Bump the npm-minor-patch group with 13 updates

[dependabot]

Bumps the npm-minor-patch group with 13 updates:

Package	From	To
i18next	26.3.4	26.3.6
radix-ui	1.6.1	1.6.2
react-hook-form	7.80.0	7.81.0
react-i18next	17.0.8	17.0.9
@eslint-react/eslint-plugin	5.10.4	5.11.2
@types/node	26.1.0	26.1.1
@vitest/browser-playwright	4.1.9	4.1.10
@vitest/coverage-v8	4.1.9	4.1.10
@vitest/ui	4.1.9	4.1.10
msw	2.14.6	2.14.7
prettier	3.9.4	3.9.5
vite	8.1.3	8.1.4
vitest	4.1.9	4.1.10

Updates i18next from 26.3.4 to 26.3.6

Release notes

Sourced from i18next's releases.

v26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

Changelog

Sourced from i18next's changelog.

26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

Commits

• e1c60d4 26.3.6
• 04da43e fix: allow typescript 7 in optional peerDependencies range (react-i18next#1927)
• 8eed4ac build
• 573ae73 26.3.5
• cc54b05 docs(changelog): 26.3.5 — multiline $t() options, replace mutation, escaped-l...
• 3180d67 fix: skip interpolation of placeholders inside escaped values (#2442)
• d16f5a2 fix: stop mutating the passed replace object when returning details (#2441)
• bed56c1 fix: parse $t() nesting options block that spans multiple lines (#2440)
• c19e458 docs(changelog): link GHSA advisory for deepExtend fix
• 7bb87d0 docs(changelog): reference security advisory for deepExtend fix
• Additional commits viewable in compare view

Updates radix-ui from 1.6.1 to 1.6.2

Changelog

Sourced from radix-ui's changelog.

1.6.2

Other updates

• Added CSS custom properties for Navigation Menu item indicators' translate values.
• Fixed a bug in Dismissable Layer causing background nested popovers to close all layers on outside click
• Fixed runtime errors for Form.Message, Form.Control, Form.Label and Form.ValidityState that are correctly rendered outside of Form.Field components
• Fixed a bug in form control components to ensure their values are updated when their associated form's is reset. This affects RadioGroup, Slider, Select, and Switch.
• Fixed menu items, tab triggers, toolbar links, and select items intercepting Space/Enter keys that originate from focusable descendants.
• Fixed a bug where calling an event handler without an argument would throw, preventing successive event handlers from being called. This affected all components that accept event handlers with internal implementations.
• Fixed a bug in Context Menu to ensure that the menu properly re-anchors to the latest pointer position when re-triggered in its open state.
• Fixed stale onEscapeKeyDown/onDismiss handlers on React 19.2.
• Fixed items in a Roving Focus Group not being auto-focused on mount within a Focus Scope component.
• Fixed a regression in Dismissable Layer originating from a bug in React's useEffectEvent.
• Fixed --radix-scroll-area-corner-width and --radix-scroll-area-corner-height not resetting to 0 when a corner is removed. Previously these values would stick around and leave a permanent gap on the remaining scrollbar.
• Fixed a bug in Slider where stepping with the keyboard would skip a valid value when the current value is off the step grid. Stepping now snaps to the next step-aligned value in the direction of travel, matching native <input type="range"> behavior.

Commits

• See full diff in compare view

Updates react-hook-form from 7.80.0 to 7.81.0

Release notes

Sourced from react-hook-form's releases.

Version 7.81.0

⚜️ feat: FieldArray component (#13394)

<FieldArray
  control={control}
  name="test"
  render={({ fields }) => null}
/>

🐞 fix #13538 useFieldArray min 1 item validation error changes its location in the errors object (#13539) 🐞 fix #13569 calling reset triggers subscribe with latest name instead of undefined (#13574) 🐞 fix(useController): reflect cleared parent object in controlled fields (#13550) (#13553) 🐞 fix(flatten): preserve Date values as leaf nodes (#13566) 🐛 fix(unset): guard against prototype keyword path traversal (#13559) (#13560) 🏸 improve setValue api with shrink value (#13576) 👝 close #13577 improve re-render with useFieldArray reset (#13578) 🐞 fix #13575 issue: clearErrors changes the name value from form.subscribe (#13579)

thanks to @​DakshSinghDhami, @​JSap0914, @​tran-simon & @​EduardF1

Changelog

Sourced from react-hook-form's changelog.

[7.81.0] - 2026-07-05

Added

• FieldArray component built on useFieldArray for controlled field-array rendering

Fixed

• clearErrors changing the name value from form.subscribe
• reset triggering subscribe with the latest name instead of undefined
• setValues leaving stale elements behind when shrinking a field array
• flatten preserving Date values as leaf nodes
• useFieldArray min length validation error changing location in the errors object
• useController not reflecting a cleared parent object in controlled fields

Security

• Harden unset() against prototype-path traversal (__proto__ / constructor / prototype), matching the existing set() guard

Performance

• Improve re-render with useFieldArray reset

Commits

• 46b217e 7.81.0
• 6595a91 🐞 fix #13575 issue: clearErrors changes the name value from form.subscribe (#...
• cae5dfe 👝 close #13577 improve re-render with useFieldArray reset (#13578)
• 5b2b743 🏸 improve setValue api with shrink value (#13576)
• 6112441 🐞 fix #13569 calling reset triggers subscribe with latest name instead of und...
• f89388f 🐞 fix(flatten): preserve Date values as leaf nodes (#13566)
• 46381fa Revert "docs: fix grammar in demo descriptions (#13565)" (#13568)
• d4c804a Revert "test: remove duplicate UseFieldArray slug (#13564)" (#13567)
• 63ec54f test: remove duplicate UseFieldArray slug (#13564)
• 08792ad docs: fix grammar in demo descriptions (#13565)
• Additional commits viewable in compare view

Updates react-i18next from 17.0.8 to 17.0.9

Changelog

Sourced from react-i18next's changelog.

17.0.9

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. Fixes #1927, thanks @​andikapradanaarif.
• fix(types): <Trans t={t} ns="ns" …> with a t from useTranslation(['ns']) now typechecks under TypeScript 7. TS7 intersects the Ns inference candidates coming from the t prop (readonly ['ns']) and the ns prop ('ns') into an unsatisfiable 'ns' & readonly ['ns'], where TS6 resolved them. The ns prop on TransProps, TransSelectorProps and IcuTransWithoutContextProps now also accepts a single namespace out of an array-typed Ns (Ns | (Ns extends readonly (infer S extends string)[] ? S : never)) — which matches runtime behavior and is unchanged under TS5/TS6.

Commits

• 8b4a9ea 17.0.9
• 422bab1 fix: support typescript 7 — widen peer range and fix Trans ns inference under...
• 6e18aa9 README: mention npx i18next-cli localize as the zero-to-localized path
• See full diff in compare view

Updates @eslint-react/eslint-plugin from 5.10.4 to 5.11.2

Release notes

Sourced from @​eslint-react/eslint-plugin's releases.

v5.11.2 (2026-07-05)

What's Changed

📝 Documentation

• Updated rule documentation for React introspection APIs (react-x/no-children-count, react-x/no-children-for-each, react-x/no-children-map, react-x/no-children-only, react-x/no-children-to-array, and react-x/no-clone-element) with clearer guidance on why child introspection creates fragile component coupling and links to Astryx's no-react-introspection rule. (#1889)
• Updated the function-component collector sequence diagram on the website.
• Updated THIRD-PARTY-LICENSE file.

Full Changelog: Rel1cx/eslint-react@v5.11.0...v5.11.2

Attestation

https://github.com/Rel1cx/eslint-react/attestations/33931871

v5.11.0 (2026-07-05)

What's Changed

✨ New

• react-x/refs now detects ref mutations/reads inside helper functions that are called (directly, or through a simple variable alias) during render, closing a gap where any nested function was previously treated as a safe boundary regardless of whether it was actually invoked during render.
• react-x/refs now reports a second guarded ref initialization: only a single if (ref.current == null) { ref.current = ... } guarded initialization is allowed per ref per component/hook, and a second guarded write (in the same or a different if block) is reported as duplicateRefInit.
• react-x/refs now supports .current accesses whose base is a member expression that looks like a ref (e.g. props.ref.current), not just a plain identifier.

🏗️ Internal

• Added unit tests for packages/ast/src/check.ts.
• Bumped @effect/language-service to ^0.86.4 and preact to ^10.29.4.
• Refactored react-x/static-components internals without changing behavior: findVariableForIdentifier now delegates to @typescript-eslint/utils/ast-utils's findVariable instead of a hand-rolled scope-chain walk, resolveDynamicValue was split into findDynamicCreationSite and findReassignmentCreationSite, and render-boundary/JSX-candidate handling was extracted into dedicated helpers.
• Unified the signatures of Check.isDirective and Check.isIdentifier in @eslint-react/ast: both now take the node as the first argument and an optional name as the second, replacing the previous curried (name) => (node) => boolean shape. Removed Check.isStringLiteral; use ts-pattern's isMatching or an inline type guard instead.

Full Changelog: Rel1cx/eslint-react@v5.10.4...v5.11.0

Attestation

https://github.com/Rel1cx/eslint-react/attestations/33921957

Changelog

Sourced from @​eslint-react/eslint-plugin's changelog.

v5.11.2 (2026-07-05)

📝 Documentation

• Updated rule documentation for React introspection APIs (react-x/no-children-count, react-x/no-children-for-each, react-x/no-children-map, react-x/no-children-only, react-x/no-children-to-array, and react-x/no-clone-element) with clearer guidance on why child introspection creates fragile component coupling and links to Astryx's no-react-introspection rule. (#1889)
• Updated the function-component collector sequence diagram on the website.
• Updated THIRD-PARTY-LICENSE file.

Full Changelog: Rel1cx/eslint-react@v5.11.0...v5.11.2

v5.11.0 (2026-07-05)

✨ New

• react-x/refs now detects ref mutations/reads inside helper functions that are called (directly, or through a simple variable alias) during render, closing a gap where any nested function was previously treated as a safe boundary regardless of whether it was actually invoked during render.
• react-x/refs now reports a second guarded ref initialization: only a single if (ref.current == null) { ref.current = ... } guarded initialization is allowed per ref per component/hook, and a second guarded write (in the same or a different if block) is reported as duplicateRefInit.
• react-x/refs now supports .current accesses whose base is a member expression that looks like a ref (e.g. props.ref.current), not just a plain identifier.

🏗️ Internal

• Added unit tests for packages/ast/src/check.ts.
• Bumped @effect/language-service to ^0.86.4 and preact to ^10.29.4.
• Refactored react-x/static-components internals without changing behavior: findVariableForIdentifier now delegates to @typescript-eslint/utils/ast-utils's findVariable instead of a hand-rolled scope-chain walk, resolveDynamicValue was split into findDynamicCreationSite and findReassignmentCreationSite, and render-boundary/JSX-candidate handling was extracted into dedicated helpers.
• Unified the signatures of Check.isDirective and Check.isIdentifier in @eslint-react/ast: both now take the node as the first argument and an optional name as the second, replacing the previous curried (name) => (node) => boolean shape. Removed Check.isStringLiteral; use ts-pattern's isMatching or an inline type guard instead.

Full Changelog: Rel1cx/eslint-react@v5.10.4...v5.11.0

Commits

• 0f8d356 release: 5.11.2
• 787aba5 refactor(ast)!: remove direct is/isOneOf re-exports and use Check namespace
• 76c0b1e release: 5.11.0
• See full diff in compare view

Updates @types/node from 26.1.0 to 26.1.1

Commits

• See full diff in compare view

Updates @vitest/browser-playwright from 4.1.9 to 4.1.10

Release notes

Sourced from @​vitest/browser-playwright's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• 5c18dd2 fix(browser): check fs access in builtin commands [backport to v4] (#10680)
• See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.9 to 4.1.10

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• See full diff in compare view

Updates @vitest/ui from 4.1.9 to 4.1.10

Release notes

Sourced from @​vitest/ui's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• See full diff in compare view

Updates msw from 2.14.6 to 2.14.7

Release notes

Sourced from msw's releases.

v2.14.7 (2026-07-07)

Bug Fixes

• sse: proper logging for concurrent requests (#2762) (5c0ae1c334a0cbe52638bd2949540372be3d46ba) @​kettanaito

Commits

• db818ee chore(release): v2.14.7
• 418854a chore: upgrade @ossjs/release
• 5c0ae1c fix(sse): proper logging for concurrent requests (#2762)
• 3016bda test: fix flaky ws.clients.browser.test.ts
• 0df6d6a test: fix flaky in-flight-request.test.ts
• ff6836b chore: pin github actions to commit sha, update pnpm (#2761)
• 8a19d54 chore: improve github actions security (#2747)
• f76d5f3 chore: drop cache in setup-node (#2745)
• d2ced69 chore: remove miniflare dependency and tests (#2744)
• a2de709 docs: add coderabbit to sponsors (#2743)
• See full diff in compare view

Updates prettier from 3.9.4 to 3.9.5

Release notes

Sourced from prettier's releases.

3.9.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.5

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @​tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text
<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text
<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @​andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](https://github.com/prettier/prettier/blob/main/<> "title")
<!-- Prettier 3.9.4 -->
[link](https://github.com/prettier/prettier/blob/main/ "title")
<!-- Prettier 3.9.5 -->
</tr></table>

... (truncated)

Commits

• b6c7d18 Release 3.9.5
• cd54ccc Avoid corrupting empty Markdown link with title (#19487)
• 2bb67ce Preserving comments' placement property (#19567)
• 91bcac8 Add more tests for comment-only object type (#19587)
• cbee737 Remove space in empty object type (#19583)
• 6394c73 Align empty module declaration with TS (#19568)
• a4e6f7a Prevent the addition of space in type() with + (#19516)
• 3d063b5 Ignore dangling comments when checking type parameter comments (#19572)
• 908503e Handle dangling comments in SwitchStatement (#19581)
• 943a475 Angular: Support expression for exhaustive typechecking (#19571)
• Additional commits viewable in compare view

Updates vite from 8.1.3 to 8.1.4

Release notes

Sourced from vite's releases.

v8.1.4

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.4 (2026-07-09)

Features

• legacy: prefer oxc as minifier (fix #21973) (#22468) (ab5dafa)

Bug Fixes

• build: add workaround for building on stackblitz (#22840) (575c32c)
• build: keep import.meta.url in preload function as-is (#22839) (f1f90ed)
• deps: update all non-major dependencies (#22865) (d4295a9)
• deps: update rolldown-related dependencies (#22866) (7cf07e4)
• html: avoid backtracking in import-only check (#22848) (b5868c0)
• optimizer: avoid optimizer run for transform request before init (#22852) (72a5e21)
• ssr: align named export function call stacktrace column with Node (#22829) (173a1b6)
• strip pure CSS chunk imports when chunkImportMap is enabled (#22841) (648bd04)

Documentation

• fix incorrect @default for server.cors (#22859) (70435b2)

Miscellaneous Chores

• deps: update dependency postcss-modules to v9 (#22867) (a9539d6)

Code Refactoring

• eliminate ineffectiveDynamicImport warn (#22876) (ea22fb3)

Tests

• avoid warnings (#22851) (af21ab6)

Build System

• remove the custom onLog function (#22878) (2c4a217)
• replace deprecated onwarn with onLog (#22741) (c581b55)

Commits

• a477454 release: v8.1.4
• ab5dafa feat(legacy): prefer oxc as minifier (fix #21973) (#22468)
• 173a1b6 fix(ssr): align named export function call stacktrace column with Node (#22829)
• 575c32c fix(build): add workaround for building on stackblitz (#22840)
• 72a5e21 fix(optimizer): avoid optimizer run for transform request before init (#22852)
• a9539d6 chore(deps): update dependency postcss-modules to v9 (#22867)
• 70435b2 docs: fix incorrect @default for server.cors (#22859)
• 2c4a217 build: remove the custom onLog function (#22878)
• c581b55 build: replace deprecated onwarn with onLog (#22741)
• ea22fb3 refactor: eliminate ineffectiveDynamicImport warn (#22876)
• Additional commits viewable in compare view

Updates vitest from 4.1.9 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions