dependabot[bot]
617c99ba17
chore(deps-dev): Bump vite from 7.3.1 to 8.0.3
...
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite ) from 7.3.1 to 8.0.3.
- [Release notes](https://github.com/vitejs/vite/releases )
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.0.3/packages/vite )
---
updated-dependencies:
- dependency-name: vite
dependency-version: 8.0.3
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-03 14:04:16 +00:00
dependabot[bot]
11af8c55f6
chore(deps): Bump @maplibre/maplibre-gl-style-spec from 24.7.0 to 24.8.1 ( #1779 )
...
Bumps
[@maplibre/maplibre-gl-style-spec](https://github.com/maplibre/maplibre-style-spec )
from 24.7.0 to 24.8.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/maplibre/maplibre-style-spec/releases "><code>@maplibre/maplibre-gl-style-spec</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v24.8.1</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Add <code>AllPaintProperties</code> and
<code>AllLayoutProperties</code> typescript definitions (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1579 ">#1579</a>)
(by <a
href="https://github.com/CommanderStorm "><code>@CommanderStorm</code></a>)</li>
<li>Update TS definitions to allow <code>var</code> as the 3rd arg of
comparator functions (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1564 ">#1564</a>)
(by <a href="https://github.com/k-yle ">k-yle</a>)</li>
</ul>
<h3>🐞 Bug fixes</h3>
<ul>
<li>Fix <code>get</code> expression inside <code>join</code> expression
(<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1583 ">#1583</a>)
(by <a href="https://github.com/1ec5 ">1ec5</a>)</li>
</ul>
<h2>v24.8.0</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Enable data driven stylng for
<code>line-{cap,round-limit,miter-limit}</code> (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1566 ">#1566</a>)
(by <a
href="https://github.com/CommanderStorm "><code>@CommanderStorm</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/maplibre/maplibre-style-spec/blob/main/CHANGELOG.md "><code>@maplibre/maplibre-gl-style-spec</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>24.8.1</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Add <code>AllPaintProperties</code> and
<code>AllLayoutProperties</code> typescript definitions (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1579 ">#1579</a>)
(by <a
href="https://github.com/CommanderStorm "><code>@CommanderStorm</code></a>)</li>
<li>Update TS definitions to allow <code>var</code> as the 3rd arg of
comparator functions (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1564 ">#1564</a>)
(by <a href="https://github.com/k-yle ">k-yle</a>)</li>
</ul>
<h3>🐞 Bug fixes</h3>
<ul>
<li>Fix <code>get</code> expression inside <code>join</code> expression
(<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1583 ">#1583</a>)
(by <a href="https://github.com/1ec5 ">1ec5</a>)</li>
</ul>
<h2>24.8.0</h2>
<h3>✨ Features and improvements</h3>
<ul>
<li>Enable data driven stylng for
<code>line-{cap,round-limit,miter-limit}</code> (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/pull/1566 ">#1566</a>)
(by <a
href="https://github.com/CommanderStorm "><code>@CommanderStorm</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/6068119203c6f111739574f84ee6788ff541a9a3 "><code>6068119</code></a>
Bump js version to 24.8.1 (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1585 ">#1585</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/318f2e010554fc2d00e1e0bddba19c7d8645a182 "><code>318f2e0</code></a>
increase the navigabiltiy by adding linking (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1581 ">#1581</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/298570bd0f3a5d2295f47f2612898be3f9287dc4 "><code>298570b</code></a>
docs: improve the transition docs a bit more (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1584 ">#1584</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/8f4a9b7e94a92c2bf4914503f77e487fb4b4edf0 "><code>8f4a9b7</code></a>
update TS definitions to allow <code>var</code> as the 3rd arg of
comparator funcs (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1564 ">#1564</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/40b4c4e85ccb4ace01c4d14c5add0936e526fc03 "><code>40b4c4e</code></a>
feat: add AllPaintProperties and AllLayoutProperties (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1579 ">#1579</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/0d88cc3e8227f26cf25c6c571bda5b013b761843 "><code>0d88cc3</code></a>
Evaluate input to join expression (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1583 ">#1583</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/18a85aa413b704409255b5f8f39e09bb13035f99 "><code>18a85aa</code></a>
docs: document how transitions work (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1580 ">#1580</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/54855816a84a88d2b86d3844f123ab58b02ea7fd "><code>5485581</code></a>
make sure that visibiltiy is documented that it has global statate
support (#...</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/1b028b1e2cdc5ff0eb660366df070a143b8bd896 "><code>1b028b1</code></a>
Bump js version to 24.8.0 (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1578 ">#1578</a>)</li>
<li><a
href="https://github.com/maplibre/maplibre-style-spec/commit/4477c7a07c49632af496a8a3627ec3bfc5e84c81 "><code>4477c7a</code></a>
build(deps-dev): bump <code>@typescript-eslint/eslint-plugin</code> (<a
href="https://redirect.github.com/maplibre/maplibre-style-spec/issues/1576 ">#1576</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/maplibre/maplibre-style-spec/compare/v24.7.0...v24.8.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-03 14:02:54 +00:00
dependabot[bot]
bdefe6d318
chore(deps): Bump react-i18next from 17.0.1 to 17.0.2 ( #1777 )
...
Bumps [react-i18next](https://github.com/i18next/react-i18next ) from
17.0.1 to 17.0.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md ">react-i18next's
changelog</a>.</em></p>
<blockquote>
<h2>17.0.2</h2>
<ul>
<li>fix(types): <code>values</code> prop on <code><Trans /></code>
now only requires interpolation variables for the specific
<code>i18nKey</code>, not all variables in the namespace <a
href="https://redirect.github.com/i18next/react-i18next/issues/1913 ">1913</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/react-i18next/commit/4d62f869053355821249c6235c2ded6e8e3ea492 "><code>4d62f86</code></a>
17.0.2</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/61fe80c53fff86bb276ab9854ef33a3228e88147 "><code>61fe80c</code></a>
fix(types): <code>values</code> prop on <code>\<Trans /></code>
now only requires interpolation vari...</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/b58d5a57b851871a85bfc4c2f530cf2b78cbbbb3 "><code>b58d5a5</code></a>
l10n: add Swedish language support to examples (<a
href="https://redirect.github.com/i18next/react-i18next/issues/1912 ">#1912</a>)</li>
<li>See full diff in <a
href="https://github.com/i18next/react-i18next/compare/v17.0.1...v17.0.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-03 13:57:31 +00:00
dependabot[bot]
6212d5b99f
chore(deps): Bump i18next from 26.0.1 to 26.0.3 ( #1780 )
...
Bumps [i18next](https://github.com/i18next/i18next ) from 26.0.1 to
26.0.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases ">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.0.3</h2>
<ul>
<li>fix(types): <code>addResourceBundle</code> now accepts an optional
6th <code>options</code> parameter (<code>{ silent?: boolean; skipCopy?:
boolean }</code>) matching the runtime API <a
href="https://redirect.github.com/i18next/i18next/issues/2419 ">2419</a></li>
</ul>
<h2>v26.0.2</h2>
<ul>
<li>fix(types): <code>t("key", {} as TOptions)</code> no
longer produces a type error — the context constraint now bypasses
strict checking when <code>context</code> is <code>unknown</code> (e.g.
from <code>TOptions</code>) <a
href="https://redirect.github.com/i18next/i18next/issues/2418 ">2418</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md ">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.0.3</h2>
<ul>
<li>fix(types): <code>addResourceBundle</code> now accepts an optional
6th <code>options</code> parameter (<code>{ silent?: boolean; skipCopy?:
boolean }</code>) matching the runtime API <a
href="https://redirect.github.com/i18next/i18next/issues/2419 ">2419</a></li>
</ul>
<h2>26.0.2</h2>
<ul>
<li>fix(types): <code>t("key", {} as TOptions)</code> no
longer produces a type error — the context constraint now bypasses
strict checking when <code>context</code> is <code>unknown</code> (e.g.
from <code>TOptions</code>) <a
href="https://redirect.github.com/i18next/i18next/issues/2418 ">2418</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next/commit/ea8391c875ed663038fb5fb0db89aaead9f6fff6 "><code>ea8391c</code></a>
26.0.3</li>
<li><a
href="https://github.com/i18next/i18next/commit/5da85e09afe0f53033840666e13ee954d87e89e9 "><code>5da85e0</code></a>
fix(types): <code>addResourceBundle</code> now accepts an optional 6th
<code>options</code> paramet...</li>
<li><a
href="https://github.com/i18next/i18next/commit/3db098f72a40b108123c1200234707934d9e03ac "><code>3db098f</code></a>
26.0.2</li>
<li><a
href="https://github.com/i18next/i18next/commit/6ece798338e6e96d37a6148c20e4ca7279fa9897 "><code>6ece798</code></a>
fix(types): <code>t("key", {} as TOptions)</code> no longer
produces a type error — the ...</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next/compare/v26.0.1...v26.0.3 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-03 13:57:13 +00:00
dependabot[bot]
6454ae21d3
chore(deps-dev): Bump typescript-eslint from 8.57.2 to 8.58.0 ( #1778 )
...
Bumps
[typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint )
from 8.57.2 to 8.58.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">typescript-eslint's
releases</a>.</em></p>
<blockquote>
<h2>v8.58.0</h2>
<h2>8.58.0 (2026-03-30)</h2>
<h3>🚀 Features</h3>
<ul>
<li>support TypeScript 6 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12124 ">#12124</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> crash in
<code>no-unnecessary-type-arguments</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12163 ">#12163</a>)</li>
<li><strong>eslint-plugin:</strong> [no-extraneous-class] handle index
signatures (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12142 ">#12142</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-regexp-exec] avoid fixing
unknown RegExp flags (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12161 ">#12161</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>ej shafran <a
href="https://github.com/ej-shafran "><code>@ej-shafran</code></a></li>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>GG ZIBLAKING</li>
<li>milkboy2564 <a
href="https://github.com/SeolJaeHyeok "><code>@SeolJaeHyeok</code></a></li>
<li>teee32 <a
href="https://github.com/teee32 "><code>@teee32</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.58.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md ">typescript-eslint's
changelog</a>.</em></p>
<blockquote>
<h2>8.58.0 (2026-03-30)</h2>
<h3>🚀 Features</h3>
<ul>
<li>support TypeScript 6 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12124 ">#12124</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.58.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/493341709fe7d1d6433332b7bd2724e3332c7cdf "><code>4933417</code></a>
chore(release): publish 8.58.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8cde2d06fb9bc591a4c93452509ddbd600c76a35 "><code>8cde2d0</code></a>
feat: support TypeScript 6 (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint/issues/12124 ">#12124</a>)</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.58.0/packages/typescript-eslint ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-03 13:56:55 +00:00
dependabot[bot]
a23208d60d
chore(deps): Bump i18next from 25.10.10 to 26.0.1 ( #1776 )
...
Bumps [i18next](https://github.com/i18next/i18next ) from 25.10.10 to
26.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases ">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.0.1</h2>
<ul>
<li>fix: Formatter no longer crashes when <code>alwaysFormat</code> is
<code>true</code> and no format specifier is present
(<code>format</code> is <code>undefined</code>)</li>
<li>fix: Formatter now returns <code>undefined</code>/<code>null</code>
values as-is instead of producing <code>NaN</code> when the value is
missing</li>
</ul>
<h2>v26.0.0</h2>
<p><strong>This is a major breaking release:</strong></p>
<h3>Breaking Changes</h3>
<ul>
<li><strong>Remove deprecated <code>initImmediate</code> option</strong>
— the backward-compatibility mapping from <code>initImmediate</code> to
<code>initAsync</code> (introduced in v24) has been removed. Use
<code>initAsync</code> instead.</li>
<li><strong>Remove legacy <code>interpolation.format</code>
function</strong> — the old monolithic format function
(<code>interpolation: { format: (value, format, lng) => ... }</code>)
is no longer supported. The built-in Formatter (or a custom Formatter
module via <code>.use()</code>) is now always used. Migrate to the <a
href="https://www.i18next.com/translation-function/formatting ">new
formatting approach</a> using
<code>i18next.services.formatter.add()</code> or
<code>.addCached()</code> for custom formatters.</li>
<li><strong>Remove console support notice</strong> — the console support
notice introduced in v25.8.0 has been removed, along with the
<code>showSupportNotice</code> option and all related internal
suppression logic (<code>globalThis.__i18next_supportNoticeShown</code>,
<code>I18NEXT_NO_SUPPORT_NOTICE</code> env var). See our blog post for
the <a href="https://www.locize.com/blog/i18next-support-notice ">full
story</a>.</li>
<li><strong>Remove <code>simplifyPluralSuffix</code> option</strong> —
this option was unused by the core PluralResolver (which relies entirely
on <code>Intl.PluralRules</code>). It only had an effect in the old
v1/v2/v3 compatibility layer. The v4 test compatibility layer now
defaults to <code>true</code> internally.</li>
<li><strong>Remove deprecated <code>@babel/polyfill</code></strong> from
devDependencies.</li>
</ul>
<h3>Improvements</h3>
<ul>
<li><strong>Code modernization</strong> across all source files:
<ul>
<li>Replace <code>indexOf() > -1</code> / <code>indexOf() <
0</code> with <code>.includes()</code> (~40+ occurrences)</li>
<li>Replace <code>indexOf() === 0</code> with <code>.startsWith()</code>
where appropriate</li>
<li>Replace <code>var</code> with <code>const</code>, <code>'' +
object</code> with <code>String(object)</code>,
<code>.substring()</code> with <code>.slice()</code></li>
<li>Replace <code>.apply(observer, [event, ...args])</code> with direct
call <code>observer(event, ...args)</code></li>
<li>Remove unnecessary <code>.call(this, ...)</code> in BackendConnector
retry logic</li>
<li>Fix <code>array-callback-return</code> in LanguageUtils
<code>getBestMatchFromCodes</code></li>
<li>Clean up all stale <code>eslint-disable</code> comments from source
files</li>
</ul>
</li>
<li><strong>EventEmitter</strong>: add <code>once()</code> method for
one-time event subscriptions</li>
<li><strong>Memory leak fix</strong>: move module-level
<code>checkedLoadedFor</code> cache to Translator instance, preventing
cross-instance state leakage</li>
<li><strong>TypeScript</strong>: fix <code>BackendModule</code> generic
parameter naming inconsistency between CJS and ESM type definitions</li>
<li><strong>TypeScript</strong>: add <code>once()</code> method to
<code>i18n</code> and <code>ResourceStore</code> type interfaces</li>
<li><strong>ESLint 9</strong>: migrate from ESLint 8 (airbnb-base) to
ESLint 9 flat config with <a
href="https://github.com/neostandard/neostandard ">neostandard</a></li>
<li><strong>Vitest 4</strong>: upgrade from vitest 3 to vitest 4,
migrate workspace files to <code>test.projects</code> config</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md ">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.0.1</h2>
<ul>
<li>fix: Formatter no longer crashes when <code>alwaysFormat</code> is
<code>true</code> and no format specifier is present
(<code>format</code> is <code>undefined</code>)</li>
<li>fix: Formatter now returns <code>undefined</code>/<code>null</code>
values as-is instead of producing <code>NaN</code> when the value is
missing</li>
</ul>
<h2>26.0.0</h2>
<p><strong>This is a major breaking release:</strong></p>
<h3>Breaking Changes</h3>
<ul>
<li><strong>Remove deprecated <code>initImmediate</code> option</strong>
— the backward-compatibility mapping from <code>initImmediate</code> to
<code>initAsync</code> (introduced in v24) has been removed. Use
<code>initAsync</code> instead.</li>
<li><strong>Remove legacy <code>interpolation.format</code>
function</strong> — the old monolithic format function
(<code>interpolation: { format: (value, format, lng) => ... }</code>)
is no longer supported. The built-in Formatter (or a custom Formatter
module via <code>.use()</code>) is now always used. Migrate to the <a
href="https://www.i18next.com/translation-function/formatting ">new
formatting approach</a> using
<code>i18next.services.formatter.add()</code> or
<code>.addCached()</code> for custom formatters.</li>
<li><strong>Remove console support notice</strong> — the console support
notice introduced in v25.8.0 has been removed, along with the
<code>showSupportNotice</code> option and all related internal
suppression logic (<code>globalThis.__i18next_supportNoticeShown</code>,
<code>I18NEXT_NO_SUPPORT_NOTICE</code> env var). See our blog post for
the <a href="https://www.locize.com/blog/i18next-support-notice ">full
story</a>.</li>
<li><strong>Remove <code>simplifyPluralSuffix</code> option</strong> —
this option was unused by the core PluralResolver (which relies entirely
on <code>Intl.PluralRules</code>). It only had an effect in the old
v1/v2/v3 compatibility layer. The v4 test compatibility layer now
defaults to <code>true</code> internally.</li>
<li><strong>Remove deprecated <code>@babel/polyfill</code></strong> from
devDependencies.</li>
</ul>
<h3>Improvements</h3>
<ul>
<li><strong>Code modernization</strong> across all source files:
<ul>
<li>Replace <code>indexOf() > -1</code> / <code>indexOf() <
0</code> with <code>.includes()</code> (~40+ occurrences)</li>
<li>Replace <code>indexOf() === 0</code> with <code>.startsWith()</code>
where appropriate</li>
<li>Replace <code>var</code> with <code>const</code>, <code>'' +
object</code> with <code>String(object)</code>,
<code>.substring()</code> with <code>.slice()</code></li>
<li>Replace <code>.apply(observer, [event, ...args])</code> with direct
call <code>observer(event, ...args)</code></li>
<li>Remove unnecessary <code>.call(this, ...)</code> in BackendConnector
retry logic</li>
<li>Fix <code>array-callback-return</code> in LanguageUtils
<code>getBestMatchFromCodes</code></li>
<li>Clean up all stale <code>eslint-disable</code> comments from source
files</li>
</ul>
</li>
<li><strong>EventEmitter</strong>: add <code>once()</code> method for
one-time event subscriptions</li>
<li><strong>Memory leak fix</strong>: move module-level
<code>checkedLoadedFor</code> cache to Translator instance, preventing
cross-instance state leakage</li>
<li><strong>TypeScript</strong>: fix <code>BackendModule</code> generic
parameter naming inconsistency between CJS and ESM type definitions</li>
<li><strong>TypeScript</strong>: add <code>once()</code> method to
<code>i18n</code> and <code>ResourceStore</code> type interfaces</li>
<li><strong>ESLint 9</strong>: migrate from ESLint 8 (airbnb-base) to
ESLint 9 flat config with <a
href="https://github.com/neostandard/neostandard ">neostandard</a></li>
<li><strong>Vitest 4</strong>: upgrade from vitest 3 to vitest 4,
migrate workspace files to <code>test.projects</code> config</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next/commit/18b3dbb4734dc25dba1c21ea05df0315c73f6bc0 "><code>18b3dbb</code></a>
26.0.1</li>
<li><a
href="https://github.com/i18next/i18next/commit/c829f91a2af9d227b35be3025d4ce8866f5c25c1 "><code>c829f91</code></a>
fix: Formater crashes etc.</li>
<li><a
href="https://github.com/i18next/i18next/commit/1593d1125ef7890ef294aa5fef39dd70e11ca537 "><code>1593d11</code></a>
remove node v18 from github actions</li>
<li><a
href="https://github.com/i18next/i18next/commit/d85c23da8615c0f0fdbeaae588a741a6c6149eb4 "><code>d85c23d</code></a>
26.0.0</li>
<li><a
href="https://github.com/i18next/i18next/commit/fad19d59cf4d2acd512981d2cc41a0033d6cf672 "><code>fad19d5</code></a>
feat!: v26.0.0 — major version with breaking changes</li>
<li><a
href="https://github.com/i18next/i18next/commit/780aa9170f4ed5b645aa35bb9ef1832d38f7b5d8 "><code>780aa91</code></a>
jsr update</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next/compare/v25.10.10...v26.0.1 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 14:00:40 +00:00
dependabot[bot]
51e2dcbd4c
chore(deps-dev): Bump i18next-cli from 1.51.4 to 1.51.5 ( #1775 )
...
Bumps [i18next-cli](https://github.com/i18next/i18next-cli ) from 1.51.4
to 1.51.5.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md ">i18next-cli's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/i18next/i18next-cli/compare/v1.51.4...v1.51.5 ">1.51.5</a>
- 2026-03-30</h2>
<ul>
<li>Fix extractor using only the initializer value instead of the full
enum type
when a variable has both a type annotation and an initializer
(e.g. <code>const status: Status = Status.New</code> now correctly
extracts all enum
values, not just <code>"new"</code>).
Fixes <a
href="https://redirect.github.com/i18next/i18next-cli/issues/210#issuecomment-4153581609 ">#210
(comment)</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-cli/commit/3583c5f158f62a01f3c20a5add8d2f6aa7f2f5cb "><code>3583c5f</code></a>
1.51.5</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/10341e765e5d7e120edc242c799e11c391ef3499 "><code>10341e7</code></a>
Fix extractor using only the initializer value instead of the full enum
type</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/114f1de4d340a7fdd328938b8a7022689b11417d "><code>114f1de</code></a>
update i18next dep</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-cli/compare/v1.51.4...v1.51.5 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 13:52:14 +00:00
dependabot[bot]
8b23561fe5
chore(deps): Bump react-i18next from 16.6.6 to 17.0.1 ( #1774 )
...
Bumps [react-i18next](https://github.com/i18next/react-i18next ) from
16.6.6 to 17.0.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md ">react-i18next's
changelog</a>.</em></p>
<blockquote>
<h2>17.0.1</h2>
<ul>
<li>chore: bump minimum i18next peer dependency to <code>>=
26.0.1</code> <em>(forgot to do it in last version)</em></li>
<li>fix: migrate test setup from removed legacy
<code>interpolation.format</code> to
<code>i18n.services.formatter.add()</code> (i18next v26)</li>
</ul>
<h2>17.0.0</h2>
<h3>Potentially breaking changes</h3>
<ul>
<li>fix: <code>transKeepBasicHtmlNodesFor</code> now correctly preserves
HTML tag names when children contain interpolations or mixed content <a
href="https://redirect.github.com/i18next/i18next-cli/issues/230 ">230</a>
<ul>
<li>Previously, <code><strong>{{name}}</strong></code> was
incorrectly serialized as <code><1>{{name}}</1></code> — the
tag name was only preserved for plain string children</li>
<li>This bug existed since the feature was introduced and affects
auto-generated keys (when no explicit <code>i18nKey</code> is
provided)</li>
<li>If you rely on auto-generated Trans keys containing indexed tags for
kept HTML elements with interpolation children, you will need to update
your translation files</li>
</ul>
</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>updated dev dependencies (vitest, rollup plugins, happy-dom,
typescript, etc.)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/react-i18next/commit/23214960e3ead0b6774a1a0cb40387d41868da60 "><code>2321496</code></a>
17.0.1</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/7e656b567125b059738ccd6f79b45de3767a8df4 "><code>7e656b5</code></a>
chore: bump minimum i18next peer dependency</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/dfc350b2c465a7e0283c4fa5c6d83e3d447fc87a "><code>dfc350b</code></a>
upate github actions</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/7fe2620326e3027ecf4654ae739c4f74f83a5482 "><code>7fe2620</code></a>
17.0.0</li>
<li><a
href="https://github.com/i18next/react-i18next/commit/f4ada4c38c0d0fb5a992a8e76d5b510df69b257d "><code>f4ada4c</code></a>
fix: <code>transKeepBasicHtmlNodesFor</code> now correctly preserves
HTML tag names when...</li>
<li>See full diff in <a
href="https://github.com/i18next/react-i18next/compare/v16.6.6...v17.0.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 13:51:54 +00:00
Mike Taves
a62e5014ee
fix: typos ( #1771 )
...
Fix a few typos identified with codespell.
## Launch Checklist
- [X] Briefly describe the changes in this PR.
- [ ] Link to related issues.
- [ ] Write tests for all new functionality.
- [ ] Add an entry to `CHANGELOG.md` under the `## main` section.
2026-04-02 13:55:15 +03:00
dependabot[bot]
0032b85fb8
chore(deps): Bump lodash from 4.17.23 to 4.18.1 ( #1773 )
...
Bumps [lodash](https://github.com/lodash/lodash ) from 4.17.23 to 4.18.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lodash/lodash/releases ">lodash's
releases</a>.</em></p>
<blockquote>
<h2>4.18.1</h2>
<h2>Bugs</h2>
<p>Fixes a <code>ReferenceError</code> issue in <code>lodash</code>
<code>lodash-es</code> <code>lodash-amd</code> and
<code>lodash.template</code> when using the <code>template</code> and
<code>fromPairs</code> functions from the modular builds. See <a
href="https://redirect.github.com/lodash/lodash/issues/6167#issuecomment-4165269769 ">lodash/lodash#6167</a></p>
<p>These defects were related to how lodash distributions are built from
the main branch using <a
href="https://github.com/lodash-archive/lodash-cli ">https://github.com/lodash-archive/lodash-cli </a>.
When internal dependencies change inside lodash functions, equivalent
updates need to be made to a mapping in the lodash-cli. (hey, it was
ahead of its time once upon a time!). We know this, but we missed it in
the last release. It's the kind of thing that passes in CI, but fails bc
the build is not the same thing you tested.</p>
<p>There is no diff on main for this, but you can see the diffs for each
of the npm packages on their respective branches:</p>
<ul>
<li><code>lodash</code>: <a
href="https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm ">https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm </a></li>
<li><code>lodash-es</code>: <a
href="https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es ">https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es </a></li>
<li><code>lodash-amd</code>: <a
href="https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd ">https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd </a></li>
<li><code>lodash.template</code><a
href="https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages ">https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages </a></li>
</ul>
<h2>4.18.0</h2>
<h2>v4.18.0</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/lodash/lodash/compare/4.17.23...4.18.0 ">https://github.com/lodash/lodash/compare/4.17.23...4.18.0 </a></p>
<h3>Security</h3>
<p><strong><code>_.unset</code> / <code>_.omit</code></strong>: Fixed
prototype pollution via <code>constructor</code>/<code>prototype</code>
path traversal (<a
href="https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh ">GHSA-f23m-r3pf-42rh</a>,
<a
href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b ">fe8d32e</a>).
Previously, array-wrapped path segments and primitive roots could bypass
the existing guards, allowing deletion of properties from built-in
prototypes. Now <code>constructor</code> and <code>prototype</code> are
blocked unconditionally as non-terminal path keys, matching
<code>baseSet</code>. Calls that previously returned <code>true</code>
and deleted the property now return <code>false</code> and leave the
target untouched.</p>
<p><strong><code>_.template</code></strong>: Fixed code injection via
<code>imports</code> keys (<a
href="https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc ">GHSA-r5fr-rjxr-66jc</a>,
CVE-2026-4800, <a
href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6 ">879aaa9</a>).
Fixes an incomplete patch for CVE-2021-23337. The <code>variable</code>
option was validated against <code>reForbiddenIdentifierChars</code> but
<code>importsKeys</code> was left unguarded, allowing code injection via
the same <code>Function()</code> constructor sink. <code>imports</code>
keys containing forbidden identifier characters now throw
<code>"Invalid imports option passed into
_.template"</code>.</p>
<h3>Docs</h3>
<ul>
<li>Add security notice for <code>_.template</code> in threat model and
API docs (<a
href="https://redirect.github.com/lodash/lodash/pull/6099 ">#6099</a>)</li>
<li>Document <code>lower > upper</code> behavior in
<code>_.random</code> (<a
href="https://redirect.github.com/lodash/lodash/pull/6115 ">#6115</a>)</li>
<li>Fix quotes in <code>_.compact</code> jsdoc (<a
href="https://redirect.github.com/lodash/lodash/pull/6090 ">#6090</a>)</li>
</ul>
<h3><code>lodash.*</code> modular packages</h3>
<p><a
href="https://redirect.github.com/lodash/lodash/pull/6157 ">Diff</a></p>
<p>We have also regenerated and published a select number of the
<code>lodash.*</code> modular packages.</p>
<p>These modular packages had fallen out of sync significantly from the
minor/patch updates to lodash. Specifically, we have brought the
following packages up to parity w/ the latest lodash release because
they have had CVEs on them in the past:</p>
<ul>
<li><a
href="https://www.npmjs.com/package/lodash.orderby ">lodash.orderby</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.tonumber ">lodash.tonumber</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.trim ">lodash.trim</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.trimend ">lodash.trimend</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.sortedindexby ">lodash.sortedindexby</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.zipobjectdeep ">lodash.zipobjectdeep</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.unset ">lodash.unset</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.omit ">lodash.omit</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.template ">lodash.template</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lodash/lodash/commit/cb0b9b9212521c08e3eafe7c8cb0af1b42b6649e "><code>cb0b9b9</code></a>
release(patch): bump main to 4.18.1 (<a
href="https://redirect.github.com/lodash/lodash/issues/6177 ">#6177</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/75535f57883b7225adb96de1cfc1cd4169cfcb51 "><code>75535f5</code></a>
chore: prune stale advisory refs (<a
href="https://redirect.github.com/lodash/lodash/issues/6170 ">#6170</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/62e91bc6a39c98d85b9ada8c44d40593deaf82a4 "><code>62e91bc</code></a>
docs: remove n_ Node.js < 6 REPL note from README (<a
href="https://redirect.github.com/lodash/lodash/issues/6165 ">#6165</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/59be2de61f8aa9461c7856533b51d31b7d8babc4 "><code>59be2de</code></a>
release(minor): bump to 4.18.0 (<a
href="https://redirect.github.com/lodash/lodash/issues/6161 ">#6161</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/af634573030f979194871da7c68f79420992f53d "><code>af63457</code></a>
fix: broken tests for _.template 879aaa9</li>
<li><a
href="https://github.com/lodash/lodash/commit/1073a7693e1727e0cf3641e5f71f75ddcf8de7c0 "><code>1073a76</code></a>
fix: linting issues</li>
<li><a
href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6 "><code>879aaa9</code></a>
fix: validate imports keys in _.template</li>
<li><a
href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b "><code>fe8d32e</code></a>
fix: block prototype pollution in baseUnset via constructor/prototype
traversal</li>
<li><a
href="https://github.com/lodash/lodash/commit/18ba0a32f42fd02117f096b032f89c984173462d "><code>18ba0a3</code></a>
refactor(fromPairs): use baseAssignValue for consistent assignment (<a
href="https://redirect.github.com/lodash/lodash/issues/6153 ">#6153</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/b8190803d48d60b8c80ad45d39125f32fa618cb2 "><code>b819080</code></a>
ci: add dist sync validation workflow (<a
href="https://redirect.github.com/lodash/lodash/issues/6137 ">#6137</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/lodash/lodash/compare/4.17.23...4.18.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/maplibre/maputnik/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 08:12:45 +00:00
dependabot[bot]
3fa9b83563
chore(deps): Bump lodash-es from 4.17.23 to 4.18.1 ( #1772 )
...
Bumps [lodash-es](https://github.com/lodash/lodash ) from 4.17.23 to
4.18.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lodash/lodash/releases ">lodash-es's
releases</a>.</em></p>
<blockquote>
<h2>4.18.1</h2>
<h2>Bugs</h2>
<p>Fixes a <code>ReferenceError</code> issue in <code>lodash</code>
<code>lodash-es</code> <code>lodash-amd</code> and
<code>lodash.template</code> when using the <code>template</code> and
<code>fromPairs</code> functions from the modular builds. See <a
href="https://redirect.github.com/lodash/lodash/issues/6167#issuecomment-4165269769 ">lodash/lodash#6167</a></p>
<p>These defects were related to how lodash distributions are built from
the main branch using <a
href="https://github.com/lodash-archive/lodash-cli ">https://github.com/lodash-archive/lodash-cli </a>.
When internal dependencies change inside lodash functions, equivalent
updates need to be made to a mapping in the lodash-cli. (hey, it was
ahead of its time once upon a time!). We know this, but we missed it in
the last release. It's the kind of thing that passes in CI, but fails bc
the build is not the same thing you tested.</p>
<p>There is no diff on main for this, but you can see the diffs for each
of the npm packages on their respective branches:</p>
<ul>
<li><code>lodash</code>: <a
href="https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm ">https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm </a></li>
<li><code>lodash-es</code>: <a
href="https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es ">https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es </a></li>
<li><code>lodash-amd</code>: <a
href="https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd ">https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd </a></li>
<li><code>lodash.template</code><a
href="https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages ">https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages </a></li>
</ul>
<h2>4.18.0</h2>
<h2>v4.18.0</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/lodash/lodash/compare/4.17.23...4.18.0 ">https://github.com/lodash/lodash/compare/4.17.23...4.18.0 </a></p>
<h3>Security</h3>
<p><strong><code>_.unset</code> / <code>_.omit</code></strong>: Fixed
prototype pollution via <code>constructor</code>/<code>prototype</code>
path traversal (<a
href="https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh ">GHSA-f23m-r3pf-42rh</a>,
<a
href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b ">fe8d32e</a>).
Previously, array-wrapped path segments and primitive roots could bypass
the existing guards, allowing deletion of properties from built-in
prototypes. Now <code>constructor</code> and <code>prototype</code> are
blocked unconditionally as non-terminal path keys, matching
<code>baseSet</code>. Calls that previously returned <code>true</code>
and deleted the property now return <code>false</code> and leave the
target untouched.</p>
<p><strong><code>_.template</code></strong>: Fixed code injection via
<code>imports</code> keys (<a
href="https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc ">GHSA-r5fr-rjxr-66jc</a>,
CVE-2026-4800, <a
href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6 ">879aaa9</a>).
Fixes an incomplete patch for CVE-2021-23337. The <code>variable</code>
option was validated against <code>reForbiddenIdentifierChars</code> but
<code>importsKeys</code> was left unguarded, allowing code injection via
the same <code>Function()</code> constructor sink. <code>imports</code>
keys containing forbidden identifier characters now throw
<code>"Invalid imports option passed into
_.template"</code>.</p>
<h3>Docs</h3>
<ul>
<li>Add security notice for <code>_.template</code> in threat model and
API docs (<a
href="https://redirect.github.com/lodash/lodash/pull/6099 ">#6099</a>)</li>
<li>Document <code>lower > upper</code> behavior in
<code>_.random</code> (<a
href="https://redirect.github.com/lodash/lodash/pull/6115 ">#6115</a>)</li>
<li>Fix quotes in <code>_.compact</code> jsdoc (<a
href="https://redirect.github.com/lodash/lodash/pull/6090 ">#6090</a>)</li>
</ul>
<h3><code>lodash.*</code> modular packages</h3>
<p><a
href="https://redirect.github.com/lodash/lodash/pull/6157 ">Diff</a></p>
<p>We have also regenerated and published a select number of the
<code>lodash.*</code> modular packages.</p>
<p>These modular packages had fallen out of sync significantly from the
minor/patch updates to lodash. Specifically, we have brought the
following packages up to parity w/ the latest lodash release because
they have had CVEs on them in the past:</p>
<ul>
<li><a
href="https://www.npmjs.com/package/lodash.orderby ">lodash.orderby</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.tonumber ">lodash.tonumber</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.trim ">lodash.trim</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.trimend ">lodash.trimend</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.sortedindexby ">lodash.sortedindexby</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.zipobjectdeep ">lodash.zipobjectdeep</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.unset ">lodash.unset</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.omit ">lodash.omit</a></li>
<li><a
href="https://www.npmjs.com/package/lodash.template ">lodash.template</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lodash/lodash/commit/cb0b9b9212521c08e3eafe7c8cb0af1b42b6649e "><code>cb0b9b9</code></a>
release(patch): bump main to 4.18.1 (<a
href="https://redirect.github.com/lodash/lodash/issues/6177 ">#6177</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/75535f57883b7225adb96de1cfc1cd4169cfcb51 "><code>75535f5</code></a>
chore: prune stale advisory refs (<a
href="https://redirect.github.com/lodash/lodash/issues/6170 ">#6170</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/62e91bc6a39c98d85b9ada8c44d40593deaf82a4 "><code>62e91bc</code></a>
docs: remove n_ Node.js < 6 REPL note from README (<a
href="https://redirect.github.com/lodash/lodash/issues/6165 ">#6165</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/59be2de61f8aa9461c7856533b51d31b7d8babc4 "><code>59be2de</code></a>
release(minor): bump to 4.18.0 (<a
href="https://redirect.github.com/lodash/lodash/issues/6161 ">#6161</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/af634573030f979194871da7c68f79420992f53d "><code>af63457</code></a>
fix: broken tests for _.template 879aaa9</li>
<li><a
href="https://github.com/lodash/lodash/commit/1073a7693e1727e0cf3641e5f71f75ddcf8de7c0 "><code>1073a76</code></a>
fix: linting issues</li>
<li><a
href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6 "><code>879aaa9</code></a>
fix: validate imports keys in _.template</li>
<li><a
href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b "><code>fe8d32e</code></a>
fix: block prototype pollution in baseUnset via constructor/prototype
traversal</li>
<li><a
href="https://github.com/lodash/lodash/commit/18ba0a32f42fd02117f096b032f89c984173462d "><code>18ba0a3</code></a>
refactor(fromPairs): use baseAssignValue for consistent assignment (<a
href="https://redirect.github.com/lodash/lodash/issues/6153 ">#6153</a>)</li>
<li><a
href="https://github.com/lodash/lodash/commit/b8190803d48d60b8c80ad45d39125f32fa618cb2 "><code>b819080</code></a>
ci: add dist sync validation workflow (<a
href="https://redirect.github.com/lodash/lodash/issues/6137 ">#6137</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/lodash/lodash/compare/4.17.23...4.18.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/maplibre/maputnik/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 06:53:41 +00:00
dependabot[bot]
83cc461ac8
chore(deps): Bump github/codeql-action from 4.34.1 to 4.35.1 ( #1770 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action )
from 4.34.1 to 4.35.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases ">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.35.1</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158 ">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781 ">#3781</a></li>
</ul>
<h2>v4.35.0</h2>
<ul>
<li>Reduced the minimum Git version required for <a
href="https://redirect.github.com/github/roadmap/issues/1158 ">improved
incremental analysis</a> from 2.38.0 to 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3767 ">#3767</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1 ">2.25.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3773 ">#3773</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md ">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases ">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789 ">#3789</a></li>
</ul>
<h2>4.35.1 - 27 Mar 2026</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158 ">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781 ">#3781</a></li>
</ul>
<h2>4.35.0 - 27 Mar 2026</h2>
<ul>
<li>Reduced the minimum Git version required for <a
href="https://redirect.github.com/github/roadmap/issues/1158 ">improved
incremental analysis</a> from 2.38.0 to 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3767 ">#3767</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1 ">2.25.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3773 ">#3773</a></li>
</ul>
<h2>4.34.1 - 20 Mar 2026</h2>
<ul>
<li>Downgrade default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3 ">2.24.3</a>
due to issues with a small percentage of Actions and JavaScript
analyses. <a
href="https://redirect.github.com/github/codeql-action/pull/3762 ">#3762</a></li>
</ul>
<h2>4.34.0 - 20 Mar 2026</h2>
<ul>
<li>Added an experimental change which disables TRAP caching when <a
href="https://redirect.github.com/github/roadmap/issues/1158 ">improved
incremental analysis</a> is enabled, since improved incremental analysis
supersedes TRAP caching. This will improve performance and reduce
Actions cache usage. We expect to roll this change out to everyone in
March. <a
href="https://redirect.github.com/github/codeql-action/pull/3569 ">#3569</a></li>
<li>We are rolling out improved incremental analysis to C/C++ analyses
that use build mode <code>none</code>. We expect this rollout to be
complete by the end of April 2026. <a
href="https://redirect.github.com/github/codeql-action/pull/3584 ">#3584</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0 ">2.25.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3585 ">#3585</a></li>
</ul>
<h2>4.33.0 - 16 Mar 2026</h2>
<ul>
<li>
<p>Upcoming change: Starting April 2026, the CodeQL Action will skip
collecting file coverage information on pull requests to improve
analysis performance. File coverage information will still be computed
on non-PR analyses. Pull request analyses will log a warning about this
upcoming change. <a
href="https://redirect.github.com/github/codeql-action/pull/3562 ">#3562</a></p>
<p>To opt out of this change:</p>
<ul>
<li><strong>Repositories owned by an organization:</strong> Create a
custom repository property with the name
<code>github-codeql-file-coverage-on-prs</code> and the type
"True/false", then set this property to <code>true</code> in
the repository's settings. For more information, see <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization ">Managing
custom properties for repositories in your organization</a>.
Alternatively, if you are using an advanced setup workflow, you can set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using default setup:</strong> Switch
to an advanced setup workflow and set the
<code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to
<code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using advanced setup:</strong> Set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
</ul>
</li>
<li>
<p>Fixed <a
href="https://redirect.github.com/github/codeql-action/issues/3555 ">a
bug</a> which caused the CodeQL Action to fail loading repository
properties if a "Multi select" repository property was
configured for the repository. <a
href="https://redirect.github.com/github/codeql-action/pull/3557 ">#3557</a></p>
</li>
<li>
<p>The CodeQL Action now loads <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization ">custom
repository properties</a> on GitHub Enterprise Server, enabling the
customization of features such as
<code>github-codeql-disable-overlay</code> that was previously only
available on GitHub.com. <a
href="https://redirect.github.com/github/codeql-action/pull/3559 ">#3559</a></p>
</li>
<li>
<p>Once <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries ">private
package registries</a> can be configured with OIDC-based authentication
for organizations, the CodeQL Action will now be able to accept such
configurations. <a
href="https://redirect.github.com/github/codeql-action/pull/3563 ">#3563</a></p>
</li>
<li>
<p>Fixed the retry mechanism for database uploads. Previously this would
fail with the error "Response body object should not be disturbed
or locked". <a
href="https://redirect.github.com/github/codeql-action/pull/3564 ">#3564</a></p>
</li>
<li>
<p>A warning is now emitted if the CodeQL Action detects a repository
property whose name suggests that it relates to the CodeQL Action, but
which is not one of the properties recognised by the current version of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3570 ">#3570</a></p>
</li>
</ul>
<h2>4.32.6 - 05 Mar 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3 ">2.24.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3548 ">#3548</a></li>
</ul>
<h2>4.32.5 - 02 Mar 2026</h2>
<ul>
<li>Repositories owned by an organization can now set up the
<code>github-codeql-disable-overlay</code> custom repository property to
disable <a
href="https://redirect.github.com/github/roadmap/issues/1158 ">improved
incremental analysis for CodeQL</a>. First, create a custom repository
property with the name <code>github-codeql-disable-overlay</code> and
the type "True/false" in the organization's settings. Then in
the repository's settings, set this property to <code>true</code> to
disable improved incremental analysis. For more information, see <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization ">Managing
custom properties for repositories in your organization</a>. This
feature is not yet available on GitHub Enterprise Server. <a
href="https://redirect.github.com/github/codeql-action/pull/3507 ">#3507</a></li>
<li>Added an experimental change so that when <a
href="https://redirect.github.com/github/roadmap/issues/1158 ">improved
incremental analysis</a> fails on a runner — potentially due to
insufficient disk space — the failure is recorded in the Actions cache
so that subsequent runs will automatically skip improved incremental
analysis until something changes (e.g. a larger runner is provisioned or
a new CodeQL version is released). We expect to roll this change out to
everyone in March. <a
href="https://redirect.github.com/github/codeql-action/pull/3487 ">#3487</a></li>
<li>The minimum memory check for improved incremental analysis is now
skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage.
<a
href="https://redirect.github.com/github/codeql-action/pull/3515 ">#3515</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/c10b8064de6f491fea524254123dbe5e09572f13 "><code>c10b806</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3782 ">#3782</a>
from github/update-v4.35.1-d6d1743b8</li>
<li><a
href="https://github.com/github/codeql-action/commit/c5ffd0683786820677d054e3505e1c5bb4b8c227 "><code>c5ffd06</code></a>
Update changelog for v4.35.1</li>
<li><a
href="https://github.com/github/codeql-action/commit/d6d1743b8ec7ecd94f78ad1ce4cb3d8d2ba58001 "><code>d6d1743</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3781 ">#3781</a>
from github/henrymercer/update-git-minimum-version</li>
<li><a
href="https://github.com/github/codeql-action/commit/65d2efa7333ad65f97cc54be40f4cd18630f884c "><code>65d2efa</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/2437b20ab31021229573a66717323dd5c6ce9319 "><code>2437b20</code></a>
Update minimum git version for overlay to 2.36.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/ea5f71947c021286c99f61cc426a10d715fe4434 "><code>ea5f719</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3775 ">#3775</a>
from github/dependabot/npm_and_yarn/node-forge-1.4.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/45ceeea896ba2293e10982f871198d1950ee13d6 "><code>45ceeea</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3777 ">#3777</a>
from github/mergeback/v4.35.0-to-main-b8bb9f28</li>
<li><a
href="https://github.com/github/codeql-action/commit/24448c98434f429f901d27db7ddae55eec5cc1c4 "><code>24448c9</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/7c510606312e5c68ac8b27c009e5254f226f5dfa "><code>7c51060</code></a>
Update changelog and version after v4.35.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/b8bb9f28b8d3f992092362369c57161b755dea45 "><code>b8bb9f2</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3776 ">#3776</a>
from github/update-v4.35.0-0078ad667</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/38697555549f1db7851b81482ff19f1fa5c4fedc...c10b8064de6f491fea524254123dbe5e09572f13 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 13:54:03 +00:00
dependabot[bot]
327771d143
chore(deps-dev): Bump i18next-cli from 1.51.3 to 1.51.4 ( #1768 )
...
Bumps [i18next-cli](https://github.com/i18next/i18next-cli ) from 1.51.3
to 1.51.4.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md ">i18next-cli's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/i18next/i18next-cli/compare/v1.51.3...v1.51.4 ">1.51.4</a>
- 2026-03-27</h2>
<ul>
<li>Updated <code>react-i18next</code> to v17.
<code>transKeepBasicHtmlNodesFor</code> now correctly preserves HTML tag
names when
children contain interpolations or mixed content (e.g.
<code><strong>{{name}}</strong></code> instead of
<code><1>{{name}}</1></code>).
Fixes <a
href="https://redirect.github.com/i18next/i18next-cli/issues/230 ">#230</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-cli/commit/23b1681ae9178eec6dc9e30fa3d608219363f1f1 "><code>23b1681</code></a>
1.51.4</li>
<li><a
href="https://github.com/i18next/i18next-cli/commit/262c6ae835680695b5ad1eb7e755d6cf56b1b7c0 "><code>262c6ae</code></a>
Updated <code>react-i18next</code> to v17 to fix <a
href="https://redirect.github.com/i18next/i18next-cli/issues/230 ">#230</a></li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-cli/compare/v1.51.3...v1.51.4 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 13:52:07 +00:00