Skip to content

fix(deps): update all non-major dependencies - #496

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 5, 2026 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@commencis/eslint-config (source) 3.7.0 → 3.8.0 age confidence
@commencis/eslint-plugin (source) 3.5.0 → 3.6.0 age confidence
@commencis/lint-staged-config (source) 3.2.0 → 3.3.0 age confidence
@commencis/prettier-config (source) 3.3.0 → 3.4.0 age confidence
@commencis/stylelint-config (source) 3.5.0 → 3.6.0 age confidence
@hookform/resolvers (source) 5.9.1 → 5.9.2 age confidence
@reduxjs/toolkit (source) 2.12.0 → 2.13.0 age confidence
@storybook/addon-a11y (source) 10.6.0 → 10.6.2 age confidence
@storybook/addon-docs (source) 10.6.0 → 10.6.2 age confidence
@storybook/addon-links (source) 10.6.0 → 10.6.2 age confidence
@storybook/react-vite (source) 10.6.0 → 10.6.2 age confidence
@testing-library/user-event 14.6.7 → 14.6.8 age confidence
@types/node (source) 24.13.6 → 24.19.2 age confidence
@vitest/coverage-v8 (source) 4.1.11 → 4.1.12 age confidence
i18next (source) 26.4.2 → 26.4.7 age confidence
lint-staged 17.5.1 → 17.6.0 age confidence
prettier (source) 3.9.9 → 3.9.10 age confidence
react (source) 19.3.0 → 19.3.1 age confidence
react-dom (source) 19.3.0 → 19.3.1 age confidence
react-hook-form (source) 7.88.0 → 7.90.0 age confidence
react-i18next 17.0.15 → 17.0.20 age confidence
sass-embedded 1.105.0 → 1.105.2 age confidence
storybook (source) 10.6.0 → 10.6.2 age confidence
stylelint (source) 17.15.0 → 17.16.0 age confidence
vite (source) 7.3.6 → 7.3.7 age confidence
zod (source) 4.6.5 → 4.6.7 age confidence

Release Notes

Commencis/js-toolkit (@​commencis/eslint-config)

v3.8.0

Compare Source

Minor Changes
Commencis/js-toolkit (@​commencis/eslint-plugin)

v3.6.0

Compare Source

Minor Changes
Commencis/js-toolkit (@​commencis/lint-staged-config)

v3.3.0

Compare Source

Minor Changes
Commencis/js-toolkit (@​commencis/prettier-config)

v3.4.0

Compare Source

Minor Changes
Commencis/js-toolkit (@​commencis/stylelint-config)

v3.6.0

Compare Source

Minor Changes
react-hook-form/resolvers (@​hookform/resolvers)

v5.9.2

Compare Source

Bug Fixes
  • ajv: preserve escaped field names in validation errors (#​879) (71e6052)
reduxjs/redux-toolkit (@​reduxjs/toolkit)

v2.13.0

Compare Source

This feature release updates our build tooling to TSDown and PNPM, adds official TypeScript 7 support, and includes a long list of bugfixes across RTK Query, createAsyncThunk, createEntityAdapter, and combineSlices.

Changelog

Build Tooling Updates

We've fully modernizing modernized our build tooling across all of the Redux repos. That included switching from Yarn to PNPM, ESLint to Oxlint, Prettier to Oxfmt, and TSUp to TSDown.

The part that matters for users is that we now build the package with TSDown instead of tsup. The package layout, exports definitions, and exported APIs are all unchanged from 2.12. We've checked the new build with attw, and verified that CJS and ESM entry points load in both dev and prod builds, and that the legacy-esm artifacts still target ES2017. The contents of the bundles do look a bit different (smaller CJS artifacts, slightly different helper output in the legacy-esm files). If you see any behavior differences that look build-related, please file an issue!

This is also our first release published via the updated PNPM-based workflow, still using NPM Trusted Publishing. We've also added pkg.pr.new previews for every commit, so you can try out a PR build before it's released.

Docs Updates

We've shipped a new combined Redux libraries docs site! The core docs site at https://redux.js.org now contains the docs for all of our libraries: Redux core and usage guides, Redux Toolkit, React Redux, and Reselect. The prior standalone docs sites for RTK, R-R, and Reselect now redirect to their respective sections of the combined docs. We've also done a major cleanup pass on the docs, deduplicating pages that had similarities (like the Next.js or RTK2 migration pages that lived in both the core and RTK docs), and updating outdated content (modernizing example code snippets, deleting dead links, and making RTK and hooks the default patterns shown). The RTK content now lives at https://redux.js.org/toolkit/ .

TypeScript 7 Support

TS 7.0 (the native Go port) is now out! We fixed the remaining type errors in RTK when checked by TS 7.0 and 7.1, and TS 7.0 is now part of our CI test matrix.

Per our TS support policy of matching DefinitelyTyped's support window, we've also updated our support matrix to TS 5.6+. As always, RTK may still work with earlier versions, but we no longer test against them.

RTK Query Fixes

useQueryState (and thus useQuery) was passing a new inline selector to useSelector on every render, and also reading the store directly during render. The selector is now memoized, and the direct store read is gone. This also fixes a bug where isSuccess could flip from false to true on an unrelated re-render while a query was refetching after an error. isSuccess now correctly stays false in that case.

data now reflects cache updates made via updateQueryData while a refetch is in flight, instead of showing the previous result.

Polling now reads the current cache state when each poll fires, rather than the state at the time the poll was scheduled. This means skipPollingIfUnfocused respects focus loss that happens after scheduling, and polls stop if their cache entry was removed.

We fixed a race where a duplicate query request rejected by the thunk condition could cause queued tag invalidations to run too early and be lost, leaving stale data in the cache.

Tags with falsy ids like 0 now invalidate and clean up correctly.

Lazy query hooks now re-subscribe correctly when effects restart while the hook state is preserved, such as with Fast Refresh or <Activity>.

Infinite queries no longer trigger onQueryStarted when fetching past the end of the list, and the infinite query hook result type now includes the page error flags.

fetchBaseQuery only treats a URL as absolute if it starts with a scheme.

We also fixed an error when rehydrating state for an endpoint name that has no definition.

Other Fixes

createAsyncThunk no longer swallows aborts that happen before the pending action is dispatched, and now correctly sets rejectedWithValue when rejectWithValue is called with a falsy payload.

createEntityAdapter's setAll now keeps the last item when given duplicate IDs, matching setMany. The sorted adapter's updateMany now merges multiple updates for the same ID before applying them.

combineSlices now keeps its internal state proxy cache per instance, so multiple combined reducers no longer interfere with each other.

The immutability check middleware now handles circular references in state.

The dynamic middleware now caches its composed middleware chains when the list of middleware hasn't changed.

What's Changed

Full Changelog: reduxjs/redux-toolkit@v2.12.0...v2.13.0

storybookjs/storybook (@​storybook/addon-a11y)

v10.6.2

Compare Source

v10.6.1

Compare Source

testing-library/user-event (@​testing-library/user-event)

v14.6.8

Compare Source

Bug Fixes
  • treat programmatic null input values as empty string (#​1329) (1951eb7)
vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.12

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
i18next/i18next (i18next)

v26.4.7

Compare Source

  • perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#​2451).

v26.4.6

Compare Source

  • fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#​2450).

v26.4.5

Compare Source

  • fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

v26.4.4

Compare Source

  • fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#​2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. See advisory GHSA-5jr9-983r-c8x4, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
  • fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

Compare Source

  • perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#​2449).
lint-staged/lint-staged (lint-staged)

v17.6.0

Compare Source

Minor Changes
  • #​1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

    import { defineConfig } from 'lint-staged/config'
    
    export default defineConfig({
      '*': {
        title: 'Fail if PDF files are committed',
        task: async (filepaths, { log }) => {
          const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
          if (pdfFiles.length > 0) {
            log('PDF files should not be committed: %s', pdfFiles)
            throw new Error('Failed')
          }
        },
      },
    })
  • #​1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

    If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes
  • #​1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

  • #​1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

    import { defineConfig } from 'lint-staged/config'
    
    export default defineConfig({
      '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
    })
  • #​1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

  • #​1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

prettier/prettier (prettier)

v3.9.10

Compare Source

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#​20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

react/react (react)

v19.3.1: 19.3.1 (October 14th, 2026)

Compare Source

React Server Components
react-hook-form/react-hook-form (react-hook-form)

v7.90.0

Compare Source

Changed
  • Improve performance of watch, subscribe, scoped subscriptions, dirty field checks and form state fan-out
  • Reduce bundle size
Fixed
  • Fields named after Object.prototype members not being marked as touched on blur and setValue
  • Dirty values extraction for fields named hasOwnProperty
  • cloneObject dropping the length of sparse arrays
  • cloneObject failing on objects with a null prototype
  • Form options removed from props on re-render not being reset
  • remove() mishandling duplicated indexes and mutating the indexes passed in
  • useFieldArray unregistering fields while a parent array reindexes
  • Input edited before the form is ready being overwritten
  • useWatch not updating watched objects after an <Activity> subtree reconnects
  • useWatch preferring its own defaultValue over form defaultValues for array names
  • reset without values and keepDefaultValues setting isDirty to true
  • Controller blur validation not working after reset
  • watch reading a stale shouldUnregister option when a field registers
  • Native validation reading a stale shouldUseNativeValidation option when stopping at the first error
  • Form values stored under a ref key not being compared correctly
  • setError, clearErrors and remaining error updates not producing a new errors reference

v7.89.0

Compare Source

Changed
  • Add optional @types/react peer dependency
Fixed
  • validateField calling setCustomValidity on refs that don't implement it under native validation
  • Form-level validate running a stale function instead of the latest one
  • Form-level validation leaving stale errors after a successful re-validation
  • Form-level validation running more than once per traversal
  • Stale validation results (resolver, built-in, form-level validate) being applied after reset in onChange and handleSubmit
  • Pending delayError timers for nested paths not being cancelled when a parent validates clean or is reset via resetField
  • getValues(names, { dirtyFields }) returning every row of a field array instead of only the marked entries
  • Field array touched state not being re-indexed when touchedFields is not subscribed
  • useFieldArray emitting touchedFields in form state updates when unnecessary
  • Stale field array root error not clearing once an array operation satisfies the rule
  • useFieldArray marking the form dirty when the array default is null
  • Dirty state lingering for rows removed from a field array
  • setValue with shouldValidate not revalidating deps
  • setValue with shouldValidate not triggering validation for a field array root
  • Validation rules removed from register options at runtime still being applied
  • useController validating required against the input value instead of the controlled value
  • isValid not recomputing when the errors prop is emptied
  • getFieldState(name, formState) with a resolver after reset()
i18next/react-i18next (react-i18next)

v17.0.20

Compare Source

  • fix: useTranslation no longer suspends when a missing namespace is loaded by a synchronous backend. With useSuspense (the default), a namespace that wasn't in the store yet always made the component throw the loading promise, even when the backend had already delivered the resources while that promise was being created. React then showed the Suspense fallback and rendered again right away, which appears as a fallback flash (a white flash in React Native) and costs performance. The hook now starts the load first, checks the store again and only suspends if the namespace is still missing. This helps every backend that calls back synchronously, for example i18next-resources-to-backend with a static resources object or a loader that returns the data directly. Async backends, and an instance that isn't initialized yet, still suspend as before. Thanks @​oblador (#​1937).

v17.0.19

Compare Source

  • fix: useTranslation with an inline selector keyPrefix (useTranslation('ns', { keyPrefix: ($) => $.role })) returned a new t on every render, so every effect, useCallback and useMemo depending on t ran again each time. The cached t was compared against the keyPrefix function itself, and an inline arrow is a new function on every render. It is now compared against the key the selector resolves to (with the same options and namespace list getFixedT resolves it with), so t keeps its identity as long as the resolved prefix does, just like a string keyPrefix. A selector that resolves to a different key still gets a new t, and i18next still resolves the selector on each t call as before. Fixes #​1936.
  • fix: useTranslation kept returning the previous t when only the namespace (useTranslation('a') → useTranslation('b')) or only the i18n instance (another instance with the same language, via props or I18nextProvider) changed on a mounted component. That t kept resolving against the old namespace or instance until something else (the language, the ready state, a bound i18n event) produced a new one. Both are now part of the check that decides whether the cached t can be reused.

v17.0.18

Compare Source

  • fix(Trans): with shouldUnescape, the default unescape now turns &nbsp; and &#&#8203;160; into a no-break space (U+00A0) instead of a regular space (U+0020). The regular space dropped what the entity is for: u&nbsp;nás or 10&nbsp;km could wrap across lines, and consecutive &nbsp;s collapsed into one space. This also matches IcuTrans, whose entity decoder already mapped &nbsp; to U+00A0. Compatibility note: only affects shouldUnescape; snapshots or exact textContent comparisons of such text now contain U+00A0 (Testing Library's default normalizer still matches it as a space). A custom react.unescape function can restore the old mapping for text nodes. Thanks @​lprnmns (#​1935).

v17.0.17

Compare Source

  • perf: useTranslation no longer unsubscribes and resubscribes its i18n listeners on every render. The subscribe callback handed to useSyncExternalStore depended on the merged options object, which is rebuilt whenever props is a new object: with no options (the {} default), with options passed inline (useTranslation('ns', { keyPrefix })), and through withTranslation and <Translation>. A new subscribe makes React resubscribe, so each render of each caller ran i18n.off and i18n.on in an extra effect. It now depends only on the instance and the bindI18n/bindI18nStore event names. No updates were ever missed, because React re-checks the snapshot after resubscribing; this only removes the churn, which adds up with many mounted components that re-render often. Reported via next-i18next#2349.

v17.0.16

Compare Source

  • fix(Trans): a selector i18nKey that points into a secondary namespace of useTranslation now resolves the same way t() does. With const { t } = useTranslation(['ns1', 'ns2']), t($ => $.ns2.message) works since 17.0.7, but <Trans t={t} i18nKey={$ => $.ns2.message} /> rendered the raw key (or its children). Trans always passed an ns option to t, filled from t.ns (the primary namespace only), and an explicit ns makes i18next's fixed t skip the hook's full namespace list (scopeNs). When Trans or TransWithoutContext gets a t that carries its own namespace and no ns prop, it now leaves ns out and lets that t apply its own. String keys, keyPrefix, nsMode: 'fallback', an explicit ns prop and Trans without a t prop behave as before. Compatibility note: if the primary namespace has a nested object named like a secondary namespace (ns1 → ns2.message), Trans now resolves $ => $.ns2.message to ns2:message, as t() already does. Fixes #​1933.
sass/embedded-host-node (sass-embedded)

v1.105.2

Compare Source

Node.js Embedded Host
  • Fix a deadlock when the async compiler fails to start.

v1.105.1

Compare Source

  • Improve error messages for @extends across different media queries.
stylelint/stylelint (stylelint)

v17.16.0

Compare Source

It fixes 2 bugs in the layout-mappings rules. This will likely be the last 17.x release, as we prepare for 18.0.0.

  • Fixed: property-layout-mappings and unit-layout-mappings false negatives for uppercase property names and units (#​9485) (@​giaBaoJS).
  • Fixed: value-keyword-layout-mappings false positives for caption-side (#​9483) (@​giaBaoJS).
vitejs/vite (vite)

v7.3.7

Compare Source

Please refer to [CHANGELOG.md](https://redirect.github.com/vitejs/vite/blob/v7.3.7/packages/vite/C

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (in timezone Europe/Istanbul)

  • Branch creation
    • Between 07:00 AM and 09:59 AM, only on Monday (* 7-9 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner October 5, 2026 06:17
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from c4f70b6 to bb87f08 Compare October 9, 2026 05:54
@changeset-bot

changeset-bot Bot commented Oct 9, 2026 •

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 0a45b36

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from aace3d2 to 455f863 Compare October 16, 2026 09:14
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 3557a67 to ba66bf4 Compare October 19, 2026 10:08
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from ba66bf4 to 0a45b36 Compare October 20, 2026 09:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants