Compare commits

...

5 Commits

Author SHA1 Message Date
dependabot[bot] a23208d60d chore(deps): Bump i18next from 25.10.10 to 26.0.1 (#1776)
Bumps [i18next](https://github.com/i18next/i18next) from 25.10.10 to
26.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.0.1</h2>
<ul>
<li>fix: Formatter no longer crashes when <code>alwaysFormat</code> is
<code>true</code> and no format specifier is present
(<code>format</code> is <code>undefined</code>)</li>
<li>fix: Formatter now returns <code>undefined</code>/<code>null</code>
values as-is instead of producing <code>NaN</code> when the value is
missing</li>
</ul>
<h2>v26.0.0</h2>
<p><strong>This is a major breaking release:</strong></p>
<h3>Breaking Changes</h3>
<ul>
<li><strong>Remove deprecated <code>initImmediate</code> option</strong>
— the backward-compatibility mapping from <code>initImmediate</code> to
<code>initAsync</code> (introduced in v24) has been removed. Use
<code>initAsync</code> instead.</li>
<li><strong>Remove legacy <code>interpolation.format</code>
function</strong> — the old monolithic format function
(<code>interpolation: { format: (value, format, lng) =&gt; ... }</code>)
is no longer supported. The built-in Formatter (or a custom Formatter
module via <code>.use()</code>) is now always used. Migrate to the <a
href="https://www.i18next.com/translation-function/formatting">new
formatting approach</a> using
<code>i18next.services.formatter.add()</code> or
<code>.addCached()</code> for custom formatters.</li>
<li><strong>Remove console support notice</strong> — the console support
notice introduced in v25.8.0 has been removed, along with the
<code>showSupportNotice</code> option and all related internal
suppression logic (<code>globalThis.__i18next_supportNoticeShown</code>,
<code>I18NEXT_NO_SUPPORT_NOTICE</code> env var). See our blog post for
the <a href="https://www.locize.com/blog/i18next-support-notice">full
story</a>.</li>
<li><strong>Remove <code>simplifyPluralSuffix</code> option</strong> —
this option was unused by the core PluralResolver (which relies entirely
on <code>Intl.PluralRules</code>). It only had an effect in the old
v1/v2/v3 compatibility layer. The v4 test compatibility layer now
defaults to <code>true</code> internally.</li>
<li><strong>Remove deprecated <code>@babel/polyfill</code></strong> from
devDependencies.</li>
</ul>
<h3>Improvements</h3>
<ul>
<li><strong>Code modernization</strong> across all source files:
<ul>
<li>Replace <code>indexOf() &gt; -1</code> / <code>indexOf() &lt;
0</code> with <code>.includes()</code> (~40+ occurrences)</li>
<li>Replace <code>indexOf() === 0</code> with <code>.startsWith()</code>
where appropriate</li>
<li>Replace <code>var</code> with <code>const</code>, <code>'' +
object</code> with <code>String(object)</code>,
<code>.substring()</code> with <code>.slice()</code></li>
<li>Replace <code>.apply(observer, [event, ...args])</code> with direct
call <code>observer(event, ...args)</code></li>
<li>Remove unnecessary <code>.call(this, ...)</code> in BackendConnector
retry logic</li>
<li>Fix <code>array-callback-return</code> in LanguageUtils
<code>getBestMatchFromCodes</code></li>
<li>Clean up all stale <code>eslint-disable</code> comments from source
files</li>
</ul>
</li>
<li><strong>EventEmitter</strong>: add <code>once()</code> method for
one-time event subscriptions</li>
<li><strong>Memory leak fix</strong>: move module-level
<code>checkedLoadedFor</code> cache to Translator instance, preventing
cross-instance state leakage</li>
<li><strong>TypeScript</strong>: fix <code>BackendModule</code> generic
parameter naming inconsistency between CJS and ESM type definitions</li>
<li><strong>TypeScript</strong>: add <code>once()</code> method to
<code>i18n</code> and <code>ResourceStore</code> type interfaces</li>
<li><strong>ESLint 9</strong>: migrate from ESLint 8 (airbnb-base) to
ESLint 9 flat config with <a
href="https://github.com/neostandard/neostandard">neostandard</a></li>
<li><strong>Vitest 4</strong>: upgrade from vitest 3 to vitest 4,
migrate workspace files to <code>test.projects</code> config</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.0.1</h2>
<ul>
<li>fix: Formatter no longer crashes when <code>alwaysFormat</code> is
<code>true</code> and no format specifier is present
(<code>format</code> is <code>undefined</code>)</li>
<li>fix: Formatter now returns <code>undefined</code>/<code>null</code>
values as-is instead of producing <code>NaN</code> when the value is
missing</li>
</ul>
<h2>26.0.0</h2>
<p><strong>This is a major breaking release:</strong></p>
<h3>Breaking Changes</h3>
<ul>
<li><strong>Remove deprecated <code>initImmediate</code> option</strong>
— the backward-compatibility mapping from <code>initImmediate</code> to
<code>initAsync</code> (introduced in v24) has been removed. Use
<code>initAsync</code> instead.</li>
<li><strong>Remove legacy <code>interpolation.format</code>
function</strong> — the old monolithic format function
(<code>interpolation: { format: (value, format, lng) =&gt; ... }</code>)
is no longer supported. The built-in Formatter (or a custom Formatter
module via <code>.use()</code>) is now always used. Migrate to the <a
href="https://www.i18next.com/translation-function/formatting">new
formatting approach</a> using
<code>i18next.services.formatter.add()</code> or
<code>.addCached()</code> for custom formatters.</li>
<li><strong>Remove console support notice</strong> — the console support
notice introduced in v25.8.0 has been removed, along with the
<code>showSupportNotice</code> option and all related internal
suppression logic (<code>globalThis.__i18next_supportNoticeShown</code>,
<code>I18NEXT_NO_SUPPORT_NOTICE</code> env var). See our blog post for
the <a href="https://www.locize.com/blog/i18next-support-notice">full
story</a>.</li>
<li><strong>Remove <code>simplifyPluralSuffix</code> option</strong> —
this option was unused by the core PluralResolver (which relies entirely
on <code>Intl.PluralRules</code>). It only had an effect in the old
v1/v2/v3 compatibility layer. The v4 test compatibility layer now
defaults to <code>true</code> internally.</li>
<li><strong>Remove deprecated <code>@babel/polyfill</code></strong> from
devDependencies.</li>
</ul>
<h3>Improvements</h3>
<ul>
<li><strong>Code modernization</strong> across all source files:
<ul>
<li>Replace <code>indexOf() &gt; -1</code> / <code>indexOf() &lt;
0</code> with <code>.includes()</code> (~40+ occurrences)</li>
<li>Replace <code>indexOf() === 0</code> with <code>.startsWith()</code>
where appropriate</li>
<li>Replace <code>var</code> with <code>const</code>, <code>'' +
object</code> with <code>String(object)</code>,
<code>.substring()</code> with <code>.slice()</code></li>
<li>Replace <code>.apply(observer, [event, ...args])</code> with direct
call <code>observer(event, ...args)</code></li>
<li>Remove unnecessary <code>.call(this, ...)</code> in BackendConnector
retry logic</li>
<li>Fix <code>array-callback-return</code> in LanguageUtils
<code>getBestMatchFromCodes</code></li>
<li>Clean up all stale <code>eslint-disable</code> comments from source
files</li>
</ul>
</li>
<li><strong>EventEmitter</strong>: add <code>once()</code> method for
one-time event subscriptions</li>
<li><strong>Memory leak fix</strong>: move module-level
<code>checkedLoadedFor</code> cache to Translator instance, preventing
cross-instance state leakage</li>
<li><strong>TypeScript</strong>: fix <code>BackendModule</code> generic
parameter naming inconsistency between CJS and ESM type definitions</li>
<li><strong>TypeScript</strong>: add <code>once()</code> method to
<code>i18n</code> and <code>ResourceStore</code> type interfaces</li>
<li><strong>ESLint 9</strong>: migrate from ESLint 8 (airbnb-base) to
ESLint 9 flat config with <a
href="https://github.com/neostandard/neostandard">neostandard</a></li>
<li><strong>Vitest 4</strong>: upgrade from vitest 3 to vitest 4,
migrate workspace files to <code>test.projects</code> config</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next/commit/18b3dbb4734dc25dba1c21ea05df0315c73f6bc0"><code>18b3dbb</code></a>
26.0.1</li>
<li><a
href="https://github.com/i18next/i18next/commit/c829f91a2af9d227b35be3025d4ce8866f5c25c1"><code>c829f91</code></a>
fix: Formater crashes etc.</li>
<li><a
href="https://github.com/i18next/i18next/commit/1593d1125ef7890ef294aa5fef39dd70e11ca537"><code>1593d11</code></a>
remove node v18 from github actions</li>
<li><a
href="https://github.com/i18next/i18next/commit/d85c23da8615c0f0fdbeaae588a741a6c6149eb4"><code>d85c23d</code></a>
26.0.0</li>
<li><a
href="https://github.com/i18next/i18next/commit/fad19d59cf4d2acd512981d2cc41a0033d6cf672"><code>fad19d5</code></a>
feat!: v26.0.0 — major version with breaking changes</li>
<li><a
href="https://github.com/i18next/i18next/commit/780aa9170f4ed5b645aa35bb9ef1832d38f7b5d8"><code>780aa91</code></a>
jsr update</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next/compare/v25.10.10...v26.0.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 14:00:40 +00:00
dependabot[bot] 51e2dcbd4c chore(deps-dev): Bump i18next-cli from 1.51.4 to 1.51.5 (#1775)
Bumps [i18next-cli](https://github.com/i18next/i18next-cli) from 1.51.4
to 1.51.5.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md">i18next-cli's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/i18next/i18next-cli/compare/v1.51.4...v1.51.5">1.51.5</a>
- 2026-03-30</h2>
<ul>
<li>Fix extractor using only the initializer value instead of the full
enum type
when a variable has both a type annotation and an initializer
(e.g. <code>const status: Status = Status.New</code> now correctly
extracts all enum
values, not just <code>&quot;new&quot;</code>).
Fixes <a
href="https://redirect.github.com/i18next/i18next-cli/issues/210#issuecomment-4153581609">#210
(comment)</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-cli/commit/3583c5f158f62a01f3c20a5add8d2f6aa7f2f5cb"><code>3583c5f</code></a>
1.51.5</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/10341e765e5d7e120edc242c799e11c391ef3499"><code>10341e7</code></a>
Fix extractor using only the initializer value instead of the full enum
type</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/114f1de4d340a7fdd328938b8a7022689b11417d"><code>114f1de</code></a>
update i18next dep</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-cli/compare/v1.51.4...v1.51.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next-cli&package-manager=npm_and_yarn&previous-version=1.51.4&new-version=1.51.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 13:52:14 +00:00
dependabot[bot] 8b23561fe5 chore(deps): Bump react-i18next from 16.6.6 to 17.0.1 (#1774)
Bumps [react-i18next](https://github.com/i18next/react-i18next) from
16.6.6 to 17.0.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md">react-i18next's
changelog</a>.</em></p>
<blockquote>
<h2>17.0.1</h2>
<ul>
<li>chore: bump minimum i18next peer dependency to <code>&gt;=
26.0.1</code> <em>(forgot to do it in last version)</em></li>
<li>fix: migrate test setup from removed legacy
<code>interpolation.format</code> to
<code>i18n.services.formatter.add()</code> (i18next v26)</li>
</ul>
<h2>17.0.0</h2>
<h3>Potentially breaking changes</h3>
<ul>
<li>fix: <code>transKeepBasicHtmlNodesFor</code> now correctly preserves
HTML tag names when children contain interpolations or mixed content <a
href="https://redirect.github.com/i18next/i18next-cli/issues/230">230</a>
<ul>
<li>Previously, <code>&lt;strong&gt;{{name}}&lt;/strong&gt;</code> was
incorrectly serialized as <code>&lt;1&gt;{{name}}&lt;/1&gt;</code> — the
tag name was only preserved for plain string children</li>
<li>This bug existed since the feature was introduced and affects
auto-generated keys (when no explicit <code>i18nKey</code> is
provided)</li>
<li>If you rely on auto-generated Trans keys containing indexed tags for
kept HTML elements with interpolation children, you will need to update
your translation files</li>
</ul>
</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>updated dev dependencies (vitest, rollup plugins, happy-dom,
typescript, etc.)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/react-i18next/commit/23214960e3ead0b6774a1a0cb40387d41868da60"><code>2321496</code></a>
17.0.1</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/7e656b567125b059738ccd6f79b45de3767a8df4"><code>7e656b5</code></a>
chore: bump minimum i18next peer dependency</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/dfc350b2c465a7e0283c4fa5c6d83e3d447fc87a"><code>dfc350b</code></a>
upate github actions</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/7fe2620326e3027ecf4654ae739c4f74f83a5482"><code>7fe2620</code></a>
17.0.0</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/f4ada4c38c0d0fb5a992a8e76d5b510df69b257d"><code>f4ada4c</code></a>
fix: <code>transKeepBasicHtmlNodesFor</code> now correctly preserves
HTML tag names when...</li>
<li>See full diff in <a
href="https://github.com/i18next/react-i18next/compare/v16.6.6...v17.0.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-i18next&package-manager=npm_and_yarn&previous-version=16.6.6&new-version=17.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 13:51:54 +00:00
Mike Taves a62e5014ee fix: typos (#1771)
Fix a few typos identified with codespell.

## Launch Checklist

 - [X] Briefly describe the changes in this PR.
 - [ ] Link to related issues.
 - [ ] Write tests for all new functionality.
 - [ ] Add an entry to `CHANGELOG.md` under the `## main` section.
2026-04-02 13:55:15 +03:00
dependabot[bot] 0032b85fb8 chore(deps): Bump lodash from 4.17.23 to 4.18.1 (#1773)
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lodash/lodash/releases">lodash's
releases</a>.</em></p>
<blockquote>
<h2>4.18.1</h2>
<h2>Bugs</h2>
<p>Fixes a <code>ReferenceError</code> issue in <code>lodash</code>
<code>lodash-es</code> <code>lodash-amd</code> and
<code>lodash.template</code> when using the <code>template</code> and
<code>fromPairs</code> functions from the modular builds. See <a
href="https://redirect.github.com/lodash/lodash/issues/6167#issuecomment-4165269769">lodash/lodash#6167</a></p>
<p>These defects were related to how lodash distributions are built from
the main branch using <a
href="https://github.com/lodash-archive/lodash-cli">https://github.com/lodash-archive/lodash-cli</a>.
When internal dependencies change inside lodash functions, equivalent
updates need to be made to a mapping in the lodash-cli. (hey, it was
ahead of its time once upon a time!). We know this, but we missed it in
the last release. It's the kind of thing that passes in CI, but fails bc
the build is not the same thing you tested.</p>
<p>There is no diff on main for this, but you can see the diffs for each
of the npm packages on their respective branches:</p>
<ul>
<li><code>lodash</code>: <a
href="https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm">https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm</a></li>
<li><code>lodash-es</code>: <a
href="https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es">https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es</a></li>
<li><code>lodash-amd</code>: <a
href="https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd">https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd</a></li>
<li><code>lodash.template</code><a
href="https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages">https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages</a></li>
</ul>
<h2>4.18.0</h2>
<h2>v4.18.0</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/lodash/lodash/compare/4.17.23...4.18.0">https://github.com/lodash/lodash/compare/4.17.23...4.18.0</a></p>
<h3>Security</h3>
<p><strong><code>_.unset</code> / <code>_.omit</code></strong>: Fixed
prototype pollution via <code>constructor</code>/<code>prototype</code>
path traversal (<a
href="https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh">GHSA-f23m-r3pf-42rh</a>,
<a
href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b">fe8d32e</a>).
Previously, array-wrapped path segments and primitive roots could bypass
the existing guards, allowing deletion of properties from built-in
prototypes. Now <code>constructor</code> and <code>prototype</code> are
blocked unconditionally as non-terminal path keys, matching
<code>baseSet</code>. Calls that previously returned <code>true</code>
and deleted the property now return <code>false</code> and leave the
target untouched.</p>
<p><strong><code>_.template</code></strong>: Fixed code injection via
<code>imports</code> keys (<a
href="https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc">GHSA-r5fr-rjxr-66jc</a>,
CVE-2026-4800, <a
href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6">879aaa9</a>).
Fixes an incomplete patch for CVE-2021-23337. The <code>variable</code>
option was validated against <code>reForbiddenIdentifierChars</code> but
<code>importsKeys</code> was left unguarded, allowing code injection via
the same <code>Function()</code> constructor sink. <code>imports</code>
keys containing forbidden identifier characters now throw
<code>&quot;Invalid imports option passed into
_.template&quot;</code>.</p>
<h3>Docs</h3>
<ul>
<li>Add security notice for <code>_.template</code> in threat model and
API docs (<a
href="https://redirect.github.com/lodash/lodash/pull/6099">#6099</a>)</li>
<li>Document <code>lower &gt; upper</code> behavior in
<code>_.random</code> (<a
href="https://redirect.github.com/lodash/lodash/pull/6115">#6115</a>)</li>
<li>Fix quotes in <code>_.compact</code> jsdoc (<a
href="https://redirect.github.com/lodash/lodash/pull/6090">#6090</a>)</li>
</ul>
<h3><code>lodash.*</code> modular packages</h3>
<p><a
href="https://redirect.github.com/lodash/lodash/pull/6157">Diff</a></p>
<p>We have also regenerated and published a select number of the
<code>lodash.*</code> modular packages.</p>
<p>These modular packages had fallen out of sync significantly from the
minor/patch updates to lodash. Specifically, we have brought the
following packages up to parity w/ the latest lodash release because
they have had CVEs on them in the past:</p>
<ul>
<li><a
href="https://www.npmjs.com/package/lodash.orderby">lodash.orderby</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.tonumber">lodash.tonumber</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.trim">lodash.trim</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.trimend">lodash.trimend</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.sortedindexby">lodash.sortedindexby</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.zipobjectdeep">lodash.zipobjectdeep</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.unset">lodash.unset</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.omit">lodash.omit</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.template">lodash.template</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lodash/lodash/commit/cb0b9b9212521c08e3eafe7c8cb0af1b42b6649e"><code>cb0b9b9</code></a>
release(patch): bump main to 4.18.1 (<a
href="https://redirect.github.com/lodash/lodash/issues/6177">#6177</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/75535f57883b7225adb96de1cfc1cd4169cfcb51"><code>75535f5</code></a>
chore: prune stale advisory refs (<a
href="https://redirect.github.com/lodash/lodash/issues/6170">#6170</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/62e91bc6a39c98d85b9ada8c44d40593deaf82a4"><code>62e91bc</code></a>
docs: remove n_ Node.js &lt; 6 REPL note from README (<a
href="https://redirect.github.com/lodash/lodash/issues/6165">#6165</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/59be2de61f8aa9461c7856533b51d31b7d8babc4"><code>59be2de</code></a>
release(minor): bump to 4.18.0 (<a
href="https://redirect.github.com/lodash/lodash/issues/6161">#6161</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/af634573030f979194871da7c68f79420992f53d"><code>af63457</code></a>
fix: broken tests for _.template 879aaa9</li>
<li><a
href="https://github.com/lodash/lodash/commit/1073a7693e1727e0cf3641e5f71f75ddcf8de7c0"><code>1073a76</code></a>
fix: linting issues</li>
<li><a
href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6"><code>879aaa9</code></a>
fix: validate imports keys in _.template</li>
<li><a
href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b"><code>fe8d32e</code></a>
fix: block prototype pollution in baseUnset via constructor/prototype
traversal</li>
<li><a
href="https://github.com/lodash/lodash/commit/18ba0a32f42fd02117f096b032f89c984173462d"><code>18ba0a3</code></a>
refactor(fromPairs): use baseAssignValue for consistent assignment (<a
href="https://redirect.github.com/lodash/lodash/issues/6153">#6153</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/b8190803d48d60b8c80ad45d39125f32fa618cb2"><code>b819080</code></a>
ci: add dist sync validation workflow (<a
href="https://redirect.github.com/lodash/lodash/issues/6137">#6137</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/lodash/lodash/compare/4.17.23...4.18.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lodash&package-manager=npm_and_yarn&previous-version=4.17.23&new-version=4.18.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/maplibre/maputnik/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 08:12:45 +00:00
11 changed files with 32 additions and 60 deletions
+2 -2
View File
@@ -20,8 +20,8 @@
- Fixed the Expression editor (for long expressions) being able to be float under other components further down
- Fixed an issue when clicking on a popup and then clicking on the map again
- Fix modal close button possition
- Fixed an issue with the generation of tranlations
- Fix modal close button position
- Fixed an issue with the generation of translations
- Fix missing spec info when clicking next to a property
- Fix Firefox open file that stopped working due to react upgrade
- Fix issue with missing bottom error panel
+1 -1
View File
@@ -7,7 +7,7 @@ export default class ModalDriver {
public when = {
fillLayers: (opts: { type: string; layer?: string; id?: string }) => {
// Having logic in test code is an anti pattern.
// This should be splitted to multiple single responsibility functions
// This should be split to multiple single responsibility functions
const type = opts.type;
const layer = opts.layer;
let id;
+1 -1
View File
@@ -283,7 +283,7 @@ describe("modals", () => {
it("inlcude API key when change renderer", () => {
it("include API key when change renderer", () => {
when.click("modal:settings.close-modal");
when.click("nav:open");
+18 -46
View File
@@ -30,12 +30,12 @@
"downshift": "^9.3.2",
"events": "^3.3.0",
"file-saver": "^2.0.5",
"i18next": "^25.10.10",
"i18next": "^26.0.1",
"i18next-browser-languagedetector": "^8.2.1",
"i18next-resources-to-backend": "^1.2.1",
"json-stringify-pretty-compact": "^4.0.0",
"json-to-ast": "^2.1.0",
"lodash": "^4.17.23",
"lodash": "^4.18.1",
"lodash.capitalize": "^4.2.1",
"lodash.clamp": "^4.0.3",
"lodash.clonedeep": "^4.5.0",
@@ -55,7 +55,7 @@
"react-collapse": "^5.1.1",
"react-color": "^2.19.3",
"react-dom": "^19.2.4",
"react-i18next": "^16.6.6",
"react-i18next": "^17.0.1",
"react-icons": "^5.6.0",
"react-markdown": "^10.1.0",
"reconnecting-websocket": "^4.4.0",
@@ -100,7 +100,7 @@
"eslint-plugin-react": "^7.37.5",
"eslint-plugin-react-hooks": "^7.0.1",
"eslint-plugin-react-refresh": "^0.5.2",
"i18next-cli": "^1.51.4",
"i18next-cli": "^1.51.5",
"istanbul": "^0.4.5",
"istanbul-lib-coverage": "^3.2.2",
"postcss": "^8.5.8",
@@ -8050,9 +8050,9 @@
}
},
"node_modules/i18next": {
"version": "25.10.10",
"resolved": "https://registry.npmjs.org/i18next/-/i18next-25.10.10.tgz",
"integrity": "sha512-cqUW2Z3EkRx7NqSyywjkgCLK7KLCL6IFVFcONG7nVYIJ3ekZ1/N5jUsihHV6Bq37NfhgtczxJcxduELtjTwkuQ==",
"version": "26.0.1",
"resolved": "https://registry.npmjs.org/i18next/-/i18next-26.0.1.tgz",
"integrity": "sha512-vtz5sXU4+nkCm8yEU+JJ6yYIx0mkg9e68W0G0PXpnOsmzLajNsW5o28DJMqbajxfsfq0gV3XdrBudsDQnwxfsQ==",
"funding": [
{
"type": "individual",
@@ -8090,9 +8090,9 @@
}
},
"node_modules/i18next-cli": {
"version": "1.51.4",
"resolved": "https://registry.npmjs.org/i18next-cli/-/i18next-cli-1.51.4.tgz",
"integrity": "sha512-7VR1AIqVj4vuTu0vdbX6TG85Zh4IiwtQtlHSQdtDxLVDUpQB3pnJzjWmUPmOcV1iPcIVkJhYq9BnTc1L91bWbA==",
"version": "1.51.5",
"resolved": "https://registry.npmjs.org/i18next-cli/-/i18next-cli-1.51.5.tgz",
"integrity": "sha512-WjNfP2D61NjxH9KNpsCq0dg6PRcSo4ZWxEx6MawiX/ZXIB8QeKVQEMFGe+5mP+1QN88Wz5Zgopjll1WXB4g/kg==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -8110,7 +8110,7 @@
"minimatch": "^10.2.4",
"ora": "^9.3.0",
"react": "^19.2.4",
"react-i18next": "^17.0.0",
"react-i18next": "^17.0.1",
"yaml": "^2.8.3"
},
"bin": {
@@ -8329,34 +8329,6 @@
"url": "https://github.com/sponsors/sindresorhus"
}
},
"node_modules/i18next-cli/node_modules/react-i18next": {
"version": "17.0.2",
"resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-17.0.2.tgz",
"integrity": "sha512-shBftH2vaTWK2Bsp7FiL+cevx3xFJlvFxmsDFQSrJc+6twHkP0tv/bGa01VVWzpreUVVwU+3Hev5iFqRg65RwA==",
"dev": true,
"license": "MIT",
"dependencies": {
"@babel/runtime": "^7.29.2",
"html-parse-stringify": "^3.0.1",
"use-sync-external-store": "^1.6.0"
},
"peerDependencies": {
"i18next": ">= 26.0.1",
"react": ">= 16.8.0",
"typescript": "^5 || ^6"
},
"peerDependenciesMeta": {
"react-dom": {
"optional": true
},
"react-native": {
"optional": true
},
"typescript": {
"optional": true
}
}
},
"node_modules/i18next-cli/node_modules/readdirp": {
"version": "5.0.0",
"resolved": "https://registry.npmjs.org/readdirp/-/readdirp-5.0.0.tgz",
@@ -9943,9 +9915,9 @@
}
},
"node_modules/lodash": {
"version": "4.17.23",
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
"version": "4.18.1",
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
"integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
"license": "MIT"
},
"node_modules/lodash-es": {
@@ -12652,9 +12624,9 @@
}
},
"node_modules/react-i18next": {
"version": "16.6.6",
"resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-16.6.6.tgz",
"integrity": "sha512-ZgL2HUoW34UKUkOV7uSQFE1CDnRPD+tCR3ywSuWH7u2iapnz86U8Bi3Vrs620qNDzCf1F47NxglCEkchCTDOHw==",
"version": "17.0.1",
"resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-17.0.1.tgz",
"integrity": "sha512-iG65FGnFHcYyHNuT01ukffYWCOBFTWSdVD8EZd/dCVWgtjFPObcSsvYYNwcsokO/rDcTb5d6D8Acv8MrOdm6Hw==",
"license": "MIT",
"dependencies": {
"@babel/runtime": "^7.29.2",
@@ -12662,7 +12634,7 @@
"use-sync-external-store": "^1.6.0"
},
"peerDependencies": {
"i18next": ">= 25.10.9",
"i18next": ">= 26.0.1",
"react": ">= 16.8.0",
"typescript": "^5 || ^6"
},
+4 -4
View File
@@ -47,12 +47,12 @@
"downshift": "^9.3.2",
"events": "^3.3.0",
"file-saver": "^2.0.5",
"i18next": "^25.10.10",
"i18next": "^26.0.1",
"i18next-browser-languagedetector": "^8.2.1",
"i18next-resources-to-backend": "^1.2.1",
"json-stringify-pretty-compact": "^4.0.0",
"json-to-ast": "^2.1.0",
"lodash": "^4.17.23",
"lodash": "^4.18.1",
"lodash.capitalize": "^4.2.1",
"lodash.clamp": "^4.0.3",
"lodash.clonedeep": "^4.5.0",
@@ -72,7 +72,7 @@
"react-collapse": "^5.1.1",
"react-color": "^2.19.3",
"react-dom": "^19.2.4",
"react-i18next": "^16.6.6",
"react-i18next": "^17.0.1",
"react-icons": "^5.6.0",
"react-markdown": "^10.1.0",
"reconnecting-websocket": "^4.4.0",
@@ -134,7 +134,7 @@
"eslint-plugin-react": "^7.37.5",
"eslint-plugin-react-hooks": "^7.0.1",
"eslint-plugin-react-refresh": "^0.5.2",
"i18next-cli": "^1.51.4",
"i18next-cli": "^1.51.5",
"istanbul": "^0.4.5",
"istanbul-lib-coverage": "^3.2.2",
"postcss": "^8.5.8",
+1 -1
View File
@@ -450,7 +450,7 @@ export default class App extends React.Component<any, AppState> {
if (message) {
try {
const objPath = message.split(":")[0];
// Errors can be deply nested for example 'layers[0].filter[1][1][0]' we only care upto the property 'layers[0].filter'
// Errors can be deeply nested for example 'layers[0].filter[1][1][0]' we only care upto the property 'layers[0].filter'
const unsetPath = objPath.match(/^\S+?\[\d+\]\.[^[]+/)![0];
unset(dirtyMapStyle, unsetPath);
}
+1 -1
View File
@@ -57,7 +57,7 @@ class FeatureLayerPopup extends React.Component<FeatureLayerPopupProps> {
// Default color
return "black";
}
// This is quite complex, just incase there's an edgecase we're missing
// This is quite complex, just in case there's an edgecase we're missing
// always return black if we get an unexpected error.
catch (err) {
console.warn("Unable to get feature color, error:", err);
+1 -1
View File
@@ -21,7 +21,7 @@ import { type MappedLayerErrors } from "../libs/definitions";
function setStopRefs(props: DataPropertyInternalProps, state: DataPropertyState) {
// This is initialsed below only if required to improved performance.
// This is initialised below only if required to improved performance.
let newRefs: {[key: number]: string} | undefined;
if(props.value && props.value.stops) {
+1 -1
View File
@@ -24,7 +24,7 @@ import { type MappedLayerErrors } from "../libs/definitions";
* When the stops are reordered the references are also updated (see this.orderStops) this allows React to use the same key for the element and keep keyboard focus.
*/
function setStopRefs(props: ZoomPropertyInternalProps, state: ZoomPropertyState) {
// This is initialsed below only if required to improved performance.
// This is initialised below only if required to improved performance.
let newRefs: {[key: number]: string} = {};
if(props.value && (props.value as ZoomWithStops).stops) {
+1 -1
View File
@@ -25,7 +25,7 @@ export default class LayerWatcher {
// Since we scan over all features we want to avoid this as much as
// possible and only do it after a batch of data has loaded because
// we only care eventuall about knowing the fields in the vector layers
// we only care eventually about knowing the fields in the vector layers
this.throttledAnalyzeVectorLayerFields = throttle(this.analyzeVectorLayerFields, 5000);
}
+1 -1
View File
@@ -33,7 +33,7 @@
border-radius: 2px;
position: relative;
// HACK: Overide
// HACK: Override
.maputnik-input-block {
margin: vars.$margin-2;
}