Repository navigation
chore(deps): weekly dependencies update 2026-10-15 - #368
Merged
Merged
Conversation
CataldoMazzilli
requested review from
lisaparma,
matteobaglini and
rodleyorosa
October 15, 2026 17:44
|
0 New Issues
0 Fixed Issues
0 Accepted Issues
No data about coverage (80.40% Estimated after merge)
lisaparma
approved these changes
Oct 16, 2026
Contributor
|
🎉 This PR is included in version 0.0.39 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Weekly dependencies update — 2026-10-15
Automated bundle of all runtime dependencies bumped to the latest minor/patch within the same major (the
dependenciesblock only).Updates
@zextras/carbonio-design-system12.0.412.2.1graphql16.14.116.14.2i18next26.4.226.4.5i18next-http-backend4.0.24.0.3react-i18next17.0.1417.0.17Notes
mainncu --target minorat planning time and applied verbatim to thedependenciesblock, thenpnpm install --no-frozen-lockfile.package.jsonandpnpm-lock.yamlwere modified.🤖 Generated by the
update-depsskill.Changelogs
@zextras/carbonio-design-system12.0.4 → 12.2.1v12.0.512.0.5 (2026-09-03)
Bug Fixes
v12.1.012.1.0 (2026-09-03)
Features
v12.1.112.1.1 (2026-09-03)
Bug Fixes
Other changes
v12.1.212.1.2 (2026-09-15)
Other changes
v12.1.312.1.3 (2026-09-16)
Other changes
v12.1.412.1.4 (2026-09-16)
Other changes
v12.1.512.1.5 (2026-09-16)
Other changes
v12.1.612.1.6 (2026-09-17)
Other changes
v12.1.712.1.7 (2026-09-17)
Other changes
v12.1.812.1.8 (2026-09-17)
Other changes
v12.1.912.1.9 (2026-09-21)
Other changes
v12.1.1012.1.10 (2026-09-21)
Other changes
v12.1.1112.1.11 (2026-09-22)
Other changes
v12.1.1212.1.12 (2026-09-25)
Other changes
v12.1.1312.1.13 (2026-09-29)
Other changes
v12.1.1412.1.14 (2026-10-13)
Other changes
v12.1.1512.1.15 (2026-10-14)
Other changes
v12.1.1612.1.16 (2026-10-15)
Other changes
v12.2.012.2.0 (2026-10-15)
Features
v12.2.112.2.1 (2026-10-15)
Other changes
graphql16.14.1 → 16.14.2v16.14.2v16.14.2 (2026-06-09)
Docs 📝
7 PRs were merged
Polish 💅
Committers: 2
i18next26.4.2 → 26.4.5v26.4.3ResourceStore.hasLanguageSomeTranslations()no longer enumerates every key of a large bundle on each call. It ranObject.keys()on the whole bundle just to learn whether it had at least one key, andinit()/changeLanguage()reach it three times per instance (once while picking the language, twice viasetResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before anyt()call. Bundle objects already found non-empty are now remembered in aWeakSetshared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads,addResource,addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand withdeleteon every key while it is still in the store keeps counting as having translations; useremoveResourceBundle()for that. Thanks @dmchoi77 for the detailed report (#2449).v26.4.4$t(. Its repeated group had overlapping alternatives ([^()"']+inside(?:...)*?, and inside parentheses[^()]also matched quotes), so a string containing$t(without a closing)made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hungt()for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch$,tor(, and theskipOnVariablescheck runs the regexp on the interpolated result, sonest: falsedid not help either. Every alternative now starts with a different character (plain char,",'or(), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone"or'inside unquoted parentheses within$t(...)is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.nest()now resolves$t(...)in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a$t(...)inside a variable that the nested lookup deliberately kept literal (defaultskipOnVariables: true) was resolved anyway by the outer loop: withouter: 'A $t(inner) B'andinner: 'Hi {{name}}',t('outer', { name: '$t(secret)' })rendered thesecrettranslation. It now staysA Hi $t(secret) B, the same as without the outer nesting; withskipOnVariables: falseit is still resolved. Second, the cost was quadratic when an unclosed$t(preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going throughString.replace, so$&,$`,$'and$$stay literal as before (26.4.2).v26.4.5hasLoadedNamespace(ns, { lng })no longer staysfalseforever when the passed inlngis loaded under another code, or not at all. It checked the load state of the rawlng, butloadLanguages()stores a language under its resolved code (de-ch→de-CH,de-CH→dewithload: 'languageOnly') and skips alngoutsidesupportedLngsentirely (only the fallback gets loaded), so that state never got set. react-i18next'suseTranslation(ns, { lng })then never became ready: withuseSuspenseit kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for alngoutsidesupportedLngsonly waits for the fallback, which is also whatt()resolves to. Calls withoutlngand theprecheck(react-i18next'sbindI18n: 'languageChanging') are unchanged (react-i18next#1934).i18next-http-backend4.0.2 → 4.0.34.0.3
Security release. See advisory GHSA-9jhj-wvmw-cfx5.
//(or\) when theloadPath/addPathtemplate does not. With a template that puts{{ns}}directly after a leading/(e.g./{{ns}}/{{lng}}.json), annsvalue of/evil.examplepassed the per-value checks, because a single/is allowed for nested namespaces, but it joined the template's own/into//evil.example/en.json, a protocol-relative URL that browsers send to another origin. The 4.0.2//check looked at the value only, so it missed this. The interpolated URL is now checked as a whole. The default/locales/{{lng}}/{{ns}}.json, templates with an origin, and protocol-relative CDN templates such as//cdn.example/{{lng}}/{{ns}}.jsonare not affected and keep working.Source: CHANGELOG.md
react-i18next17.0.14 → 17.0.1717.0.15
<wrap></wrap>), a component array (<0></0>), or indexed JSX children (<1></1>). This matches the existing behavior for two or more children and self-closing tags. React represents one JSX child as an element and multiple children as an array; the previous array-only check silently rendered the one-child case empty. Compatibility note: when that sole element contains an interpolation object, the restored raw children can expose an existing React rendering limitation as an error instead of silently rendering empty; the same shape already errors with two children. Fixes #1932.17.0.16
i18nKeythat points into a secondary namespace ofuseTranslationnow resolves the same wayt()does. Withconst { t } = useTranslation(['ns1', 'ns2']),t($ => $.ns2.message)works since 17.0.7, but<Trans t={t} i18nKey={$ => $.ns2.message} />rendered the raw key (or its children).Transalways passed annsoption tot, filled fromt.ns(the primary namespace only), and an explicitnsmakes i18next's fixedtskip the hook's full namespace list (scopeNs). WhenTransorTransWithoutContextgets atthat carries its own namespace and nonsprop, it now leavesnsout and lets thattapply its own. String keys,keyPrefix,nsMode: 'fallback', an explicitnsprop andTranswithout atprop behave as before. Compatibility note: if the primary namespace has a nested object named like a secondary namespace (ns1→ns2.message),Transnow resolves$ => $.ns2.messagetons2:message, ast()already does. Fixes #1933.17.0.17
useTranslationno longer unsubscribes and resubscribes its i18n listeners on every render. Thesubscribecallback handed touseSyncExternalStoredepended on the merged options object, which is rebuilt wheneverpropsis a new object: with no options (the{}default), with options passed inline (useTranslation('ns', { keyPrefix })), and throughwithTranslationand<Translation>. A newsubscribemakes React resubscribe, so each render of each caller rani18n.offandi18n.onin an extra effect. It now depends only on the instance and thebindI18n/bindI18nStoreevent names. No updates were ever missed, because React re-checks the snapshot after resubscribing; this only removes the churn, which adds up with many mounted components that re-render often. Reported via next-i18next#2349.Source: CHANGELOG.md