Skip to content

chore(deps): bump the npm-minor-and-patch group across 1 directory with 30 updates - #115

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-053c0ddb8b
Open

chore(deps): bump the npm-minor-and-patch group across 1 directory with 30 updates#115
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-053c0ddb8b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 30 updates in the / directory:

Package From To
@bpmn-io/form-js 1.23.0 1.24.1
@bpmn-io/properties-panel 3.47.0 3.48.0
@tanstack/react-query 5.101.2 5.101.4
axios 1.18.1 1.19.0
bpmn-js 18.19.0 18.22.1
bpmn-js-properties-panel 5.60.0 5.63.0
dmn-js 17.8.1 17.10.1
i18next 26.3.4 26.3.6
react 19.2.7 19.2.8
@types/react 19.2.17 19.2.18
react-dom 19.2.7 19.2.8
@types/react-dom 19.2.3 19.2.4
react-i18next 17.0.8 17.0.11
react-router-dom 7.18.1 7.18.2
@playwright/test 1.61.1 1.62.1
@redocly/cli 2.37.0 2.43.2
@storybook/addon-a11y 10.4.6 10.5.5
@storybook/addon-docs 10.4.6 10.5.5
@storybook/react-vite 10.4.6 10.5.5
@types/node 26.1.0 26.1.2
@vitejs/plugin-react 6.0.3 6.0.5
eslint 10.6.0 10.8.0
eslint-plugin-storybook 10.4.6 10.5.5
globals 17.7.0 17.9.0
msw 2.14.6 2.15.0
openapi3-ts 4.6.0 4.6.1
orval 8.19.0 8.23.0
storybook 10.4.6 10.5.5
typescript-eslint 8.62.1 8.65.0
vite 8.1.3 8.2.0

Updates @bpmn-io/form-js from 1.23.0 to 1.24.1

Release notes

Sourced from @​bpmn-io/form-js's releases.

v1.24.1

Changes

  • FIX: avoid redundant document preview fetches (#1520, #1538)
  • FIX: correct getVariableSchema reporting invalid variables (#710, #1475)

New Contributors

Full Changelog: bpmn-io/form-js@v1.24.0...v1.24.1

Changelog

Sourced from @​bpmn-io/form-js's changelog.

1.24.1

  • FIX: avoid redundant document preview fetches (#1520, #1538)
  • FIX: correct getVariableSchema reporting invalid variables (#710, #1475)

1.24.0

  • FEAT: apply shared cm-theme syntax highlighting to the playground data (input) and result (output) editors
  • FIX: correct drag and drop not working with recent preact versions (#1529, #760)
  • DEPS: update to preact@10.29.3
  • DEPS: update to dompurify@3.4.11
  • DEPS: update to @bpmn-io/properties-panel@3.47.0
  • DEPS: update to @bpmn-io/cm-theme@0.2.2
  • DEPS: update to min-dash@5.1.0

1.23.1

  • FIX: handle numerical 0 value in select (#1532)
Commits
  • 81e6183 chore(project): publish v1.24.1
  • 001da43 chore(CHANGELOG): update to v1.24.1
  • 0f4a5bc chore(CHANGELOG): update
  • 4ddda4f chore(project): publish v1.24.0
  • 83e3a64 chore(CHANGELOG): update to v1.24.0
  • 4972c27 feat(playground): use cm-theme highlighting in data and result editors
  • 5e8da50 chore(project): publish v1.23.1
  • 26bdcf9 chore: update changelog
  • See full diff in compare view

Updates @bpmn-io/properties-panel from 3.47.0 to 3.48.0

Release notes

Sourced from @​bpmn-io/properties-panel's releases.

v3.48.0

  • chore(CHANGELOG): update to v3.48.0 95f19ca
  • fix(components): compare popup input against live value c305939
  • feat(components): resize TextArea on any interaction 1c351cc
  • feat(popup): allow overriding popup providers via priority 32623a6
  • fix(popup): scope text popup editor id to avoid duplicate DOM ids 521c23a
  • fix: respect field height when showing a placeholder 7b98421
  • chore: register popup providers via event bus 5d884e8
  • feat: allow registering custom popup providers a334c16
  • chore: make popups available in the example 3699d2e
  • feat: enable popup editor for text areas d2af487
  • fix(popup): respect popup size constants 1669adc
  • chore(refactor): move generic popup out of feel-popup feature 4cf40b9
  • test: increase timeout for checkbox a11y test c032c37
  • chore: update actions/setup-node action to v7 e18d4e8
  • chore: update CHANGELOG.md 6f3403b
  • fix: support snippet placeholder navigation in FEEL popup 0bbe73c
  • chore: resolve preact from actual install location 3ffa86c

bpmn-io/properties-panel@v3.47.0...v3.48.0

Changelog

Sourced from @​bpmn-io/properties-panel's changelog.

3.48.0

  • FEAT: enable popup editor for text areas (#523)
  • FEAT: allow registering custom popup providers (#523)
  • FEAT: allow overriding popup providers via priority (#523)
  • FEAT: resize TextArea on any interaction (#529)
  • FIX: support snippet placeholder navigation in FEEL popup (#524)
  • FIX: respect popup size constants (#523)
  • FIX: respect field height when showing a placeholder (#523)
  • FIX: scope text popup editor id to avoid duplicate DOM ids (#523)
  • FIX: compare popup input against live value (#530)
Commits
  • 282ffd2 3.48.0
  • 95f19ca chore(CHANGELOG): update to v3.48.0
  • c305939 fix(components): compare popup input against live value
  • 1c351cc feat(components): resize TextArea on any interaction
  • 32623a6 feat(popup): allow overriding popup providers via priority
  • 521c23a fix(popup): scope text popup editor id to avoid duplicate DOM ids
  • 7b98421 fix: respect field height when showing a placeholder
  • 5d884e8 chore: register popup providers via event bus
  • a334c16 feat: allow registering custom popup providers
  • 3699d2e chore: make popups available in the example
  • Additional commits viewable in compare view

Updates @tanstack/react-query from 5.101.2 to 5.101.4

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.101.4

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.101.4
    • @​tanstack/react-query@​5.101.4

@​tanstack/react-query-next-experimental@​5.101.4

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.101.4

@​tanstack/react-query-persist-client@​5.101.4

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.101.4
    • @​tanstack/react-query@​5.101.4

@​tanstack/react-query@​5.101.4

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.101.4

@​tanstack/react-query-devtools@​5.101.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.101.3
    • @​tanstack/react-query@​5.101.3

@​tanstack/react-query-next-experimental@​5.101.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.101.3

@​tanstack/react-query-persist-client@​5.101.3

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.101.3
    • @​tanstack/react-query@​5.101.3

@​tanstack/react-query@​5.101.3

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.101.4

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.101.4

5.101.3

Patch Changes

  • Updated dependencies [7e3c822]:
    • @​tanstack/query-core@​5.101.3
Commits
  • 86bb8a6 ci: Version Packages (#11094)
  • 181ea82 ci: Version Packages (#11089)
  • 6d55b07 test({react,preact}-query): use the '.then()' convention consistently (#11085)
  • 44f38df test({react,preact,solid}-query/useInfiniteQuery): inline the shared 'fetchIt...
  • d1558c1 test({react,preact}-query/usePrefetchQuery): inline the 'generateQueryFn' fac...
  • 99690d1 test({react,preact}-query/usePrefetchInfiniteQuery): inline single-use helper...
  • 10770f0 test({react,preact}-query/usePrefetchInfiniteQuery): inline the shared 'Suspe...
  • dbd5a86 test({react,preact}-query/usePrefetchQuery): inline the shared 'Suspended' co...
  • b955f60 test({react,preact}-query/useSuspenseQuery): assert the 'loading' fallback is...
  • b9c657e test({react,preact}-query/usePrefetchQuery): assert the 'Loading...' fallback...
  • Additional commits viewable in compare view

Updates axios from 1.18.1 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • 311fcc5 chore(release): prepare release 1.19.0 (#11095)
  • cb4fd74 chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (#11088)
  • 004c93a chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...
  • 122edde chore(deps-dev): bump the development_dependencies group with 3 updates (#11089)
  • c44f8d0 ci: use bundled npm for v1 publish (#11083)
  • 878bb29 fix(sandbox): resolve TypeError on constant variable path assignment (#11073)
  • a092bae fix(core): synchronous interceptors swallow errors and proceed with request (...
  • 3041b8f feat(HttpStatusCode): add missing 520 status code (#11067)
  • 58b16c8 refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...
  • 3077e62 feat(types): Allow the Params property to be typed, instead of any (#11081)
  • Additional commits viewable in compare view

Updates bpmn-js from 18.19.0 to 18.22.1

Release notes

Sourced from bpmn-js's releases.

v18.22.1

  • chore(CHANGELOG): update to v18.22.1 2b208458
  • fix(export): prevent clipped strokes in exported diagrams 15f956fb
  • deps: update to diagram-js@15.23.2 4f01d955

bpmn-io/bpmn-js@v18.22.0...v18.22.1

v18.22.0

v18.21.0

Changes

  • chore(CHANGELOG): update to v18.21.0 58b506b2
  • deps: update to diagram-js@15.20.0 c56b91b0

bpmn-io/bpmn-js@v18.20.0...v18.21.0

v18.20.0

Changes

  • chore: update to bio-dts@0.15.3 724798b8
  • chore: update to npm-run-all2@9.0.2 42eb3fd7
  • chore(CHANGELOG): update to v18.20.0 e2a9eb01
  • deps: update to diagram-js@15.19.0 25adea56
  • chore: revert to @​babel/core@​7.29.7 15b6afe0
  • test(benchmark): verify small diagram a82f0057
  • test(benchmark): verify paste 6401da81
  • test(benchmark): verify move commit c6c3b791
  • test(benchmark): validate selection 8fec4061
  • deps: update to diagram-js@15.18.1 26ac0455
  • test(benchmark): validate spacetool preview d3a13b9f
  • test: add benchmark script to validate key scenarios against HUGE diagrams c77c2fa2
  • chore(test): publish CI env var to browser 205addda
  • chore(label-link): use native Selection#isSelected API for check 896438c3
  • test(modeling): ensure outline before verifying update semantics 73a15fb5
  • style: turn helper function into standard test helper 5993d1ef
  • chore(CHANGELOG): update 6d8e92ee
  • fix(modeling): do not adjust parent when moving out of canvas 6730e229

... (truncated)

Changelog

Sourced from bpmn-js's changelog.

18.22.1

  • FIX: prevent clipped strokes in exported diagrams (#2476)
  • DEPS: update to diagram-js@15.23.2

18.22.0

18.21.0

18.20.0

  • FEAT: various performance improvements in many parts of the code base
  • FIX: disallow move when dropped outside of canvas (#2437, #2210)
  • CHORE: derive label link offset from (circular) outline shape (#2457)
  • DEPS: update to diagram-js@15.19.0
Commits
  • 319cb1e 18.22.1
  • 2b20845 chore(CHANGELOG): update to v18.22.1
  • 15f956f fix(export): prevent clipped strokes in exported diagrams
  • 4f01d95 deps: update to diagram-js@15.23.2
  • 7f79216 18.22.0
  • e85b907 chore: update CHANGELOG.md
  • 8edf1df chore: update CHANGELOG.md
  • 8d5bd08 deps: update to diagram-js@15.23.0
  • 4ed19f0 feat: allow overriding the replace menu width via css variable
  • 0e113ed test(popup-menu): verify the description can be overridden
  • Additional commits viewable in compare view

Updates bpmn-js-properties-panel from 5.60.0 to 5.63.0

Release notes

Sourced from bpmn-js-properties-panel's releases.

v5.63.0

Changes

  • chore: update to @​bpmn-io/variable-resolver@​3.3.0 811f44d7
  • chore: update to camunda-bpmn-js-behaviors@1.18.0 4765d65d
  • chore: update to @​bpmn-io/properties-panel@​3.48.0 77d772d2
  • chore(CHANGELOG): update to v5.63.0 8250535e
  • docs: fix PropertiesProvider JSDoc typedef 52701b46
  • test(zeebe): pin resolved singleton entry ids to the rendered DOM a4c7bee1
  • fix(zeebe): align activeElementsCollection entry id with rendered entry 57f95e08
  • feat: resolve remaining properties panel entry IDs from model paths 97492c21
  • chore(zeebe): source all provider entry ids from EntryIdUtil b7d7195f
  • chore(zeebe): derive entry ids from the shared EntryIdUtil ee3113de
  • feat: add propertiesPanel#getEntryId(element, path) API e677a3e3
  • chore(CHANGELOG): update 14c5ea42
  • test(zeebe): cover invalid text priority display 1f77a8ac
  • feat: use number entry for priority and job priority 9df254d1
  • chore: update dependency bpmn-js-create-append-anything to v2 0dbe4f23

bpmn-io/bpmn-js-properties-panel@v5.62.0...v5.63.0

v5.62.0

  • chore: bump zeebe-bpmn-moddle to ^1.17.0 ca1d7ee
  • feat(zeebe): add Business ID group for Call Activities 343c05c
  • chore: update actions/setup-node action to v7 1c1029a

bpmn-io/bpmn-js-properties-panel@v5.61.0...v5.62.0

v5.61.0

  • chore(CHANGELOG): update to v5.61.0 928d26bd
  • chore: update README 95ba97d6
  • chore: require @bpmn-io/properties-panel >= 3.42.0 07aee59d
  • feat: allow rendering the header into a separate container 208bc84f
  • chore: update dependency karma-tldr-reporter to v1 32a1bfaa

bpmn-io/bpmn-js-properties-panel@v5.60.0...v5.61.0

Changelog

Sourced from bpmn-js-properties-panel's changelog.

5.63.0

  • FEAT: add propertiesPanel#getEntryId(element, path) API to resolve a moddle property path to an entry id (#1242)
  • FEAT: use number input for priority and jobPriority (#1241)

5.62.0

  • FEAT: add business ID group for Call Activities (#1240)

5.61.0

  • FEAT: allow rendering the header into a separate container (#1239)
Commits
  • 1ed8eb1 5.63.0
  • 811f44d chore: update to @​bpmn-io/variable-resolver@​3.3.0
  • 4765d65 chore: update to camunda-bpmn-js-behaviors@1.18.0
  • 77d772d chore: update to @​bpmn-io/properties-panel@​3.48.0
  • 8250535 chore(CHANGELOG): update to v5.63.0
  • 52701b4 docs: fix PropertiesProvider JSDoc typedef
  • a4c7bee test(zeebe): pin resolved singleton entry ids to the rendered DOM
  • 57f95e0 fix(zeebe): align activeElementsCollection entry id with rendered entry
  • 97492c2 feat: resolve remaining properties panel entry IDs from model paths
  • b7d7195 chore(zeebe): source all provider entry ids from EntryIdUtil
  • Additional commits viewable in compare view

Updates dmn-js from 17.8.1 to 17.10.1

Changelog

Sourced from dmn-js's changelog.

17.10.1

  • FIX: prevent clipped strokes in exported diagrams (#1017)
  • DEPS: update to diagram-js@15.23.2

17.10.0

  • FEAT: create variable for decision and input data per default (#1011)
  • FIX: do not remove typeref when decision implementation changes(#1011)

17.9.0

  • FEAT: add type ref dropdown (#1009)
  • DEPS: update to diagram-js@15.21.0
  • DEPS: update to diagram-js-direct-editing@3.4.0
  • DEPS: update to @bpmn-io/feel-editor@2.6.0
Commits
  • fbc0ed7 chore(packages): release
  • fafd0f7 chore(CHANGELOG): update to v17.10.1
  • e33e5f8 chore(packages): release
  • e132f3b chore: update changelog
  • ef05660 test: print XML after changes in npm start run
  • be5c032 chore(packages): release
  • a52f4bd chore: update changelog
  • d7a0765 deps: update to diagram-js@15.21.0
  • c1cc1f0 chore: update test dependencies
  • d312c79 chore: update linting
  • Additional commits viewable in compare view

Updates i18next from 26.3.4 to 26.3.6

Release notes

Sourced from i18next's releases.

v26.3.6

  • fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

  • fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
  • fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
  • fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).
Changelog

Sourced from i18next's changelog.

26.3.6

  • fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

26.3.5

  • fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
  • fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
  • fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).
Commits
  • e1c60d4 26.3.6
  • 04da43e fix: allow typescript 7 in optional peerDependencies range (react-i18next#1927)
  • 8eed4ac build
  • 573ae73 26.3.5
  • cc54b05 docs(changelog): 26.3.5 — multiline $t() options, replace mutation, escaped-l...
  • 3180d67 fix: skip interpolation of placeholders inside escaped values (#2442)
  • d16f5a2 fix: stop mutating the passed replace object when returning details (#2441)
  • bed56c1 fix: parse $t() nesting options block that spans multiple lines (#2440)
  • c19e458 docs(changelog): link GHSA advisory for deepExtend fix
  • 7bb87d0 docs(changelog): reference security advisory for deepExtend fix
  • Additional commits viewable in compare viewDescription has been truncated

@dependabot
chore(deps): bump the npm-minor-and-patch group across 1 directory wi…
28767de 
…th 30 updates

Bumps the npm-minor-and-patch group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@bpmn-io/form-js](https://github.com/bpmn-io/form-js/tree/HEAD/packages/form-js) | `1.23.0` | `1.24.1` |
| [@bpmn-io/properties-panel](https://github.com/bpmn-io/properties-panel) | `3.47.0` | `3.48.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.2` | `5.101.4` |
| [axios](https://github.com/axios/axios) | `1.18.1` | `1.19.0` |
| [bpmn-js](https://github.com/bpmn-io/bpmn-js) | `18.19.0` | `18.22.1` |
| [bpmn-js-properties-panel](https://github.com/bpmn-io/bpmn-js-properties-panel) | `5.60.0` | `5.63.0` |
| [dmn-js](https://github.com/bpmn-io/dmn-js/tree/HEAD/packages/dmn-js) | `17.8.1` | `17.10.1` |
| [i18next](https://github.com/i18next/i18next) | `26.3.4` | `26.3.6` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.8` | `17.0.11` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.1` | `7.18.2` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.1` |
| [@redocly/cli](https://github.com/Redocly/redocly-cli) | `2.37.0` | `2.43.2` |
| [@storybook/addon-a11y](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/a11y) | `10.4.6` | `10.5.5` |
| [@storybook/addon-docs](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs) | `10.4.6` | `10.5.5` |
| [@storybook/react-vite](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite) | `10.4.6` | `10.5.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.0` | `26.1.2` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.3` | `6.0.5` |
| [eslint](https://github.com/eslint/eslint) | `10.6.0` | `10.8.0` |
| [eslint-plugin-storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/lib/eslint-plugin) | `10.4.6` | `10.5.5` |
| [globals](https://github.com/sindresorhus/globals) | `17.7.0` | `17.9.0` |
| [msw](https://github.com/mswjs/msw) | `2.14.6` | `2.15.0` |
| [openapi3-ts](https://github.com/metadevpro/openapi3-ts) | `4.6.0` | `4.6.1` |
| [orval](https://github.com/orval-labs/orval) | `8.19.0` | `8.23.0` |
| [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core) | `10.4.6` | `10.5.5` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.62.1` | `8.65.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.3` | `8.2.0` |



Updates `@bpmn-io/form-js` from 1.23.0 to 1.24.1
- [Release notes](https://github.com/bpmn-io/form-js/releases)
- [Changelog](https://github.com/bpmn-io/form-js/blob/develop/packages/form-js/CHANGELOG.md)
- [Commits](https://github.com/bpmn-io/form-js/commits/v1.24.1/packages/form-js)

Updates `@bpmn-io/properties-panel` from 3.47.0 to 3.48.0
- [Release notes](https://github.com/bpmn-io/properties-panel/releases)
- [Changelog](https://github.com/bpmn-io/properties-panel/blob/main/CHANGELOG.md)
- [Commits](bpmn-io/properties-panel@v3.47.0...v3.48.0)

Updates `@tanstack/react-query` from 5.101.2 to 5.101.4
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.4/packages/react-query)

Updates `axios` from 1.18.1 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.1...v1.19.0)

Updates `bpmn-js` from 18.19.0 to 18.22.1
- [Release notes](https://github.com/bpmn-io/bpmn-js/releases)
- [Changelog](https://github.com/bpmn-io/bpmn-js/blob/develop/CHANGELOG.md)
- [Commits](bpmn-io/bpmn-js@v18.19.0...v18.22.1)

Updates `bpmn-js-properties-panel` from 5.60.0 to 5.63.0
- [Release notes](https://github.com/bpmn-io/bpmn-js-properties-panel/releases)
- [Changelog](https://github.com/bpmn-io/bpmn-js-properties-panel/blob/main/CHANGELOG.md)
- [Commits](bpmn-io/bpmn-js-properties-panel@v5.60.0...v5.63.0)

Updates `dmn-js` from 17.8.1 to 17.10.1
- [Release notes](https://github.com/bpmn-io/dmn-js/releases)
- [Changelog](https://github.com/bpmn-io/dmn-js/blob/develop/packages/dmn-js/CHANGELOG.md)
- [Commits](https://github.com/bpmn-io/dmn-js/commits/v17.10.1/packages/dmn-js)

Updates `i18next` from 26.3.4 to 26.3.6
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.3.4...v26.3.6)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `@types/react-dom` from 19.2.3 to 19.2.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-i18next` from 17.0.8 to 17.0.11
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.8...v17.0.11)

Updates `react-router-dom` from 7.18.1 to 7.18.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.2/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.2/packages/react-router-dom)

Updates `@playwright/test` from 1.61.1 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.61.1...v1.62.1)

Updates `@redocly/cli` from 2.37.0 to 2.43.2
- [Release notes](https://github.com/Redocly/redocly-cli/releases)
- [Commits](https://github.com/Redocly/redocly-cli/compare/@redocly/cli@2.37.0...@redocly/cli@2.43.2)

Updates `@storybook/addon-a11y` from 10.4.6 to 10.5.5
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.5.5/code/addons/a11y)

Updates `@storybook/addon-docs` from 10.4.6 to 10.5.5
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.5.5/code/addons/docs)

Updates `@storybook/react-vite` from 10.4.6 to 10.5.5
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.5.5/code/frameworks/react-vite)

Updates `@types/node` from 26.1.0 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.3 to 19.2.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.0.3 to 6.0.5
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react)

Updates `eslint` from 10.6.0 to 10.8.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.6.0...v10.8.0)

Updates `eslint-plugin-storybook` from 10.4.6 to 10.5.5
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.5.5/code/lib/eslint-plugin)

Updates `globals` from 17.7.0 to 17.9.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.7.0...v17.9.0)

Updates `msw` from 2.14.6 to 2.15.0
- [Release notes](https://github.com/mswjs/msw/releases)
- [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md)
- [Commits](mswjs/msw@v2.14.6...v2.15.0)

Updates `openapi3-ts` from 4.6.0 to 4.6.1
- [Release notes](https://github.com/metadevpro/openapi3-ts/releases)
- [Changelog](https://github.com/metadevpro/openapi3-ts/blob/master/Changelog.md)
- [Commits](https://github.com/metadevpro/openapi3-ts/commits)

Updates `orval` from 8.19.0 to 8.23.0
- [Release notes](https://github.com/orval-labs/orval/releases)
- [Commits](orval-labs/orval@v8.19.0...v8.23.0)

Updates `storybook` from 10.4.6 to 10.5.5
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.5.5/code/core)

Updates `typescript-eslint` from 8.62.1 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint)

Updates `vite` from 8.1.3 to 8.2.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite)

---
updated-dependencies:
- dependency-name: "@bpmn-io/form-js"
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@bpmn-io/properties-panel"
  dependency-version: 3.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.101.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: axios
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: bpmn-js
  dependency-version: 18.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: bpmn-js-properties-panel
  dependency-version: 5.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: dmn-js
  dependency-version: 17.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: i18next
  dependency-version: 26.3.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react-i18next
  dependency-version: 17.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react-router-dom
  dependency-version: 7.18.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@redocly/cli"
  dependency-version: 2.43.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@storybook/addon-a11y"
  dependency-version: 10.5.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@storybook/addon-docs"
  dependency-version: 10.5.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@storybook/react-vite"
  dependency-version: 10.5.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: eslint
  dependency-version: 10.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: eslint-plugin-storybook
  dependency-version: 10.5.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: globals
  dependency-version: 17.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: msw
  dependency-version: 2.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: openapi3-ts
  dependency-version: 4.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: orval
  dependency-version: 8.23.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: storybook
  dependency-version: 10.5.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: typescript-eslint
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: vite
  dependency-version: 8.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants