Skip to content

chore(deps): update dependencies minor and patch updates - #474

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/minor-patch
Open

chore(deps): update dependencies minor and patch updates#474
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@tanstack/history (source) 1.162.1 → 1.162.4 age confidence
@tanstack/react-query (source) 5.102.4 → 5.102.8 age confidence
@tanstack/react-router (source) 1.170.32 → 1.170.36 age confidence
axios (source) 1.19.0 → 1.20.0 age confidence
i18next (source) 26.4.0 → 26.4.2 age confidence
react (source) 19.2.8 → 19.3.0 age confidence
react-dom (source) 19.2.8 → 19.3.0 age confidence
react-hook-form (source) 7.86.0 → 7.88.0 age confidence
react-i18next 17.0.12 → 17.0.14 age confidence
zod (source) 4.4.3 → 4.6.5 age confidence

Release Notes

TanStack/router (@​tanstack/history)

v1.162.4

Compare Source

Patch Changes

  • #​8359 8fff7fa - Normalize memory history hrefs consistently with browser and server history, including protocol-relative paths and control characters.

  • #​8352 f021f6d - Avoid temporary arrays when replacing forward memory-history entries.

  • #​8349 ae68535 - Avoid generating unused history keys for locations with existing state.

  • #​8354 9872d2a - Use lightweight request history for SSR and make server navigation a no-op. Use redirect() to issue HTTP redirects. Server hrefs use the same normalization as browser history to handle protocol-relative URLs and control characters.

v1.162.3

Compare Source

Patch Changes

  • #​8308 9c1871c - Validate navigation and redirect destinations, keep ambiguous relative URLs on the current origin, and constrain prerender requests and output paths. Prevent redirect headers from appearing in serialized server function response bodies.

    Preserve native form HTTP redirects, route error handling and masks for document redirects, and per-navigation destinations for shared loader redirects. Avoid redundant origin parsing and reduce link styling and server-rendering work. Configured origins must already be normalized.

    Keep blocked-link inactive props consistent during React hydration, honor explicit redirect Location headers before checking route options, and refresh Vue link state when destinations become internal. Reuse the protocol-relative URL check while parsing redirect schemes once.

    Reduce React link bundle size by sharing pathname comparisons, state-prop selection, and element creation.

    Share normalized pathname comparisons in Solid and Vue links to reduce bundle size.

  • #​8287 0654c0a - Use full-document navigation when an output rewrite produces a cross-origin destination, including the public URL of a route mask.

    Respect registered history blockers during document navigation, passing history locations and the requested push or replace action.

v1.162.2

Compare Source

Patch Changes

  • #​8264 9035abc - Respect ignoreBlocker during go() navigation, including document unload warnings. Preserve beforeunload warnings during back and forward navigation unless ignoreBlocker is requested, and clear the bypass after same-document traversal so later document navigation still warns about unsaved changes.

    Restore the original browser history entry when forward or multi-entry navigation is blocked.

TanStack/query (@​tanstack/react-query)

v5.102.8

Compare Source

Patch Changes

v5.102.7

Compare Source

Patch Changes

v5.102.6

Compare Source

Patch Changes

v5.102.5

Compare Source

Patch Changes
TanStack/router (@​tanstack/react-router)

v1.170.36

Compare Source

Patch Changes

  • #​8390 b747fb8 - Keep the Link location cache out of server bundles: buildLocation only creates, reads and writes it when isServer is false. Render React Links on the server without the extra prop copies and the forwarded-ref hook. Link SSR rendering is 20-40% faster in the Link benchmarks and the React Start SSR request loop about 7% faster.

    React activeProps and inactiveProps now follow one precedence rule on every link, including links whose destination is blocked for using a disallowed scheme: state props override element props, ref and event handlers, while href, disabled and target stay controlled by the router. Previously a blocked link ignored a ref or handler from its inactive props.

    React Link and useLinkProps split router options from element props with one key set on the client and the server. Element props pass through as given: external links forward them verbatim, falsy values included, and useLinkProps now returns children for router-controlled links as it already did for external ones.

  • #​8324 6387d58 - Reuse hydration snapshot getters to avoid unnecessary store-instance effect updates when Links and other hydration-aware components rerender.

  • #​8318 9b2adaf - Allow active and inactive Link props to override base element props in React and Solid while preserving class/style merging. Keep React's href, target, and disabled values controlled by routing options. Preserve Vue object and nested-array class bindings, including reactive updates and server rendering, without mutating cached bindings during VNode normalization.

  • #​8327 634da91 - Make pathParamsAllowedCharacters initialization-only. Configure it when creating the router; changing allowed characters requires a new router instance. Remove decoder-update bookkeeping and decoder-change checks from route-owned path caches.

  • #​8370 e9396c9 - Stop exporting the internal isPlainObject and isPlainArray helpers.

  • #​8324 6387d58 - Avoid a redundant prop copy when rendering native Links while preserving custom-component props and the public hook result.

  • #​8252 7e349c3 - Reduce the bundle cost of shared Link pathname interpolation while preserving its rendering performance. Reuse one interpolation pass for pathname and optional metadata, keep the bounded cache on the router, and simplify React Link active-state and prop merging.

  • #​8370 e9396c9 - Reuse built locations for Links whose destination does not depend on the current location. buildLocation keeps the result per options object when the build never read the current location, and the React Link passes one stable options object per instance, so navigations resolve unchanged Links with a lookup instead of a full build. The per-route pathname interpolation cache this replaces is removed. Link params, search and activeOptions are compared by value on render, so inline object literals with unchanged contents keep reusing the Link's location. Pass a new object to change a destination; like any other React prop, an object mutated in place is not re-read.

  • Updated dependencies [d76a332, b747fb8, 6cfb1e8, 700a714, 700a714, 8fff7fa, f021f6d, ae68535, 7e349c3, 873c830, 7e349c3, 634da91, e9396c9, 634da91, f151ab0, bc57fa3, 9872d2a, d76a332, 634da91, 634da91, 7e349c3, 9448caa, e9396c9, 700a714, 634da91, 634da91]:

v1.170.35

Compare Source

Patch Changes
  • #​7824 8c43c71 - Upgrade TanStack Store to 0.11 and migrate router subscriptions to useSelector, preserving selector comparisons and Vue subscription cleanup.

v1.170.34

Compare Source

Patch Changes

  • #​8279 aee42c6 - Avoid allocating event-handler arrays and wrapper functions for links without user-supplied event handlers.

  • #​8308 9c1871c - Validate navigation and redirect destinations, keep ambiguous relative URLs on the current origin, and constrain prerender requests and output paths. Prevent redirect headers from appearing in serialized server function response bodies.

    Preserve native form HTTP redirects, route error handling and masks for document redirects, and per-navigation destinations for shared loader redirects. Avoid redundant origin parsing and reduce link styling and server-rendering work. Configured origins must already be normalized.

    Keep blocked-link inactive props consistent during React hydration, honor explicit redirect Location headers before checking route options, and refresh Vue link state when destinations become internal. Reuse the protocol-relative URL check while parsing redirect schemes once.

    Reduce React link bundle size by sharing pathname comparisons, state-prop selection, and element creation.

    Share normalized pathname comparisons in Solid and Vue links to reduce bundle size.

  • #​8311 9aec5a7 - React Links resolve state props without temporary class-name arrays or unnecessary style copies.

  • Updated dependencies [f9836f1, 9c1871c, 9871c06, 0654c0a]:

v1.170.33

Compare Source

Patch Changes

  • #​8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

  • #​8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

    When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

  • #​8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

  • #​8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

  • #​8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

  • #​8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

  • Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

axios/axios (axios)

v1.20.0

Compare Source

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#​11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#​11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#​11087, #​11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#​11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#​11094, #​11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#​11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#​11096)

🔧 Maintenance & Chores

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

i18next/i18next (i18next)

v26.4.2

Compare Source

  • fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#​854). Thanks @​mahirhir (#​2447).

v26.4.1

Compare Source

  • fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#​2446).
react/react (react)

v19.3.0

Compare Source

react/react (react-dom)

v19.3.0

Compare Source

react-hook-form/react-hook-form (react-hook-form)

v7.88.0: Version 7.88.0

Compare Source

✨ Features

  • Add Error Message component (#​13472)
  • Add the Error Message component for displaying validation errors from React Hook Form.

🐞 Fixes

  • Fix stale validating state after resetField() (#​13735)
  • Fix errors and touched state remaining for rows removed by replace() (#​13734)
  • Fix stale resolver results updating form state after reset() during handleSubmit() (#​13733)
  • Fix nested registered errors being removed when trigger() targets their parent (#​13732)
  • Fix resolver-reported root errors being dropped during handleSubmit() (#​13731)
  • Fix parent errors being incorrectly set when trigger() targets a field with only nested resolver errors (#​13730)
  • Fix useWatch compute cache not being initialized with the initial output (#​13728)
  • Fix FileList being lost during flatten/expand and omit undefined values in jsonToFormData (#​13725)
  • Fix schemaErrorLookup reporting nested containers as exact-name errors (#​13727)
  • Fix isValidating not being recomputed after unregister() clears validating fields (#​13723)
  • Fix stale resolver state updates after reset() (#​13722)
  • Fix iterateFieldsByAction only breaking out of one loop level (#​13718)
  • Fix stale validation types surviving setError() overwrites (#​13716)
  • Fix reset() not clearing validating fields (#​13714)
  • Fix remove() leaking deleted values onto surviving field-array items (#​13713)
  • Fix the React Server build being unpublished (#​13709)
  • Fix validateField calling setCustomValidity once per key in validate-object mode (#​13707)
  • Fix useFieldArray focus behavior for checkboxes and radio buttons in appended rows (#​13705)
  • Fix getFieldState reading isValidating from the supplied form state (#​13704)
  • Fix unregister() stripping kept values from the submit payload (#​13703)
  • Fix useFormState not re-subscribing when control changes (#​13702)
  • Fix reset() keeping dirtyFields out of sync with isDirty when keepValues is enabled (#​13701)
  • Fix useForm not reconciling correctly when an Activity subtree is initially hidden (#​13698)
  • Fix cleared errors returning after the delayError timer fires (#​13697)
  • Fix cloneObject throwing when checking Blob with instanceof (#​13694)
  • Fix useFieldArray retaining stale fields after an Activity subtree reconnects (#​13688)

🧹 Refactors

  • Extend _isTracked to the remaining multi-key proxy/subscribe form-state checks (#​13699)
  • Extract _isTracked helper for proxy/subscribe form-state checks (#​13690)
  • Remove the unused abortEarly parameter from iterateFieldsByAction (#​13689)
  • Remove redundant optional chaining from clearErrors (#​13696)

📝 Documentation

  • Fix useWatch compute example variable names in JSDoc (#​13700)

📦 Dependencies

❤️ Thank You

v7.87.0

Compare Source

Added
  • shouldTouch option for trigger()
  • OpaqueTypes registry for opaque leaf types
Fixed
  • Inconsistent behavior among useController().field.onChange()-like APIs
  • Controller under a null parent submitting undefined instead of a value
  • ERR_MODULE_NOT_FOUND resolving react-hook-form due to a react-server declaration (Next.js builds)
  • useWatch never reconciling when an Activity subtree is hidden on its first render
  • resetField not recomputing isValid for subscribe-only consumers
  • generateWatchOutput ignoring defaultValue for an array of names
  • useFormState never reconciling when an Activity subtree is hidden on its first render
i18next/react-i18next (react-i18next)

v17.0.14

Compare Source

  • fix: the i18n object returned by useTranslation was only refreshed when i18n.language changed, so a resolvedLanguage (or languages) change of its own kept handing components the previous snapshot. That happens whenever the translations for the current language arrive after the switch — i18next resolves to the fallback until its store has them — and components reading i18n.resolvedLanguage (language switchers, for example) then stayed one switch behind. The cached wrapper is now keyed on all three language fields, which are exactly the ones the surrounding useMemo already depends on; wrapper identity still only changes when the language state does, so the caching from #​1885 is unaffected. Reported via next-i18next#2348.

v17.0.13

Compare Source

  • fix(types): the selector-form keyPrefix overload of useTranslation() is now available under enableSelector: 'strict'. useTranslation was gated on true | 'optimize' only, so under 'strict' it resolved to the legacy signature and the selector overload disappeared entirely (keyPrefix: ($) => $.ns.foo failed with Type '($: any) => any' is not assignable to type 'undefined'). Trans already handled all three modes. Companion to the same fix for getFixedT in i18next#2446. Thanks @​hovelopin (#​1930).
colinhacks/zod (zod)

v4.6.5

Compare Source

Commits:

  • d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#​6598)
  • 56222cd feat(instanceof): key the .properties() shape off the instance type (#​6600)
  • ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)"
  • cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)""
  • 0f3f5ee 4.6.5
  • 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

Compare Source

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#​6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#​6153)

v4.6.3

Compare Source

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#​6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

Compare Source

Commits:

v4.6.1

Compare Source

A patch on top of 4.6.0.

v4.6.0

Compare Source

Commits:

  • 908c9e1 fix(docs): retry the GitHub stars fetch and log the real status
  • 93186ca docs(wiki): drop the zod-compiler benchmark (#​6505)
  • 8ce9e8d feat(mini): publish Zod Mini as the standalone @​zod/mini package (#​6491)
  • 2956c4c chore(mini): sync @​zod/mini to 4.5.4
  • abd41ad docs(wiki): move plans and comparisons into a gitignored internal/ (#​6506)
  • 8106573 chore(docs): build with Turbopack
  • c7ec94d ci: check zod and @​zod/mini lockstep on npm after every publish (#​6507)
  • c46eeff chore: narrow blanket biome-ignore comments (#​6504)
  • a0898b4 ci: wait hours for npm to serve a publish, not ten minutes (#​6502)
  • 1c0bce0 docs: bring the 4.5 charts and worked examples into the docs pages
  • 70eb2c0 docs: drop the traits section and the compilation feature bullet
  • 43b9bfc docs: drop the bound-methods section from the Zod package page
  • cd4f9a6 perf(v4): report Standard Schema issues without constructing a ZodError (#​6509)
  • f3cb364 docs: surface the blog on the home page and in the sidebar
  • f3e7c72 fix(docs): render the docs 404 page inside the (doc) layout once
  • f412178 ci: publish @​zod/mini to JSR in lockstep with npm (#​6510)
  • 5ff9566 Stop re-exporting the compile internals from zod/v4/core (#​6511)
  • 40b4d0b fix(ci): read zod's latest version with npm view when picking the backfill dist-tag
  • a6b4939 Mark the compile internals @​internal instead of hiding them (#​6518)
  • 3195ed0 docs: label the memory chart like the compile chart
  • 8cd1250 docs: center the memory chart callout labels
  • ff56a55 docs: center the memory chart callout labels and pad them off the number
  • fb2fedf docs: tighten the memory chart callout, pad the canvas, say "less memory"
  • 93f3ab3 docs: replace the blog navbar's GitHub icon with a star-count pill
  • 7ae49d6 docs: drop the circle around the star pill's GitHub mark and center it on the pill's arc
  • b801439 bench: add typebox (compiled and dynamic) to the moltar cross-library harness
  • 1ec6b7c docs: add an RSS feed to the blog at /blog/rss.xml
  • 08ba069 perf(v4): read Luhn digits with charCodeAt instead of string indexing (#​6529)
  • 319f47f Emit a length-aware base64url pattern in toJSONSchema (#​6527)
  • a2a019a Accept enum-typed targets in z.toZod (#​6528)
  • 74f9a6d docs: drop the toZod enum block from basics and pin the page's curation rule in a comment
  • f83ab51 fix(v4): reject

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 26, 2026
@renovate
renovate Bot force-pushed the renovate/minor-patch branch 8 times, most recently from 8993a6f to ed5586d Compare September 1, 2026 12:43
@renovate
renovate Bot force-pushed the renovate/minor-patch branch 6 times, most recently from a2fbaba to bd68dc9 Compare September 10, 2026 02:36
@renovate
renovate Bot force-pushed the renovate/minor-patch branch 5 times, most recently from eb18d11 to c153c1e Compare September 13, 2026 17:26
@renovate
renovate Bot force-pushed the renovate/minor-patch branch from c153c1e to dc6ec54 Compare September 14, 2026 02:10
@sonarqubecloud

sonarqubecloud Bot commented Sep 14, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants