dependabot[bot] opened a new pull request, #65911: URL: https://github.com/apache/airflow/pull/65911
Bumps the 3-2-core-ui-package-updates group with 37 updates in the /airflow-core/src/airflow/ui directory: | Package | From | To | | --- | --- | --- | | [@chakra-ui/react](https://github.com/chakra-ui/chakra-ui/tree/HEAD/packages/react) | `3.34.0` | `3.35.0` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.90.21` | `5.99.2` | | [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.13.21` | `3.13.24` | | [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.10.1` | `12.10.2` | | [axios](https://github.com/axios/axios) | `1.15.0` | `1.15.2` | | [dayjs](https://github.com/iamkun/dayjs) | `1.11.19` | `1.11.20` | | [i18next](https://github.com/i18next/i18next) | `25.8.16` | `25.10.10` | | [i18next-http-backend](https://github.com/i18next/i18next-http-backend) | `3.0.2` | `3.0.5` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.5` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.5` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.71.2` | `7.73.1` | | [react-hotkeys-hook](https://github.com/JohannesKlauss/react-keymap-hook) | `4.6.1` | `4.6.2` | | [react-i18next](https://github.com/i18next/react-i18next) | `15.5.1` | `15.7.4` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.13.1` | `7.14.2` | | [react-syntax-highlighter](https://github.com/react-syntax-highlighter/react-syntax-highlighter) | `15.6.1` | `15.6.6` | | [use-debounce](https://github.com/xnimorz/use-debounce) | `10.1.0` | `10.1.1` | | [zustand](https://github.com/pmndrs/zustand) | `5.0.11` | `5.0.12` | | [@eslint/compat](https://github.com/eslint/rewrite/tree/HEAD/packages/compat) | `1.2.9` | `1.4.1` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.1` | `9.39.4` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.58.2` | `1.59.1` | | [@tanstack/eslint-plugin-query](https://github.com/TanStack/query/tree/HEAD/packages/eslint-plugin-query) | `5.91.4` | `5.99.2` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.10.3` | `24.12.2` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.56.1` | `8.59.0` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.56.1` | `8.59.0` | | [@typescript-eslint/utils](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/utils) | `8.56.1` | `8.59.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `5.1.4` | `5.2.0` | | [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react-swc) | `4.2.3` | `4.3.0` | | [eslint](https://github.com/eslint/eslint) | `9.39.1` | `9.39.4` | | [eslint-plugin-i18next](https://github.com/edvardchen/eslint-plugin-i18next) | `6.1.3` | `6.1.4` | | [eslint-plugin-jsonc](https://github.com/ota-meshi/eslint-plugin-jsonc) | `2.21.0` | `2.21.1` | | [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) | `7.0.1` | `7.1.1` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `20.8.9` | `20.9.0` | | [jsonc-eslint-parser](https://github.com/ota-meshi/jsonc-eslint-parser) | `2.4.1` | `2.4.2` | | [msw](https://github.com/mswjs/msw) | `2.12.10` | `2.13.4` | | [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.8.3` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.56.1` | `8.59.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.5` | `8.0.9` | Updates `@chakra-ui/react` from 3.34.0 to 3.35.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/chakra-ui/chakra-ui/releases";><code>@chakra-ui/react</code>'s releases</a>.</em></p> <blockquote> <h2><code>@chakra-ui/react</code><a href="https://github.com/3";><code>@3</code></a>.35.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://github.com/chakra-ui/chakra-ui/commit/1b1f545aeb753131f4f8c296c9edfade6b09094e";><code>1b1f545</code></a> Thanks <a href="https://github.com/segunadebayo";><code>@segunadebayo</code></a>! - <strong>Pagination</strong>: Allow <code>format</code> prop in <code>Pagination.PageText</code> to accept a function for i18n support.</p> <pre lang="tsx"><code><Pagination.PageText format={({ page, totalPages }) => `Page ${page} de ${totalPages}`} /> </code></pre> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://github.com/chakra-ui/chakra-ui/commit/d041e108d28b77524b302ac6389bee0fb06b6c6f";><code>d041e10</code></a> Thanks <a href="https://github.com/segunadebayo";><code>@segunadebayo</code></a>! - Bump <code>@ark-ui/react</code> to <code>5.36.0</code> (from <code>^5.34.1</code>)</p> <ul> <li><strong>Accordion</strong>: Fix missing <code>data-focus</code> on item trigger props.</li> <li><strong>Carousel</strong>: Fix issue with controlled carousel inside dialog, navigation transformed containers, scroll drift, and page sync with indicators.</li> <li><strong>ColorPicker</strong>: Fix vertical slider orientation on pointer updates.</li> <li><strong>Combobox</strong>: VoiceOver announces highlighted options on Apple devices via a live region</li> <li><strong>Dialog, Popover, HoverCard</strong>: Add support for multiple triggers sharing one dialog instance.</li> <li><strong>Field</strong>: <code>Field.Item</code> and <code>target</code> on <code>Field.Root</code> for multi-control fields (re-exported as <code>FieldItem</code> / <code>Field.Item</code>).</li> <li><strong>FileUpload</strong>: Reject duplicate files with <code>FILE_EXISTS</code>.</li> <li><strong>Listbox</strong>: <code>keyboardPriority</code> for Home/End and arrows; <code>highlightFirst</code>, <code>highlightLast</code>, <code>highlightNext</code>, <code>highlightPrevious</code>.</li> <li><strong>Menu</strong>: <code>aria-expanded</code> when closed; submenu hover “diagonal” flash fix; multiple triggers.</li> <li><strong>PinInput</strong>: Deletion and focus behavior, Home/End, <code>enterKeyHint</code>, <code>autoSubmit</code>, <code>sanitizeValue</code>.</li> <li><strong>Popover</strong>: Add support for <code>translations</code>; <code>finalFocusEl</code> and <code>restoreFocus</code> props.</li> <li><strong>TagsInput</strong>: <code>allowDuplicates</code>; <code>sanitizeValue</code>; <code>enterKeyHint</code> on mobile.</li> </ul> </li> <li> <p><a href="https://github.com/chakra-ui/chakra-ui/commit/3da73c35b6eb4dcef919967d9e654682603dcd89";><code>3da73c3</code></a> Thanks <a href="https://github.com/segunadebayo";><code>@segunadebayo</code></a>! - Export missing <code>datePickerSlotRecipe</code> from slot recipes</p> </li> <li> <p><a href="https://redirect.github.com/chakra-ui/chakra-ui/pull/10721";>#10721</a> <a href="https://github.com/chakra-ui/chakra-ui/commit/d2b7decc32f3c99ebda1492731f7e72c6189f11b";><code>d2b7dec</code></a> Thanks <a href="https://github.com/isBatak";><code>@isBatak</code></a>! - Improve <code>useBreakpoint</code> and <code>useBreakpointValue</code> types with <code>BreakpointName</code></p> </li> <li> <p><a href="https://github.com/chakra-ui/chakra-ui/commit/6bad1b7f67fe6ef5e5421947edd513b9956c51ff";><code>6bad1b7</code></a></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/chakra-ui/chakra-ui/blob/main/packages/react/CHANGELOG.md";><code>@chakra-ui/react</code>'s changelog</a>.</em></p> <blockquote> <h2>3.35.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://github.com/chakra-ui/chakra-ui/commit/1b1f545aeb753131f4f8c296c9edfade6b09094e";><code>1b1f545</code></a> Thanks <a href="https://github.com/segunadebayo";><code>@segunadebayo</code></a>! - <strong>Pagination</strong>: Allow <code>format</code> prop in <code>Pagination.PageText</code> to accept a function for i18n support.</p> <pre lang="tsx"><code><Pagination.PageText format={({ page, totalPages }) => `Page ${page} de ${totalPages}`} /> </code></pre> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://github.com/chakra-ui/chakra-ui/commit/d041e108d28b77524b302ac6389bee0fb06b6c6f";><code>d041e10</code></a> Thanks <a href="https://github.com/segunadebayo";><code>@segunadebayo</code></a>! - Bump <code>@ark-ui/react</code> to <code>5.36.0</code> (from <code>^5.34.1</code>)</p> <ul> <li><strong>Accordion</strong>: Fix missing <code>data-focus</code> on item trigger props.</li> <li><strong>Carousel</strong>: Fix issue with controlled carousel inside dialog, navigation transformed containers, scroll drift, and page sync with indicators.</li> <li><strong>ColorPicker</strong>: Fix vertical slider orientation on pointer updates.</li> <li><strong>Combobox</strong>: VoiceOver announces highlighted options on Apple devices via a live region</li> <li><strong>Dialog, Popover, HoverCard</strong>: Add support for multiple triggers sharing one dialog instance.</li> <li><strong>Field</strong>: <code>Field.Item</code> and <code>target</code> on <code>Field.Root</code> for multi-control fields (re-exported as <code>FieldItem</code> / <code>Field.Item</code>).</li> <li><strong>FileUpload</strong>: Reject duplicate files with <code>FILE_EXISTS</code>.</li> <li><strong>Listbox</strong>: <code>keyboardPriority</code> for Home/End and arrows; <code>highlightFirst</code>, <code>highlightLast</code>, <code>highlightNext</code>, <code>highlightPrevious</code>.</li> <li><strong>Menu</strong>: <code>aria-expanded</code> when closed; submenu hover “diagonal” flash fix; multiple triggers.</li> <li><strong>PinInput</strong>: Deletion and focus behavior, Home/End, <code>enterKeyHint</code>, <code>autoSubmit</code>, <code>sanitizeValue</code>.</li> <li><strong>Popover</strong>: Add support for <code>translations</code>; <code>finalFocusEl</code> and <code>restoreFocus</code> props.</li> <li><strong>TagsInput</strong>: <code>allowDuplicates</code>; <code>sanitizeValue</code>; <code>enterKeyHint</code> on mobile.</li> </ul> </li> <li> <p><a href="https://github.com/chakra-ui/chakra-ui/commit/3da73c35b6eb4dcef919967d9e654682603dcd89";><code>3da73c3</code></a> Thanks <a href="https://github.com/segunadebayo";><code>@segunadebayo</code></a>! - Export missing <code>datePickerSlotRecipe</code> from slot recipes</p> </li> <li> <p><a href="https://redirect.github.com/chakra-ui/chakra-ui/pull/10721";>#10721</a> <a href="https://github.com/chakra-ui/chakra-ui/commit/d2b7decc32f3c99ebda1492731f7e72c6189f11b";><code>d2b7dec</code></a> Thanks <a href="https://github.com/isBatak";><code>@isBatak</code></a>! - Improve <code>useBreakpoint</code> and <code>useBreakpointValue</code> types with <code>BreakpointName</code></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/chakra-ui/chakra-ui/commit/975bd3685ee67f7f206d50d8c73e9f313a8dcd8a";><code>975bd36</code></a> Version Packages (<a href="https://github.com/chakra-ui/chakra-ui/tree/HEAD/packages/react/issues/10677";>#10677</a>)</li> <li><a href="https://github.com/chakra-ui/chakra-ui/commit/4dfd1eeaea9a040d2264cdcb97fcfd458d533f3f";><code>4dfd1ee</code></a> chore: bump ark-ui</li> <li><a href="https://github.com/chakra-ui/chakra-ui/commit/d041e108d28b77524b302ac6389bee0fb06b6c6f";><code>d041e10</code></a> build: use lower ark-ui version for now</li> <li><a href="https://github.com/chakra-ui/chakra-ui/commit/16f8329acccb105f1481dcaf2dabec7b0278206e";><code>16f8329</code></a> fix: reject invalid css unit decimals (<a href="https://github.com/chakra-ui/chakra-ui/tree/HEAD/packages/react/issues/10785";>#10785</a>)</li> <li><a href="https://github.com/chakra-ui/chakra-ui/commit/af36e215b034a0adc97bd62f53c91a4c2331995c";><code>af36e21</code></a> fix: regression and bump ark-ui</li> <li><a href="https://github.com/chakra-ui/chakra-ui/commit/581c7d12f0e18472b55565f43d8c233afdbea113";><code>581c7d1</code></a> fix: correct css prop usage in GridItem component (<a href="https://github.com/chakra-ui/chakra-ui/tree/HEAD/packages/react/issues/10781";>#10781</a>)</li> <li><a href="https://github.com/chakra-ui/chakra-ui/commit/4ea94e7f66d71a22af009c2ecf83ad992ac5aa57";><code>4ea94e7</code></a> fix(deps): update react to v19.2.5 (<a href="https://github.com/chakra-ui/chakra-ui/tree/HEAD/packages/react/issues/10777";>#10777</a>)</li> <li><a href="https://github.com/chakra-ui/chakra-ui/commit/2d630b16871756980a5ecfba71cf0254b4f2e48b";><code>2d630b1</code></a> chore: add pin-input example</li> <li><a href="https://github.com/chakra-ui/chakra-ui/commit/e9f04d4a6dad093852b924883b55e4c257ca0c22";><code>e9f04d4</code></a> fix: backdrop stacking index</li> <li><a href="https://github.com/chakra-ui/chakra-ui/commit/39e3db3eb56ebc37a444a6ae3f1e2a1b95d27605";><code>39e3db3</code></a> fix(tokens): resolve array shorthand for fonts, shadows, gradients, animation...</li> <li>Additional commits viewable in <a href="https://github.com/chakra-ui/chakra-ui/commits/@chakra-ui/[email protected]/packages/react";>compare view</a></li> </ul> </details> <br /> Updates `@tanstack/react-query` from 5.90.21 to 5.99.2 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md";><code>@tanstack/react-query</code>'s changelog</a>.</em></p> <blockquote> <h2>5.99.2</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-core</code><a href="https://github.com/5";><code>@5</code></a>.99.2</li> </ul> </li> </ul> <h2>5.99.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-core</code><a href="https://github.com/5";><code>@5</code></a>.99.1</li> </ul> </li> </ul> <h2>5.99.0</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-core</code><a href="https://github.com/5";><code>@5</code></a>.99.0</li> </ul> </li> </ul> <h2>5.98.0</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-core</code><a href="https://github.com/5";><code>@5</code></a>.98.0</li> </ul> </li> </ul> <h2>5.97.0</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/query/commit/2bfb12cc44f1d8495106136e4ddacb817135f8f9";><code>2bfb12c</code></a>]: <ul> <li><code>@tanstack/query-core</code><a href="https://github.com/5";><code>@5</code></a>.97.0</li> </ul> </li> </ul> <h2>5.96.2</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-core</code><a href="https://github.com/5";><code>@5</code></a>.96.2</li> </ul> </li> </ul> <h2>5.96.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-core</code><a href="https://github.com/5";><code>@5</code></a>.96.1</li> </ul> </li> </ul> <h2>5.96.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/TanStack/query/commit/a3ec7b30cc4c18b2c5aefe608638ecadce732b81";><code>a3ec7b3</code></a> ci: Version Packages (<a href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/10520";>#10520</a>)</li> <li><a href="https://github.com/TanStack/query/commit/69d2757c982f7bd5a483398492fe753f6f574ab8";><code>69d2757</code></a> ci: Version Packages (<a href="https://github.com/TanStack/query/tree/HEAD/packages/react-query/issues/10514";>#10514</a>)</li> <li><a href="https://github.com/TanStack/query/commit/7ffa1ed0b01d8c397c379dbb3d85da80b278b21c";><code>7ffa1ed</code></a> test({react,preact,solid}-query/useQueries): fix test description from 'useQu...</li> <li><a href="https://github.com/TanStack/query/commit/bc83d370e8922f1c3126aea4e7757ce8761a06f2";><code>bc83d37</code></a> test({react,preact}-query/useMutation): unify destructuring pattern in comple...</li> <li><a href="https://github.com/TanStack/query/commit/aad1bd59d8e1ecebf14f556e0d9ca2605b4e4b80";><code>aad1bd5</code></a> test({react,preact}-query/useMutation): add parallel 'mutateAsync' tests with...</li> <li><a href="https://github.com/TanStack/query/commit/d7643b54fda462492d474695cd35e2549cefa5d7";><code>d7643b5</code></a> test({react,preact}-query/useMutation): add optimistic update tests with succ...</li> <li><a href="https://github.com/TanStack/query/commit/cd89d6f706bd143382db5ae3807ed8644ec52afe";><code>cd89d6f</code></a> test({react,preact}-query/useMutation): add conditional handling and retry te...</li> <li><a href="https://github.com/TanStack/query/commit/6e15fe62d2551b5269b21a1522f3c7bd653808ba";><code>6e15fe6</code></a> test({react,preact}-query/useMutation): add chained 'mutateAsync' tests for s...</li> <li><a href="https://github.com/TanStack/query/commit/792d3a5b32ee90b13f44456bb50518d24e9550d5";><code>792d3a5</code></a> test({react,preact}-query/useMutation): add callback tests when 'useMutation'...</li> <li><a href="https://github.com/TanStack/query/commit/1b661b34ec5d1df00b4b0a2c084efbd486e73899";><code>1b661b3</code></a> test({react,preact}-query/useMutation): add single callback tests for 'mutate...</li> <li>Additional commits viewable in <a href="https://github.com/TanStack/query/commits/@tanstack/[email protected]/packages/react-query";>compare view</a></li> </ul> </details> <br /> Updates `@tanstack/react-virtual` from 3.13.21 to 3.13.24 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/TanStack/virtual/releases";><code>@tanstack/react-virtual</code>'s releases</a>.</em></p> <blockquote> <h2><code>@tanstack/react-virtual</code><a href="https://github.com/3";><code>@3</code></a>.13.24</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/virtual/commit/97a204dc5526669114458685552b7569b60d2940";><code>97a204d</code></a>]: <ul> <li><code>@tanstack/virtual-core</code><a href="https://github.com/3";><code>@3</code></a>.14.0</li> </ul> </li> </ul> <h2><code>@tanstack/react-virtual</code><a href="https://github.com/3";><code>@3</code></a>.13.23</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/virtual/commit/7ece2d5d4249b7e703c68ac497ae5545c54e7c67";><code>7ece2d5</code></a>]: <ul> <li><code>@tanstack/virtual-core</code><a href="https://github.com/3";><code>@3</code></a>.13.23</li> </ul> </li> </ul> <h2><code>@tanstack/react-virtual</code><a href="https://github.com/3";><code>@3</code></a>.13.22</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/virtual/commit/54d771a7d4c74f6968e8132b5a85f3e04682376a";><code>54d771a</code></a>, <a href="https://github.com/TanStack/virtual/commit/d3416c386c6446957f413db2eef3211f5fdf3b5f";><code>d3416c3</code></a>]: <ul> <li><code>@tanstack/virtual-core</code><a href="https://github.com/3";><code>@3</code></a>.13.22</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md";><code>@tanstack/react-virtual</code>'s changelog</a>.</em></p> <blockquote> <h2>3.13.24</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/virtual/commit/97a204dc5526669114458685552b7569b60d2940";><code>97a204d</code></a>]: <ul> <li><code>@tanstack/virtual-core</code><a href="https://github.com/3";><code>@3</code></a>.14.0</li> </ul> </li> </ul> <h2>3.13.23</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/virtual/commit/7ece2d5d4249b7e703c68ac497ae5545c54e7c67";><code>7ece2d5</code></a>]: <ul> <li><code>@tanstack/virtual-core</code><a href="https://github.com/3";><code>@3</code></a>.13.23</li> </ul> </li> </ul> <h2>3.13.22</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/virtual/commit/54d771a7d4c74f6968e8132b5a85f3e04682376a";><code>54d771a</code></a>, <a href="https://github.com/TanStack/virtual/commit/d3416c386c6446957f413db2eef3211f5fdf3b5f";><code>d3416c3</code></a>]: <ul> <li><code>@tanstack/virtual-core</code><a href="https://github.com/3";><code>@3</code></a>.13.22</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/TanStack/virtual/commit/c3d4cd4f63d9c314ac6ec0ee7885a93a14ae52f9";><code>c3d4cd4</code></a> ci: Version Packages (<a href="https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual/issues/1157";>#1157</a>)</li> <li><a href="https://github.com/TanStack/virtual/commit/9394e13fdb4b9858057a972ef090e250f754edce";><code>9394e13</code></a> ci: Version Packages (<a href="https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual/issues/1149";>#1149</a>)</li> <li><a href="https://github.com/TanStack/virtual/commit/7ece2d5d4249b7e703c68ac497ae5545c54e7c67";><code>7ece2d5</code></a> fix(virtual-core): remove incorrect elementsCache cleanup using getItemKey (#...</li> <li><a href="https://github.com/TanStack/virtual/commit/c2f1c3979a3170a5995a70eda465618f7339b7a5";><code>c2f1c39</code></a> ci: Version Packages (<a href="https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual/issues/1139";>#1139</a>)</li> <li><a href="https://github.com/TanStack/virtual/commit/fc3c733445381f78dc5895a5512f0bdca5279e90";><code>fc3c733</code></a> perf(virtual-core): skip sync DOM reads during normal scrolling (<a href="https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual/issues/1144";>#1144</a>)</li> <li>See full diff in <a href="https://github.com/TanStack/virtual/commits/@tanstack/[email protected]/packages/react-virtual";>compare view</a></li> </ul> </details> <br /> Updates `@xyflow/react` from 12.10.1 to 12.10.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/xyflow/xyflow/releases";><code>@xyflow/react</code>'s releases</a>.</em></p> <blockquote> <h2><code>@xyflow/react</code><a href="https://github.com/12";><code>@12</code></a>.10.2</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/xyflow/xyflow/pull/5735";>#5735</a> <a href="https://github.com/xyflow/xyflow/commit/a6c938fb2e5ed030512ef75d665ac80dc3a66bc6";><code>a6c938fb2</code></a> Thanks <a href="https://github.com/nvie";><code>@nvie</code></a>! - Allow <code>type</code> field to be missing in <code>BuiltInNode</code> (no <code>type</code> field is the same as <code>type: "default"</code>)</p> </li> <li> <p><a href="https://redirect.github.com/xyflow/xyflow/pull/5722";>#5722</a> <a href="https://github.com/xyflow/xyflow/commit/8c9b7e726e0bb79871c85017dace0f1ccf1b478c";><code>8c9b7e726</code></a> Thanks <a href="https://github.com/dfblhmm";><code>@dfblhmm</code></a>! - Add <code>snapGrid</code> to <code>screenToFlowPosition</code> options</p> </li> <li> <p><a href="https://redirect.github.com/xyflow/xyflow/pull/5723";>#5723</a> <a href="https://github.com/xyflow/xyflow/commit/82249517a3338d7bd0d6d499abecfaa6bca8c339";><code>82249517a</code></a> Thanks <a href="https://github.com/moklick";><code>@moklick</code></a>! - Pass options to useReactFlow/useSvelteFlow viewport helper functions correctly</p> </li> <li> <p><a href="https://redirect.github.com/xyflow/xyflow/pull/5733";>#5733</a> <a href="https://github.com/xyflow/xyflow/commit/64115cd086d2c04235f1cae80acb45455fd0de49";><code>64115cd08</code></a> Thanks <a href="https://github.com/AlaricBaraou";><code>@AlaricBaraou</code></a>! - Fix empty store during ReactFlow remount by reordering StoreUpdater before GraphView and using layout effects</p> </li> <li> <p><a href="https://redirect.github.com/xyflow/xyflow/pull/5727";>#5727</a> <a href="https://github.com/xyflow/xyflow/commit/dd54e86b91da29c1f58f646ad9a99f96f0c4a2e5";><code>dd54e86b9</code></a> Thanks <a href="https://github.com/solastley";><code>@solastley</code></a>! - Ensure visual nodes selection state is cleared when zero selected nodes remain in the flow</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/xyflow/xyflow/commit/4a278dbbf942b2bc964e4159347b70ae6617f3dc";><code>4a278dbbf</code></a>]:</p> <ul> <li><code>@xyflow/system</code><a href="https://github.com/0";><code>@0</code></a>.0.76</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md";><code>@xyflow/react</code>'s changelog</a>.</em></p> <blockquote> <h2>12.10.2</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/xyflow/xyflow/pull/5735";>#5735</a> <a href="https://github.com/xyflow/xyflow/commit/a6c938fb2e5ed030512ef75d665ac80dc3a66bc6";><code>a6c938fb2</code></a> Thanks <a href="https://github.com/nvie";><code>@nvie</code></a>! - Allow <code>type</code> field to be missing in <code>BuiltInNode</code> (no <code>type</code> field is the same as <code>type: "default"</code>)</p> </li> <li> <p><a href="https://redirect.github.com/xyflow/xyflow/pull/5722";>#5722</a> <a href="https://github.com/xyflow/xyflow/commit/8c9b7e726e0bb79871c85017dace0f1ccf1b478c";><code>8c9b7e726</code></a> Thanks <a href="https://github.com/dfblhmm";><code>@dfblhmm</code></a>! - Add <code>snapGrid</code> to <code>screenToFlowPosition</code> options</p> </li> <li> <p><a href="https://redirect.github.com/xyflow/xyflow/pull/5723";>#5723</a> <a href="https://github.com/xyflow/xyflow/commit/82249517a3338d7bd0d6d499abecfaa6bca8c339";><code>82249517a</code></a> Thanks <a href="https://github.com/moklick";><code>@moklick</code></a>! - Pass options to useReactFlow/useSvelteFlow viewport helper functions correctly</p> </li> <li> <p><a href="https://redirect.github.com/xyflow/xyflow/pull/5733";>#5733</a> <a href="https://github.com/xyflow/xyflow/commit/64115cd086d2c04235f1cae80acb45455fd0de49";><code>64115cd08</code></a> Thanks <a href="https://github.com/AlaricBaraou";><code>@AlaricBaraou</code></a>! - Fix empty store during ReactFlow remount by reordering StoreUpdater before GraphView and using layout effects</p> </li> <li> <p><a href="https://redirect.github.com/xyflow/xyflow/pull/5727";>#5727</a> <a href="https://github.com/xyflow/xyflow/commit/dd54e86b91da29c1f58f646ad9a99f96f0c4a2e5";><code>dd54e86b9</code></a> Thanks <a href="https://github.com/solastley";><code>@solastley</code></a>! - Ensure visual nodes selection state is cleared when zero selected nodes remain in the flow</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/xyflow/xyflow/commit/4a278dbbf942b2bc964e4159347b70ae6617f3dc";><code>4a278dbbf</code></a>]:</p> <ul> <li><code>@xyflow/system</code><a href="https://github.com/0";><code>@0</code></a>.0.76</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xyflow/xyflow/commit/ba0a3612fdec69bd3e63046cb25c2b94d30ea672";><code>ba0a361</code></a> chore(packages): bump</li> <li><a href="https://github.com/xyflow/xyflow/commit/613ad309998563c1009397d5312e23f302670554";><code>613ad30</code></a> Merge pull request <a href="https://github.com/xyflow/xyflow/tree/HEAD/packages/react/issues/5733";>#5733</a> from AlaricBaraou/fix/store-reset-timing-on-remount</li> <li><a href="https://github.com/xyflow/xyflow/commit/a6c938fb2e5ed030512ef75d665ac80dc3a66bc6";><code>a6c938f</code></a> Explicitly allow missing <code>type</code> field in BuiltInNode type definition</li> <li><a href="https://github.com/xyflow/xyflow/commit/f2831bdf31ae4cd1c19eaa2bda6617f3d651f88a";><code>f2831bd</code></a> Merge pull request <a href="https://github.com/xyflow/xyflow/tree/HEAD/packages/react/issues/5727";>#5727</a> from unifygtm/clear-nodes-selection-active</li> <li><a href="https://github.com/xyflow/xyflow/commit/0e48d846fa6e10ac7eed48bf19312ead2274f3ae";><code>0e48d84</code></a> Return <code>hasSelectedNodes</code> from <code>adoptUserNodes</code> and use it to update `nodesSe...</li> <li><a href="https://github.com/xyflow/xyflow/commit/6db2bd053ff516a484b5d10efee33bd8957fdcee";><code>6db2bd0</code></a> fix(react): prevent empty store during ReactFlow remount</li> <li><a href="https://github.com/xyflow/xyflow/commit/e7b78d1f53474ffe61585fa6a31c706d03eb1c29";><code>e7b78d1</code></a> Merge pull request <a href="https://github.com/xyflow/xyflow/tree/HEAD/packages/react/issues/5720";>#5720</a> from yarikoptic/enh-codespell</li> <li><a href="https://github.com/xyflow/xyflow/commit/38f4fef52d88951b6978d33fb5a4f5ec1fbeda3a";><code>38f4fef</code></a> Merge pull request <a href="https://github.com/xyflow/xyflow/tree/HEAD/packages/react/issues/5722";>#5722</a> from dfblhmm/fix/type-definition</li> <li><a href="https://github.com/xyflow/xyflow/commit/759042d108b34317a12c94e2bb51c8ea4b3422e6";><code>759042d</code></a> Fix spacing in store/index.ts</li> <li><a href="https://github.com/xyflow/xyflow/commit/52d452b08ed92a39875afd4ab3eb79fed77ea2ea";><code>52d452b</code></a> Centralize nodesSelectionActive update in setNodes of store</li> <li>Additional commits viewable in <a href="https://github.com/xyflow/xyflow/commits/@xyflow/[email protected]/packages/react";>compare view</a></li> </ul> </details> <br /> Updates `axios` from 1.15.0 to 1.15.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases";>axios's releases</a>.</em></p> <blockquote> <h2>v1.15.2</h2> <p>This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in <code>allowedSocketPaths</code> allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Prototype Pollution Hardening (HTTP Adapter):</strong> Hardened the Node HTTP adapter and <code>resolveConfig</code>/<code>mergeConfig</code>/validator paths to read only own properties and use null-prototype config objects, preventing polluted <code>auth</code>, <code>baseURL</code>, <code>socketPath</code>, <code>beforeRedirect</code>, and <code>insecureHTTPParser</code> from influencing requests. (<strong><a href="https://redirect.github.com/axios/axios/issues/10779";>#10779</a></strong>)</li> <li><strong>SSRF via <code>socketPath</code>:</strong> Rejects non-string <code>socketPath</code> values and adds an opt-in <code>allowedSocketPaths</code> config option to restrict permitted Unix domain socket paths, returning <code>AxiosError</code> <code>ERR_BAD_OPTION_VALUE</code> on mismatch. (<strong><a href="https://redirect.github.com/axios/axios/issues/10777";>#10777</a></strong>)</li> <li><strong>Supply-chain Hardening:</strong> Added <code>.npmrc</code> with <code>ignore-scripts=true</code>, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded <code>SECURITY.md</code>/<code>THREATMODEL.md</code> with provenance verification (<code>npm audit signatures</code>), 60-day resolution policy, and maintainer incident-response runbook. (<strong><a href="https://redirect.github.com/axios/axios/issues/10776";>#10776</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong><code>allowedSocketPaths</code> Config Option:</strong> New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (<strong><a href="https://redirect.github.com/axios/axios/issues/10777";>#10777</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Keep-alive Socket Memory Leak:</strong> Installs a single per-socket <code>error</code> listener tracking the active request via <code>kAxiosSocketListener</code>/<code>kAxiosCurrentReq</code>, eliminating per-request listener accumulation, <code>MaxListenersExceededWarning</code>, and linear heap growth under concurrent or long-running keep-alive workloads (fixes <a href="https://redirect.github.com/axios/axios/issues/10780";>#10780</a>). (<strong><a href="https://redirect.github.com/axios/axios/issues/10788";>#10788</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Changelog:</strong> Updated <code>CHANGELOG.md</code> with v1.15.1 release notes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10781";>#10781</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.15.1...v1.15.2";>Full Changelog</a></p> <h2>v1.15.1</h2> <p>This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Header Injection Hardening:</strong> Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (<strong><a href="https://redirect.github.com/axios/axios/issues/10749";>#10749</a></strong>)</li> <li><strong>CRLF Stripping in Multipart Headers:</strong> Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (<strong><a href="https://redirect.github.com/axios/axios/issues/10758";>#10758</a></strong>)</li> <li><strong>Prototype Pollution / Auth Bypass:</strong> Replaced unsafe <code>in</code> checks with <code>hasOwnProperty</code> to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (<strong><a href="https://redirect.github.com/axios/axios/issues/10761";>#10761</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10760";>#10760</a></strong>)</li> <li><strong><code>withXSRFToken</code> Truthy Bypass:</strong> Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10762";>#10762</a></strong>)</li> <li><strong><code>maxBodyLength</code> With Zero Redirects:</strong> Enforces <code>maxBodyLength</code> even when <code>maxRedirects</code> is set to <code>0</code>, closing a bypass path for oversized request bodies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10753";>#10753</a></strong>)</li> <li><strong>Streamed Response <code>maxContentLength</code> Bypass:</strong> Applies <code>maxContentLength</code> to streamed responses that previously bypassed the cap. (<strong><a href="https://redirect.github.com/axios/axios/issues/10754";>#10754</a></strong>)</li> <li><strong>Follow-up CVE Completion:</strong> Completes an earlier incomplete CVE fix to fully close the regression window. (<strong><a href="https://redirect.github.com/axios/axios/issues/10755";>#10755</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>AI-Based Docs Translations:</strong> Initial scaffold for AI-assisted translations of the documentation site. (<strong><a href="https://redirect.github.com/axios/axios/issues/10705";>#10705</a></strong>)</li> <li><strong><code>Location</code> Request Header Type:</strong> Adds <code>Location</code> to <code>CommonRequestHeadersList</code> for accurate typing of redirect-aware requests. (<strong><a href="https://redirect.github.com/axios/axios/issues/7528";>#7528</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>FormData Handling:</strong> Removes <code>Content-Type</code> when no boundary is present on <code>FormData</code> fetch requests, supports multi-select fields, cancels <code>request.body</code> instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (<strong><a href="https://redirect.github.com/axios/axios/issues/7314";>#7314</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10676";>#10676</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10702";>#10702</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10726";>#10726</a></strong>)</li> <li><strong>HTTP Adapter:</strong> Handles socket-only request errors without leaking keep-alive listeners. (<strong><a href="https://redirect.github.com/axios/axios/issues/10576";>#10576</a></strong>)</li> <li><strong>Progress Events:</strong> Clamps <code>loaded</code> to <code>total</code> for computable upload/download progress events. (<strong><a href="https://redirect.github.com/axios/axios/issues/7458";>#7458</a></strong>)</li> <li><strong>Types:</strong> Aligns <code>runWhen</code> type with the runtime behaviour in <code>InterceptorManager</code> and makes response header keys case-insensitive. (<strong><a href="https://redirect.github.com/axios/axios/issues/7529";>#7529</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10677";>#10677</a></strong>)</li> <li><strong><code>buildFullPath</code>:</strong> Uses strict equality in the base/relative URL check. (<strong><a href="https://redirect.github.com/axios/axios/issues/7252";>#7252</a></strong>)</li> <li><strong><code>AxiosURLSearchParams</code> Regex:</strong> Improves the regex used for param serialisation to avoid edge-case mismatches. (<strong><a href="https://redirect.github.com/axios/axios/issues/10736";>#10736</a></strong>)</li> <li><strong>Resilient Value Parsing:</strong> Parses out header/config values instead of throwing on malformed input. (<strong><a href="https://redirect.github.com/axios/axios/issues/10687";>#10687</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md";>axios's changelog</a>.</em></p> <blockquote> <h2>v1.15.2 - April 21, 2026</h2> <p>This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in <code>allowedSocketPaths</code> allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Prototype Pollution Hardening (HTTP Adapter):</strong> Hardened the Node HTTP adapter and <code>resolveConfig</code>/<code>mergeConfig</code>/validator paths to read only own properties and use null-prototype config objects, preventing polluted <code>auth</code>, <code>baseURL</code>, <code>socketPath</code>, <code>beforeRedirect</code>, and <code>insecureHTTPParser</code> from influencing requests. (<strong><a href="https://redirect.github.com/axios/axios/issues/10779";>#10779</a></strong>)</li> <li><strong>SSRF via <code>socketPath</code>:</strong> Rejects non-string <code>socketPath</code> values and adds an opt-in <code>allowedSocketPaths</code> config option to restrict permitted Unix domain socket paths, returning <code>AxiosError</code> <code>ERR_BAD_OPTION_VALUE</code> on mismatch. (<strong><a href="https://redirect.github.com/axios/axios/issues/10777";>#10777</a></strong>)</li> <li><strong>Supply-chain Hardening:</strong> Added <code>.npmrc</code> with <code>ignore-scripts=true</code>, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded <code>SECURITY.md</code>/<code>THREATMODEL.md</code> with provenance verification (<code>npm audit signatures</code>), 60-day resolution policy, and maintainer incident-response runbook. (<strong><a href="https://redirect.github.com/axios/axios/issues/10776";>#10776</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong><code>allowedSocketPaths</code> Config Option:</strong> New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (<strong><a href="https://redirect.github.com/axios/axios/issues/10777";>#10777</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Keep-alive Socket Memory Leak:</strong> Installs a single per-socket <code>error</code> listener tracking the active request via <code>kAxiosSocketListener</code>/<code>kAxiosCurrentReq</code>, eliminating per-request listener accumulation, <code>MaxListenersExceededWarning</code>, and linear heap growth under concurrent or long-running keep-alive workloads (fixes <a href="https://redirect.github.com/axios/axios/issues/10780";>#10780</a>). (<strong><a href="https://redirect.github.com/axios/axios/issues/10788";>#10788</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Changelog:</strong> Updated <code>CHANGELOG.md</code> with v1.15.1 release notes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10781";>#10781</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.15.1...v1.15.2";>Full Changelog</a></p> <hr /> <h2>v1.15.1 - April 19, 2026</h2> <p>This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Header Injection Hardening:</strong> Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (<strong><a href="https://redirect.github.com/axios/axios/issues/10749";>#10749</a></strong>)</p> </li> <li> <p><strong>CRLF Stripping in Multipart Headers:</strong> Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (<strong><a href="https://redirect.github.com/axios/axios/issues/10758";>#10758</a></strong>)</p> </li> <li> <p><strong>Prototype Pollution / Auth Bypass:</strong> Replaced unsafe <code>in</code> checks with <code>hasOwnProperty</code> to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (<strong><a href="https://redirect.github.com/axios/axios/issues/10761";>#10761</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10760";>#10760</a></strong>)</p> </li> <li> <p><strong><code>withXSRFToken</code> Truthy Bypass:</strong> Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10762";>#10762</a></strong>)</p> </li> <li> <p><strong><code>maxBodyLength</code> With Zero Redirects:</strong> Enforces <code>maxBodyLength</code> even when <code>maxRedirects</code> is set to <code>0</code>, closing a bypass path for oversized request bodies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10753";>#10753</a></strong>)</p> </li> <li> <p><strong>Streamed Response <code>maxContentLength</code> Bypass:</strong> Applies <code>maxContentLength</code> to streamed responses that previously bypassed the cap. (<strong><a href="https://redirect.github.com/axios/axios/issues/10754";>#10754</a></strong>)</p> </li> <li> <p><strong>Follow-up CVE Completion:</strong> Completes an earlier incomplete CVE fix to fully close the regression window. (<strong><a href="https://redirect.github.com/axios/axios/issues/10755";>#10755</a></strong>)</p> </li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>AI-Based Docs Translations:</strong> Initial scaffold for AI-assisted translations of the documentation site. (<strong><a href="https://redirect.github.com/axios/axios/issues/10705";>#10705</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/582934382e4e0e0bcb679c628071a4203e93cf57";><code>5829343</code></a> chore(release): prepare release 1.15.2 (<a href="https://redirect.github.com/axios/axios/issues/10789";>#10789</a>)</li> <li><a href="https://github.com/axios/axios/commit/4709a48fa2717ba97f43f5432d48ca4e26c2d326";><code>4709a48</code></a> fix: added fix for memory leak in sockets (<a href="https://redirect.github.com/axios/axios/issues/10788";>#10788</a>)</li> <li><a href="https://github.com/axios/axios/commit/be3336014e01f9a4fc1f8aef15303cf7daaf58db";><code>be33360</code></a> chore: update changelog (<a href="https://redirect.github.com/axios/axios/issues/10781";>#10781</a>)</li> <li><a href="https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa";><code>4791514</code></a> fix: more header pollutions (<a href="https://redirect.github.com/axios/axios/issues/10779";>#10779</a>)</li> <li><a href="https://github.com/axios/axios/commit/6feafcff6c2dbafe206161c5d09e38e1d36af66f";><code>6feafcf</code></a> fix: socket issue (<a href="https://redirect.github.com/axios/axios/issues/10777";>#10777</a>)</li> <li><a href="https://github.com/axios/axios/commit/302e2739c602f00e323d4f3f5c79500647633a73";><code>302e273</code></a> docs: update docs, add a couple actions etc (<a href="https://redirect.github.com/axios/axios/issues/10776";>#10776</a>)</li> <li><a href="https://github.com/axios/axios/commit/ac42446be51300fe214ba3c6e40cc95f34fd6871";><code>ac42446</code></a> chore(release): prepare release 1.15.1 (<a href="https://redirect.github.com/axios/axios/issues/10767";>#10767</a>)</li> <li><a href="https://github.com/axios/axios/commit/908f2206b6bfeff67236784abce85935698ac1d9";><code>908f220</code></a> docs: update threatmodel (<a href="https://redirect.github.com/axios/axios/issues/10765";>#10765</a>)</li> <li><a href="https://github.com/axios/axios/commit/f93f8155250c2e066205521eda05ae22983a1f6d";><code>f93f815</code></a> docs: added docs around potential decompressions bomb (<a href="https://redirect.github.com/axios/axios/issues/10763";>#10763</a>)</li> <li><a href="https://github.com/axios/axios/commit/1728aa1b15b8857f970611fd8983c06b423fc486";><code>1728aa1</code></a> fix: short-circuits on any truthy non-boolean in withXSRFToken (<a href="https://redirect.github.com/axios/axios/issues/10762";>#10762</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.15.0...v1.15.2";>compare view</a></li> </ul> </details> <br /> Updates `dayjs` from 1.11.19 to 1.11.20 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/iamkun/dayjs/releases";>dayjs's releases</a>.</em></p> <blockquote> <h2>v1.11.20</h2> <h2><a href="https://github.com/iamkun/dayjs/compare/v1.11.19...v1.11.20";>1.11.20</a> (2026-03-12)</h2> <h3>Bug Fixes</h3> <ul> <li>Update locale km.js to support meridiem (<a href="https://redirect.github.com/iamkun/dayjs/issues/3017";>#3017</a>) (<a href="https://github.com/iamkun/dayjs/commit/9d2b6a1ec744ad5db13afd4d701f93349135dfec";>9d2b6a1</a>)</li> <li>update updateLocale plugin to merge nested object properties instead of replacing (<a href="https://redirect.github.com/iamkun/dayjs/issues/3012";>#3012</a>) (<a href="https://github.com/iamkun/dayjs/commit/99691c5f3bd1371d3b763d5f9dfaed9a1945a477";>99691c5</a>), closes <a href="https://redirect.github.com/iamkun/dayjs/issues/1118";>#1118</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/iamkun/dayjs/blob/dev/CHANGELOG.md";>dayjs's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/iamkun/dayjs/compare/v1.11.19...v1.11.20";>1.11.20</a> (2026-03-12)</h2> <h3>Bug Fixes</h3> <ul> <li>Update locale km.js to support meridiem (<a href="https://redirect.github.com/iamkun/dayjs/issues/3017";>#3017</a>) (<a href="https://github.com/iamkun/dayjs/commit/9d2b6a1ec744ad5db13afd4d701f93349135dfec";>9d2b6a1</a>)</li> <li>update updateLocale plugin to merge nested object properties instead of replacing (<a href="https://redirect.github.com/iamkun/dayjs/issues/3012";>#3012</a>) (<a href="https://github.com/iamkun/dayjs/commit/99691c5f3bd1371d3b763d5f9dfaed9a1945a477";>99691c5</a>), closes <a href="https://redirect.github.com/iamkun/dayjs/issues/1118";>#1118</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/iamkun/dayjs/commit/af6e1f85c10fa8596e79471eadad25ab2da56f0f";><code>af6e1f8</code></a> chore(release): 1.11.20 [skip ci]</li> <li><a href="https://github.com/iamkun/dayjs/commit/82babd6688d7238fe1585895816fb2e8e0817c7d";><code>82babd6</code></a> D2M (<a href="https://redirect.github.com/iamkun/dayjs/issues/3018";>#3018</a>)</li> <li><a href="https://github.com/iamkun/dayjs/commit/bbe4ab1bdb1042667817de2433fc85e6b12eadad";><code>bbe4ab1</code></a> chore: fix lint error</li> <li><a href="https://github.com/iamkun/dayjs/commit/99691c5f3bd1371d3b763d5f9dfaed9a1945a477";><code>99691c5</code></a> fix: update updateLocale plugin to merge nested object properties instead of ...</li> <li><a href="https://github.com/iamkun/dayjs/commit/9d2b6a1ec744ad5db13afd4d701f93349135dfec";><code>9d2b6a1</code></a> fix: Update locale km.js to support meridiem (<a href="https://redirect.github.com/iamkun/dayjs/issues/3017";>#3017</a>)</li> <li><a href="https://github.com/iamkun/dayjs/commit/acf21cd152fcf0851162cba92b56fb4281673b1a";><code>acf21cd</code></a> chore: update doc</li> <li><a href="https://github.com/iamkun/dayjs/commit/55a64e195a7354b3222241e6a64085c706cc157e";><code>55a64e1</code></a> chore: update doc</li> <li><a href="https://github.com/iamkun/dayjs/commit/807face1fef65eee9955fa587888cf31c5a0d3c0";><code>807face</code></a> chore: update doc</li> <li><a href="https://github.com/iamkun/dayjs/commit/54f447048cee679e51a7053f8042d9b6b7028b89";><code>54f4470</code></a> chore: update doc</li> <li><a href="https://github.com/iamkun/dayjs/commit/9ea23c71a125dbb34025cb9f6114d1083ea62705";><code>9ea23c7</code></a> chore: update doc</li> <li>Additional commits viewable in <a href="https://github.com/iamkun/dayjs/compare/v1.11.19...v1.11.20";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for dayjs since your current version.</p> </details> <br /> Updates `i18next` from 25.8.16 to 25.10.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/i18next/i18next/releases";>i18next's releases</a>.</em></p> <blockquote> <h2>v25.10.10</h2> <ul> <li>feat: suppress support notice automatically in production environments (<code>NODE_ENV=production</code>)</li> </ul> <h2>v25.10.9</h2> <ul> <li>feat(types): export <code>SelectorParam<Ns, KPrefix></code> helper type — a stable, readable alternative to <code>Parameters<TFunction<Ns>>[0]</code> for typing selector function props <a href="https://redirect.github.com/i18next/i18next/issues/2414";>2414</a></li> </ul> <h2>v25.10.8</h2> <ul> <li>fix(types): reorder <code>TFunctionSelector</code> overloads so <code>Parameters<TFunction></code> resolves to the general selector signature instead of the branded <code>SelectorKey</code> type <a href="https://redirect.github.com/i18next/i18next/issues/2412";>2412</a></li> </ul> <h2>v25.10.7</h2> <ul> <li>feat(types): support typescript 6 to address <a href="https://redirect.github.com/i18next/react-i18next/issues/1910";>i18next/react-i18next#1910</a></li> </ul> <h2>v25.10.6</h2> <ul> <li>feat(types): support typescript 6 to address <a href="https://redirect.github.com/i18next/react-i18next/issues/1910";>i18next/react-i18next#1910</a></li> </ul> <h2>v25.10.5</h2> <ul> <li>feat(types): selector functions as <code>keyPrefix</code> in <code>getFixedT</code> now provide full type-safe key narrowing — the returned <code>t</code> function is scoped to the prefix subtree <a href="https://redirect.github.com/i18next/i18next/issues/2367";>2367</a></li> </ul> <h2>v25.10.4</h2> <ul> <li>feat(types): i18nKey of <code><Trans i18nKey={sk} /></code> to accept a <code>SelectorKey</code> <a href="https://redirect.github.com/i18next/i18next/issues/2364";>2364</a></li> </ul> <h2>v25.10.3</h2> <ul> <li>check also for I18NEXT_NO_SUPPORT_NOTICE env variable</li> </ul> <h2>v25.10.2</h2> <ul> <li>feat(types): <code>keyFromSelector</code> is now type-safe — the selector callback is constrained against your resource definitions, catching invalid keys at compile time. Supports optional <code>ns</code> and <code>keyPrefix</code> options for non-default namespace/prefix contexts <a href="https://redirect.github.com/i18next/i18next/issues/2364";>2364</a></li> </ul> <h2>v25.10.1</h2> <ul> <li>fix(types): <code>FilterKeys</code> now correctly excludes base keys that have context variants when the provided context doesn't match any of them (e.g. key <code>some</code> with variant <code>some_me</code> is no longer accessible with <code>context="one"</code>)</li> </ul> <h2>v25.10.0</h2> <ul> <li>feat(types): <code>keyFromSelector</code> now returns a branded <code>SelectorKey</code> type that <code>t()</code> accepts directly, enabling pre-computed and reusable translation keys <a href="https://redirect.github.com/i18next/i18next/issues/2364";>2364</a></li> <li>feat: support selector syntax for <code>keyPrefix</code> in <code>getFixedT</code> and per-call options <a href="https://redirect.github.com/i18next/i18next/issues/2367";>2367</a></li> <li>feat(types): interpolation values are now automatically typed based on built-in format specifiers — <code>{{val, number}}</code> requires <code>number</code>, <code>{{val, datetime}}</code> requires <code>Date</code>, <code>{{name}}</code> requires <code>string</code>, etc. Custom formatters can be typed via <code>interpolationFormatTypeMap</code> in <code>CustomTypeOptions</code> <a href="https://redirect.github.com/i18next/i18next/issues/2378";>2378</a></li> <li>fix(types): <code>FilterKeys</code> in selector mode now preserves non-context, non-plural leaf keys when <code>context</code> is provided, fixing incorrect type narrowing when combining <code>returnObjects: true</code> with <code>context</code> <a href="https://redirect.github.com/i18next/i18next/issues/2398";>2398</a></li> </ul> <h2>v25.9.0</h2> <ul> <li>feat(types): selector API now enforces <code>{ count: number }</code> when a key resolves to plural forms <a href="https://redirect.github.com/i18next/i18next/issues/2373";>2373</a></li> <li>fix(types): string unions with invalid members are now correctly detected as type errors when used as context option <a href="https://redirect.github.com/i18next/i18next/issues/2172";>2172</a></li> </ul> <h2>v25.8.20</h2> <ul> <li> <ul> <li>fix: <code>getFixedT()</code> selector now resolves namespaces against the effective <code>ns</code> rather than the global init options <a href="https://redirect.github.com/i18next/i18next/issues/2406";>#2406</a></li> </ul> </li> </ul> <h2>v25.8.19</h2> <ul> <li>fix: selector API namespace resolution regression for single-string <code>ns</code> and primary namespace in array <a href="https://redirect.github.com/i18next/i18next/issues/2405";>#2405</a>. Reverts the broad namespace-prefix rewrite from v25.8.15 and replaces it with a targeted fix that only rewrites paths starting with a secondary namespace in a multi-namespace array, matching the type-level contract of <code>GetSource</code></li> </ul> <h2>v25.8.18</h2> <ul> <li>improve selector api to accept array of selector functions, analogous to array of keys <a href="https://redirect.github.com/i18next/i18next/issues/2404";>2404</a></li> </ul> <h2>v25.8.17</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md";>i18next's changelog</a>.</em></p> <blockquote> <h2>25.10.10</h2> <ul> <li>feat: suppress support notice automatically in production environments (<code>NODE_ENV=production</code>)</li> </ul> <h2>25.10.9</h2> <ul> <li>feat(types): export <code>SelectorParam<Ns, KPrefix></code> helper type — a stable, readable alternative to <code>Parameters<TFunction<Ns>>[0]</code> for typing selector function props <a href="https://redirect.github.com/i18next/i18next/issues/2414";>2414</a></li> </ul> <h2>25.10.8</h2> <ul> <li>fix(types): reorder <code>TFunctionSelector</code> overloads so <code>Parameters<TFunction></code> resolves to the general selector signature instead of the branded <code>SelectorKey</code> type <a href="https://redirect.github.com/i18next/i18next/issues/2412";>2412</a></li> </ul> <h2>25.10.7</h2> <ul> <li>feat(types): support typescript 6 to address <a href="https://redirect.github.com/i18next/react-i18next/issues/1910";>i18next/react-i18next#1910</a></li> </ul> <h2>25.10.5</h2> <ul> <li>feat(types): selector functions as <code>keyPrefix</code> in <code>getFixedT</code> now provide full type-safe key narrowing — the returned <code>t</code> function is scoped to the prefix subtree <a href="https://redirect.github.com/i18next/i18next/issues/2367";>2367</a></li> </ul> <h2>25.10.4</h2> <ul> <li>feat(types): <code>exists()</code> is now a type guard that narrows the key to <code>SelectorKey</code>, so a validated key can be passed directly to <code>t()</code> <a href="https://redirect.github.com/i18next/i18next/issues/2364";>2364</a></li> </ul> <h2>25.10.3</h2> <ul> <li>check also for I18NEXT_NO_SUPPORT_NOTICE env variable</li> </ul> <h2>25.10.2</h2> <ul> <li>feat(types): <code>keyFromSelector</code> is now type-safe — the selector callback is constrained against your resource definitions, catching invalid keys at compile time. Supports optional <code>ns</code> and <code>keyPrefix</code> options for non-default namespace/prefix contexts <a href="https://redirect.github.com/i18next/i18next/issues/2364";>2364</a></li> </ul> <h2>25.10.1</h2> <ul> <li>fix(types): <code>FilterKeys</code> now correctly excludes base keys that have context variants when the provided context doesn't match any of them (e.g. key <code>some</code> with variant <code>some_me</code> is no longer accessible with <code>context="one"</code>)</li> </ul> <h2>25.10.0</h2> <ul> <li>feat(types): <code>keyFromSelector</code> now returns a branded <code>SelectorKey</code> type that <code>t()</code> accepts directly, enabling pre-computed and reusable translation keys <a href="https://redirect.github.com/i18next/i18next/issues/2364";>2364</a></li> <li>feat: support selector syntax for <code>keyPrefix</code> in <code>getFixedT</code> and per-call options <a href="https://redirect.github.com/i18next/i18next/issues/2367";>2367</a></li> <li>feat(types): interpolation values are now automatically typed based on built-in format specifiers — <code>{{val, number}}</code> requires <code>number</code>, <code>{{val, datetime}}</code> requires <code>Date</code>, <code>{{name}}</code> requires <code>string</code>, etc. Custom formatters can be typed via <code>interpolationFormatTypeMap</code> in <code>CustomTypeOptions</code> <a href="https://redirect.github.com/i18next/i18next/issues/2378";>2378</a></li> <li>fix(types): <code>FilterKeys</code> in selector mode now preserves non-context, non-plural leaf keys when <code>context</code> is provided, fixing incorrect type narrowing when combining <code>returnObjects: true</code> with <code>context</code> <a href="https://redirect.github.com/i18next/i18next/issues/2398";>2398</a></li> </ul> <h2>25.9.0</h2> <ul> <li>feat(types): selector API now enforces <code>{ count: number }</code> when a key resolves to plural forms <a href="https://redirect.github.com/i18next/i18next/issues/2373";>2373</a></li> <li>fix(types): string unions with invalid members are now correctly detected as type errors when used as context option <a href="https://redirect.github.com/i18next/i18next/issues/2172";>2172</a></li> </ul> <h2>25.8.20</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/i18next/i18next/commit/e0fa8382de3b64100a594a2c27124ea9fa48814b";><code>e0fa838</code></a> 25.10.10</li> <li><a href="https://github.com/i18next/i18next/commit/796fdd96c99967fcecdca21ceabd61aee7b3cc21";><code>796fdd9</code></a> feat: suppress support notice automatically in production environments (`NODE...</li> <li><a href="https://github.com/i18next/i18next/commit/07f585f351a564249c8f83dfd168037cd1d4cf69";><code>07f585f</code></a> changelog</li> <li><a href="https://github.com/i18next/i18next/commit/1ba99513b2ac4f7a3e2d97cefd3716230db93032";><code>1ba9951</code></a> jsr update</li> <li><a href="https://github.com/i18next/i18next/commit/8ea74a97948892400736ee2330d9e6f7224117ad";><code>8ea74a9</code></a> 25.10.9</li> <li><a href="https://github.com/i18next/i18next/commit/74220cce3ff03ca659748dbb00cf72b389bbcbc3";><code>74220cc</code></a> lint fix</li> <li><a href="https://github.com/i18next/i18next/commit/c972af2cd0702c7c5dcc71d8afd9c6b1a68ee1d5";><code>c972af2</code></a> feat(types): export <code>SelectorParam\<Ns, KPrefix></code> helper type — a stable, read...</li> <li><a href="https://github.com/i18next/i18next/commit/2b5313d855a5a77b4eeaa12764e3aa7bbf4f4b3e";><code>2b5313d</code></a> jsr update</li> <li><a href="https://github.com/i18next/i18next/commit/c11655ffb2026c7d8f8904e6ea34c161b209e68f";><code>c11655f</code></a> 25.10.8</li> <li><a href="https://github.com/i18next/i18next/commit/5bb5665ac4486dcf814e32b5ad85c6bc19b36c69";><code>5bb5665</code></a> fix(types): reorder <code>TFunctionSelector</code> overloads so <code>Parameters\<TFunction></code> ...</li> <li>Additional commits viewable in <a href="https://github.com/i18next/i18next/compare/v25.8.16...v25.10.10";>compare view</a></li> </ul> </details> <br /> Updates `i18next-http-backend` from 3.0.2 to 3.0.5 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/i18next/i18next-http-backend/blob/master/CHANGELOG.md";>i18next-http-backend's changelog</a>.</em></p> <blockquote> <h3>3.0.5</h3> <p>Security release — all issues found via an internal audit. See published advisory <a href="https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g";>GHSA-q89c-q3h5-w34g</a>.</p> <ul> <li>security: refuse to build request URLs when <code>lng</code> or <code>ns</code> values contain path-traversal, URL-structure (<code>?</code>, <code>#</code>, <code>%</code>, <code>@</code>, whitespace), path separators, control characters, prototype keys, or exceed 128 chars. Prevents path traversal / SSRF / URL injection via attacker-controlled language-code values. <code>isSafeUrlSegment</code> is permissive for legitimate i18next language codes (any BCP-47-like shape, underscores, hyphens, dots, <code>+</code>-joined multi-language requests) (<a href="https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g";>GHSA-q89c-q3h5-w34g</a>)</li> <li>security: per-instance <code>omitFetchOptions</code> — the fetch-options-stripping fallback is now scoped to a single backend instance via <code>options._omitFetchOptions</code> instead of a module-level boolean. One instance hitting a "not implemented" fetch error no longer permanently strips <code>requestOptions</code> (including <code>credentials</code>, <code>mode</code>, <code>cache</code>) from every other backend instance in the same process</li> <li>security: strip CR/LF/NUL and other C0/C1 control characters from <code>lng</code>/<code>ns</code> / URL values before they appear in error-callback strings (CWE-117 log forging)</li> <li>security: redact <code>user:password</code> credentials from URLs before including them in error-callback strings — prevents leaking basic-auth credentials embedded in <code>loadPath</code> / <code>addPath</code></li> <li>security: iterate own enumerable keys only (<code>Object.keys</code> + prototype-key guard) in <code>addQueryString</code> and in the <code>customHeaders</code> loop in XHR mode — prevents prototype-pollution amplification into the URL and request headers</li> <li>chore: ignore <code>.env*</code> and <code>*.pem</code>/<code>*.key</code> files in <code>.gitignore</code></li> </ul> <h3>3.0.4</h3> <ul> <li>use own interpolation function for loadPath and addPath instead of relying on i18next's interpolator <a href="https://redirect.github.com/i18next/i18next/issues/2420";>i18next#2420</a> — this means only <code>{{lng}}</code> and <code>{{ns}}</code> placeholders are supported; custom interpolation prefix/suffix from i18next config no longer applies to backend paths</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/i18next/i18next-http-backend/commit/5757fa3283bff31bd75e75598c3bcb44179bd892";><code>5757fa3</code></a> 3.0.5</li> <li><a href="https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621";><code>4cee84f</code></a> security: hardening for 3.0.5</li> <li><a href="https://github.com/i18next/i18next-http-backend/commit/4cbc48741128d9b1f6cceb43edabfbec84c92615";><code>4cbc487</code></a> Bump next from 16.2.1 to 16.2.3 in /example/next (<a href="https://redirect.github.com/i18next/i18next-http-backend/issues/180";>#180</a>)</li> <li><a href="https://github.com/i18ne... _Description has been truncated_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
