Skip to content

chore(deps): bump the webui-minor-and-patch group across 1 directory with 17 updates - #79

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/webui/webui-minor-and-patch-651ec252a0
Closed

chore(deps): bump the webui-minor-and-patch group across 1 directory with 17 updates#79
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/webui/webui-minor-and-patch-651ec252a0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the webui-minor-and-patch group with 17 updates in the /webui directory:

Package From To
@tanstack/react-query 5.101.4 5.104.2
antd 6.6.1 6.6.6
axios 1.19.0 1.20.0
i18next 26.4.0 26.4.5
marked 18.0.10 18.1.1
react-i18next 17.0.12 17.0.16
react-syntax-highlighter 16.1.1 16.1.2
wouter 3.10.0 3.13.0
@types/node 26.2.0 26.6.5
@typescript-eslint/eslint-plugin 8.67.0 8.71.2
@typescript-eslint/parser 8.67.0 8.71.2
@vitejs/plugin-react 6.1.0 6.1.2
eslint 10.8.1 10.12.0
eslint-plugin-react-refresh 0.5.4 0.5.7
fast-check 4.9.0 4.10.2
globals 17.11.0 17.13.0
vite 8.2.2 8.3.4

Updates @tanstack/react-query from 5.101.4 to 5.104.2

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.104.2
    • @​tanstack/react-query@​5.104.2

@​tanstack/react-query-next-experimental@​5.104.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.104.2

@​tanstack/react-query-persist-client@​5.104.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.104.2
    • @​tanstack/react-query@​5.104.2

@​tanstack/react-query@​5.104.2

Patch Changes

  • Updated dependencies [03e8c39]:
    • @​tanstack/query-core@​5.104.2
Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.2

Patch Changes

  • Updated dependencies [03e8c39]:
    • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.104.1

5.104.0

Minor Changes

Patch Changes

  • Updated dependencies [5279b05]:
    • @​tanstack/query-core@​5.104.0

5.103.3

Patch Changes

  • #11647 1c9693e - fix(codemods): avoid copying unnecessary files from codemods project
  • Updated dependencies []:
    • @​tanstack/query-core@​5.103.3

5.103.2

Patch Changes

  • Updated dependencies [8a28904]:
    • @​tanstack/query-core@​5.103.2

5.103.1

Patch Changes

5.103.0

Patch Changes

... (truncated)

Commits
  • b699b52 ci: Version Packages (#11849)
  • e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
  • df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
  • 833062c chore: replace prettier with oxfmt (#11939)
  • d0cfa6a chore: replace eslint with oxlint (#11938)
  • 0012ec1 docs(react-query): add JSDoc to the properties of the exported interfaces and...
  • b5e8e7b docs(react-query): add JSDoc to the exported classes, methods, and arrow func...
  • 01abab3 docs(*): note that 'throwOnError' makes the hook rethrow the errors of 'mutat...
  • b42166e docs(react-query): add JSDoc to the exported interfaces and type aliases (#11...
  • 205d422 docs(*): add missing JSDoc descriptions and enforce 'jsdoc/require-descriptio...
  • Additional commits viewable in compare view

Updates antd from 6.6.1 to 6.6.6

Release notes

Sourced from antd's releases.

6.6.6

  • Table
    • 🐞 Fix Table selection menu's "Select all data" option missing descendant rows in tree data. #59342 @​QDyanbing
    • 🐞 Fix Table rowSelection onSelect returning undefined for preserved keys when preserveSelectedRowKeys is enabled. #59449 @​Chaoqi31
    • 🐞 Fix Table column.filterDropdownProps.popupRender not working. #59393 @​ramen2020
    • 🐞 Fix Table not scrolling to the first row when scroll is configured only in ConfigProvider. #59394 @​ramen2020
    • 🐞 Fix Table selection column z-index not applying with fixed columns after the v6 logical property migration. #58609 @​leshalv
  • Transfer
    • 🐞 Fix Transfer selectAllLabels falling back to default counts when set to numeric 0. #59487 @​QDyanbing
    • 🐞 Fix controlled Transfer selection remaining checked after one-way removal. #59428 @​yunfeizhu
    • 🐞 Fix Transfer Shift selection affecting filtered-out items and selecting incorrect ranges after search results change. #59348 @​QDyanbing
  • Tree
    • 🐞 Fix Tree.DirectoryTree Shift range selection with numeric keys and defaultExpandAll. #59375 @​QDyanbing
    • 🐞 Fix Tree.DirectoryTree incorrectly selecting nodes with selectable: false or disabled: true during Shift range selection. #59341 @​QDyanbing
  • Carousel
    • 🐞 Fix Carousel reversing vertical slide order in RTL when dotPlacement makes the carousel vertical. #59436 @​Chaoqi31
    • 🤖 Fix Carousel types exposing the ignored verticalSwiping prop. #59366 @​QDyanbing
  • 🐞 Fix numeric 0 content rendering across List, Divider, and Drawer. #59118 #59517 #59437 @​nrps9909 @​Ye-YiChen @​Chaoqi31
  • 🐞 Fix Notification timers not resuming after closing hovered notices. #59435 @​zombieJ
  • 🐞 Fix DatePicker and TimePicker RangePicker not applying ConfigProvider locale.DatePicker. #59356 @​QDyanbing
  • 🐞 Fix TreeSelect and Mentions calling renderEmpty with Select instead of their component names. #59364 @​QDyanbing
  • 🐞 Fix AutoComplete incorrectly inheriting allowClear from ConfigProvider select. #59358 @​QDyanbing
  • 🐞 Fix Upload ignoring linkProps.onClick when clicking a file name link. #59324 @​QDyanbing
  • 🐞 Fix Input.OTP focus landing on the wrong cell after paste. #59479 @​dogledogle
  • 🐞 Fix Typography text editing not working when onClick is provided. #59325 @​QDyanbing
  • 🐞 Fix Alert close button remaining clickable when closable.disabled is true. #59432 @​QDyanbing
  • 🐞 Fix Card ignoring tabProps.defaultActiveKey when selecting the initial tab. #59414 @​QDyanbing
  • 🐞 Fix Breadcrumb dropdown menu links starting with undefined when the parent item has no href or path. #59423 @​QDyanbing
  • 🐞 Fix Avatar falling back to its default size when a larger breakpoint matches without a configured size. #59446 @​QDyanbing
  • 🐞 Fix Badge truncating fractional horizontal offset values. #59314 @​QDyanbing
  • 🐞 Fix Button custom loading icons appearing before the loading delay ends. #59353 @​QDyanbing
  • 🐞 Fix Tour nextButtonProps.onClick and prevButtonProps.onClick not receiving mouse events. #59332 @​QDyanbing
  • 🤖 Fix Form.Item, Rate, and QRCode TypeScript definitions to exclude unsupported props. #59373 #59379 #59408 @​QDyanbing
  • 🤖 Fix Upload custom request types to expose abort handles. #59382 @​QDyanbing
  • 🌐 Add missing DatePicker placeholders and Carousel arrow labels in remaining locales. #59351 @​shoutoutuoadi325
  • 🌐 Improve Romanian (ro_RO) locale translations. #59528 @​vicuts
  • Table
    • 🐞 修复 Table 树形数据使用「全选所有」时漏选子孙行的问题。#59342 @​QDyanbing
    • 🐞 修复 Table 开启 preserveSelectedRowKeys 时 rowSelection 的 onSelect 对已保留 key 返回 undefined 的问题。#59449 @​Chaoqi31
    • 🐞 修复 Table column.filterDropdownProps.popupRender 不生效的问题。#59393 @​ramen2020
    • 🐞 修复 Table 仅在 ConfigProvider 中配置 scroll 时，翻页或筛选后不会滚动到首行的问题。#59394 @​ramen2020
    • 🐞 修复 Table 在 v6 逻辑方向属性迁移后，固定列场景下选择列 z-index 不生效的问题。#58609 @​leshalv
  • Transfer
    • 🐞 修复 Transfer 的 selectAllLabels 设置为数值 0 时回退为默认数量文案的问题。#59487 @​QDyanbing
    • 🐞 修复单向 Transfer 移除条目后，受控选中状态仍保持勾选的问题。#59428 @​yunfeizhu
    • 🐞 修复 Transfer 使用 Shift 连选时选中搜索隐藏项，以及搜索结果变化后连选范围错误的问题。#59348 @​QDyanbing
  • Tree
    • 🐞 修复 Tree.DirectoryTree 使用数字 key 和 defaultExpandAll 时 Shift 范围选择失效的问题。#59375 @​QDyanbing
    • 🐞 修复 Tree.DirectoryTree 按住 Shift 连选时会选中 selectable: false 或 disabled: true 节点的问题。#59341 @​QDyanbing

... (truncated)

Changelog

Sourced from antd's changelog.

6.6.6

2026-10-12

  • Table
    • 🐞 Fix Table selection menu's "Select all data" option missing descendant rows in tree data. #59342 @​QDyanbing
    • 🐞 Fix Table rowSelection onSelect returning undefined for preserved keys when preserveSelectedRowKeys is enabled. #59449 @​Chaoqi31
    • 🐞 Fix Table column.filterDropdownProps.popupRender not working. #59393 @​ramen2020
    • 🐞 Fix Table not scrolling to the first row when scroll is configured only in ConfigProvider. #59394 @​ramen2020
    • 🐞 Fix Table selection column z-index not applying with fixed columns after the v6 logical property migration. #58609 @​leshalv
  • Transfer
    • 🐞 Fix Transfer selectAllLabels falling back to default counts when set to numeric 0. #59487 @​QDyanbing
    • 🐞 Fix controlled Transfer selection remaining checked after one-way removal. #59428 @​yunfeizhu
    • 🐞 Fix Transfer Shift selection affecting filtered-out items and selecting incorrect ranges after search results change. #59348 @​QDyanbing
  • Tree
    • 🐞 Fix Tree.DirectoryTree Shift range selection with numeric keys and defaultExpandAll. #59375 @​QDyanbing
    • 🐞 Fix Tree.DirectoryTree incorrectly selecting nodes with selectable: false or disabled: true during Shift range selection. #59341 @​QDyanbing
  • Carousel
    • 🐞 Fix Carousel reversing vertical slide order in RTL when dotPlacement makes the carousel vertical. #59436 @​Chaoqi31
    • 🤖 Fix Carousel types exposing the ignored verticalSwiping prop. #59366 @​QDyanbing
  • 🐞 Fix numeric 0 content rendering across List, Divider, and Drawer. #59118 #59517 #59437 @​nrps9909 @​Ye-YiChen @​Chaoqi31
  • 🐞 Fix Notification timers not resuming after closing hovered notices. #59435 @​zombieJ
  • 🐞 Fix DatePicker and TimePicker RangePicker not applying ConfigProvider locale.DatePicker. #59356 @​QDyanbing
  • 🐞 Fix TreeSelect and Mentions calling renderEmpty with Select instead of their component names. #59364 @​QDyanbing
  • 🐞 Fix AutoComplete incorrectly inheriting allowClear from ConfigProvider select. #59358 @​QDyanbing
  • 🐞 Fix Upload ignoring linkProps.onClick when clicking a file name link. #59324 @​QDyanbing
  • 🐞 Fix Input.OTP focus landing on the wrong cell after paste. #59479 @​dogledogle
  • 🐞 Fix Typography text editing not working when onClick is provided. #59325 @​QDyanbing
  • 🐞 Fix Alert close button remaining clickable when closable.disabled is true. #59432 @​QDyanbing
  • 🐞 Fix Card ignoring tabProps.defaultActiveKey when selecting the initial tab. #59414 @​QDyanbing
  • 🐞 Fix Breadcrumb dropdown menu links starting with undefined when the parent item has no href or path. #59423 @​QDyanbing
  • 🐞 Fix Avatar falling back to its default size when a larger breakpoint matches without a configured size. #59446 @​QDyanbing
  • 🐞 Fix Badge truncating fractional horizontal offset values. #59314 @​QDyanbing
  • 🐞 Fix Button custom loading icons appearing before the loading delay ends. #59353 @​QDyanbing
  • 🐞 Fix Tour nextButtonProps.onClick and prevButtonProps.onClick not receiving mouse events. #59332 @​QDyanbing
  • 🤖 Fix Form.Item, Rate, and QRCode TypeScript definitions to exclude unsupported props. #59373 #59379 #59408 @​QDyanbing
  • 🤖 Fix Upload custom request types to expose abort handles. #59382 @​QDyanbing
  • 🌐 Add missing DatePicker placeholders and Carousel arrow labels in remaining locales. #59351 @​shoutoutuoadi325
  • 🌐 Improve Romanian (ro_RO) locale translations. #59528 @​vicuts

6.6.5

2026-09-20

... (truncated)

Commits
  • c1a538b docs: changelog for 6.6.6 (#59539)
  • f755d90 fix(Table): include tree descendants when selecting all data (#59342)
  • df35daf fix(Avatar): preserve responsive size at larger breakpoints (#59446)
  • 255cb18 docs: correct Cascader tagRender signature and doc typos (#59523)
  • d069448 docs: fix Descriptions column type and description (#59533)
  • 9a5f4e1 fix(locale): improve ro_RO translations (#59528)
  • 5bc7ff7 chore(deps): update actions/setup-node digest to 949feb2 (#59530)
  • 2b939f4 chore(deps): update actions/download-artifact digest to 9000827 (#59529)
  • e1b172d chore(deps): update dependency @​types/adm-zip to ^0.6.0 (#59531)
  • 4db00b4 chore(deps): update dependency node-notifier to v11 (#59532)
  • Additional commits viewable in compare view

Updates axios from 1.19.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

  • Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
  • Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
  • Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
  • CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

Changelog

Sourced from axios's changelog.

Changelog

Commits
  • 84a9f3b chore(release): prepare release 1.20.0 (#11152)
  • e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
  • d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
  • 2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
  • d19040b fix: harden runtime option handling (#11141)
  • e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
  • d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
  • 2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
  • 76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
  • ba98559 docs: add ScrapingBee sponsor (#11137)
  • Additional commits viewable in compare view

Updates i18next from 26.4.0 to 26.4.5

Release notes

Sourced from i18next's releases.

v26.4.5

  • fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

v26.4.4

  • fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
  • fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

  • perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

v26.4.2

  • fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

v26.4.1

  • fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).
Changelog

Sourced from i18next's changelog.

26.4.5

  • fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

26.4.4

  • fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. See advisory GHSA-5jr9-983r-c8x4, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
  • fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

26.4.3

  • perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

26.4.2

  • fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

26.4.1

  • fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).
Commits

Updates marked from 18.0.10 to 18.1.1

Release notes

Sourced from marked's releases.

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

  • cli: honor an explicitly empty string input (#4113) (ec3a4e5)
  • end blockquote before a lazy line after a heading, hr or html block (#4115) (9e64a6a)
  • keep a backslash in a code span from hiding emphasis (#4117) (6a57018)
  • keep a decoded character reference from forming a new one (#4111) (6bbac0c), closes #38 #112
  • let indented and type 3-5 html blocks interrupt a paragraph (#4124) (eaa1fff)
  • make walkTokens linear by appending values in place (#4121) (627d9ae), closes #4120
  • match pre, script, style and textarea as whole tag names (#4114) (0db74cb)
  • preserve enclosing link state after parsing images (#4123) (cc07bb9)
  • respect tab stops in list continuation indentation (#4119) (4bd2528)

Performance Improvements

  • avoid repeated raw string copies in nested lists (#4082) (7e8754d)

v18.1.0

18.1.0 (2026-10-05)

Bug Fixes

  • avoid cubic backtracking on unicode whitespace in a link destination (#4106) (0d20220)
  • load CLI configs with top-level await (#4100) (c61543e)
  • reject unbalanced parentheses in link destinations (#4107) (3363c99)

Features

  • add linkParenPossible to lexer state to fail fast for link token generation (#4070) (4ee44f7)

v18.0.14

@dependabot
chore(deps): bump the webui-minor-and-patch group across 1 directory …
917b7dc 
…with 17 updates

Bumps the webui-minor-and-patch group with 17 updates in the /webui directory:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.104.2` |
| [antd](https://github.com/ant-design/ant-design) | `6.6.1` | `6.6.6` |
| [axios](https://github.com/axios/axios) | `1.19.0` | `1.20.0` |
| [i18next](https://github.com/i18next/i18next) | `26.4.0` | `26.4.5` |
| [marked](https://github.com/markedjs/marked) | `18.0.10` | `18.1.1` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.12` | `17.0.16` |
| [react-syntax-highlighter](https://github.com/react-syntax-highlighter/react-syntax-highlighter) | `16.1.1` | `16.1.2` |
| [wouter](https://github.com/molefrog/wouter) | `3.10.0` | `3.13.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.5` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.67.0` | `8.71.2` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.67.0` | `8.71.2` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.0` | `6.1.2` |
| [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.12.0` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.4` | `0.5.7` |
| [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.2` |
| [globals](https://github.com/sindresorhus/globals) | `17.11.0` | `17.13.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.4` |



Updates `@tanstack/react-query` from 5.101.4 to 5.104.2
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.2/packages/react-query)

Updates `antd` from 6.6.1 to 6.6.6
- [Release notes](https://github.com/ant-design/ant-design/releases)
- [Changelog](https://github.com/ant-design/ant-design/blob/master/CHANGELOG.en-US.md)
- [Commits](ant-design/ant-design@6.6.1...6.6.6)

Updates `axios` from 1.19.0 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.19.0...v1.20.0)

Updates `i18next` from 26.4.0 to 26.4.5
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.4.0...v26.4.5)

Updates `marked` from 18.0.10 to 18.1.1
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.0.10...v18.1.1)

Updates `react-i18next` from 17.0.12 to 17.0.16
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.12...v17.0.16)

Updates `react-syntax-highlighter` from 16.1.1 to 16.1.2
- [Release notes](https://github.com/react-syntax-highlighter/react-syntax-highlighter/releases)
- [Changelog](https://github.com/react-syntax-highlighter/react-syntax-highlighter/blob/master/CHANGELOG.MD)
- [Commits](react-syntax-highlighter/react-syntax-highlighter@v16.1.1...v16.1.2)

Updates `wouter` from 3.10.0 to 3.13.0
- [Release notes](https://github.com/molefrog/wouter/releases)
- [Commits](https://github.com/molefrog/wouter/commits/v3.13.0)

Updates `@types/node` from 26.2.0 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@typescript-eslint/eslint-plugin` from 8.67.0 to 8.71.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.67.0 to 8.71.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/parser)

Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react)

Updates `eslint` from 10.8.1 to 10.12.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.1...v10.12.0)

Updates `eslint-plugin-react-refresh` from 0.5.4 to 0.5.7
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.5.4...v0.5.7)

Updates `fast-check` from 4.9.0 to 4.10.2
- [Release notes](https://github.com/dubzzz/fast-check/releases)
- [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md)
- [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.2/packages/fast-check)

Updates `globals` from 17.11.0 to 17.13.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.11.0...v17.13.0)

Updates `vite` from 8.2.2 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.104.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: webui-minor-and-patch
- dependency-name: antd
  dependency-version: 6.6.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: webui-minor-and-patch
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: webui-minor-and-patch
- dependency-name: i18next
  dependency-version: 26.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: webui-minor-and-patch
- dependency-name: marked
  dependency-version: 18.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: webui-minor-and-patch
- dependency-name: react-i18next
  dependency-version: 17.0.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: webui-minor-and-patch
- dependency-name: react-syntax-highlighter
  dependency-version: 16.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: webui-minor-and-patch
- dependency-name: wouter
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: webui-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: webui-minor-and-patch
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.71.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: webui-minor-and-patch
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.71.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: webui-minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: webui-minor-and-patch
- dependency-name: eslint
  dependency-version: 10.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: webui-minor-and-patch
- dependency-name: eslint-plugin-react-refresh
  dependency-version: 0.5.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: webui-minor-and-patch
- dependency-name: fast-check
  dependency-version: 4.10.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: webui-minor-and-patch
- dependency-name: globals
  dependency-version: 17.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: webui-minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: webui-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 18, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 25, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/webui/webui-minor-and-patch-651ec252a0 branch October 25, 2026 06:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants