Skip to content

build(deps-dev): bump the dev-dependencies group with 5 updates - #8365

Merged
github-actions[bot] merged 1 commit into
developfrom
dependabot/npm_and_yarn/dev-dependencies-20d91dfb04
Oct 19, 2026
Merged

build(deps-dev): bump the dev-dependencies group with 5 updates#8365
github-actions[bot] merged 1 commit into
developfrom
dependabot/npm_and_yarn/dev-dependencies-20d91dfb04

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 5 updates:

Package From To
eslint 10.12.0 10.13.0
set-cookie-parser 3.1.3 3.1.4
i18next 26.4.5 26.4.7
lucide-react 1.56.0 1.58.0
react-i18next 17.0.17 17.0.21

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

  • b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
  • 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
  • 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
  • b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
  • 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
  • e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)
Commits

Updates set-cookie-parser from 3.1.3 to 3.1.4

Changelog

Sourced from set-cookie-parser's changelog.

Commits
  • 3c27fc4 3.1.4
  • 06d0606 v3.1.4 changelog
  • aab8962 Merge pull request #91 from 00200200/codex/ignore-invalid-cookie-expires
  • 22d4baa Merge pull request #90 from cpruijsen/fix/issue-89-2fd980b5
  • c52ea02 fix: ignore Expires attributes that parse as Invalid Date
  • 00e44b0 fix: ignore malformed Max-Age values (RFC 6265 5.2.2)
  • See full diff in compare view

Updates i18next from 26.4.5 to 26.4.7

Release notes

Sourced from i18next's releases.

v26.4.7

  • perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

v26.4.6

  • fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).
Changelog

Sourced from i18next's changelog.

26.4.7

  • perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

26.4.6

  • fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).
Commits

Updates lucide-react from 1.56.0 to 1.58.0

Release notes

Sourced from lucide-react's releases.

Version 1.58.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.57.0...1.58.0

Version 1.57.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

Commits

Updates react-i18next from 17.0.17 to 17.0.21

Changelog

Sourced from react-i18next's changelog.

17.0.21

  • fix(IcuTrans): explicit values now win over interpolation.defaultVariables, as they do in t(). IcuTrans merged them the other way round, so <IcuTrans values={{ user: 'John Doe' }} /> rendered the configured default variable user instead of John Doe. Trans had the same inverted merge and is fixed too. Compatibility note: only names that are set both in values and in defaultVariables render differently.
  • feat: new entry point react-i18next/IcuTransWithoutContext (with types) for React Server Components. Importing IcuTransWithoutContext from react-i18next in a Server Component could fail the build with createContext is not a function, because the main entry creates the React context when it is loaded. Like react-i18next/TransWithoutContext, the new entry point does not.
  • fix(build): the ESM build's dist/es/package.json now declares "sideEffects": false, like the root package.json already did. Bundlers use the nearest package.json, so the ESM build counted as having side effects and unused exports were kept: an app that only uses Trans still bundled IcuTrans with its HTML entity decoder, useTranslation and use-sync-external-store. With esbuild, a Trans-only bundle (React and i18next external) goes from 20.9 KB to 11.6 KB minified, 8.3 KB to 5.0 KB gzipped.
  • docs: the icu.macro Babel macro is now marked as deprecated in favour of using IcuTrans directly. It fails on Babel 8 (t.jSXIdentifier is not a function), <Plural count={count}> renders the raw ICU message, and a React key on <Plural>/<Select> becomes an ICU case. It keeps working on Babel 7 and is not removed. The IcuTrans docs page has a corrected example and props table and covers Server Components.

17.0.20

  • fix: useTranslation no longer suspends when a missing namespace is loaded by a synchronous backend. With useSuspense (the default), a namespace that wasn't in the store yet always made the component throw the loading promise, even when the backend had already delivered the resources while that promise was being created. React then showed the Suspense fallback and rendered again right away, which appears as a fallback flash (a white flash in React Native) and costs performance. The hook now starts the load first, checks the store again and only suspends if the namespace is still missing. This helps every backend that calls back synchronously, for example i18next-resources-to-backend with a static resources object or a loader that returns the data directly. Async backends, and an instance that isn't initialized yet, still suspend as before. Thanks @​oblador (#1937).

17.0.19

  • fix: useTranslation with an inline selector keyPrefix (useTranslation('ns', { keyPrefix: ($) => $.role })) returned a new t on every render, so every effect, useCallback and useMemo depending on t ran again each time. The cached t was compared against the keyPrefix function itself, and an inline arrow is a new function on every render. It is now compared against the key the selector resolves to (with the same options and namespace list getFixedT resolves it with), so t keeps its identity as long as the resolved prefix does, just like a string keyPrefix. A selector that resolves to a different key still gets a new t, and i18next still resolves the selector on each t call as before. Fixes #1936.
  • fix: useTranslation kept returning the previous t when only the namespace (useTranslation('a') → useTranslation('b')) or only the i18n instance (another instance with the same language, via props or I18nextProvider) changed on a mounted component. That t kept resolving against the old namespace or instance until something else (the language, the ready state, a bound i18n event) produced a new one. Both are now part of the check that decides whether the cached t can be reused.

17.0.18

  • fix(Trans): with shouldUnescape, the default unescape now turns &nbsp; and &[#160](https://github.com/i18next/react-i18next/issues/160); into a no-break space (U+00A0) instead of a regular space (U+0020). The regular space dropped what the entity is for: u&nbsp;nás or 10&nbsp;km could wrap across lines, and consecutive &nbsp;s collapsed into one space. This also matches IcuTrans, whose entity decoder already mapped &nbsp; to U+00A0. Compatibility note: only affects shouldUnescape; snapshots or exact textContent comparisons of such text now contain U+00A0 (Testing Library's default normalizer still matches it as a space). A custom react.unescape function can restore the old mapping for text nodes. Thanks @​lprnmns (#1935).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the dev-dependencies group with 5 updates
05f6d14 
Bumps the dev-dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.13.0` |
| [set-cookie-parser](https://github.com/nfriedly/set-cookie-parser) | `3.1.3` | `3.1.4` |
| [i18next](https://github.com/i18next/i18next) | `26.4.5` | `26.4.7` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.56.0` | `1.58.0` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.17` | `17.0.21` |


Updates `eslint` from 10.12.0 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.13.0)

Updates `set-cookie-parser` from 3.1.3 to 3.1.4
- [Changelog](https://github.com/nfriedly/set-cookie-parser/blob/master/CHANGELOG.md)
- [Commits](nfriedly/set-cookie-parser@v3.1.3...v3.1.4)

Updates `i18next` from 26.4.5 to 26.4.7
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.4.5...v26.4.7)

Updates `lucide-react` from 1.56.0 to 1.58.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.58.0/packages/lucide-react)

Updates `react-i18next` from 17.0.17 to 17.0.21
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.17...v17.0.21)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: set-cookie-parser
  dependency-version: 3.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: i18next
  dependency-version: 26.4.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: lucide-react
  dependency-version: 1.58.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: react-i18next
  dependency-version: 17.0.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 19, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) October 19, 2026 15:39
@github-actions
github-actions Bot merged commit fbf0ed7 into develop Oct 19, 2026
37 checks passed
@github-actions
github-actions Bot deleted the dependabot/npm_and_yarn/dev-dependencies-20d91dfb04 branch October 19, 2026 16:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants