
<code>line-dasharray</code> whose dash positions were never set (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8846">#8846</a>)
(by <a
href="https://github.com/yulman2207"><code>@​yulman2207</code></a>)</li>
<li>Fix <code>GeoJSONSource.updateData</code> applying a queued update
to a feature that a later call adds again (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8804">#8804</a>)
(by <a
href="https://github.com/architpai"><code>@​architpai</code></a>)</li>
<li>Fix images added with <code>addImage</code>, e.g. from
<code>styleimagemissing</code>, not showing in tiles that were reloaded
after the map was panned across 180° (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8858">#8858</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Fix maps that stop loading after iOS shuts down their background
workers to save memory (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8461">#8461</a>,
<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8491">#8491</a>)
(by <a href="https://github.com/lucaswoj"><code>@​lucaswoj</code></a>,
<a href="https://github.com/ingalls"><code>@​ingalls</code></a>, and <a
href="https://github.com/HarelM"><code>@​HarelM</code></a>)</li>
<li>Fix vector tiles past the source's maxzoom failing to load when
slicing leaves a one-point line (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8681">#8681</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Fix terrain drawing flat at low zoom, where its tiles are at the DEM
source's minzoom (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8772">#8772</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Fix <code>queryRenderedFeatures</code> missing part of a GeoJSON
polygon whose ring does not repeat its first point (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8874">#8874</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md">maplibre-gl's
changelog</a>.</em></p>
<blockquote>
<h2>6.16.0</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Allow <code>Map#setMaxBounds</code> to constrain one geographic axis
without constraining the other (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/6148">#6148</a>)
(by <a
href="https://github.com/erenbati"><code>@​erenbati</code></a>)</li>
<li>Allow calling <code>new Map({ transformStyle: { ... }})</code> to
provide a style transformation function similar to the same option in
<code>setStyle</code> (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8786">#8786</a>)
(by <a
href="https://github.com/hiddewie"><code>@​hiddewie</code></a>)</li>
<li>Add accept headers for MLT according to the current capabilities (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/7483">#7483</a>)
(by <a
href="https://github.com/CommanderStorm"><code>@​CommanderStorm</code></a>)</li>
</ul>
<h3>🐞 Bug fixes</h3>
<ul>
<li>Fix expired vector tiles erroring on their next reload, e.g. after
<code>setFilter()</code>, when the server returns an unchanged ETag (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8771">#8771</a>)
(by <a
href="https://github.com/DoFabien"><code>@​DoFabien</code></a>)</li>
<li>Fix <code>GeoJSONSource.getBounds</code> throwing when a feature has
a <code>null</code> geometry (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8814">#8814</a>)
(by <a
href="https://github.com/auraseb"><code>@​auraseb</code></a>)</li>
<li>Fix characters covered by <code>font-faces</code> switching to
glyphs from the glyphs URL once their PBF range is downloaded (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8490">#8490</a>)
(by <a
href="https://github.com/NEKOYASAN"><code>@​NEKOYASAN</code></a>)</li>
<li>Fix the map shrinking to a single stretched pixel for good when it
resizes after the WebGL context is lost but before
<code>webglcontextlost</code> fires, e.g. when a mobile browser returns
from the background (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8837">#8837</a>)
(by <a href="https://github.com/lazerg"><code>@​lazerg</code></a>)</li>
<li>Fix <code>TypeError: Cannot read properties of undefined (reading
'0')</code> when drawing a line layer with a constant
<code>line-dasharray</code> whose dash positions were never set (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8846">#8846</a>)
(by <a
href="https://github.com/yulman2207"><code>@​yulman2207</code></a>)</li>
<li>Fix <code>GeoJSONSource.updateData</code> applying a queued update
to a feature that a later call adds again (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8804">#8804</a>)
(by <a
href="https://github.com/architpai"><code>@​architpai</code></a>)</li>
<li>Fix images added with <code>addImage</code>, e.g. from
<code>styleimagemissing</code>, not showing in tiles that were reloaded
after the map was panned across 180° (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8858">#8858</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Fix maps that stop loading after iOS shuts down their background
workers to save memory (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8461">#8461</a>,
<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8491">#8491</a>)
(by <a href="https://github.com/lucaswoj"><code>@​lucaswoj</code></a>,
<a href="https://github.com/ingalls"><code>@​ingalls</code></a>, and <a
href="https://github.com/HarelM"><code>@​HarelM</code></a>)</li>
<li>Fix vector tiles past the source's maxzoom failing to load when
slicing leaves a one-point line (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8681">#8681</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Fix terrain drawing flat at low zoom, where its tiles are at the DEM
source's minzoom (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8772">#8772</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Fix <code>queryRenderedFeatures</code> missing part of a GeoJSON
polygon whose ring does not repeat its first point (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8874">#8874</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/538a7680ab16d5cf5a6564ee0ce72a11be14d142"><code>538a768</code></a>
Bump js version to 6.16.0 (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8880">#8880</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/2c7bcbdc2117913fa4e1e168b46afaa9eaa998a6"><code>2c7bcbd</code></a>
chore(deps-dev): bump fast-uri (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8878">#8878</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/93374993c80463cc7660062530c694de6ace25ca"><code>9337499</code></a>
chore(deps): bump fast-uri from 3.1.7 to 3.1.9 (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8877">#8877</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/23d35d905be82b9db7ed4c67810d74593059ec8e"><code>23d35d9</code></a>
fix: <code>queryRenderedFeatures</code> missing part of a GeoJSON
polygon whose ring doe...</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/33a237066fa9aca2258af950680717a27869dfe7"><code>33a2370</code></a>
fix: keep terrain relief at low zoom, where its tiles are at the DEM
source's...</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/23e09377a5c7997b825d3c57f9b6872cbb2c3c03"><code>23e0937</code></a>
fix: images added with <code>addImage</code> missing from tiles reloaded
after panning a...</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/393b6e989cc59bf5ac5f36fe88001bf2fc19f483"><code>393b6e9</code></a>
CSC-1.8 Read the camera state directly in the projection classes (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8870">#8870</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/fc727114698ec7819fe80a20472ff5cec5975760"><code>fc72711</code></a>
fix: keep two points when clipping a line that ends on the slice's edge
(<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8869">#8869</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/da14df808f394e34d3aa3797b771df11357c769c"><code>da14df8</code></a>
CSC-1.7 Pass the tile zoom to the terrain elevation lookups instead of
the tr...</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/3ea36bb61fd93ed9f67e38091bdd8f12948b6cf1"><code>3ea36bb</code></a>
CSC-1.6 Split the camera calculations from the writes in the projection
class...</li>
<li>Additional commits viewable in <a
href="https://github.com/maplibre/maplibre-gl-js/compare/v6.15.0...v6.16.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=maplibre-gl&package-manager=npm_and_yarn&previous-version=6.15.0&new-version=6.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-28 13:55:06 +00:00
dependabot[bot] 501191c6aa chore(deps): Bump @maplibre/maplibre-gl-style-spec from 26.4.4 to 26.5.0 (#2277) 
Bumps
[@maplibre/maplibre-gl-style-spec](https://github.com/maplibre/maplibre-style-spec)
from 26.4.4 to 26.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/maplibre/maplibre-style-spec/releases">@​maplibre/maplibre-gl-style-spec's
releases</a>.</em></p>
<blockquote>
<h2>v26.5.0</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Allow the <code>elevation</code> expression in
<code>fill-extrusion-color</code> to color extrusions by height above
the ground (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1851">#1851</a>)</li>
<li>feat: intial <code>{fill,line}-layer-blend</code> support (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1798">#1798</a>,
<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1950">#1950</a>)
(by <a
href="https://github.com/CommanderStorm"><code>@​CommanderStorm</code></a>)</li>
</ul>
<h3>🐞 Bug fixes</h3>
<ul>
<li>Make <code>createPropertyExpression</code> take linear time on
nested <code>let</code> and <code>coalesce</code>. Each level used to
double the time: 20 levels took about 300 ms and 22 about a second (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1933">#1933</a>)
(by <a
href="https://github.com/essejmclean"><code>@​essejmclean</code></a>)</li>
<li>Fix dead links to renamed maplibre-gl-js examples in the expression
docs (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1948">#1948</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/maplibre/maplibre-style-spec/blob/main/CHANGELOG.md">@​maplibre/maplibre-gl-style-spec's
changelog</a>.</em></p>
<blockquote>
<h2>26.5.0</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Allow the <code>elevation</code> expression in
<code>fill-extrusion-color</code> to color extrusions by height above
the ground (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1851">#1851</a>)</li>
<li>feat: intial <code>{fill,line}-layer-blend</code> support (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1798">#1798</a>,
<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1950">#1950</a>)
(by <a
href="https://github.com/CommanderStorm"><code>@​CommanderStorm</code></a>)</li>
</ul>
<h3>🐞 Bug fixes</h3>
<ul>
<li>Make <code>createPropertyExpression</code> take linear time on
nested <code>let</code> and <code>coalesce</code>. Each level used to
double the time: 20 levels took about 300 ms and 22 about a second (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1933">#1933</a>)
(by <a
href="https://github.com/essejmclean"><code>@​essejmclean</code></a>)</li>
<li>Fix dead links to renamed maplibre-gl-js examples in the expression
docs (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1948">#1948</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/f5708a944ac65d46620a649b2edaa51eed719b3e"><code>f5708a9</code></a>
Bump js version to 26.5.0 (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1951">#1951</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/40fb5d866ea885aeed1e0fa7514c5a5b10fd29dc"><code>40fb5d8</code></a>
Fix dead links to renamed maplibre-gl-js examples (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1948">#1948</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/768ff6dca444cd5fa7adba0874d2641066a0cefd"><code>768ff6d</code></a>
Add missing cross-reference links in v8.json doc strings (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1946">#1946</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/85087cc63fe11f95e7d800a5fb0122a02a3ea347"><code>85087cc</code></a>
Update sdk-support for global-state with MapLibre Android and iOS
versions (#...</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/e285fb6ce964cc2de596055d3df7cdf52f3fc283"><code>e285fb6</code></a>
test(layer-blend): add testcases requested in code review (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1950">#1950</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/10b247c7712b9018487e8b8cb69a9dd04bf295d2"><code>10b247c</code></a>
feat: intial <code>{fill,line}-layer-blend</code> support (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1798">#1798</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/17337d88a4b54db153fd37ef8fa4aca03ea7876a"><code>17337d8</code></a>
Allow elevation expression in fill-extrusion-color (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1851">#1851</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/7805437aa9f76bd71a64d4521a6360f89870afb0"><code>7805437</code></a>
build(deps-dev): bump oxfmt from 0.73.0 to 0.74.0 (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1942">#1942</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/a2c96cb8deb5b43420dd6b6bb3f90fd1a9bab11c"><code>a2c96cb</code></a>
build(deps-dev): bump <code>@​typescript-eslint/eslint-plugin</code> (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1941">#1941</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/98f1a28d9cb49c51b09441573400a0aff674d14e"><code>98f1a28</code></a>
build(deps-dev): bump eslint from 10.12.0 to 10.13.0 (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1940">#1940</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/maplibre/maplibre-style-spec/compare/v26.4.4...v26.5.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@maplibre/maplibre-gl-style-spec&package-manager=npm_and_yarn&previous-version=26.4.4&new-version=26.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-28 13:54:13 +00:00
dependabot[bot] f23506c365 chore(deps): Bump react-resizable-panels from 4.14.8 to 4.15.0 in the react group (#2275) 
Bumps the react group with 1 update:
[react-resizable-panels](https://github.com/bvaughn/react-resizable-panels).

Updates `react-resizable-panels` from 4.14.8 to 4.15.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/releases">react-resizable-panels's
releases</a>.</em></p>
<blockquote>
<h2>4.15.0</h2>
<ul>
<li>Add <code>useParentGroup</code>, <code>useParentPanel</code>, and
<code>useParentGrid</code> hooks. Components rendered within a
<code>Group</code>, <code>Panel</code>, or <code>Grid</code> can use
them to access the nearest one (including its imperative API) without
passing refs down; they return <code>null</code> outside of a matching
component. Within a <code>Cell</code>, <code>useParentGroup</code>
returns the nearest <code>Group</code> outside of the <code>Grid</code>.
- <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/775">#775</a></li>
<li>Imperative <code>Panel</code> and <code>GridTrack</code>
<code>resize()</code>, <code>collapse()</code>, and
<code>expand()</code> calls (and double-clicking a separator to reset a
panel's size) now take space from, or give it to, the nearest panels
that can absorb it, on either side of the panel being resized.
Previously only the panels on one side were used, starting with the
adjacent panel, so these calls could silently do nothing (e.g. when the
next panel was collapsed) or unexpectedly collapse or expand other
panels. Changes that don't collapse or expand other panels are now
preferred. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/774">#774</a></li>
<li><code>expand()</code> still restores a panel's most recent size, but
if that would require collapsing another panel, it now expands to the
largest size that fits instead (as long as that's at least its
<code>minSize</code>). - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/774">#774</a></li>
<li>Fix releasing the pointer after dragging the boundary between panels
that don't have a <code>Separator</code> &quot;clicking&quot; the
element under the pointer (e.g. a button in a panel header). - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/774">#774</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md">react-resizable-panels's
changelog</a>.</em></p>
<blockquote>
<h2>4.15.0</h2>
<ul>
<li>Add <code>useParentGroup</code>, <code>useParentPanel</code>, and
<code>useParentGrid</code> hooks. Components rendered within a
<code>Group</code>, <code>Panel</code>, or <code>Grid</code> can use
them to access the nearest one (including its imperative API) without
passing refs down; they return <code>null</code> outside of a matching
component. Within a <code>Cell</code>, <code>useParentGroup</code>
returns the nearest <code>Group</code> outside of the <code>Grid</code>.
- <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/775">#775</a></li>
<li>Imperative <code>Panel</code> and <code>GridTrack</code>
<code>resize()</code>, <code>collapse()</code>, and
<code>expand()</code> calls (and double-clicking a separator to reset a
panel's size) now take space from, or give it to, the nearest panels
that can absorb it, on either side of the panel being resized.
Previously only the panels on one side were used, starting with the
adjacent panel, so these calls could silently do nothing (e.g. when the
next panel was collapsed) or unexpectedly collapse or expand other
panels. Changes that don't collapse or expand other panels are now
preferred. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/774">#774</a></li>
<li><code>expand()</code> still restores a panel's most recent size, but
if that would require collapsing another panel, it now expands to the
largest size that fits instead (as long as that's at least its
<code>minSize</code>). - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/774">#774</a></li>
<li>Fix releasing the pointer after dragging the boundary between panels
that don't have a <code>Separator</code> &quot;clicking&quot; the
element under the pointer (e.g. a button in a panel header). - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/774">#774</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/f7f213a55036845ec9fcadef2638dda387707c13"><code>f7f213a</code></a>
4.14.8 -&gt; 4.15.0</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/6dac60f950bff2a110f3c9ec27757c08af3108c8"><code>6dac60f</code></a>
Add useParent* hooks (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/775">#775</a>)</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/ca8df1283c1ce0a17b7494639b1829a84065b2a2"><code>ca8df12</code></a>
Support accordions (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/774">#774</a>)</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/ad163a74ff99055ce2e743e94ddce8588003ae11"><code>ad163a7</code></a>
Update react-lib-tools dev dependency; remove local Param component</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/21e636183833d941481b3f8a85b525d899f1fcc3"><code>21e6361</code></a>
Spruce up docs content and demos (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/773">#773</a>)</li>
<li>See full diff in <a
href="https://github.com/bvaughn/react-resizable-panels/compare/4.14.8...4.15.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-resizable-panels&package-manager=npm_and_yarn&previous-version=4.14.8&new-version=4.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-28 13:51:21 +00:00
dependabot[bot] 8fc05f6d20 chore(deps): Bump i18next-browser-languagedetector from 8.2.1 to 8.2.2 (#2274) 
Bumps
[i18next-browser-languagedetector](https://github.com/i18next/i18next-browser-languageDetector)
from 8.2.1 to 8.2.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-browser-languageDetector/blob/master/CHANGELOG.md">i18next-browser-languagedetector's
changelog</a>.</em></p>
<blockquote>
<h3>8.2.2</h3>
<ul>
<li>fix: the path and hash detectors keep digits in a language segment,
so <code>/es-419/</code> and <code>#/es-419</code> are detected as
<code>es-419</code> instead of <code>es-</code> (which i18next resolved
to <code>es</code>). Segments that start with a digit
(<code>/2024/</code>) still yield no language, and
<code>lookupFromPathIndex</code> / <code>lookupFromHashIndex</code>
point at the same segments as before. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> <a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/pull/327">327</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/6e4fa0123b9ebf60b1c2b109ee2f0079c2f6403b"><code>6e4fa01</code></a>
8.2.2</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/e66a3afc957eb85293022ab05ad67d609ec8e797"><code>e66a3af</code></a>
release</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/feedf66e8d036878249a38047141b1c186611b2d"><code>feedf66</code></a>
fix: keep digits of region subtags in path and hash detection (<a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/issues/327">#327</a>)</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/a05f0c5e8c49ec22d88f80feff0291df523dc362"><code>a05f0c5</code></a>
Bump brace-expansion from 1.1.18 to 1.1.21 (<a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/issues/326">#326</a>)</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/ca2366c6197ee05165c9b069fc7a1df59fa906df"><code>ca2366c</code></a>
Bump js-yaml (<a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/issues/325">#325</a>)</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/b1edea5c58908bea7a67c90bb82f46b01386db32"><code>b1edea5</code></a>
Bump browserslist from 4.28.2 to 4.28.9 (<a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/issues/324">#324</a>)</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/b4b823e1f4464871f95f9b2f6be514a0968b571e"><code>b4b823e</code></a>
docs: &quot;For AI assistants&quot; paragraph in the README</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/8d55454ec754047c2acc6f301982e388c40a40c7"><code>8d55454</code></a>
chore: keep dev-only and local files out of the npm package</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/fa858b619a12e43e3299b38635eae19af9592603"><code>fa858b6</code></a>
Bump brace-expansion from 1.1.14 to 1.1.18 (<a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/issues/323">#323</a>)</li>
<li><a
href="https://github.com/i18next/i18next-browser-languageDetector/commit/4515f87aadea6fd273d1a997b0738dad470e7788"><code>4515f87</code></a>
Bump <code>@​babel/core</code> from 7.29.0 to 7.29.6 (<a
href="https://redirect.github.com/i18next/i18next-browser-languageDetector/issues/321">#321</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/i18next/i18next-browser-languageDetector/compare/v8.2.1...v8.2.2">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-27 15:38:10 +00:00
dependabot[bot] 2eba8b0c90 chore(deps): Bump react-i18next from 17.1.4 to 17.1.8 in the react group (#2271) 
Bumps the react group with 1 update:
[react-i18next](https://github.com/i18next/react-i18next).

Updates `react-i18next` from 17.1.4 to 17.1.8
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md">react-i18next's
changelog</a>.</em></p>
<blockquote>
<h2>17.1.8</h2>
<ul>
<li>fix(Trans): an interpolation variable named <code>format</code> is
no longer dropped. <code>Trans</code> reads <code>format</code> in an
interpolation object as the formatter name (<code>{{ value, format
}}</code>), so with <code>{{ format }}</code> as the only key nothing
was left: <code>&lt;Trans&gt;Export as {{ format }}&lt;/Trans&gt;</code>
warned <code>TRANS_INVALID_OBJ</code> and used the default string
<code>Export as </code> instead of <code>Export as {{format}}</code>.
When <code>format</code> is the object's only key it is now treated as
the variable. <code>{{ value, format }}</code> works as before. Without
an <code>i18nKey</code>, the key derived from the children changes
accordingly, from <code>Export as </code> to <code>Export as
{{format}}</code>. i18next-cli serializes <code>Trans</code> children
with react-i18next, so extracting with this version produces the same
key. Thanks <a
href="https://github.com/Pharex38"><code>@​Pharex38</code></a> (<a
href="https://redirect.github.com/i18next/react-i18next/pull/1944">#1944</a>).</li>
</ul>
<h2>17.1.7</h2>
<ul>
<li>fix(IcuTrans): each HTML entity in a translation is now decoded
exactly once. Named, decimal and hexadecimal entities were decoded in
three passes, and each pass decoded the output of the previous one, so
an escaped numeric entity was decoded twice: <code>&quot;Write
&amp;amp;[#169](https://github.com/i18next/react-i18next/issues/169); to
get
&amp;[#169](https://github.com/i18next/react-i18next/issues/169);&quot;</code>
rendered <code>Write © to get ©</code> instead of <code>Write
&amp;[#169](https://github.com/i18next/react-i18next/issues/169); to get
©</code>, and
<code>&amp;amp;[#60](https://github.com/i18next/react-i18next/issues/60);</code>
rendered <code>&lt;</code> instead of
<code>&amp;[#60](https://github.com/i18next/react-i18next/issues/60);</code>.
This also hit interpolated values with <code>escapeValue: true</code>,
where a value containing
<code>&amp;[#60](https://github.com/i18next/react-i18next/issues/60);</code>
is escaped to
<code>&amp;amp;[#60](https://github.com/i18next/react-i18next/issues/60);</code>.
Escaped named entities like <code>&amp;amp;lt;</code> already stayed
<code>&amp;lt;</code>, as browsers and <code>Trans</code> decode them.
Unknown named entities and entities above U+10FFFF still stay as
written. Thanks <a
href="https://github.com/Pharex38"><code>@​Pharex38</code></a> (<a
href="https://redirect.github.com/i18next/react-i18next/pull/1943">#1943</a>).</li>
</ul>
<h2>17.1.6</h2>
<ul>
<li>fix(Trans): a <code>count</code> passed in <code>tOptions</code> is
now used. <code>Trans</code> spread <code>tOptions</code> and then set
its own <code>count</code> prop, so a count only in
<code>tOptions</code> was overwritten with <code>undefined</code>:
<code>&lt;Trans i18nKey=&quot;items&quot; tOptions={{ count: 5 }}
/&gt;</code> rendered the key <code>items</code> instead of <code>5
items</code>, and with children <code>Trans</code> could pick the wrong
plural form. Like <code>context</code>, <code>Trans</code> now falls
back to <code>tOptions.count</code>, handled the same way as the
<code>count</code> prop. A <code>count</code> prop, a count in the
children or <code>values.count</code> still take precedence, and
<code>tOptions</code> is not modified. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/react-i18next/pull/1942">#1942</a>).</li>
</ul>
<h2>17.1.5</h2>
<ul>
<li>fix(Trans): with an array of keys and no children,
<code>Trans</code> now falls back to the last key when none of them has
a translation, as <code>t()</code> does. It used the array itself as
<code>defaultValue</code>, which i18next handles as an object, so
<code>&lt;Trans i18nKey={['notifications.crm_item_created',
'crm_item_created']} components={[&lt;strong /&gt;]} /&gt;</code>
rendered <code>key 'crm_item_created (en)' returned an object instead of
string.</code> instead of <code>crm_item_created</code>. An array of
selectors falls back to the key of the last selector. The first key that
has a translation still wins, and <code>children</code>,
<code>defaults</code> and <code>tOptions.defaultValue</code> are used as
before. With <code>saveMissing</code>, these calls now report the
missing key, like a single <code>i18nKey</code> does. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/react-i18next/pull/1941">#1941</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/react-i18next/commit/3f0880e218f7d1235f474faf1d695d0fbde94a48"><code>3f0880e</code></a>
17.1.8</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/9802f17e3921028ec2f582284b8dc344d4cd8f4d"><code>9802f17</code></a>
build</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/fb5fa17ea9be7b6bcc9990064f99aacb81eaa753"><code>fb5fa17</code></a>
changelog for 17.1.8</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/63f4e41dda4cb42e03edde5611f44018620bdc62"><code>63f4e41</code></a>
fix(Trans): don't drop an interpolation variable named format (<a
href="https://redirect.github.com/i18next/react-i18next/issues/1944">#1944</a>)</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/8655c0f679d4ec8002a2db1c5ad4d447a973d115"><code>8655c0f</code></a>
17.1.7</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/5e2cf4ac622c282572bce4a4cfef1324fb763365"><code>5e2cf4a</code></a>
build</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/4745dc626e14b55095e5f7ac5684859de6dfcd9b"><code>4745dc6</code></a>
changelog for 17.1.7</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/b708a76aedb44484b4fde924ad9e1630adfcbcc1"><code>b708a76</code></a>
fix(IcuTrans): decode each HTML entity only once (<a
href="https://redirect.github.com/i18next/react-i18next/issues/1943">#1943</a>)</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/a8626e0470cdb627a6af420c67ac03a59ae9aff8"><code>a8626e0</code></a>
17.1.6</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/c0cafdf3f4a8b174e05ea999de0b4fe1fb55ec91"><code>c0cafdf</code></a>
build</li>
<li>Additional commits viewable in <a
href="https://github.com/i18next/react-i18next/compare/v17.1.4...v17.1.8">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-i18next&package-manager=npm_and_yarn&previous-version=17.1.4&new-version=17.1.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-27 14:34:13 +00:00
dependabot[bot] a630a98fda chore(deps-dev): Bump i18next-cli from 1.80.0 to 1.80.1 (#2273) 
Bumps [i18next-cli](https://github.com/i18next/i18next-cli) from 1.80.0
to 1.80.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md">i18next-cli's
changelog</a>.</em></p>
<blockquote>
<h2>1.80.1</h2>
<ul>
<li>fix(extract): a <code>&lt;Trans&gt;</code> interpolation variable
named <code>format</code> is extracted. <code>&lt;Trans&gt;Export as {{
format }}&lt;/Trans&gt;</code>
was extracted as <code>Export as </code>, because react-i18next read
<code>format</code> as the formatter name and dropped the variable;
it is now <code>Export as {{format}}</code>, as react-i18next 17.1.8
renders it. Requires react-i18next <code>^17.1.8</code>.</li>
<li>chore(deps): update dependencies within their ranges and neostandard
to 0.14.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-cli/commit/58d5a03c7e66ffe9a67361a3e957ab23debbffd0"><code>58d5a03</code></a>
1.80.1</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/db1ad55504ea78b65f0674c150344e8cb5127424"><code>db1ad55</code></a>
fix(extract): extract a Trans variable named format, update deps</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-cli/compare/v1.80.0...v1.80.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next-cli&package-manager=npm_and_yarn&previous-version=1.80.0&new-version=1.80.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-27 14:33:51 +00:00
dependabot[bot] f6e9a54dfc chore(deps): Bump i18next from 26.5.6 to 26.5.10 (#2272) 
Bumps [i18next](https://github.com/i18next/i18next) from 26.5.6 to
26.5.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.5.10</h2>
<ul>
<li>fix: when none of the detected languages is in
<code>supportedLngs</code>, the best match no longer picks a different
language whose code only starts with the same letters. The last fuzzy
check took any supported code starting with the language part, so with
<code>supportedLngs: ['en', 'fil-PH']</code> a Finnish user
(<code>fi-FI</code>) got Filipino instead of the fallback language, and
<code>ha</code> (Hausa) picked <code>haw-US</code> (Hawaiian). Other
regions of the same language still match as before (<code>de-CH</code> →
<code>de-DE</code>, <code>pt-PT</code> → <code>pt-BR</code>,
<code>fil</code> → <code>fil-PH</code>). Compatibility note: a
two-letter code no longer matches a supported three-letter code that
extends it, like <code>ar</code> → <code>arz-EG</code>, <code>sw</code>
→ <code>swh-KE</code> or <code>no</code> → <code>nob-NO</code>; list the
two-letter code in <code>supportedLngs</code> (or map it with
<code>fallbackLng</code>) if you relied on that. Thanks <a
href="https://github.com/Pharex38"><code>@​Pharex38</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2460">#2460</a>).</li>
</ul>
<h2>v26.5.9</h2>
<ul>
<li>fix: nested lookups no longer resolve to methods inherited from the
prototype, like <code>constructor</code>, <code>toString</code> or
<code>map</code>. Only the top level was guarded, so
<code>{{constructor}}</code> was treated as missing, but
<code>{{user.constructor}}</code> rendered the function source (with a
class instance, the full source code of the class), and
<code>{{user.toString}}</code>, <code>{{items.map}}</code> or a class
method like <code>{{user.greet}}</code> did the same. The same lookup is
used for translation keys when <code>ignoreJSONStructure</code> is on
(the default): a nested key named like an inherited method that is
missing in the current language (<code>t('roles.constructor')</code>
with <code>roles.constructor</code> only in the fallback language)
returned <code>function Object() { [native code] }</code> instead of
falling back, and <code>exists('roles.valueOf')</code> returned
<code>true</code>. These keys are now missing, so the fallback language,
<code>missingInterpolationHandler</code>, <code>saveMissing</code> and
the missing key handler apply as for any other missing key. Getters
defined on a class (<code>{{user.fullName}}</code> with <code>get
fullName()</code>) still work. Nested lookups also no longer walk into
the prototype via <code>__proto__</code>, so
<code>{{user.__proto__.constructor}}</code> no longer prints the class
source either. Thanks <a
href="https://github.com/Pharex38"><code>@​Pharex38</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2459">#2459</a>).</li>
</ul>
<h2>v26.5.8</h2>
<ul>
<li>fix: arrays returned with <code>joinArrays</code> now get the same
resolved details as strings. The joined value was extended with
<code>lastKey</code> in the place of the resolved lookup, so with
<code>postProcessPassResolved</code> a post processor got no
<code>usedLng</code>, <code>usedNS</code> or <code>exactUsedKey</code>
(<code>t('steps', { joinArrays: ' / ' })</code> reported
<code>undefined/undefined:undefined</code>). This affected the
subliminal post processor used by the locize InContext editor, which
could not map a joined array to its key. The nesting recursion guard did
not get the parent key either, so arrays that nest each other
(<code>listA: ['a', '$t(listB)']</code>, <code>listB: ['b',
'$t(listA)']</code>) threw <code>Maximum call stack size
exceeded</code>. They now stop at the guard, as strings do. An
<code>i18nFormat</code> plugin with <code>handleAsObject</code> and
<code>parse</code> also no longer throws <code>Cannot read properties of
undefined (reading 'usedNS')</code> on joined arrays. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2458">#2458</a>).</li>
</ul>
<h2>v26.5.7</h2>
<ul>
<li>fix: with the default <code>cacheInBuiltFormats: true</code>,
built-in formats now also work when the <code>t()</code> options contain
a BigInt or a circular object. The cache key was built with
<code>JSON.stringify</code> over all options, including the
interpolation values, which throws on those, so every built-in format in
that call returned the raw value: <code>t('num', { val:
12345678901234567890n })</code> with <code>'Total: {{val,
number}}'</code> returned <code>'Total: 12345678901234567890'</code>
instead of <code>'Total: 12,345,678,901,234,567,890'</code>, and passing
an object with a back-reference (like an ORM entity) left all numbers,
dates and lists of that call unformatted. When the key cannot be built,
the value is now formatted without the cache, as with
<code>cacheInBuiltFormats: false</code>. This also applies to formatters
added with <code>addCached</code>. Other calls still use the cache as
before. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2457">#2457</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.5.10</h2>
<ul>
<li>fix: when none of the detected languages is in
<code>supportedLngs</code>, the best match no longer picks a different
language whose code only starts with the same letters. The last fuzzy
check took any supported code starting with the language part, so with
<code>supportedLngs: ['en', 'fil-PH']</code> a Finnish user
(<code>fi-FI</code>) got Filipino instead of the fallback language, and
<code>ha</code> (Hausa) picked <code>haw-US</code> (Hawaiian). Other
regions of the same language still match as before (<code>de-CH</code> →
<code>de-DE</code>, <code>pt-PT</code> → <code>pt-BR</code>,
<code>fil</code> → <code>fil-PH</code>). Compatibility note: a
two-letter code no longer matches a supported three-letter code that
extends it, like <code>ar</code> → <code>arz-EG</code>, <code>sw</code>
→ <code>swh-KE</code> or <code>no</code> → <code>nob-NO</code>; list the
two-letter code in <code>supportedLngs</code> (or map it with
<code>fallbackLng</code>) if you relied on that. Thanks <a
href="https://github.com/Pharex38"><code>@​Pharex38</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2460">#2460</a>).</li>
</ul>
<h2>26.5.9</h2>
<ul>
<li>fix: nested lookups no longer resolve to methods inherited from the
prototype, like <code>constructor</code>, <code>toString</code> or
<code>map</code>. Only the top level was guarded, so
<code>{{constructor}}</code> was treated as missing, but
<code>{{user.constructor}}</code> rendered the function source (with a
class instance, the full source code of the class), and
<code>{{user.toString}}</code>, <code>{{items.map}}</code> or a class
method like <code>{{user.greet}}</code> did the same. The same lookup is
used for translation keys when <code>ignoreJSONStructure</code> is on
(the default): a nested key named like an inherited method that is
missing in the current language (<code>t('roles.constructor')</code>
with <code>roles.constructor</code> only in the fallback language)
returned <code>function Object() { [native code] }</code> instead of
falling back, and <code>exists('roles.valueOf')</code> returned
<code>true</code>. These keys are now missing, so the fallback language,
<code>missingInterpolationHandler</code>, <code>saveMissing</code> and
the missing key handler apply as for any other missing key. Getters
defined on a class (<code>{{user.fullName}}</code> with <code>get
fullName()</code>) still work. Nested lookups also no longer walk into
the prototype via <code>__proto__</code>, so
<code>{{user.__proto__.constructor}}</code> no longer prints the class
source either. Thanks <a
href="https://github.com/Pharex38"><code>@​Pharex38</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2459">#2459</a>).</li>
</ul>
<h2>26.5.8</h2>
<ul>
<li>fix: arrays returned with <code>joinArrays</code> now get the same
resolved details as strings. The joined value was extended with
<code>lastKey</code> in the place of the resolved lookup, so with
<code>postProcessPassResolved</code> a post processor got no
<code>usedLng</code>, <code>usedNS</code> or <code>exactUsedKey</code>
(<code>t('steps', { joinArrays: ' / ' })</code> reported
<code>undefined/undefined:undefined</code>). This affected the
subliminal post processor used by the locize InContext editor, which
could not map a joined array to its key. The nesting recursion guard did
not get the parent key either, so arrays that nest each other
(<code>listA: ['a', '$t(listB)']</code>, <code>listB: ['b',
'$t(listA)']</code>) threw <code>Maximum call stack size
exceeded</code>. They now stop at the guard, as strings do. An
<code>i18nFormat</code> plugin with <code>handleAsObject</code> and
<code>parse</code> also no longer throws <code>Cannot read properties of
undefined (reading 'usedNS')</code> on joined arrays. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2458">#2458</a>).</li>
</ul>
<h2>26.5.7</h2>
<ul>
<li>fix: with the default <code>cacheInBuiltFormats: true</code>,
built-in formats now also work when the <code>t()</code> options contain
a BigInt or a circular object. The cache key was built with
<code>JSON.stringify</code> over all options, including the
interpolation values, which throws on those, so every built-in format in
that call returned the raw value: <code>t('num', { val:
12345678901234567890n })</code> with <code>'Total: {{val,
number}}'</code> returned <code>'Total: 12345678901234567890'</code>
instead of <code>'Total: 12,345,678,901,234,567,890'</code>, and passing
an object with a back-reference (like an ORM entity) left all numbers,
dates and lists of that call unformatted. When the key cannot be built,
the value is now formatted without the cache, as with
<code>cacheInBuiltFormats: false</code>. This also applies to formatters
added with <code>addCached</code>. Other calls still use the cache as
before. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2457">#2457</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next/commit/00b6a3f22771e50be732826014d49a6ae2647ef5"><code>00b6a3f</code></a>
26.5.10</li>
<li><a
href="https://github.com/i18next/i18next/commit/9bdd4f6567573e529b7d8088b4e74ec9f3aeef82"><code>9bdd4f6</code></a>
build</li>
<li><a
href="https://github.com/i18next/i18next/commit/fb168f3b2f81f46e64ffbdbde6b97f682a933dde"><code>fb168f3</code></a>
changelog for 26.5.10</li>
<li><a
href="https://github.com/i18next/i18next/commit/2584a56acf2aa2a9f723f0c5a97f8a95499a60ca"><code>2584a56</code></a>
fix: don't match a supported language that only starts with the same
letters ...</li>
<li><a
href="https://github.com/i18next/i18next/commit/6c98e55c7e08b510d705e7d618073997126a9636"><code>6c98e55</code></a>
build</li>
<li><a
href="https://github.com/i18next/i18next/commit/3465ae460a304294475839900d3a813c24a9c6b3"><code>3465ae4</code></a>
26.5.9</li>
<li><a
href="https://github.com/i18next/i18next/commit/5888c1635b27bb6282ef082ef8f59204cbfd695d"><code>5888c16</code></a>
changelog for 26.5.9</li>
<li><a
href="https://github.com/i18next/i18next/commit/db036c88cb58ef27b651ab3562e332dbc9819f97"><code>db036c8</code></a>
fix: don't walk into the prototype via <strong>proto</strong> in nested
lookups</li>
<li><a
href="https://github.com/i18next/i18next/commit/0815882cb34e3e2aab630544692c3be786daf5e0"><code>0815882</code></a>
fix: don't interpolate inherited methods like constructor from nested
values ...</li>
<li><a
href="https://github.com/i18next/i18next/commit/45ae264ad20c0faf7d5e19dd09f100f545c312cf"><code>45ae264</code></a>
26.5.8</li>
<li>Additional commits viewable in <a
href="https://github.com/i18next/i18next/compare/v26.5.6...v26.5.10">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next&package-manager=npm_and_yarn&previous-version=26.5.6&new-version=26.5.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-27 14:32:10 +00:00
dependabot[bot] c64452c1bd chore(deps): Bump i18next from 26.5.3 to 26.5.6 (#2264) 
Bumps [i18next](https://github.com/i18next/i18next) from 26.5.3 to
26.5.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.5.6</h2>
<ul>
<li>fix: <code>cloneInstance({ forkResourceStore: true })</code> now
copies the resources at every level. It copied them only down to the
namespace objects, so nested keys and arrays stayed shared with the
original instance: <code>addResource()</code> with a nested key
(<code>fork.addResource('en', 'translation', 'greeting.hello',
'Hi')</code>) or a deep <code>addResourceBundle()</code> on the fork
also changed the original instance and every other fork. Flat keys were
already isolated. Forking a large store takes a bit longer: with 300k
keys in nested groups, about 11 ms instead of 3 ms per fork. Clones
without <code>forkResourceStore</code> still share the store as before.
Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2456">#2456</a>,
follow-up to <a
href="https://redirect.github.com/i18next/i18next/issues/2270">#2270</a>).</li>
</ul>
<h2>v26.5.5</h2>
<ul>
<li>fix: with the default <code>skipOnVariables: true</code>, a
<code>{{placeholder}}</code> inside a value inserted with an unescaped
<code>{{- var}}</code> now stays literal, as it already did for
<code>{{var}}</code>. The escape pass ran after the unescaped values
were written and scanned them again, so <code>t('{{- a}}', { a: '{{b}}',
b: 'c' })</code> returned <code>'c'</code> instead of
<code>'{{b}}'</code>. With pre-built HTML that carries user text, like
<code>t('You may contact {{name}} at {{- emailHTML}}.', { name,
emailHTML })</code>, that text could pull another variable of the same
<code>t()</code> call into the output. Results with
<code>skipOnVariables: false</code>, and values without placeholders,
are unchanged. Compatibility note: a <code>{{- var}}</code> value whose
placeholders were meant to be filled from the same <code>t()</code> call
now keeps them literally; <code>skipOnVariables: false</code> restores
the old behavior. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2455">#2455</a>,
reported in <a
href="https://redirect.github.com/i18next/i18next/issues/1595#issuecomment-814611747">#1595</a>).</li>
</ul>
<h2>v26.5.4</h2>
<ul>
<li>fix: with the default <code>skipOnVariables: true</code>, a
<code>{{placeholder}}</code> inside an interpolated value now stays
literal also when the same placeholder appears later in the translation.
Each value was written with <code>String.replace</code>, which replaces
the first copy of the placeholder text, and that could be the copy
inside an earlier value: <code>t('{{name}} has {{count}} items', { name:
'{{count}}', count: 5 })</code> returned <code>'5 has {{count}}
items'</code> instead of <code>'{{count}} has 5 items'</code>. The value
is now written at the position of the matched placeholder. Results with
<code>skipOnVariables: false</code> are unchanged. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2454">#2454</a>,
reported in <a
href="https://redirect.github.com/i18next/i18next/issues/1595#issuecomment-814609503">#1595</a>).</li>
<li>fix: with <code>useRawValueToEscape: true</code>, a non-string value
in an unescaped <code>{{- var}}</code> placeholder or with
<code>escapeValue: false</code> no longer throws <code>val.replace is
not a function</code>; it is converted to a string like any other
value.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.5.6</h2>
<ul>
<li>fix: <code>cloneInstance({ forkResourceStore: true })</code> now
copies the resources at every level. It copied them only down to the
namespace objects, so nested keys and arrays stayed shared with the
original instance: <code>addResource()</code> with a nested key
(<code>fork.addResource('en', 'translation', 'greeting.hello',
'Hi')</code>) or a deep <code>addResourceBundle()</code> on the fork
also changed the original instance and every other fork. Flat keys were
already isolated. Forking a large store takes a bit longer: with 300k
keys in nested groups, about 11 ms instead of 3 ms per fork. Clones
without <code>forkResourceStore</code> still share the store as before.
Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2456">#2456</a>,
follow-up to <a
href="https://redirect.github.com/i18next/i18next/issues/2270">#2270</a>).</li>
</ul>
<h2>26.5.5</h2>
<ul>
<li>fix: with the default <code>skipOnVariables: true</code>, a
<code>{{placeholder}}</code> inside a value inserted with an unescaped
<code>{{- var}}</code> now stays literal, as it already did for
<code>{{var}}</code>. The escape pass ran after the unescaped values
were written and scanned them again, so <code>t('{{- a}}', { a: '{{b}}',
b: 'c' })</code> returned <code>'c'</code> instead of
<code>'{{b}}'</code>. With pre-built HTML that carries user text, like
<code>t('You may contact {{name}} at {{- emailHTML}}.', { name,
emailHTML })</code>, that text could pull another variable of the same
<code>t()</code> call into the output. Results with
<code>skipOnVariables: false</code>, and values without placeholders,
are unchanged. Compatibility note: a <code>{{- var}}</code> value whose
placeholders were meant to be filled from the same <code>t()</code> call
now keeps them literally; <code>skipOnVariables: false</code> restores
the old behavior. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2455">#2455</a>,
reported in <a
href="https://redirect.github.com/i18next/i18next/issues/1595#issuecomment-814611747">#1595</a>).</li>
</ul>
<h2>26.5.4</h2>
<ul>
<li>fix: with the default <code>skipOnVariables: true</code>, a
<code>{{placeholder}}</code> inside an interpolated value now stays
literal also when the same placeholder appears later in the translation.
Each value was written with <code>String.replace</code>, which replaces
the first copy of the placeholder text, and that could be the copy
inside an earlier value: <code>t('{{name}} has {{count}} items', { name:
'{{count}}', count: 5 })</code> returned <code>'5 has {{count}}
items'</code> instead of <code>'{{count}} has 5 items'</code>. The value
is now written at the position of the matched placeholder. Results with
<code>skipOnVariables: false</code> are unchanged. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2454">#2454</a>,
reported in <a
href="https://redirect.github.com/i18next/i18next/issues/1595#issuecomment-814609503">#1595</a>).</li>
<li>fix: with <code>useRawValueToEscape: true</code>, a non-string value
in an unescaped <code>{{- var}}</code> placeholder or with
<code>escapeValue: false</code> no longer throws <code>val.replace is
not a function</code>; it is converted to a string like any other
value.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next/commit/82894c159845c3675fb6540db52a4144abbd5d4a"><code>82894c1</code></a>
26.5.6</li>
<li><a
href="https://github.com/i18next/i18next/commit/343080da6802c0badb2fe1032139d49af93d9774"><code>343080d</code></a>
build</li>
<li><a
href="https://github.com/i18next/i18next/commit/8e2eebb132aaccfb752990b6cc61cbfd7d835764"><code>8e2eebb</code></a>
changelog for 26.5.6</li>
<li><a
href="https://github.com/i18next/i18next/commit/822a37bc57f50b4a476aa630f864d3ed1f88a7e9"><code>822a37b</code></a>
fix: copy nested resources when cloning with forkResourceStore (<a
href="https://redirect.github.com/i18next/i18next/issues/2456">#2456</a>)</li>
<li><a
href="https://github.com/i18next/i18next/commit/744c5cb41a19f52ae08d1a71c2d9ceca6525dc1d"><code>744c5cb</code></a>
26.5.5</li>
<li><a
href="https://github.com/i18next/i18next/commit/de5960eee00d9db2a7c1b452d6ce9231c16b6474"><code>de5960e</code></a>
build</li>
<li><a
href="https://github.com/i18next/i18next/commit/fbe16f3429273f2f9c1fe9736f4590fa2e8253a5"><code>fbe16f3</code></a>
changelog for 26.5.5</li>
<li><a
href="https://github.com/i18next/i18next/commit/67b4ae194ed4a1af083119f77daba48f1c295f1d"><code>67b4ae1</code></a>
fix: keep placeholders inside unescaped values literal (<a
href="https://redirect.github.com/i18next/i18next/issues/2455">#2455</a>)</li>
<li><a
href="https://github.com/i18next/i18next/commit/aadd75ba9e88a20b34b7f44798d4e3bd8ec71baa"><code>aadd75b</code></a>
26.5.4</li>
<li><a
href="https://github.com/i18next/i18next/commit/a43c43286a381bbae144c04de9f8056f464c7cd9"><code>a43c432</code></a>
build</li>
<li>Additional commits viewable in <a
href="https://github.com/i18next/i18next/compare/v26.5.3...v26.5.6">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-26 14:26:02 +00:00
dependabot[bot] ab3316d5e9 chore(deps): Bump fast-uri from 3.1.7 to 3.1.9 (#2270) 
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.7 to
3.1.9.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fastify/fast-uri/releases">fast-uri's
releases</a>.</em></p>
<blockquote>
<h2>v3.1.9</h2>
<h2>Security</h2>
<p>This security release fixes four URI parsing and normalization
vulnerabilities in fast-uri 3.x. Applications that process untrusted URI
input should upgrade to v3.1.9.</p>
<ul>
<li><strong>Medium — URI scheme spoofing through percent-encoded
schemes</strong> (<a
href="https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg">GHSA-w74x-v6f9-j3xg</a>,
CVE-2026-110306): percent-encoded scheme input is now rejected instead
of being decoded into a live scheme.</li>
<li><strong>Medium — Host confusion during domain-host
canonicalization</strong> (<a
href="https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr">GHSA-wjr9-j795-jxcr</a>,
CVE-2026-110180): malformed domain hosts containing ambiguous delimiters
or stripped control characters are now rejected instead of being
silently rewritten.</li>
<li><strong>Low — Incorrect relative-reference normalization</strong>
(<a
href="https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h">GHSA-xhq7-xmqj-769h</a>,
CVE-2026-110095): dot-segment removal now preserves the resolution
semantics of relative references.</li>
<li><strong>Low — Scheme injection in suffix references</strong> (<a
href="https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp">GHSA-333x-w4r6-6crp</a>,
CVE-2026-110725): first-segment colons in path-only suffix references
are now escaped so the output is not reparsed as a scheme.</li>
</ul>
<p>Upgrade with:</p>
<pre lang="sh"><code>npm install fast-uri@3.1.9
</code></pre>
<p>Thanks to <a href="https://github.com/zekth"><code>@​zekth</code></a>
for reporting the scheme, host, and relative-reference issues, and to <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
for finding the suffix-reference issue and reviewing the
remediations.</p>
<h2>What's Changed</h2>
<ul>
<li>ci: enable trusted publishing releases (v3.x) by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/fastify/fast-uri/pull/229">fastify/fast-uri#229</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fastify/fast-uri/compare/v3.1.8...v3.1.9">https://github.com/fastify/fast-uri/compare/v3.1.8...v3.1.9</a></p>
<h2>v3.1.8</h2>
<h2>⚠️ Security Warning</h2>
<p>This security release fixes the following medium-severity security
advisory:</p>
<ul>
<li><a
href="https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj">GHSA-hrr3-gc8f-f4qj</a>
— inconsistent host case normalization via percent-encoded octets</li>
</ul>
<p>Users of the v3.x release line should upgrade to v3.1.8.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8">https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fastify/fast-uri/commit/0def70338a0fa2f12a10c83ae8eafc2139ae9a07"><code>0def703</code></a>
Bumped v3.1.9</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/a1d0da2f5c703244027c1b204c1aebd0516da338"><code>a1d0da2</code></a>
test: generate only relative path references</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd"><code>9eb8759</code></a>
fix: preserve relative paths in suffix and relative resolution</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/54c30f75891b74e5a4393b44be9ea7ba43dd1e4b"><code>54c30f7</code></a>
docs: note suffix-reference authority ambiguity</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e"><code>39e6493</code></a>
fix: escape a first-segment colon in suffix references</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/745183c1d9d98d113bed8a57bb1c9ceaf0147b7a"><code>745183c</code></a>
test: cover first-segment colon in suffix references</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c"><code>ddfc6a5</code></a>
fix(SEC-03): reject non reg-name characters in domain hosts</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/d86a8d29f45187819dac2d4fe171c35e3e488264"><code>d86a8d2</code></a>
fix: keep a colon-first segment behind &quot;./&quot; in relative
normalization</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/eb483b5da2580bdecb8af644bbfee878d5424850"><code>eb483b5</code></a>
test: cover colon-first relative references in normalization</li>
<li><a
href="https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424"><code>b110a35</code></a>
fix(SEC-02): preserve meaning of relative references during
normalization</li>
<li>Additional commits viewable in <a
href="https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.9">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for fast-uri since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fast-uri&package-manager=npm_and_yarn&previous-version=3.1.7&new-version=3.1.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/maplibre/maputnik/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-26 14:06:56 +00:00
dependabot[bot] f5c9d9f323 chore(deps-dev): Bump i18next-cli from 1.77.0 to 1.80.0 (#2266) 
Bumps [i18next-cli](https://github.com/i18next/i18next-cli) from 1.77.0
to 1.80.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md">i18next-cli's
changelog</a>.</em></p>
<blockquote>
<h2>1.80.0</h2>
<ul>
<li>feat(lint): in the i18next format, the translation files of every
locale are compared with the primary language:
interpolations by name (<code>{{name}}</code>, <code>{{- name}}</code>,
<code>{{val, number}}</code>), nested <code>$t(key)</code> references
and tags (<code>&lt;0&gt;</code>,
<code>&lt;1/&gt;</code>, <code>&lt;bold&gt;</code>), except the basic
HTML react-i18next keeps (<code>transKeepBasicHtmlNodesFor</code>). A
translation that
renamed or dropped a placeholder is reported with file, key and line,
e.g.
<code>greeting: missing {{name}}, unexpected {{nom}} (compared with
&quot;en&quot;)</code>. Plural forms are compared as a group, so
<code>{{count}}</code> may be left out of <code>_one</code> or
<code>_zero</code>. A warning by default, so existing CI runs keep
passing;
<code>lint.checkTranslationPlaceholders: 'error'</code> fails the run,
<code>'off'</code> disables it. Until now only ICU and MF2 projects
had this check.</li>
<li>feat(status): values identical to the primary language (English
copied into <code>de</code>) are marked
<code>≈ (identical to en)</code> and counted in the summary.
<code>status.checkIdentical</code>: <code>'warn'</code> (default) still
counts them as
translated and keeps the exit code, <code>'error'</code> counts them as
untranslated, <code>'off'</code> disables it. Locales of the
primary's language (<code>en-GB</code> with <code>en</code>), values
without letters, URLs, e-mail addresses and short all-caps words
(<code>OK</code>, <code>FAQ</code>) are skipped; other values that stay
the same go into <code>status.ignoreKeys</code>.</li>
<li>feat(lint): <code>lint --update-baseline</code> writes the current
issues to <code>i18next-lint-baseline.json</code>
(<code>lint.baseline</code> for
another path). While the file exists, <code>lint</code> reports and
fails only on new issues, so a codebase with existing
hardcoded strings can run <code>lint</code> in CI. Issues are matched by
file, type and text, not by line.</li>
<li>fix(lint): interpolations are read like i18next does. The unescaped
<code>{{-name}}</code> was read as a parameter <code>-name</code>, so
<code>t('Hi {{-name}}', { name })</code> reported two false
interpolation issues; <code>{{- name}}</code> and names outside
<code>[A-Za-z0-9_.-]</code>
(<code>{{größe}}</code>) were not read at all.</li>
<li>docs(types): <code>transKeepBasicHtmlNodesFor</code> defaults to
react-i18next's <code>['br', 'strong', 'i', 'p']</code>.</li>
<li>docs(skill, localize): after translating by hand, run
<code>lint</code> to check the placeholders.</li>
</ul>
<h2>1.79.1</h2>
<ul>
<li>fix(init, migrate-config): the default source glob includes
<code>.mjs</code> (<code>src/**/*.{js,jsx,mjs,ts,tsx}</code>), in
<code>init</code>, in the
config detected for a project without one, and in
<code>migrate-config</code> when the old config has no
<code>input</code>. Existing
configs do not change. <a
href="https://redirect.github.com/i18next/i18next-cli/pull/309#issuecomment-6310275918">#309</a></li>
</ul>
<h2>1.79.0</h2>
<ul>
<li>feat(extract, instrument, lint): a <code>.mjs</code> file with JSX
is parsed with the same JSX fallback as a <code>.js</code> file,
including the constants pre-scan of <code>extract</code>. Before, it
failed with a syntax error and <code>extract</code> exited with 1.
<a
href="https://redirect.github.com/i18next/i18next-cli/pull/309">#309</a></li>
</ul>
<h2>1.78.0</h2>
<ul>
<li>feat(lint): with <code>messageFormat: 'mf2'</code>,
<code>lint</code> warns when whitespace at the start or end of a pattern
differs from
the primary language. MF2 keeps a space inside <code>{{ }}</code> as
text, so <code>{{ {$count} files}}</code> shows it in the app. A
warning does not fail the run.</li>
<li>fix(lint): a language code with <code>_</code> (<code>ru_RU</code>,
<code>pt_BR</code>) is read as <code>ru-RU</code>, <code>pt-BR</code>
for the plural categories. Before,
<code>Intl</code> rejected it and only <code>other</code> was required,
so a <code>ru_RU</code> plural with only <code>one</code> and
<code>other</code> passed.</li>
<li>fix(lint): the required plural categories are <code>other</code>
plus every category a whole number below one million selects
(was 0 to 1000), the same rule as Locize; exact selectors count for a
category only when it selects a few small
numbers. No locale's result changes with today's CLDR data.</li>
<li>docs(skill): the ICU and MF2 reference names the common MF2 plural
mistakes: <code>other</code> instead of <code>*</code>, <code>{{
{$count}</code>
instead of <code>{{{$count}</code>, and spaces inside <code>{{
}}</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-cli/commit/6a339b2ab661cc4465b46f5276c448e2e44287b2"><code>6a339b2</code></a>
1.80.0</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/3f5ffd91fdc458fb0c0be086a5f6cf9e75c6a084"><code>3f5ffd9</code></a>
feat(lint, status): placeholders across locales, identical values, lint
baseline</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/73b085de457bcf6ffd9b868f2c5d71cc55c5dfb6"><code>73b085d</code></a>
1.79.1</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/f479d53ac90ade3d7e7dc71313fd9f79b0e198c4"><code>f479d53</code></a>
fix(init, migrate-config): include .mjs in the default source glob</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/ee7b1aa652ec89fab53f8d2b3f74e23910b91099"><code>ee7b1aa</code></a>
1.79.0</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/7c95544e98d6732f816a0c724d5e9816e25a31b5"><code>7c95544</code></a>
fix(extract): JSX fallback for .mjs in the constants pre-scan too</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/d320c6aad9d3d5f21907281406963a1852ece7a4"><code>d320c6a</code></a>
feat(extract, instrument, lint): support .mjs files with JSX (<a
href="https://redirect.github.com/i18next/i18next-cli/issues/309">#309</a>)</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/20524b8fe98937c79859cad42658f40709304bde"><code>20524b8</code></a>
1.78.0</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/462ed40b05e2b9637d56efcce9c850a287312a3d"><code>462ed40</code></a>
feat(lint): MF2 pattern-edge whitespace warning, <code>_</code> language
codes, plural r...</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-cli/compare/v1.77.0...v1.80.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next-cli&package-manager=npm_and_yarn&previous-version=1.77.0&new-version=1.80.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-26 14:04:15 +00:00
dependabot[bot] 414db4b9a2 chore(deps-dev): Bump vite from 8.3.4 to 8.3.5 (#2267) 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite)
from 8.3.4 to 8.3.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.3.5</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>build:</strong> handle missing chunk import maps (<a
href="https://redirect.github.com/vitejs/vite/issues/23777">#23777</a>)
(<a
href="https://github.com/vitejs/vite/commit/8d7623d9b5647714a5b20cbd787a5401ca846229">8d7623d</a>)</li>
<li><strong>build:</strong> include preload dependencies to chunk import
map hashing (<a
href="https://redirect.github.com/vitejs/vite/issues/23793">#23793</a>)
(<a
href="https://github.com/vitejs/vite/commit/4d16e7c14d5e1c361f148238b1e81131238ab8e9">4d16e7c</a>)</li>
<li><strong>bundled-dev:</strong> apply <code>server.origin</code> to
asset URLs (<a
href="https://redirect.github.com/vitejs/vite/issues/23683">#23683</a>)
(<a
href="https://github.com/vitejs/vite/commit/52ba877693c8633458d163117504a8259beb3cf5">52ba877</a>)</li>
<li><strong>bundled-dev:</strong> declare utf-8 charset in fallback page
(<a
href="https://redirect.github.com/vitejs/vite/issues/23846">#23846</a>)
(<a
href="https://github.com/vitejs/vite/commit/197daf6c4c7bfdaa005bebcc41dd2ff22fa3a5b6">197daf6</a>)</li>
<li><strong>bundled-dev:</strong> ignore build.chunkImportMap (<a
href="https://redirect.github.com/vitejs/vite/issues/23685">#23685</a>)
(<a
href="https://github.com/vitejs/vite/commit/cfe917d67d279a13f20ae9449e3befa736b64b07">cfe917d</a>)</li>
<li><strong>bundled-dev:</strong> include user
<code>import.meta.env.*</code> defines in the
<code>import.meta.env</code> object (<a
href="https://redirect.github.com/vitejs/vite/issues/23713">#23713</a>)
(<a
href="https://github.com/vitejs/vite/commit/6019aa79975465516da7c6f532d568422b019a25">6019aa7</a>)</li>
<li><strong>bundled-dev:</strong> map forwarded error stacks through the
bundle source maps (<a
href="https://redirect.github.com/vitejs/vite/issues/23741">#23741</a>)
(<a
href="https://github.com/vitejs/vite/commit/11fe1e46ff0c136cb90fbe263ba03993bc94df18">11fe1e4</a>)</li>
<li><strong>bundled-dev:</strong> normalize served output files (<a
href="https://redirect.github.com/vitejs/vite/issues/23684">#23684</a>)
(<a
href="https://github.com/vitejs/vite/commit/df4e02cc8317a62f21edefc79a9690571ffed1f3">df4e02c</a>)</li>
<li><strong>bundled-dev:</strong> stop hmr propagation at modules that
are no longer imported (<a
href="https://redirect.github.com/vitejs/vite/issues/23839">#23839</a>)
(<a
href="https://github.com/vitejs/vite/commit/7471e8c3b32d3d55243590bb7713e602c9fb0212">7471e8c</a>)</li>
<li><strong>css:</strong> don't fail on a literal <code>%</code> in
<code>url()</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23676">#23676</a>)
(<a
href="https://github.com/vitejs/vite/commit/50b382d31835b8b4bc8b6964738ac03146e44261">50b382d</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23731">#23731</a>)
(<a
href="https://github.com/vitejs/vite/commit/cf80aa552cac02eac0293330ccd5fde3c7ae8d29">cf80aa5</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23826">#23826</a>)
(<a
href="https://github.com/vitejs/vite/commit/77d8373510da1b26ce057eb2248e570b7f63fde9">77d8373</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23733">#23733</a>)
(<a
href="https://github.com/vitejs/vite/commit/43f0d052e514c3ad2dea2f7dc44b0720e1f62f48">43f0d05</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23827">#23827</a>)
(<a
href="https://github.com/vitejs/vite/commit/c2e04187e49aab7ab809989f0537b4906653acab">c2e0418</a>)</li>
<li><strong>optimizer:</strong> fall back to yarn.lock for lockfile hash
(<a
href="https://redirect.github.com/vitejs/vite/issues/23667">#23667</a>)
(<a
href="https://github.com/vitejs/vite/commit/f20609630faa93026924275115d1426fdc08629e">f206096</a>)</li>
<li><strong>optimizer:</strong> scan <code>oxc.jsxInject</code> imports
(<a
href="https://redirect.github.com/vitejs/vite/issues/23758">#23758</a>)
(<a
href="https://github.com/vitejs/vite/commit/38f3cb45b1490ed24775547ceafa677b91a57714">38f3cb4</a>)</li>
<li><strong>optimizer:</strong> skip patches dir check for yarn.lock
fallback (<a
href="https://redirect.github.com/vitejs/vite/issues/23725">#23725</a>)
(<a
href="https://github.com/vitejs/vite/commit/8e890e1ce438bfbc07ea4931ce332e40589940fa">8e890e1</a>)</li>
<li><strong>optimizer:</strong> skip patches dir hash for nub lockfile
(<a
href="https://redirect.github.com/vitejs/vite/issues/23761">#23761</a>)
(<a
href="https://github.com/vitejs/vite/commit/a7d56967ef0050a09c0507e63a18164bc7a0d486">a7d5696</a>)</li>
<li><strong>resolve:</strong> support subpath imports with multiple
<code>#</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23631">#23631</a>)
(<a
href="https://github.com/vitejs/vite/commit/0d86b3485fbbd0fcb9a1f70a14adedfcb7a1fff1">0d86b34</a>)</li>
<li><strong>resolve:</strong> update resolve.exports to 2.0.4 (<a
href="https://redirect.github.com/vitejs/vite/issues/23739">#23739</a>)
(<a
href="https://github.com/vitejs/vite/commit/4ea708a3ae9a324c6aabca59fade4082bf72f3e5">4ea708a</a>)</li>
<li><strong>server:</strong> handle socket errors on upgrade requests
not taken by the HMR server (<a
href="https://redirect.github.com/vitejs/vite/issues/23728">#23728</a>)
(<a
href="https://github.com/vitejs/vite/commit/c2c9ef4dcd05b3e4d88844ea3a13dc23819ca2a5">c2c9ef4</a>)</li>
<li><strong>server:</strong> only strip base when path matches a full
segment (<a
href="https://redirect.github.com/vitejs/vite/issues/23641">#23641</a>)
(<a
href="https://github.com/vitejs/vite/commit/3dfde87b90a9f80b125d710e3e5d4fc795662db6">3dfde87</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li><strong>ssr:</strong> extract inline source maps without a regexp
(<a
href="https://redirect.github.com/vitejs/vite/issues/23775">#23775</a>)
(<a
href="https://github.com/vitejs/vite/commit/6a0278055d8501bbaf65b8d34ec094722b4e877a">6a02780</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li>migrate to Oxlint (<a
href="https://redirect.github.com/vitejs/vite/issues/23746">#23746</a>)
(<a
href="https://github.com/vitejs/vite/commit/5b73935881424ed5919571036dd89d3868590f92">5b73935</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li><strong>deps:</strong> replace <code>@vercel/detect-agent</code>
with <code>std-env</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23744">#23744</a>)
(<a
href="https://github.com/vitejs/vite/commit/ce4293f15cc5cd221c5ed60f5cd64e82ca5cbaf5">ce4293f</a>)</li>
<li><strong>dev:</strong> consolidate moduleURL to file path utilities
(<a
href="https://redirect.github.com/vitejs/vite/issues/23828">#23828</a>)
(<a
href="https://github.com/vitejs/vite/commit/df7b40ee9d691e9f4e2413244f6665ef5482dce3">df7b40e</a>)</li>
<li><strong>dev:</strong> separate import resolution from URL conversion
(<a
href="https://redirect.github.com/vitejs/vite/issues/23791">#23791</a>)
(<a
href="https://github.com/vitejs/vite/commit/611668983d4b717f5e5e66cf9f7125bd94f92bf7">6116689</a>)</li>
<li><strong>dev:</strong> share ModuleURL and BrowserURL conversions (<a
href="https://redirect.github.com/vitejs/vite/issues/23790">#23790</a>)
(<a
href="https://github.com/vitejs/vite/commit/446954c69c806795c83fe2f97c28ae8f9ef83731">446954c</a>)</li>
<li><strong>dev:</strong> use ModuleURLs throughout HTML transforms (<a
href="https://redirect.github.com/vitejs/vite/issues/23815">#23815</a>)
(<a
href="https://github.com/vitejs/vite/commit/a16299092c0f0f3f90e05d4bb5f0168b293c2b52">a162990</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.3.4...v8.3.5">8.3.5</a>
(2026-10-21)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>build:</strong> handle missing chunk import maps (<a
href="https://redirect.github.com/vitejs/vite/issues/23777">#23777</a>)
(<a
href="https://github.com/vitejs/vite/commit/8d7623d9b5647714a5b20cbd787a5401ca846229">8d7623d</a>)</li>
<li><strong>build:</strong> include preload dependencies to chunk import
map hashing (<a
href="https://redirect.github.com/vitejs/vite/issues/23793">#23793</a>)
(<a
href="https://github.com/vitejs/vite/commit/4d16e7c14d5e1c361f148238b1e81131238ab8e9">4d16e7c</a>)</li>
<li><strong>bundled-dev:</strong> apply <code>server.origin</code> to
asset URLs (<a
href="https://redirect.github.com/vitejs/vite/issues/23683">#23683</a>)
(<a
href="https://github.com/vitejs/vite/commit/52ba877693c8633458d163117504a8259beb3cf5">52ba877</a>)</li>
<li><strong>bundled-dev:</strong> declare utf-8 charset in fallback page
(<a
href="https://redirect.github.com/vitejs/vite/issues/23846">#23846</a>)
(<a
href="https://github.com/vitejs/vite/commit/197daf6c4c7bfdaa005bebcc41dd2ff22fa3a5b6">197daf6</a>)</li>
<li><strong>bundled-dev:</strong> ignore build.chunkImportMap (<a
href="https://redirect.github.com/vitejs/vite/issues/23685">#23685</a>)
(<a
href="https://github.com/vitejs/vite/commit/cfe917d67d279a13f20ae9449e3befa736b64b07">cfe917d</a>)</li>
<li><strong>bundled-dev:</strong> include user
<code>import.meta.env.*</code> defines in the
<code>import.meta.env</code> object (<a
href="https://redirect.github.com/vitejs/vite/issues/23713">#23713</a>)
(<a
href="https://github.com/vitejs/vite/commit/6019aa79975465516da7c6f532d568422b019a25">6019aa7</a>)</li>
<li><strong>bundled-dev:</strong> map forwarded error stacks through the
bundle source maps (<a
href="https://redirect.github.com/vitejs/vite/issues/23741">#23741</a>)
(<a
href="https://github.com/vitejs/vite/commit/11fe1e46ff0c136cb90fbe263ba03993bc94df18">11fe1e4</a>)</li>
<li><strong>bundled-dev:</strong> normalize served output files (<a
href="https://redirect.github.com/vitejs/vite/issues/23684">#23684</a>)
(<a
href="https://github.com/vitejs/vite/commit/df4e02cc8317a62f21edefc79a9690571ffed1f3">df4e02c</a>)</li>
<li><strong>bundled-dev:</strong> stop hmr propagation at modules that
are no longer imported (<a
href="https://redirect.github.com/vitejs/vite/issues/23839">#23839</a>)
(<a
href="https://github.com/vitejs/vite/commit/7471e8c3b32d3d55243590bb7713e602c9fb0212">7471e8c</a>)</li>
<li><strong>css:</strong> don't fail on a literal <code>%</code> in
<code>url()</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23676">#23676</a>)
(<a
href="https://github.com/vitejs/vite/commit/50b382d31835b8b4bc8b6964738ac03146e44261">50b382d</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23731">#23731</a>)
(<a
href="https://github.com/vitejs/vite/commit/cf80aa552cac02eac0293330ccd5fde3c7ae8d29">cf80aa5</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23826">#23826</a>)
(<a
href="https://github.com/vitejs/vite/commit/77d8373510da1b26ce057eb2248e570b7f63fde9">77d8373</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23733">#23733</a>)
(<a
href="https://github.com/vitejs/vite/commit/43f0d052e514c3ad2dea2f7dc44b0720e1f62f48">43f0d05</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23827">#23827</a>)
(<a
href="https://github.com/vitejs/vite/commit/c2e04187e49aab7ab809989f0537b4906653acab">c2e0418</a>)</li>
<li><strong>optimizer:</strong> fall back to yarn.lock for lockfile hash
(<a
href="https://redirect.github.com/vitejs/vite/issues/23667">#23667</a>)
(<a
href="https://github.com/vitejs/vite/commit/f20609630faa93026924275115d1426fdc08629e">f206096</a>)</li>
<li><strong>optimizer:</strong> scan <code>oxc.jsxInject</code> imports
(<a
href="https://redirect.github.com/vitejs/vite/issues/23758">#23758</a>)
(<a
href="https://github.com/vitejs/vite/commit/38f3cb45b1490ed24775547ceafa677b91a57714">38f3cb4</a>)</li>
<li><strong>optimizer:</strong> skip patches dir check for yarn.lock
fallback (<a
href="https://redirect.github.com/vitejs/vite/issues/23725">#23725</a>)
(<a
href="https://github.com/vitejs/vite/commit/8e890e1ce438bfbc07ea4931ce332e40589940fa">8e890e1</a>)</li>
<li><strong>optimizer:</strong> skip patches dir hash for nub lockfile
(<a
href="https://redirect.github.com/vitejs/vite/issues/23761">#23761</a>)
(<a
href="https://github.com/vitejs/vite/commit/a7d56967ef0050a09c0507e63a18164bc7a0d486">a7d5696</a>)</li>
<li><strong>resolve:</strong> support subpath imports with multiple
<code>#</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23631">#23631</a>)
(<a
href="https://github.com/vitejs/vite/commit/0d86b3485fbbd0fcb9a1f70a14adedfcb7a1fff1">0d86b34</a>)</li>
<li><strong>resolve:</strong> update resolve.exports to 2.0.4 (<a
href="https://redirect.github.com/vitejs/vite/issues/23739">#23739</a>)
(<a
href="https://github.com/vitejs/vite/commit/4ea708a3ae9a324c6aabca59fade4082bf72f3e5">4ea708a</a>)</li>
<li><strong>server:</strong> handle socket errors on upgrade requests
not taken by the HMR server (<a
href="https://redirect.github.com/vitejs/vite/issues/23728">#23728</a>)
(<a
href="https://github.com/vitejs/vite/commit/c2c9ef4dcd05b3e4d88844ea3a13dc23819ca2a5">c2c9ef4</a>)</li>
<li><strong>server:</strong> only strip base when path matches a full
segment (<a
href="https://redirect.github.com/vitejs/vite/issues/23641">#23641</a>)
(<a
href="https://github.com/vitejs/vite/commit/3dfde87b90a9f80b125d710e3e5d4fc795662db6">3dfde87</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li><strong>ssr:</strong> extract inline source maps without a regexp
(<a
href="https://redirect.github.com/vitejs/vite/issues/23775">#23775</a>)
(<a
href="https://github.com/vitejs/vite/commit/6a0278055d8501bbaf65b8d34ec094722b4e877a">6a02780</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li>migrate to Oxlint (<a
href="https://redirect.github.com/vitejs/vite/issues/23746">#23746</a>)
(<a
href="https://github.com/vitejs/vite/commit/5b73935881424ed5919571036dd89d3868590f92">5b73935</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li><strong>deps:</strong> replace <code>@vercel/detect-agent</code>
with <code>std-env</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23744">#23744</a>)
(<a
href="https://github.com/vitejs/vite/commit/ce4293f15cc5cd221c5ed60f5cd64e82ca5cbaf5">ce4293f</a>)</li>
<li><strong>dev:</strong> consolidate moduleURL to file path utilities
(<a
href="https://redirect.github.com/vitejs/vite/issues/23828">#23828</a>)
(<a
href="https://github.com/vitejs/vite/commit/df7b40ee9d691e9f4e2413244f6665ef5482dce3">df7b40e</a>)</li>
<li><strong>dev:</strong> separate import resolution from URL conversion
(<a
href="https://redirect.github.com/vitejs/vite/issues/23791">#23791</a>)
(<a
href="https://github.com/vitejs/vite/commit/611668983d4b717f5e5e66cf9f7125bd94f92bf7">6116689</a>)</li>
<li><strong>dev:</strong> share ModuleURL and BrowserURL conversions (<a
href="https://redirect.github.com/vitejs/vite/issues/23790">#23790</a>)
(<a
href="https://github.com/vitejs/vite/commit/446954c69c806795c83fe2f97c28ae8f9ef83731">446954c</a>)</li>
<li><strong>dev:</strong> use ModuleURLs throughout HTML transforms (<a
href="https://redirect.github.com/vitejs/vite/issues/23815">#23815</a>)
(<a
href="https://github.com/vitejs/vite/commit/a16299092c0f0f3f90e05d4bb5f0168b293c2b52">a162990</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/981f07fa4580fb88b333c4450431e4715d2a0b82"><code>981f07f</code></a>
release: v8.3.5 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23856">#23856</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/0d86b3485fbbd0fcb9a1f70a14adedfcb7a1fff1"><code>0d86b34</code></a>
fix(resolve): support subpath imports with multiple <code>#</code> (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23631">#23631</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/6a0278055d8501bbaf65b8d34ec094722b4e877a"><code>6a02780</code></a>
perf(ssr): extract inline source maps without a regexp (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23775">#23775</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/8e890e1ce438bfbc07ea4931ce332e40589940fa"><code>8e890e1</code></a>
fix(optimizer): skip patches dir check for yarn.lock fallback (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23725">#23725</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/197daf6c4c7bfdaa005bebcc41dd2ff22fa3a5b6"><code>197daf6</code></a>
fix(bundled-dev): declare utf-8 charset in fallback page (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23846">#23846</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/4d16e7c14d5e1c361f148238b1e81131238ab8e9"><code>4d16e7c</code></a>
fix(build): include preload dependencies to chunk import map hashing (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23793">#23793</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/df7b40ee9d691e9f4e2413244f6665ef5482dce3"><code>df7b40e</code></a>
refactor(dev): consolidate moduleURL to file path utilities (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23828">#23828</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/a16299092c0f0f3f90e05d4bb5f0168b293c2b52"><code>a162990</code></a>
refactor(dev): use ModuleURLs throughout HTML transforms (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23815">#23815</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/611668983d4b717f5e5e66cf9f7125bd94f92bf7"><code>6116689</code></a>
refactor(dev): separate import resolution from URL conversion (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23791">#23791</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/446954c69c806795c83fe2f97c28ae8f9ef83731"><code>446954c</code></a>
refactor(dev): share ModuleURL and BrowserURL conversions (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23790">#23790</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.3.5/packages/vite">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vite&package-manager=npm_and_yarn&previous-version=8.3.4&new-version=8.3.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-26 13:59:58 +00:00
dependabot[bot] 80de3632d0 chore(deps-dev): Bump sass from 1.105.2 to 1.106.1 (#2265) 
Bumps [sass](https://github.com/sass/dart-sass) from 1.105.2 to 1.106.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sass/dart-sass/releases">sass's
releases</a>.</em></p>
<blockquote>
<h2>Dart Sass 1.106.1</h2>
<p>To install Sass 1.106.1, download one of the packages below and <a
href="https://katiek2.github.io/path-doc/">add it to your PATH</a>, or
see <a href="https://sass-lang.com/install">the Sass website</a> for
full installation instructions.</p>
<h1>Changes</h1>
<ul>
<li>
<p>Fix a bug where an attribute selector with an empty value (such as
<code>[class=&quot;&quot;]</code>) would crash when serializing.</p>
</li>
<li>
<p>Don't crash when serializing a number with an empty unit. This is
only possible through the JavaScript and Dart APIs or the embedded
protocol.</p>
</li>
</ul>
<h3>Embedded Dart Sass</h3>
<ul>
<li>More robustly convert invalid value errors into <code>PARAMS</code>
errors.</li>
</ul>
<p>See the <a
href="https://github.com/sass/dart-sass/blob/master/CHANGELOG.md#11061">full
changelog</a> for changes in earlier releases.</p>
<h2>Dart Sass 1.106.0</h2>
<p>To install Sass 1.106.0, download one of the packages below and <a
href="https://katiek2.github.io/path-doc/">add it to your PATH</a>, or
see <a href="https://sass-lang.com/install">the Sass website</a> for
full installation instructions.</p>
<h1>Changes</h1>
<ul>
<li>
<p>Don't normalize CSS escapes in statement contexts that can contain
interpolation. For example, <code>@f\6Fo</code> is now emitted as
written rather than normalized to <code>@foo</code>.</p>
</li>
<li>
<p>Fix a bug where quotes would be removed from attribute selector
values that contained backslashes.</p>
</li>
<li>
<p>Fix invalid source spans that could cause crashes when encountering a
syntax error in selectors or media queries that also contain escape
sequences.</p>
</li>
<li>
<p>Fix a bug where the indented syntax parser would crash when parsing a
file where the first statement was indented <em>and</em> appeared after
the first line.</p>
</li>
<li>
<p>Fix a bug that could cause crashes when encountering errors or
warnings in interpolations that contain patterns like <code>//
*/</code>.</p>
</li>
<li>
<p><strong>Potentially breaking compatibility fix:</strong> CSS escape
codes whose values are 0, for Unicode surrogates, or greater than the
maximum allowed code point are now consistently normalized to U+FFFD
REPLACEMENT CHARACTER in expression contexts. Previously, in some cases
these were instead normalized to the normalized form of the original
escape sequence, which violates the principle that all escape sequences
for identical values should be normalized the same way. In other cases,
these would simply throw errors.</p>
<p>As a special case, <code>\0</code> on its own will continue to be
normalized to <code>\0 </code> to support historical CSS hacks.</p>
</li>
<li>
<p><strong>Potentially breaking bug fix:</strong> Throw an error for
mixins and functions that have rest parameters which are the same as
normal parameters. Previously, the positional parameters wouldn't be
accessible and calling such a mixin or function with a named argument
would crash the compiler.</p>
</li>
<li>
<p><strong>Potentially breaking bug fix:</strong> Fix various cases
where using a CSS escape code at the beginning of an identifier would
change parsing behavior versus using the character directly.</p>
</li>
<li>
<p><strong>Potentially breaking bug fix:</strong> When a number's unit
is ambiguous with a numeric exponent, the unit is now serialized as an
escape code rather than a literal <code>e</code> to avoid being
interpreted as an exponent by CSS.</p>
</li>
<li>
<p><strong>Potentially breaking bug fix:</strong> Don't parse a CSS
escape code for U+45 LATIN CAPITAL LETTER E or U+65 LATIN LOWERCASE
LETTER E as an exponent in <code>@keyframes</code> percentage
selectors.</p>
</li>
<li>
<p><strong>Potentially breaking bug fix:</strong> Properly normalize
underscores written as CSS escape codes in variable, mixin, and function
names.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/sass/dart-sass/blob/main/CHANGELOG.md">sass's
changelog</a>.</em></p>
<blockquote>
<h2>1.106.1</h2>
<ul>
<li>
<p>Fix a bug where an attribute selector with an empty value (such as
<code>[class=&quot;&quot;]</code>) would crash when serializing.</p>
</li>
<li>
<p>Don't crash when serializing a number with an empty unit. This is
only
possible through the JavaScript and Dart APIs or the embedded
protocol.</p>
</li>
</ul>
<h3>Embedded Dart Sass</h3>
<ul>
<li>More robustly convert invalid value errors into <code>PARAMS</code>
errors.</li>
</ul>
<h2>1.106.0</h2>
<ul>
<li>
<p>Don't normalize CSS escapes in statement contexts that can contain
interpolation. For example, <code>@f\6Fo</code> is now emitted as
written rather than
normalized to <code>@foo</code>.</p>
</li>
<li>
<p>Fix a bug where quotes would be removed from attribute selector
values that
contained backslashes.</p>
</li>
<li>
<p>Fix invalid source spans that could cause crashes when encountering a
syntax
error in selectors or media queries that also contain escape
sequences.</p>
</li>
<li>
<p>Fix a bug where the indented syntax parser would crash when parsing a
file
where the first statement was indented <em>and</em> appeared after the
first line.</p>
</li>
<li>
<p>Fix a bug that could cause crashes when encountering errors or
warnings in
interpolations that contain patterns like <code>// */</code>.</p>
</li>
<li>
<p><strong>Potentially breaking compatibility fix:</strong> CSS escape
codes whose values are
0, for Unicode surrogates, or greater than the maximum allowed code
point are
now consistently normalized to U+FFFD REPLACEMENT CHARACTER in
expression
contexts. Previously, in some cases these were instead normalized to the
normalized form of the original escape sequence, which violates the
principle
that all escape sequences for identical values should be normalized the
same
way. In other cases, these would simply throw errors.</p>
<p>As a special case, <code>\0</code> on its own will continue to be
normalized to <code>\0 </code> to
support historical CSS hacks.</p>
</li>
<li>
<p><strong>Potentially breaking bug fix:</strong> Throw an error for
mixins and functions that
have rest parameters which are the same as normal parameters.
Previously, the
positional parameters wouldn't be accessible and calling such a mixin or
function with a named argument would crash the compiler.</p>
</li>
<li>
<p><strong>Potentially breaking bug fix:</strong> Fix various cases
where using a CSS escape
code at the beginning of an identifier would change parsing behavior
versus
using the character directly.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sass/dart-sass/commit/811ecc67bc5ed16d410d76e8bde343d9770f08c0"><code>811ecc6</code></a>
Pull the version back to 1.106.1 (<a
href="https://redirect.github.com/sass/dart-sass/issues/2893">#2893</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/b10205ed8391f11cb9ce8b7c3d6464f842491ce8"><code>b10205e</code></a>
Fix serializing a number with an empty-string unit (<a
href="https://redirect.github.com/sass/dart-sass/issues/2892">#2892</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/e79f8a7d869efe54e3723c1e5060bb6cb95d63a4"><code>e79f8a7</code></a>
Fix serializing an attribute selector with an empty value (<a
href="https://redirect.github.com/sass/dart-sass/issues/2891">#2891</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/2ea4fc07b8560ba57e1657d9759b6ce8e89a64dd"><code>2ea4fc0</code></a>
Merge pull request <a
href="https://redirect.github.com/sass/dart-sass/issues/2883">#2883</a>
from sass/fuzz</li>
<li><a
href="https://github.com/sass/dart-sass/commit/a113995474eb2a58035f2ebb5f5d85590e4d11b9"><code>a113995</code></a>
Bump postcss from 8.5.28 to 8.5.30 in /pkg/sass-parser (<a
href="https://redirect.github.com/sass/dart-sass/issues/2886">#2886</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/2d2e76cf29ec022d5c3a8539e79d8d490accf21f"><code>2d2e76c</code></a>
Try using the SassBot GitHub token when auto-merging dependabot PRs (<a
href="https://redirect.github.com/sass/dart-sass/issues/2885">#2885</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/56608242a996f869fc1903c68fd4c68c8d97daa3"><code>5660824</code></a>
Improve the accuracy of <code>FileSpan.trimLeft()</code> and
<code>.trimRight()</code></li>
<li><a
href="https://github.com/sass/dart-sass/commit/09e4024c4c907f7bbc2754fa5c9a10a882ad9056"><code>09e4024</code></a>
Throw an error for duplicate rest and non-rest parameter names</li>
<li><a
href="https://github.com/sass/dart-sass/commit/34c8e6b1fc854b4aabc907a0c427b854ee9ec35b"><code>34c8e6b</code></a>
Fix check for an indented first statement</li>
<li><a
href="https://github.com/sass/dart-sass/commit/a05866caeb42db34c3df1181eb5bcf41534549c8"><code>a05866c</code></a>
Make <code>_expandInterpolationLeft</code> resilient to commented-out
comments</li>
<li>Additional commits viewable in <a
href="https://github.com/sass/dart-sass/compare/1.105.2...1.106.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sass&package-manager=npm_and_yarn&previous-version=1.105.2&new-version=1.106.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-26 13:58:49 +00:00
dependabot[bot] 2ba037f44c chore(deps): Bump the codeql-action group with 3 updates (#2268) 
Bumps the codeql-action group with 3 updates:
[github/codeql-action/init](https://github.com/github/codeql-action),
[github/codeql-action/autobuild](https://github.com/github/codeql-action)
and
[github/codeql-action/analyze](https://github.com/github/codeql-action).

Updates `github/codeql-action/init` from 4.39.0 to 4.39.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.39.1</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.1 - 21 Oct 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/9b3254085494b55a0f7c4c2b3d2d52cc712ce370"><code>9b32540</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4257">#4257</a>
from github/update-v4.39.1-c5a2f4b0f</li>
<li><a
href="https://github.com/github/codeql-action/commit/b5e1ed9574dcfa81c88c318140f3b3e5c199bfb3"><code>b5e1ed9</code></a>
Trigger workflows</li>
<li><a
href="https://github.com/github/codeql-action/commit/20f5ec39109073afe1789b098456b2be0164f4ee"><code>20f5ec3</code></a>
Update changelog for v4.39.1</li>
<li><a
href="https://github.com/github/codeql-action/commit/c5a2f4b0fe28ca06eaaeb86fb05a5f612ae293f9"><code>c5a2f4b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4245">#4245</a>
from github/henrymercer/graduate-overlay-trap-caching</li>
<li><a
href="https://github.com/github/codeql-action/commit/61a5a80dd98ad1b9679010141a46cace51065761"><code>61a5a80</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4256">#4256</a>
from github/update-bundle/codeql-bundle-v2.27.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/3dd33f8b69588bd9591684b2dca169eb612f5ed5"><code>3dd33f8</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4249">#4249</a>
from github/mbg/upload-improvements-for-4223</li>
<li><a
href="https://github.com/github/codeql-action/commit/b96e3390db93dc46c2c3753a94b87c0d734b0b61"><code>b96e339</code></a>
Change comment for <code>getConfig</code> call in
<code>upload-sarif</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/7fa45180db8d657b23ded3636b5d8583aec6ddfe"><code>7fa4518</code></a>
Use <code>shouldSkipSarifUpload</code> in
<code>analyze-action.ts</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/a69c7cb332d56f616fcadef002884523c71e8d1c"><code>a69c7cb</code></a>
Document that setting the env vars to <code>false</code> takes
precedence</li>
<li><a
href="https://github.com/github/codeql-action/commit/74ddcd9f65683791ab07eccd074b4ba145d89ea6"><code>74ddcd9</code></a>
Fix typo in comment</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/autobuild` from 4.39.0 to 4.39.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's
releases</a>.</em></p>
<blockquote>
<h2>v4.39.1</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.1 - 21 Oct 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/9b3254085494b55a0f7c4c2b3d2d52cc712ce370"><code>9b32540</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4257">#4257</a>
from github/update-v4.39.1-c5a2f4b0f</li>
<li><a
href="https://github.com/github/codeql-action/commit/b5e1ed9574dcfa81c88c318140f3b3e5c199bfb3"><code>b5e1ed9</code></a>
Trigger workflows</li>
<li><a
href="https://github.com/github/codeql-action/commit/20f5ec39109073afe1789b098456b2be0164f4ee"><code>20f5ec3</code></a>
Update changelog for v4.39.1</li>
<li><a
href="https://github.com/github/codeql-action/commit/c5a2f4b0fe28ca06eaaeb86fb05a5f612ae293f9"><code>c5a2f4b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4245">#4245</a>
from github/henrymercer/graduate-overlay-trap-caching</li>
<li><a
href="https://github.com/github/codeql-action/commit/61a5a80dd98ad1b9679010141a46cace51065761"><code>61a5a80</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4256">#4256</a>
from github/update-bundle/codeql-bundle-v2.27.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/3dd33f8b69588bd9591684b2dca169eb612f5ed5"><code>3dd33f8</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4249">#4249</a>
from github/mbg/upload-improvements-for-4223</li>
<li><a
href="https://github.com/github/codeql-action/commit/b96e3390db93dc46c2c3753a94b87c0d734b0b61"><code>b96e339</code></a>
Change comment for <code>getConfig</code> call in
<code>upload-sarif</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/7fa45180db8d657b23ded3636b5d8583aec6ddfe"><code>7fa4518</code></a>
Use <code>shouldSkipSarifUpload</code> in
<code>analyze-action.ts</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/a69c7cb332d56f616fcadef002884523c71e8d1c"><code>a69c7cb</code></a>
Document that setting the env vars to <code>false</code> takes
precedence</li>
<li><a
href="https://github.com/github/codeql-action/commit/74ddcd9f65683791ab07eccd074b4ba145d89ea6"><code>74ddcd9</code></a>
Fix typo in comment</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.39.0 to 4.39.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.39.1</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.1 - 21 Oct 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/9b3254085494b55a0f7c4c2b3d2d52cc712ce370"><code>9b32540</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4257">#4257</a>
from github/update-v4.39.1-c5a2f4b0f</li>
<li><a
href="https://github.com/github/codeql-action/commit/b5e1ed9574dcfa81c88c318140f3b3e5c199bfb3"><code>b5e1ed9</code></a>
Trigger workflows</li>
<li><a
href="https://github.com/github/codeql-action/commit/20f5ec39109073afe1789b098456b2be0164f4ee"><code>20f5ec3</code></a>
Update changelog for v4.39.1</li>
<li><a
href="https://github.com/github/codeql-action/commit/c5a2f4b0fe28ca06eaaeb86fb05a5f612ae293f9"><code>c5a2f4b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4245">#4245</a>
from github/henrymercer/graduate-overlay-trap-caching</li>
<li><a
href="https://github.com/github/codeql-action/commit/61a5a80dd98ad1b9679010141a46cace51065761"><code>61a5a80</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4256">#4256</a>
from github/update-bundle/codeql-bundle-v2.27.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/3dd33f8b69588bd9591684b2dca169eb612f5ed5"><code>3dd33f8</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4249">#4249</a>
from github/mbg/upload-improvements-for-4223</li>
<li><a
href="https://github.com/github/codeql-action/commit/b96e3390db93dc46c2c3753a94b87c0d734b0b61"><code>b96e339</code></a>
Change comment for <code>getConfig</code> call in
<code>upload-sarif</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/7fa45180db8d657b23ded3636b5d8583aec6ddfe"><code>7fa4518</code></a>
Use <code>shouldSkipSarifUpload</code> in
<code>analyze-action.ts</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/a69c7cb332d56f616fcadef002884523c71e8d1c"><code>a69c7cb</code></a>
Document that setting the env vars to <code>false</code> takes
precedence</li>
<li><a
href="https://github.com/github/codeql-action/commit/74ddcd9f65683791ab07eccd074b4ba145d89ea6"><code>74ddcd9</code></a>
Fix typo in comment</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-26 13:57:36 +00:00
dependabot[bot] 644ec1c75e chore(deps): Bump docker/login-action from 4.6.0 to 4.7.0 (#2269) 
Bumps [docker/login-action](https://github.com/docker/login-action) from
4.6.0 to 4.7.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.7.0</h2>
<ul>
<li>Preserve explicit ECR settings in <code>registry-auth</code> by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1089">docker/login-action#1089</a></li>
<li>Use registry hosts for scoped credentials by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1088">docker/login-action#1088</a></li>
<li>Raise Docker Hub OIDC max expiry to 6 hours by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1068">docker/login-action#1068</a></li>
<li>Log Docker Hub OIDC token exchange progress by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1061">docker/login-action#1061</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1154.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1093">docker/login-action#1093</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.94.0 to 0.107.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/1100">docker/login-action#1100</a></li>
<li>Bump <code>@​humanfs/node</code> from 0.16.7 to 0.16.8 in <a
href="https://redirect.github.com/docker/login-action/pull/1077">docker/login-action#1077</a></li>
<li>Bump csv-parse from 7.0.1 to 7.0.3 in <a
href="https://redirect.github.com/docker/login-action/pull/1078">docker/login-action#1078</a></li>
<li>Bump handlebars from 4.7.9 to 4.7.10 in <a
href="https://redirect.github.com/docker/login-action/pull/1091">docker/login-action#1091</a></li>
<li>Bump js-yaml from 5.2.2 to 5.5.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1066">docker/login-action#1066</a></li>
<li>Bump postcss from 8.5.22 to 8.5.26 in <a
href="https://redirect.github.com/docker/login-action/pull/1071">docker/login-action#1071</a></li>
<li>Bump postcss-selector-parser from 7.1.1 to 7.1.6 in <a
href="https://redirect.github.com/docker/login-action/pull/1092">docker/login-action#1092</a></li>
<li>Bump source-map-js from 1.2.1 to 1.2.2 in <a
href="https://redirect.github.com/docker/login-action/pull/1090">docker/login-action#1090</a></li>
<li>Bump undici from 6.27.0 to 6.29.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1085">docker/login-action#1085</a></li>
<li>Bump uuid from 14.0.1 to 14.0.3 in <a
href="https://redirect.github.com/docker/login-action/pull/1096">docker/login-action#1096</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.6.0...v4.7.0">https://github.com/docker/login-action/compare/v4.6.0...v4.7.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/81c6f93d4bc991e510b342a00b419b3bb4efc5c6"><code>81c6f93</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1100">#1100</a>
from docker/dependabot/npm_and_yarn/docker/actions-t...</li>
<li><a
href="https://github.com/docker/login-action/commit/1b16c8d1815e1d951d87a3522ff48a76d073735a"><code>1b16c8d</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1096">#1096</a>
from docker/dependabot/npm_and_yarn/uuid-14.0.3</li>
<li><a
href="https://github.com/docker/login-action/commit/ac86b5e9e9d2db43b12b2d3afb9140a427d69d65"><code>ac86b5e</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/1476d845f08dd8309a938959a280f2e23c0cba14"><code>1476d84</code></a>
build(deps): bump <code>@​docker/actions-toolkit</code> from 0.94.0 to
0.107.0</li>
<li><a
href="https://github.com/docker/login-action/commit/503cee68d85e94275776fcc6f5315f19207f7567"><code>503cee6</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1095">#1095</a>
from docker/dependabot/github_actions/actions/create...</li>
<li><a
href="https://github.com/docker/login-action/commit/f0935357f5c539aeb7ff6b886ba5434ab76e9de3"><code>f093535</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1099">#1099</a>
from docker/dependabot/github_actions/codecov/codeco...</li>
<li><a
href="https://github.com/docker/login-action/commit/d5ae7f188776587b12b77b45e29ea21332462da9"><code>d5ae7f1</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1098">#1098</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/6f9750797f6e7186f18c069a7e97abc1dcf1006b"><code>6f97507</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1097">#1097</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/006d61fa598847d65f6670d1569545fa2af9cf02"><code>006d61f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1094">#1094</a>
from docker/dependabot/github_actions/codeql-actions...</li>
<li><a
href="https://github.com/docker/login-action/commit/93f5f522eea5eacabf35cc89b9d19ec23e742471"><code>93f5f52</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1093">#1093</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/dbcb813823bdd20940b903addbd779551569679f...81c6f93d4bc991e510b342a00b419b3bb4efc5c6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/login-action&package-manager=github_actions&previous-version=4.6.0&new-version=4.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-26 13:56:28 +00:00
dependabot[bot] 0fa49894d7 chore(deps): Bump the react group with 2 updates (#2263) 
Bumps the react group with 2 updates:
[react-i18next](https://github.com/i18next/react-i18next) and
[react-resizable-panels](https://github.com/bvaughn/react-resizable-panels).

Updates `react-i18next` from 17.1.0 to 17.1.4
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md">react-i18next's
changelog</a>.</em></p>
<blockquote>
<h2>17.1.4</h2>
<ul>
<li>fix(types): without <code>allowObjectInHTMLChildren</code>, the
<code>children</code> of HTML elements now use React's own type
(<code>DOMAttributes&lt;T&gt;['children']</code>) instead of the
<code>ReactI18NextChildren | Iterable&lt;ReactI18NextChildren&gt;</code>
union. Both accept the same children, so nothing compiles differently.
For default installs the global <code>HTMLAttributes</code> augmentation
now repeats whatever <code>@types/react</code> declares, so changes in
React's types flow through instead of meeting a copy, and type errors on
element children no longer list an extra
<code>Iterable&lt;...&gt;</code>. With <code>allowObjectInHTMLChildren:
true</code> nothing changes. First step of <a
href="https://redirect.github.com/i18next/react-i18next/issues/1928">#1928</a>.</li>
</ul>
<h2>17.1.3</h2>
<ul>
<li>fix(IcuTrans): numeric HTML entities above U+FFFF, like emoji, now
decode to the right character. <code>&quot;Hello &amp;#x1F44B;
&lt;0&gt;friend&lt;/0&gt;
&amp;[#127881](https://github.com/i18next/react-i18next/issues/127881);&quot;</code>
rendered U+F44B and U+F389, private-use glyphs that usually show as a
box, instead of 👋 and 🎉: the decoder used
<code>String.fromCharCode</code>, which keeps only the low 16 bits of
the code point. This shows up with translations that a TMS or CMS
exports HTML-encoded. Entities above U+10FFFF, which are no valid code
points, now stay as written instead of becoming U+0000. Entities below
U+10000, including surrogate pairs written as two entities, decode as
before. Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/react-i18next/pull/1940">#1940</a>).</li>
</ul>
<h2>17.1.2</h2>
<ul>
<li>fix(Trans): when the only child is a string, a tag whose index the
children don't have now renders its own text. <code>&lt;Trans
i18nKey=&quot;welcome&quot;&gt;Welcome&lt;/Trans&gt;</code> with
<code>&quot;Welcome &lt;1&gt;friend&lt;/1&gt;&quot;</code> rendered
<code>Welcome e</code>, and <code>defaults=&quot;Hi
&lt;1&gt;there&lt;/1&gt;&quot;</code> with the child <code>Hi</code>
rendered <code>Hi i</code>. The fallback for a single object of
components (<code>{{ 1: &lt;strong /&gt; }}</code>) looked the tag up on
the string and rendered one of its characters. It now applies only when
that child is an object, so <code>{{ 1: &lt;strong /&gt; }}</code>
renders as before, and the tag falls back to its inner text, as it
already did with several children or with a number or an element as the
only child. This also stops a single-entry array child holding
<code>null</code> (<code>{[null]}</code>, e.g. from a <code>.map</code>
that returned <code>null</code>) from throwing <code>Cannot read
properties of null</code>. Thanks <a
href="https://github.com/Cayan"><code>@​Cayan</code></a> (<a
href="https://redirect.github.com/i18next/react-i18next/pull/1939">#1939</a>).</li>
</ul>
<h2>17.1.1</h2>
<ul>
<li>fix(Trans): with <code>components</code> as an object with index
keys, the component for key <code>0</code> is now rendered.
<code>components={{ 0: &lt;a href={path} /&gt; }}</code> with
<code>&quot;You're eligible. &lt;0&gt;Get started
here.&lt;/0&gt;&quot;</code> rendered the text without the link, a
self-closing <code>&lt;0/&gt;</code> rendered nothing, and in
<code>&lt;0&gt;a &lt;1&gt;b&lt;/1&gt;&lt;/0&gt;</code> both elements
were lost, while keys <code>1</code> and up and the array form worked.
The object was passed on as the indexed children, so
<code>&lt;0&gt;</code> resolved to the object itself. It is now looked
up by key, like a named components map. This also fixes an array
<code>components</code> next to
<code>react.transDefaultProps.components</code>, which the merge turns
into such an object (<code>{ Bold, 0, 1 }</code>) and so lost its first
entry, and a self-closing named tag in a mixed object (<code>{ 0: &lt;a
/&gt;, Bold: &lt;b /&gt; }</code> with <code>&lt;Bold/&gt;</code>),
which rendered as the text <code>&lt;Bold /&gt;</code>. Arrays, named
maps and index objects starting at <code>1</code> render as before.
Thanks <a
href="https://github.com/nk-batman21"><code>@​nk-batman21</code></a> (<a
href="https://redirect.github.com/i18next/react-i18next/pull/1938">#1938</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/react-i18next/commit/290e8abe91bc7660af3afb1e97cf6d2ca839eb98"><code>290e8ab</code></a>
17.1.4</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/aeb94d1ec3aa97703e3dc8142ecb236b4931a332"><code>aeb94d1</code></a>
changelog for 17.1.4</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/3fecad75a39cd5fe82e5f076108e24e5fee33b89"><code>3fecad7</code></a>
fix(types): use React's own children type unless
allowObjectInHTMLChildren is...</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/696c0f5d388b962c5275feb3bd01dcb6d89f02fd"><code>696c0f5</code></a>
17.1.3</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/094943a942b6eca7e75b3ad99456dfc77a28973f"><code>094943a</code></a>
build</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/a73495c09767db22496d5d13b2d1c622d65a477a"><code>a73495c</code></a>
changelog for 17.1.3</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/9a36388b1d2f3fc8dcc7c7ffb22602755f507357"><code>9a36388</code></a>
fix(IcuTrans): decode numeric entities above U+FFFF (<a
href="https://redirect.github.com/i18next/react-i18next/issues/1940">#1940</a>)</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/53a810c1f43198e86c7659248430d7eee0e23209"><code>53a810c</code></a>
17.1.2</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/01aa762d4adad014cd4660ae827c1658b669a28a"><code>01aa762</code></a>
build</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/78679811890fae0b5865b75d8e55934be307e2f2"><code>7867981</code></a>
changelog for 17.1.2</li>
<li>Additional commits viewable in <a
href="https://github.com/i18next/react-i18next/compare/v17.1.0...v17.1.4">compare
view</a></li>
</ul>
</details>
<br />

Updates `react-resizable-panels` from 4.14.7 to 4.14.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/releases">react-resizable-panels's
releases</a>.</em></p>
<blockquote>
<h2>4.14.8</h2>
<ul>
<li>Fix &quot;Stacking order can only be calculated for elements with a
common ancestor&quot; error thrown by the document
<code>pointermove</code> handler when the event target is removed from
the DOM during dispatch. Detached targets are now treated as viable hit
targets. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/771">#771</a></li>
<li>Fix <code>Group</code> and <code>Grid</code>
<code>setLayout()</code> and <code>Panel</code> <code>resize()</code>,
<code>collapse()</code>, and <code>expand()</code> validating against
pixel-based constraints for the previous group size when called before
the group's <code>ResizeObserver</code> ran (e.g. from an application's
own <code>ResizeObserver</code>). - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/770">#770</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md">react-resizable-panels's
changelog</a>.</em></p>
<blockquote>
<h2>4.14.8</h2>
<ul>
<li>Fix &quot;Stacking order can only be calculated for elements with a
common ancestor&quot; error thrown by the document
<code>pointermove</code> handler when the event target is removed from
the DOM during dispatch. Detached targets are now treated as viable hit
targets. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/771">#771</a></li>
<li>Fix <code>Group</code> and <code>Grid</code>
<code>setLayout()</code> and <code>Panel</code> <code>resize()</code>,
<code>collapse()</code>, and <code>expand()</code> validating against
pixel-based constraints for the previous group size when called before
the group's <code>ResizeObserver</code> ran (e.g. from an application's
own <code>ResizeObserver</code>). - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/770">#770</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/c19f0a93a96e4f214e9bd7b77eaec155f31f50d7"><code>c19f0a9</code></a>
4.14.7 -&gt; 4.14.8</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/625ef2d83a839eb6fb1a1c7e2703f27598136472"><code>625ef2d</code></a>
Validate imperative layout changes against the group's current size (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/772">#772</a>)</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/64c5be9e60a76b087fe56d9a0a20d415b9c69fe1"><code>64c5be9</code></a>
Fix &quot;Stacking order can only be calculated for elements with a
common ancesto...</li>
<li>See full diff in <a
href="https://github.com/bvaughn/react-resizable-panels/compare/4.14.7...4.14.8">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-26 13:54:49 +00:00
dependabot[bot] d113745d39 chore(deps): Bump react-resizable-panels from 4.14.6 to 4.14.7 in the react group (#2259) 
Bumps the react group with 1 update:
[react-resizable-panels](https://github.com/bvaughn/react-resizable-panels).

Updates `react-resizable-panels` from 4.14.6 to 4.14.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/releases">react-resizable-panels's
releases</a>.</em></p>
<blockquote>
<h2>4.14.7</h2>
<ul>
<li>Improve mount performance for groups with many panels by skipping
redundant constraint recalculations and subscriber notifications when a
<code>Panel</code>'s <code>disabled</code> prop has not changed. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/768">#768</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md">react-resizable-panels's
changelog</a>.</em></p>
<blockquote>
<h2>4.14.7</h2>
<ul>
<li>Improve mount performance for groups with many panels by skipping
redundant constraint recalculations and subscriber notifications when a
<code>Panel</code>'s <code>disabled</code> prop has not changed. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/768">#768</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/da1f5c16d9ba3f2767f4ff310f2cc642577757cd"><code>da1f5c1</code></a>
4.14.6 -&gt; 4.14.7</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/c8433978136e756bfef196c02e8f59a6f6550de9"><code>c843397</code></a>
perf: skip unchanged panel prop updates (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/768">#768</a>)</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/bb08b8724eb8a40f7246ca79c6d0424441ac3606"><code>bb08b87</code></a>
Update react-lib-tools to 0.0.67</li>
<li>See full diff in <a
href="https://github.com/bvaughn/react-resizable-panels/compare/4.14.6...4.14.7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-resizable-panels&package-manager=npm_and_yarn&previous-version=4.14.6&new-version=4.14.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-23 14:04:07 +00:00
dependabot[bot] 92e28a4874 chore(deps): Bump i18next from 26.5.2 to 26.5.3 (#2261) 
Bumps [i18next](https://github.com/i18next/i18next) from 26.5.2 to
26.5.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.5.3</h2>
<ul>
<li>fix(types): with the selector API, a plural key now requires
<code>count</code> also when the call passes an explicit
<code>ns</code>. <code>t(($) =&gt; $.item)</code> already failed without
<code>count</code>, but <code>t(($) =&gt; $.item, { ns: 'items'
})</code> compiled, although at runtime it looks up <code>item</code>
instead of <code>item_one</code> / <code>item_other</code> and returns
the key. It now fails the same way, also with <code>ordinal:
true</code>, <code>defaultValue</code>, an <code>ns</code> array, a key
prefix and <code>i18n.t</code>. Calls with <code>count</code>,
<code>context</code>, <code>returnObjects: true</code> and arrays of
selectors, as well as return types, are unchanged. Thanks <a
href="https://github.com/nyarthan"><code>@​nyarthan</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2452">#2452</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.5.3</h2>
<ul>
<li>fix(types): with the selector API, a plural key now requires
<code>count</code> also when the call passes an explicit
<code>ns</code>. <code>t(($) =&gt; $.item)</code> already failed without
<code>count</code>, but <code>t(($) =&gt; $.item, { ns: 'items'
})</code> compiled, although at runtime it looks up <code>item</code>
instead of <code>item_one</code> / <code>item_other</code> and returns
the key. It now fails the same way, also with <code>ordinal:
true</code>, <code>defaultValue</code>, an <code>ns</code> array, a key
prefix and <code>i18n.t</code>. Calls with <code>count</code>,
<code>context</code>, <code>returnObjects: true</code> and arrays of
selectors, as well as return types, are unchanged. Thanks <a
href="https://github.com/nyarthan"><code>@​nyarthan</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2452">#2452</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next/commit/f7d95939e7b9d52a2095dbe3808ddbd89662b1b2"><code>f7d9593</code></a>
26.5.3</li>
<li><a
href="https://github.com/i18next/i18next/commit/a19e0f90edc9b0117280e45851a3dd4d02a627eb"><code>a19e0f9</code></a>
changelog for 26.5.3</li>
<li><a
href="https://github.com/i18next/i18next/commit/124d04eebcbcaa7cc2b79ee365633e4e1725c16d"><code>124d04e</code></a>
fix(types): require count for explicit-ns plural selectors (<a
href="https://redirect.github.com/i18next/i18next/issues/2452">#2452</a>)</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next/compare/v26.5.2...v26.5.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next&package-manager=npm_and_yarn&previous-version=26.5.2&new-version=26.5.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-23 13:59:12 +00:00
dependabot[bot] 293a849976 chore(deps): Bump @codemirror/view from 6.43.14 to 6.43.15 (#2260) 
Bumps [@codemirror/view](https://github.com/codemirror/view) from
6.43.14 to 6.43.15.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/codemirror/view/commits">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@codemirror/view&package-manager=npm_and_yarn&previous-version=6.43.14&new-version=6.43.15)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-23 13:55:28 +00:00
dependabot[bot] efe357fea5 chore(deps-dev): Bump typescript-eslint from 8.71.2 to 8.72.0 (#2262) 
Bumps
[typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)
from 8.71.2 to 8.72.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.0</h2>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010">#13010</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992">#12992</a>)</li>
<li><strong>typescript-estree:</strong> error on abstract keyword that
precedes export (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13019">#13019</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> add <code>JSXFragment</code> to
<code>JSXAttribute['value']</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13051">#13051</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016">#13016</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS &lt; 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS &lt; 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055">#13055</a>)</li>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS &lt; 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054">#13054</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments &amp; whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy"><code>@​jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz"><code>@​fitchmultz</code></a></li>
<li>Shaan GS <a
href="https://github.com/ShaanGS"><code>@​ShaanGS</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.0 (2026-10-19)</h2>
<p>This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a4c2603d3e4fd43b33bc25b82457716e9f7cef71"><code>a4c2603</code></a>
chore(release): publish 8.72.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/typescript-eslint">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=typescript-eslint&package-manager=npm_and_yarn&previous-version=8.71.2&new-version=8.72.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-23 13:54:32 +00:00
dependabot[bot] cd1bc5aeed chore(deps-dev): Bump postcss from 8.5.30 to 8.5.31 (#2258) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.30 to
8.5.31.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.31</h2>
<ul>
<li>Fix better source map on <code>&lt;/style&gt;</code> escaping (by <a
href="https://github.com/firefoxic"><code>@​firefoxic</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.31</h2>
<ul>
<li>Fix better source map on <code>&lt;/style&gt;</code> escaping (by <a
href="https://github.com/firefoxic"><code>@​firefoxic</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/d1908579d6af4155ee5f759030184fb4c2b575ec"><code>d190857</code></a>
Release 8.5.31 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/4ef6d8cc0307df09c21a63b5521285657966ece3"><code>4ef6d8c</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/6abd674231f7867d1c37e6b71bc8d6e00165fd27"><code>6abd674</code></a>
Call the builder with every node when the output is escaped (<a
href="https://redirect.github.com/postcss/postcss/issues/2175">#2175</a>)</li>
<li>See full diff in <a
href="https://github.com/postcss/postcss/compare/8.5.30...8.5.31">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.30&new-version=8.5.31)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-22 14:19:25 +00:00
dependabot[bot] 0171daeea8 chore(deps): Bump react-resizable-panels from 4.14.5 to 4.14.6 in the react group (#2257) 
Bumps the react group with 1 update:
[react-resizable-panels](https://github.com/bvaughn/react-resizable-panels).

Updates `react-resizable-panels` from 4.14.5 to 4.14.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/releases">react-resizable-panels's
releases</a>.</em></p>
<blockquote>
<h2>4.14.6</h2>
<ul>
<li>Fix <code>F6</code> and <code>Shift+F6</code> keyboard navigation
trying to focus disabled separators. Disabled separators are now
skipped. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/767">#767</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md">react-resizable-panels's
changelog</a>.</em></p>
<blockquote>
<h2>4.14.6</h2>
<ul>
<li>Fix <code>F6</code> and <code>Shift+F6</code> keyboard navigation
trying to focus disabled separators. Disabled separators are now
skipped. - <a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/767">#767</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/bbc47aaf4fce78e7f424b7e1e6dcf22a2b0fbe57"><code>bbc47aa</code></a>
4.14.5 -&gt; 4.14.6</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/90cb7a4197187621a947474a004ab5bec7107b0e"><code>90cb7a4</code></a>
Tidying up</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/c8367d2f875aa8c977137a0f8a37e9db1e751d52"><code>c8367d2</code></a>
Skip disabled separators during F6 keyboard navigation (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/767">#767</a>)</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/4b6332ab872ff32faf4c08751ee3b07a14bf9548"><code>4b6332a</code></a>
Update react-lib-tools dev dependency</li>
<li>See full diff in <a
href="https://github.com/bvaughn/react-resizable-panels/compare/4.14.5...4.14.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-resizable-panels&package-manager=npm_and_yarn&previous-version=4.14.5&new-version=4.14.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-22 14:12:35 +00:00
dependabot[bot] d281e87069 chore(deps): Bump maplibre-gl from 6.14.0 to 6.15.0 (#2255) 
Bumps [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) from
6.14.0 to 6.15.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/maplibre/maplibre-gl-js/releases">maplibre-gl's
releases</a>.</em></p>
<blockquote>
<h2>v6.15.0</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Add <code>dragRotate: {around: 'pointer'}</code> to turn and tilt
the map around the point under the pointer, and <code>{around: 'center',
movement: 'circular' | 'linear'}</code>, which replaces the deprecated
<code>aroundCenter</code> (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8628">#8628</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Redraw fewer layers on terrain when a custom layer's
<code>terrainTileRevision</code> or a feature state changes (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8782">#8782</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Support the <code>hash</code> option in a projection registered with
<code>addProjection</code> (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8743">#8743</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Add experimental <code>addProjection</code>,
<code>removeProjection</code>, a built-in <code>identity</code>
projection and a <code>{bbox}</code> tile URL token for maps in a custom
planar CRS with its own quad tile grid (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/168">#168</a>,
<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/5764">#5764</a>)</li>
<li>Speed up tile loading by skipping point labels in the tile buffer,
which the neighbouring tile draws (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8535">#8535</a>)
(by <a
href="https://github.com/cherenkov"><code>@​cherenkov</code></a>)</li>
<li>Project GeoJSON sources on a map in a registered CRS, in the
workers, from a <code>definition</code> string and a projection handler
(<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8736">#8736</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Support OpenType <code>vert</code> forms in vertical labels rendered
with <code>font-faces</code> (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8489">#8489</a>)
(by <a
href="https://github.com/NEKOYASAN"><code>@​NEKOYASAN</code></a>)</li>
</ul>
<h3>🐞 Bug fixes</h3>
<ul>
<li>Fix a map in a registered projection going blank when its center
crosses 180° (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8802">#8802</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Fix world projections like Equal Earth throwing and jumping when the
mouse is in the space around the world (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8803">#8803</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Work around a regression in Safari 26.6 and later where the map
stops loading tiles after the page was in the background (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8780">#8780</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Fix labels in Brahmic scripts such as Devanagari, Thai and Telugu
mixing fonts or dropping letters when the style has a glyphs URL (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8741">#8741</a>)
(by <a
href="https://github.com/crackalamoo"><code>@​crackalamoo</code></a>)</li>
<li>Fix <code>setWorkerUrl</code> treating a <code>.cjs</code> fragment
or query marker as a module worker URL (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8769">#8769</a>)
(by <a
href="https://github.com/Anandb71"><code>@​Anandb71</code></a>)</li>
<li>Fix the terrain not finding a tile's own DEM data when the DEM
source's maxzoom is below the terrain tile zoom (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8765">#8765</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Fix the camera dropping to sea level while the terrain under the
center of a <code>jumpTo</code>, <code>easeTo</code> or
<code>flyTo</code> loads (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8549">#8549</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Fix a grid of lines along tile borders in line layers of sliced
overzoomed tiles when the source tile extent is larger than 4096, by
scaling the clip buffer with the extent (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8705">#8705</a>)
(by <a
href="https://github.com/tordans"><code>@​tordans</code></a>)</li>
<li>Fix the globe drag rounding its rotation to single precision (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8784">#8784</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Fix <code>load</code> and <code>idle</code> firing before the other
tiles finish loading when one tile fails (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8785">#8785</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Avoid using <code>.innerHTML = …</code> for the Popup close icon (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8795">#8795</a>)
(by <a href="https://github.com/k-yle"><code>@​k-yle</code></a>)</li>
<li>Fix a GeoJSON feature without coordinates staying out of the tiles
after <code>updateData</code> gives it some, by updating geojson-vt to
6.3.0 (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8797">#8797</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md">maplibre-gl's
changelog</a>.</em></p>
<blockquote>
<h2>6.15.0</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Add <code>dragRotate: {around: 'pointer'}</code> to turn and tilt
the map around the point under the pointer, and <code>{around: 'center',
movement: 'circular' | 'linear'}</code>, which replaces the deprecated
<code>aroundCenter</code> (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8628">#8628</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Redraw fewer layers on terrain when a custom layer's
<code>terrainTileRevision</code> or a feature state changes (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8782">#8782</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Support the <code>hash</code> option in a projection registered with
<code>addProjection</code> (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8743">#8743</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Add experimental <code>addProjection</code>,
<code>removeProjection</code>, a built-in <code>identity</code>
projection and a <code>{bbox}</code> tile URL token for maps in a custom
planar CRS with its own quad tile grid (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/168">#168</a>,
<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/5764">#5764</a>)</li>
<li>Speed up tile loading by skipping point labels in the tile buffer,
which the neighbouring tile draws (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8535">#8535</a>)
(by <a
href="https://github.com/cherenkov"><code>@​cherenkov</code></a>)</li>
<li>Project GeoJSON sources on a map in a registered CRS, in the
workers, from a <code>definition</code> string and a projection handler
(<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8736">#8736</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Support OpenType <code>vert</code> forms in vertical labels rendered
with <code>font-faces</code> (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8489">#8489</a>)
(by <a
href="https://github.com/NEKOYASAN"><code>@​NEKOYASAN</code></a>)</li>
</ul>
<h3>🐞 Bug fixes</h3>
<ul>
<li>Fix a map in a registered projection going blank when its center
crosses 180° (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8802">#8802</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Fix world projections like Equal Earth throwing and jumping when the
mouse is in the space around the world (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8803">#8803</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Work around a regression in Safari 26.6 and later where the map
stops loading tiles after the page was in the background (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8780">#8780</a>)
(by <a
href="https://github.com/birkskyum"><code>@​birkskyum</code></a>)</li>
<li>Fix labels in Brahmic scripts such as Devanagari, Thai and Telugu
mixing fonts or dropping letters when the style has a glyphs URL (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8741">#8741</a>)
(by <a
href="https://github.com/crackalamoo"><code>@​crackalamoo</code></a>)</li>
<li>Fix <code>setWorkerUrl</code> treating a <code>.cjs</code> fragment
or query marker as a module worker URL (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8769">#8769</a>)
(by <a
href="https://github.com/Anandb71"><code>@​Anandb71</code></a>)</li>
<li>Fix the terrain not finding a tile's own DEM data when the DEM
source's maxzoom is below the terrain tile zoom (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8765">#8765</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Fix the camera dropping to sea level while the terrain under the
center of a <code>jumpTo</code>, <code>easeTo</code> or
<code>flyTo</code> loads (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8549">#8549</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Fix a grid of lines along tile borders in line layers of sliced
overzoomed tiles when the source tile extent is larger than 4096, by
scaling the clip buffer with the extent (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8705">#8705</a>)
(by <a
href="https://github.com/tordans"><code>@​tordans</code></a>)</li>
<li>Fix the globe drag rounding its rotation to single precision (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8784">#8784</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Fix <code>load</code> and <code>idle</code> firing before the other
tiles finish loading when one tile fails (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8785">#8785</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
<li>Avoid using <code>.innerHTML = …</code> for the Popup close icon (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8795">#8795</a>)
(by <a href="https://github.com/k-yle"><code>@​k-yle</code></a>)</li>
<li>Fix a GeoJSON feature without coordinates staying out of the tiles
after <code>updateData</code> gives it some, by updating geojson-vt to
6.3.0 (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8797">#8797</a>)
(by <a
href="https://github.com/johncarmack1984"><code>@​johncarmack1984</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/638b3f9ecab4b743fd4d086d3bfd19bce7b7b032"><code>638b3f9</code></a>
Bump js version to 6.15.0 (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8812">#8812</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/ddf4cc611392d9489fa6edb2e464165e1c2d75eb"><code>ddf4cc6</code></a>
Fix registered projections going blank when the center crosses 180° (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8802">#8802</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/c8e4e34f9880d1d51a1a3ec8b54e67c694ccc173"><code>c8e4e34</code></a>
fix: world projections throwing and wrapping past their edge (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8803">#8803</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/7ec75354566c464df70cd67ae50cfaaa2f431b55"><code>7ec7535</code></a>
first step towards supporting trusted-types (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8795">#8795</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/fc1aa1cd7539ab50e4451d7175e30fa95f41ddf3"><code>fc1aa1c</code></a>
docs: separate a registered CRS from the tile grid its sources are cut
in (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8">#8</a>...</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/1897306104320058fd0bb492691384f1c9e0b64c"><code>1897306</code></a>
feat: support dragRotate around pointer (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8628">#8628</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/17ad56d0e253ae4b6cbc4d6fab50009be2f26e2f"><code>17ad56d</code></a>
docs: show how custom layers place positions on a registered CRS (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8806">#8806</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/fe339621bb436ea8ce39373c43d337eec8376551"><code>fe33962</code></a>
fix: keep GeoJSON at the far pole of a polar projection off the map (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8798">#8798</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/17eb78b3b3dbf633ed01a73b3aeedd4fd46103ec"><code>17eb78b</code></a>
chore: bump <code>@​maplibre/geojson-vt</code> to 6.3.0 and pass its
coordinates and wrap o...</li>
<li><a
href="https://github.com/maplibre/maplibre-gl-js/commit/6c2784f7adda6d138e8ef13ccc2acaf7825f3be8"><code>6c2784f</code></a>
refactor: rename CRSDefinition to CRS and its wkt to definition (<a
href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8787">#8787</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/maplibre/maplibre-gl-js/compare/v6.14.0...v6.15.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=maplibre-gl&package-manager=npm_and_yarn&previous-version=6.14.0&new-version=6.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-21 13:57:20 +00:00
dependabot[bot] 057a6a07d8 chore(deps): Bump i18next from 26.4.7 to 26.5.2 (#2256) 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [i18next](https://github.com/i18next/i18next) from 26.4.7 to
26.5.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.5.2</h2>
<ul>
<li>fix(types): on TypeScript 7, a <code>t()</code> call with a missing,
misspelled or wrongly typed option now reports that option again
(<code>Property 'album' is missing</code>, <code>Type 'string' is not
assignable to type 'number'</code>), as TypeScript 5 and 6 do.
TypeScript 7 elaborated the error against the default-value signature
instead and ended in <code>'{ count: 3; albm: &quot;Summer&quot;; }' is
not assignable to type 'string'</code>: on a failed call TypeScript
explains the last of the equally matching signatures, and TypeScript 7
sorts the 3-element <code>[key, defaultValue, options?]</code> last. It
is now written as two signatures, <code>[key, defaultValue]</code> and
<code>[key, defaultValue, options]</code>. This affects the default key
checks with i18next <code>{{name}}</code> messages as well as
<code>parseInterpolation: 'icu'</code> and <code>'mf2'</code>. Which
calls compile, their return types and the error positions are unchanged
on TypeScript 5.9, 6 and 7.</li>
</ul>
<h2>v26.5.1</h2>
<ul>
<li>perf(types): type-checking <code>t()</code> calls against a large
namespace is no longer quadratic in the number of keys. TypeScript does
not cache <code>keyof</code> of an object type, and the types rebuilt
the union of all keys of a namespace once per key while building the key
union, and again in every <code>t()</code> call to look up the return
type. Both now use a cached key union, and a literal key is looked up
directly instead of being intersected with every key. With 5,000 keys in
one namespace and one call per key, the check time went from 14.8s to
1.1s (TypeScript 6); with 1,000 keys from 0.75s to 0.27s. Keys, return
types and errors are unchanged.</li>
<li>perf(types): the selector API (<code>enableSelector: true</code> /
<code>'strict'</code>) with <code>context</code> is no longer quadratic
in the size of an object. To decide which keys a context keeps, the
types scanned all keys of the object once for every key, also when
TypeScript checks the selector with <code>context</code> widened to
<code>string</code>. With 1,000 keys plus one context variant each, a
namespace took 18.7s and failed with &quot;Type instantiation is
excessively deep and possibly infinite&quot; (TS2589); 2,500 and more
ran out of memory. The context variants of an object are now collected
once, in one pass over its keys: 1,000 keys check in 0.69s, 5,000 in
3.1s. Long keys (whole sentences with <code>keySeparator: false</code>)
work as before. Selected values and errors are unchanged.</li>
</ul>
<h2>v26.5.0</h2>
<ul>
<li>feat(types): <code>parseInterpolation: 'icu'</code> and
<code>parseInterpolation: 'mf2'</code> type <code>t()</code> options
from the message's ICU MessageFormat arguments (i18next-icu) or
MessageFormat 2 variables (i18next-mf2), so ICU and MF2 users no longer
need <code>parseInterpolation: false</code> and lose argument checking.
Missing, misspelled and wrongly typed arguments fail, and so does
leaving out the options for a message with arguments
(<code>t('greeting')</code>); that error names the missing arguments.
Opt-in, default <code>true</code> is unchanged.
<ul>
<li>ICU: <code>{name}</code> takes <code>string | number</code>,
<code>{n, number}</code>, <code>plural</code> and
<code>selectordinal</code> take <code>number</code>, <code>{d,
date}</code> and <code>{t, time}</code> take <code>Date</code>,
<code>select</code> takes its case keys or any string (for
<code>other</code>), and arguments nested in cases are required too.
<code>#</code> and tags are not arguments, apostrophe quoting is read
like intl-messageformat does.</li>
<li>MF2: <code>{$name}</code> takes <code>string | number</code>, a
variable annotated with <code>:number</code>, <code>:integer</code>,
<code>:currency</code>, <code>:percent</code> or <code>:unit</code>
(inline or through <code>.input</code> / <code>.local</code>) takes
<code>number</code>, <code>:datetime</code>, <code>:date</code> and
<code>:time</code> take <code>Date</code>, <code>:string</code> takes
<code>string</code>, option and markup variables
(<code>minimumFractionDigits=$digits</code>, <code>{#link
href=$url}</code>) are required too, <code>.local</code> variables are
not arguments, and <code>|quoted literals|</code> and <code>\{</code>
escapes are skipped.</li>
<li><code>interpolationFormatTypeMap</code> overrides a type by ICU
format or MF2 function name, e.g. <code>date: Date | number</code> or a
custom <code>uppercase: string</code>.</li>
<li>Applies to <code>t()</code>, <code>getFixedT()</code>,
<code>i18n.t</code>, key prefixes, namespaces, the selector API and
react-i18next's <code>Trans</code> <code>values</code>. Messages need
literal types, as the resources file from i18next-cli's
<code>types</code> command has them.</li>
<li>Type-check cost with 1,000 messages and one call each: 1.35s instead
of 0.86s with <code>false</code> (TypeScript 6), 0.5s instead of 0.26s
with TypeScript 7. Messages that no call uses cost nothing.</li>
</ul>
</li>
<li>fix(types): with the default (non-strict) key checks, an options
object with a missing or misspelled interpolation variable now reports
the missing variable (<code>Property 'name' is missing</code>) instead
of <code>'{ nmae: string }' is not assignable to type 'string'</code>
from the default-value overload.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.5.2</h2>
<ul>
<li>fix(types): on TypeScript 7, a <code>t()</code> call with a missing,
misspelled or wrongly typed option now reports that option again
(<code>Property 'album' is missing</code>, <code>Type 'string' is not
assignable to type 'number'</code>), as TypeScript 5 and 6 do.
TypeScript 7 elaborated the error against the default-value signature
instead and ended in <code>'{ count: 3; albm: &quot;Summer&quot;; }' is
not assignable to type 'string'</code>: on a failed call TypeScript
explains the last of the equally matching signatures, and TypeScript 7
sorts the 3-element <code>[key, defaultValue, options?]</code> last. It
is now written as two signatures, <code>[key, defaultValue]</code> and
<code>[key, defaultValue, options]</code>. This affects the default key
checks with i18next <code>{{name}}</code> messages as well as
<code>parseInterpolation: 'icu'</code> and <code>'mf2'</code>. Which
calls compile, their return types and the error positions are unchanged
on TypeScript 5.9, 6 and 7.</li>
</ul>
<h2>26.5.1</h2>
<ul>
<li>perf(types): type-checking <code>t()</code> calls against a large
namespace is no longer quadratic in the number of keys. TypeScript does
not cache <code>keyof</code> of an object type, and the types rebuilt
the union of all keys of a namespace once per key while building the key
union, and again in every <code>t()</code> call to look up the return
type. Both now use a cached key union, and a literal key is looked up
directly instead of being intersected with every key. With 5,000 keys in
one namespace and one call per key, the check time went from 14.8s to
1.1s (TypeScript 6); with 1,000 keys from 0.75s to 0.27s. Keys, return
types and errors are unchanged.</li>
<li>perf(types): the selector API (<code>enableSelector: true</code> /
<code>'strict'</code>) with <code>context</code> is no longer quadratic
in the size of an object. To decide which keys a context keeps, the
types scanned all keys of the object once for every key, also when
TypeScript checks the selector with <code>context</code> widened to
<code>string</code>. With 1,000 keys plus one context variant each, a
namespace took 18.7s and failed with &quot;Type instantiation is
excessively deep and possibly infinite&quot; (TS2589); 2,500 and more
ran out of memory. The context variants of an object are now collected
once, in one pass over its keys: 1,000 keys check in 0.69s, 5,000 in
3.1s. Long keys (whole sentences with <code>keySeparator: false</code>)
work as before. Selected values and errors are unchanged.</li>
</ul>
<h2>26.5.0</h2>
<ul>
<li>feat(types): <code>parseInterpolation: 'icu'</code> and
<code>parseInterpolation: 'mf2'</code> type <code>t()</code> options
from the message's ICU MessageFormat arguments (i18next-icu) or
MessageFormat 2 variables (i18next-mf2), so ICU and MF2 users no longer
need <code>parseInterpolation: false</code> and lose argument checking.
Missing, misspelled and wrongly typed arguments fail, and so does
leaving out the options for a message with arguments
(<code>t('greeting')</code>); that error names the missing arguments.
Opt-in, default <code>true</code> is unchanged.
<ul>
<li>ICU: <code>{name}</code> takes <code>string | number</code>,
<code>{n, number}</code>, <code>plural</code> and
<code>selectordinal</code> take <code>number</code>, <code>{d,
date}</code> and <code>{t, time}</code> take <code>Date</code>,
<code>select</code> takes its case keys or any string (for
<code>other</code>), and arguments nested in cases are required too.
<code>#</code> and tags are not arguments, apostrophe quoting is read
like intl-messageformat does.</li>
<li>MF2: <code>{$name}</code> takes <code>string | number</code>, a
variable annotated with <code>:number</code>, <code>:integer</code>,
<code>:currency</code>, <code>:percent</code> or <code>:unit</code>
(inline or through <code>.input</code> / <code>.local</code>) takes
<code>number</code>, <code>:datetime</code>, <code>:date</code> and
<code>:time</code> take <code>Date</code>, <code>:string</code> takes
<code>string</code>, option and markup variables
(<code>minimumFractionDigits=$digits</code>, <code>{#link
href=$url}</code>) are required too, <code>.local</code> variables are
not arguments, and <code>|quoted literals|</code> and <code>\{</code>
escapes are skipped.</li>
<li><code>interpolationFormatTypeMap</code> overrides a type by ICU
format or MF2 function name, e.g. <code>date: Date | number</code> or a
custom <code>uppercase: string</code>.</li>
<li>Applies to <code>t()</code>, <code>getFixedT()</code>,
<code>i18n.t</code>, key prefixes, namespaces, the selector API and
react-i18next's <code>Trans</code> <code>values</code>. Messages need
literal types, as the resources file from i18next-cli's
<code>types</code> command has them.</li>
<li>Type-check cost with 1,000 messages and one call each: 1.35s instead
of 0.86s with <code>false</code> (TypeScript 6), 0.5s instead of 0.26s
with TypeScript 7. Messages that no call uses cost nothing.</li>
</ul>
</li>
<li>fix(types): with the default (non-strict) key checks, an options
object with a missing or misspelled interpolation variable now reports
the missing variable (<code>Property 'name' is missing</code>) instead
of <code>'{ nmae: string }' is not assignable to type 'string'</code>
from the default-value overload.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next/commit/c46ea5c301c049d17e47412b1b64a94b54c1bb97"><code>c46ea5c</code></a>
26.5.2</li>
<li><a
href="https://github.com/i18next/i18next/commit/d798f0e703d49770f4016deb483945eecd3e59f3"><code>d798f0e</code></a>
fix(types): report the wrong t() option on TypeScript 7</li>
<li><a
href="https://github.com/i18next/i18next/commit/dabd9f60d849d66936baca4adbca7e349f459069"><code>dabd9f6</code></a>
26.5.1</li>
<li><a
href="https://github.com/i18next/i18next/commit/01c3852d941d2dad503ff477755e0c489f3d75ee"><code>01c3852</code></a>
perf(types): no quadratic type-check time for large namespaces</li>
<li><a
href="https://github.com/i18next/i18next/commit/64b9da8bfd6d1e2a58eef23ed885b5ab60a412f1"><code>64b9da8</code></a>
26.5.0</li>
<li><a
href="https://github.com/i18next/i18next/commit/2468227c924204a6fafcf78ff615d7a232e9a07a"><code>2468227</code></a>
feat(types): parseInterpolation 'icu' and 'mf2' type t() options from
ICU arg...</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next/compare/v26.4.7...v26.5.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next&package-manager=npm_and_yarn&previous-version=26.4.7&new-version=26.5.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-21 13:55:11 +00:00
dependabot[bot] ccfe624ac6 chore(deps-dev): Bump i18next-cli from 1.75.3 to 1.77.0 (#2254) 
Bumps [i18next-cli](https://github.com/i18next/i18next-cli) from 1.75.3
to 1.77.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md">i18next-cli's
changelog</a>.</em></p>
<blockquote>
<h2>1.77.0</h2>
<ul>
<li>feat(types): with <code>extract.messageFormat: 'icu'</code> or
<code>'mf2'</code>, a newly generated <code>i18next.d.ts</code> sets
<code>parseInterpolation: 'icu'</code> or <code>'mf2'</code> when the
project's i18next is 26.5.0 or later, so <code>t()</code> options are
type-checked
against the arguments of each message. With i18next 26.2.0 to 26.4.x it
still sets <code>parseInterpolation: false</code>. The
version is read from <code>node_modules/i18next/package.json</code>,
from the working directory upwards (hoisted monorepo
installs count); without an installed i18next it stays
<code>false</code>. The warning for an existing
<code>i18next.d.ts</code> without
<code>parseInterpolation</code> suggests the value for your i18next
version, and an existing file that still sets <code>false</code>
although your i18next supports the typed value gets a hint.</li>
<li>docs(skill): the ICU and MF2 reference describes
<code>parseInterpolation: 'icu'</code> / <code>'mf2'</code>.</li>
</ul>
<h2>1.76.0</h2>
<ul>
<li>feat: new <code>extract.messageFormat</code> option,
<code>'i18next'</code> (default), <code>'icu'</code> (<a
href="https://github.com/i18next/i18next-icu">i18next-icu</a>)
or <code>'mf2'</code> (<a
href="https://github.com/i18next/i18next-mf2">i18next-mf2</a>), for the
syntax of your translation values.</li>
<li>feat(extract): with <code>messageFormat: 'icu'</code> or
<code>'mf2'</code>, <code>extract</code> writes one key per message.
<code>t('photos', '{count, plural, ...}', { count })</code> gave
<code>photos_one</code> and <code>photos_other</code> (plus
<code>_few</code> and <code>_many</code> for languages like Polish),
keys i18next-icu and i18next-mf2 never read, and <code>context</code>
gave <code>_male</code> keys; now it gives <code>photos</code>.
<code>$t()</code> in a value
is no longer read as nesting, and the children of
<code>&lt;Trans&gt;</code> are written with <code>{name}</code> (ICU) or
<code>{$name}</code> (MF2)
instead of <code>{{name}}</code>, which ICU and MF2 rendered as
text.</li>
<li>feat(extract): <code>IcuTrans</code> and
<code>IcuTransWithoutContext</code> are extracted, also when imported
under another name (key from
<code>i18nKey</code>, or <code>defaultTranslation</code> when there is
none), and so are the <code>Trans</code>, <code>Plural</code>,
<code>Select</code> and <code>SelectOrdinal</code>
components of <code>react-i18next/icu.macro</code>, with the message the
macro builds (<code>&lt;Trans&gt;Welcome,
&lt;strong&gt;{name}&lt;/strong&gt;!&lt;/Trans&gt;</code> gives
<code>Welcome, &lt;0&gt;{name}&lt;/0&gt;!</code>). Before,
<code>IcuTrans</code> was
not extracted, and the macro <code>&lt;Trans&gt;</code> was read as
react-i18next <code>Trans</code> and written as
<code>Welcome, &lt;strong&gt;{{name}}&lt;/strong&gt;!</code>, which the
compiled <code>IcuTrans</code> rendered as text.</li>
<li>feat(status): with <code>messageFormat: 'icu'</code> or
<code>'mf2'</code>, a plural or select message counts as one key, so
<code>status</code> no
longer reports missing <code>_few</code> and <code>_many</code>
keys.</li>
<li>feat(instrument): with <code>messageFormat: 'icu'</code> or
<code>'mf2'</code>, <code>instrument</code> writes <code>{name}</code> /
<code>{$name}</code> placeholders, a
<code>count === 1 ? … : …</code> ternary becomes one plural message
instead of <code>defaultValue_one</code> /
<code>defaultValue_other</code>, and
the i18n init file it creates registers <code>i18next-icu</code> (with
<code>intl-messageformat</code> in the install hint) or
<code>i18next-mf2</code>.</li>
<li>feat(extract, instrument): with <code>messageFormat: 'icu'</code> or
<code>'mf2'</code>, the text around converted placeholders
(<code>Trans</code> values, <code>instrument</code>) is
escaped: <code>File '{{name}}' not found</code> becomes <code>File
''{name}' not found</code>, because an apostrophe before <code>{</code>
starts quoted
text in ICU and <code>'{name}'</code> would render as the text
<code>{name}</code>; literal braces are quoted (ICU) or escaped
(MF2).</li>
<li>feat(lint): with <code>messageFormat: 'icu'</code> or
<code>'mf2'</code>, <code>lint</code> parses every value in the
translation files of all
locales and reports, with file, key and line (JSON files):
<ul>
<li>syntax errors with the parser's message (<code>greeting: ICU syntax
error: EXPECT_ARGUMENT_CLOSING_BRACE at column 7</code>),
with a hint when the value contains i18next's <code>{{</code></li>
<li>argument names that differ from the primary language, so a renamed
or missing <code>{name}</code> is caught (<code>#</code> is not an
argument)</li>
<li>plural categories that do not fit the locale, for
<code>plural</code> and <code>selectordinal</code> (MF2:
<code>.match</code> on <code>:number</code> or
<code>:integer</code>). Allowed are the locale's CLDR categories,
required are <code>other</code> plus every category a whole number from
0 to 1000 selects: <code>ru</code> needs <code>one</code>,
<code>few</code> and <code>many</code>, while <code>fr</code>,
<code>es</code>, <code>it</code> and <code>pt</code> may leave out
<code>many</code> (only from
1,000,000) and <code>cs</code> its <code>many</code> (fractions only),
and <code>zero</code> in <code>en</code> is reported as never used.
Exact selectors like
<code>=0</code> are allowed and count for a category when they cover
every whole number it is used for (<code>=1</code> covers
<code>one</code> in
<code>en</code>, not in <code>ru</code>, where <code>one</code> is also
21, 31, ...). For a locale <code>Intl</code> does not know only
<code>other</code> is required.</li>
</ul>
</li>
<li>fix(lint): with <code>messageFormat: 'icu'</code> or
<code>'mf2'</code>, the <code>t()</code> interpolation check reads the
arguments with the same
parser. ICU braces like <code>male {{name}}</code> are no longer taken
for <code>{{name}}</code> interpolation (which reported the
<code>gender</code>
passed to a select as unused), and <code>t('greeting', 'Hello {name}', {
nmae })</code> is reported.</li>
<li>feat(types): with <code>messageFormat: 'icu'</code> or
<code>'mf2'</code>, a newly generated <code>i18next.d.ts</code> sets
<code>parseInterpolation: false</code>
(i18next 26.2.0+), so ICU and MF2 plurals no longer break the type-safe
<code>t</code>. For an existing file without it, <code>types</code>
prints a warning.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-cli/commit/933364ee283b2b6a805ad1ae8c936a01a2de2dae"><code>933364e</code></a>
1.77.0</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/2916f1b31425dcffffc9b2e6abc8436341f36473"><code>2916f1b</code></a>
update i18next deps</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/b7d07e784e4832a0e452afaf4640755461569638"><code>b7d07e7</code></a>
feat(types): write parseInterpolation 'icu' / 'mf2' for i18next 26.5.0
or later</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/71194cce275ba105f399e7d8aa01c7f58d76bdde"><code>71194cc</code></a>
test(lint): platform paths in the ICU/MF2 lint tests, so they pass on
Windows</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/1ea83288d0a247a28cbf87a36f3a516ee7ba4396"><code>1ea8328</code></a>
1.76.0</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/faa93a34705f0ae0cda8866e5e08943ef7579c86"><code>faa93a3</code></a>
fix(extract, instrument): escape ICU/MF2 text, register the plugin in
the ini...</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/a87f01fcb4836935afb840629c9b63f73d7a4839"><code>a87f01f</code></a>
feat(extract, status, instrument): one key per ICU/MF2 message, IcuTrans
and ...</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/e9b1f5642a95a638ff60a2194c0b039d633a1f66"><code>e9b1f56</code></a>
feat(lint, types): ICU and MF2 support with the new
extract.messageFormat option</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/6d2202d02dbb962c454ee496b12ac865d0027dba"><code>6d2202d</code></a>
README: add Awesome Claude Code badge next to the skill install
badge</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-cli/compare/v1.75.3...v1.77.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next-cli&package-manager=npm_and_yarn&previous-version=1.75.3&new-version=1.77.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-21 13:54:07 +00:00
dependabot[bot] b1ffd828ea chore(deps): Bump react-i18next from 17.0.21 to 17.1.0 in the react group (#2253) 
Bumps the react group with 1 update:
[react-i18next](https://github.com/i18next/react-i18next).

Updates `react-i18next` from 17.0.21 to 17.1.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md">react-i18next's
changelog</a>.</em></p>
<blockquote>
<h2>17.1.0</h2>
<ul>
<li>feat(types): with i18next's new <code>parseInterpolation:
'icu'</code> (or <code>'mf2'</code>) type option (i18next v26.5.0), the
<code>values</code> of <code>IcuTrans</code> and
<code>IcuTransWithoutContext</code> are typed from the message of
<code>i18nKey</code>, like the options of <code>t()</code>: a misspelled
argument, a value of the wrong type or a value meant for another key is
a type error. <code>values</code> was <code>Record&lt;string,
any&gt;</code> before, and still is with any other
<code>parseInterpolation</code> setting. <code>values</code> stays
optional, as on <code>Trans</code>. <code>useTranslation</code>'s
<code>t</code> and <code>Trans</code> <code>values</code> get the checks
from i18next's types without changes here.</li>
<li>fix(types): <code>IcuTrans</code> and
<code>IcuTransWithoutContext</code> now infer the literal
<code>i18nKey</code> (<code>const</code> type parameter, as
<code>Trans</code> does), so props that depend on the key are checked
against that key instead of all keys of the namespace.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/react-i18next/commit/d3b12369660975aa73e8c2648de5e7cfa4fcbc57"><code>d3b1236</code></a>
17.1.0</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/efed87d91449ad3cfcbdfd0d9ec3b24ff19691fb"><code>efed87d</code></a>
chore: i18next ^26.5.0 for the parseInterpolation 'icu' / 'mf2' type
tests</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/6300ae2e5860c00e34c8157ec4203c99204fefeb"><code>6300ae2</code></a>
feat(types): IcuTrans values typed from the message under
parseInterpolation ...</li>
<li>See full diff in <a
href="https://github.com/i18next/react-i18next/compare/v17.0.21...v17.1.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-i18next&package-manager=npm_and_yarn&previous-version=17.0.21&new-version=17.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-21 13:52:39 +00:00
dependabot[bot] 37d8a9fa1d chore(deps-dev): Bump eslint from 10.12.0 to 10.13.0 (#2252) 
Bumps [eslint](https://github.com/eslint/eslint) from 10.12.0 to
10.13.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.13.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/48d5cc47e43478670ccf95a74f7a73e8408152b5"><code>48d5cc4</code></a>
feat: report references inside IIFEs in
<code>no-use-before-define</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21238">#21238</a>)
(Irfan fandi)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a39d9fb1fdb5db546f6407580cac531ba3370450"><code>a39d9fb</code></a>
feat: add <code>globalThis</code> to <code>no-obj-calls</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21382">#21382</a>)
(synthex-byte)</li>
<li><a
href="https://github.com/eslint/eslint/commit/66ac58383e076940c11a5d7213ad079028d1140e"><code>66ac583</code></a>
feat: check <code>yield*</code> expressions in
<code>no-unsafe-optional-chaining</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21399">#21399</a>)
(xbinaryx)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/87bd2cef7b2309739c29598fb2be335f4bed71a3"><code>87bd2ce</code></a>
fix: avoid redeclared <code>let</code> when <code>no-var</code> and
<code>one-var</code> fix together (<a
href="https://redirect.github.com/eslint/eslint/issues/21389">#21389</a>)
(Daniel Pinto)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4783a6806fb73ea4843ac46c6ae3d8285f56c288"><code>4783a68</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/43f0ac90e7858a834a0e68309e6397fb4cfa72dd"><code>43f0ac9</code></a>
docs: clarify parameter description in <code>getText</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21287">#21287</a>)
(lumir)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/b59d889c7c18d8c73144e6ba46e9e7f3e7da0196"><code>b59d889</code></a>
chore: update github/codeql-action action to v4.38.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/21412">#21412</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/95e51a0518b15015304eca9844b3f64c1fc167ca"><code>95e51a0</code></a>
ci: re-enable <code>@typescript-eslint/typescript-eslint</code> in
ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/21410">#21410</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/317fcb365f19e912a60d171a9d5a8d1f16fe4660"><code>317fcb3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21409">#21409</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b92decf8ead7cc4082a18a4a0ab28f3c7c589887"><code>b92decf</code></a>
perf: skip no-redeclare scan for single-declaration variables (<a
href="https://redirect.github.com/eslint/eslint/issues/21365">#21365</a>)
(James Ross)</li>
<li><a
href="https://github.com/eslint/eslint/commit/47b7063b3f3f7bc7a5bcb87c082577e4e8b96e24"><code>47b7063</code></a>
chore: update dependency <code>@​eslint/json</code> to ^2.1.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21398">#21398</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/e5aea414cc00555ecd43f6e608bf80e0f9a6d4d6"><code>e5aea41</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21390">#21390</a>)
(ESLint Bot)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4637f9827a1ba137498eaee70957850621082815"><code>4637f98</code></a>
10.13.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/96df05ceb7000813859acf16a690f8a8bbbea904"><code>96df05c</code></a>
Build: changelog update for 10.13.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/4783a6806fb73ea4843ac46c6ae3d8285f56c288"><code>4783a68</code></a>
docs: Update README</li>
<li><a
href="https://github.com/eslint/eslint/commit/b59d889c7c18d8c73144e6ba46e9e7f3e7da0196"><code>b59d889</code></a>
chore: update github/codeql-action action to v4.38.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/21412">#21412</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/95e51a0518b15015304eca9844b3f64c1fc167ca"><code>95e51a0</code></a>
ci: re-enable <code>@typescript-eslint/typescript-eslint</code> in
ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/21410">#21410</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/317fcb365f19e912a60d171a9d5a8d1f16fe4660"><code>317fcb3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21409">#21409</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/48d5cc47e43478670ccf95a74f7a73e8408152b5"><code>48d5cc4</code></a>
feat: report references inside IIFEs in
<code>no-use-before-define</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21238">#21238</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/43f0ac90e7858a834a0e68309e6397fb4cfa72dd"><code>43f0ac9</code></a>
docs: clarify parameter description in <code>getText</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21287">#21287</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a39d9fb1fdb5db546f6407580cac531ba3370450"><code>a39d9fb</code></a>
feat: add <code>globalThis</code> to <code>no-obj-calls</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21382">#21382</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b92decf8ead7cc4082a18a4a0ab28f3c7c589887"><code>b92decf</code></a>
perf: skip no-redeclare scan for single-declaration variables (<a
href="https://redirect.github.com/eslint/eslint/issues/21365">#21365</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.12.0...v10.13.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=eslint&package-manager=npm_and_yarn&previous-version=10.12.0&new-version=10.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-20 17:23:01 +00:00