chore(deps): bump the frontend-minor-patch group across 1 directory with 27 updates

[dependabot]

Bumps the frontend-minor-patch group with 23 updates in the /frontend directory:

Package	From	To
@tanstack/react-query	5.101.0	5.101.4
@types/node	26.0.0	26.1.1
axios	1.18.0	1.18.1
cron-parser	5.5.0	5.6.2
i18next	26.3.1	26.3.6
lucide-react	1.18.0	1.27.0
react-hook-form	7.79.0	7.83.0
react-i18next	17.0.8	17.0.11
react-icons	5.6.0	5.7.0
recharts	3.8.1	3.10.1
@storybook/addon-docs	10.4.4	10.5.4
@storybook/react-vite	10.4.4	10.5.4
@typescript-eslint/eslint-plugin	8.61.0	8.65.0
@vitest/coverage-v8	4.1.8	4.1.10
autoprefixer	10.5.0	10.5.4
eslint	10.5.0	10.8.0
globals	17.6.0	17.8.0
happy-dom	20.10.3	20.11.1
lint-staged	17.0.7	17.2.0
playwright	1.60.0	1.62.0
postcss	8.5.17	8.5.23
prettier	3.8.4	3.9.6
vite	8.1.4	8.1.5

Updates @tanstack/react-query from 5.101.0 to 5.101.4

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.101.4

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.101.4
  • @​tanstack/react-query@​5.101.4

@​tanstack/react-query-next-experimental@​5.101.4

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.101.4

@​tanstack/react-query-persist-client@​5.101.4

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.101.4
  • @​tanstack/react-query@​5.101.4

@​tanstack/react-query@​5.101.4

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.4

@​tanstack/react-query-devtools@​5.101.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.101.3
  • @​tanstack/react-query@​5.101.3

@​tanstack/react-query-next-experimental@​5.101.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.101.3

@​tanstack/react-query-persist-client@​5.101.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.101.3
  • @​tanstack/react-query@​5.101.3

@​tanstack/react-query@​5.101.3

Patch Changes

• Updated dependencies [7e3c822]:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.101.4

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.4

5.101.3

Patch Changes

• Updated dependencies [7e3c822]:
  • @​tanstack/query-core@​5.101.3

5.101.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.2

5.101.1

Patch Changes

• Updated dependencies [9eff92e]:
  • @​tanstack/query-core@​5.101.1

Commits

• 86bb8a6 ci: Version Packages (#11094)
• 181ea82 ci: Version Packages (#11089)
• 6d55b07 test({react,preact}-query): use the '.then()' convention consistently (#11085)
• 44f38df test({react,preact,solid}-query/useInfiniteQuery): inline the shared 'fetchIt...
• d1558c1 test({react,preact}-query/usePrefetchQuery): inline the 'generateQueryFn' fac...
• 99690d1 test({react,preact}-query/usePrefetchInfiniteQuery): inline single-use helper...
• 10770f0 test({react,preact}-query/usePrefetchInfiniteQuery): inline the shared 'Suspe...
• dbd5a86 test({react,preact}-query/usePrefetchQuery): inline the shared 'Suspended' co...
• b955f60 test({react,preact}-query/useSuspenseQuery): assert the 'loading' fallback is...
• b9c657e test({react,preact}-query/usePrefetchQuery): assert the 'Loading...' fallback...
• Additional commits viewable in compare view

Updates @types/node from 26.0.0 to 26.1.1

Commits

• See full diff in compare view

Updates axios from 1.18.0 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

• AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
• Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
• Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
• AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

• Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

• Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​webdevelopersrinu (#10913)
• @​sijie-Z (#10993)
• @​bartlomieju (#11023)
• @​JSap0914 (#11019)

Full Changelog

Changelog

Sourced from axios's changelog.

Changelog

Commits

• a209bfb chore(release): prepare release 1.18.1 (#11027)
• fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
• 40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
• a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
• cf1306a docs: add Deno to install instructions (#11023)
• b32880a fix: incorrect use of error (#11021)
• 1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
• 30499d6 fix: various runtime crashes and type definition mismatches (#10959)
• 20ce9c4 fix(http): defer env proxy handling to Node (#10942)
• e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
• Additional commits viewable in compare view

Updates cron-parser from 5.5.0 to 5.6.2

Release notes

Sourced from cron-parser's releases.

v5.6.2

What's Changed

• fix: enforce iteration loop limit so unsatisfiable expressions throw instead of returning a bogus date by @​spokodev in harrisiirak/cron-parser#415
• fix: do not drop a matching day of month when the day of week uses an nth (#) occurrence by @​spokodev in harrisiirak/cron-parser#414

Full Changelog: harrisiirak/cron-parser@v5.6.1...v5.6.2

v5.6.1

What's Changed

• fix: handle DST gap correctly and prevent iteration from stopping prematurely by @​cyber-hari in harrisiirak/cron-parser#405
• fix: CronDate throws on .bind in bundled/CDN builds by @​harrisiirak in harrisiirak/cron-parser#413
• fix: do not reject an out-of-range day of month when the day of week is restricted by @​spokodev in harrisiirak/cron-parser#410

New Contributors

• @​cyber-hari made their first contribution in harrisiirak/cron-parser#405
• @​spokodev made their first contribution in harrisiirak/cron-parser#410

Full Changelog: harrisiirak/cron-parser@v5.6.0...v5.6.1

Commits

• 750c9a2 chore: bump version
• e6a869c chore(bench): add nth-day (#) expressions to benchmark inputs
• dc51aaa fix: do not drop a matching day of month when the day of week uses an nth (#)...
• bc213d2 fix: enforce iteration loop limit so unsatisfiable expressions throw instead ...
• 6d6de5c chore: bump version
• c6b2e48 fix: do not reject an out-of-range day of month when the day of week is restr...
• 152b59a fix: dispatch CronDate add/subtract via switch instead of bound-method map (#...
• e2bac3a fix: handle DST gap correctly and prevent iteration from stopping prematurely...
• b122a77 chore: bump version
• 2a5707f chore: update deps and adapt tsconfig for TypeScript 6 (#412)
• Additional commits viewable in compare view

Updates i18next from 26.3.1 to 26.3.6

Release notes

Sourced from i18next's releases.

v26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

Changelog

Sourced from i18next's changelog.

26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @​manus-use for the responsible disclosure.

26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

Commits

• e1c60d4 26.3.6
• 04da43e fix: allow typescript 7 in optional peerDependencies range (react-i18next#1927)
• 8eed4ac build
• 573ae73 26.3.5
• cc54b05 docs(changelog): 26.3.5 — multiline $t() options, replace mutation, escaped-l...
• 3180d67 fix: skip interpolation of placeholders inside escaped values (#2442)
• d16f5a2 fix: stop mutating the passed replace object when returning details (#2441)
• bed56c1 fix: parse $t() nesting options block that spans multiple lines (#2440)
• c19e458 docs(changelog): link GHSA advisory for deepExtend fix
• 7bb87d0 docs(changelog): reference security advisory for deepExtend fix
• Additional commits viewable in compare view

Updates lucide-react from 1.18.0 to 1.27.0

Release notes

Sourced from lucide-react's releases.

Version 1.27.0

What's Changed

• feat(icons): removed brand names from tags & revised brand stopwords by @​karsa-mistmere in lucide-icons/lucide#4575
• fix(docs): Fix site build by @​ericfennis in lucide-icons/lucide#4582
• fix(icons): optimised square-scissors icons by @​karsa-mistmere in lucide-icons/lucide#4581
• fix(packages/angular): add more supported attributes for SVG nodes by @​karsa-mistmere in lucide-icons/lucide#4570
• feat(icons): added pending-cw icon by @​NielsLazaroms in lucide-icons/lucide#4439
• fix(icons): changed zap and zap-off icons by @​kapowaz in lucide-icons/lucide#4536
• feat(icons): add square-off icon by @​october-learns in lucide-icons/lucide#4496
• chore(deps-dev): bump astro from 6.4.8 to 7.1.0 by @​dependabot[bot] in lucide-icons/lucide#4572
• fix(icons): changed toolbox icon by @​karsa-mistmere in lucide-icons/lucide#4571
• feat(icons): add scan-square by @​samuelalake in lucide-icons/lucide#4550
• feat(icons): added user-shield icon by @​MArtytraM99 in lucide-icons/lucide#3099
• feat(icons): added mosque icon by @​iskepr in lucide-icons/lucide#4494
• fix(request-review): Remove pull_request_target by @​ericfennis in lucide-icons/lucide#4593
• fix(icons): changed feather icon by @​karsa-mistmere in lucide-icons/lucide#4584
• feat(ci): added custom prettier plugin for icon SVG files by @​karsa-mistmere in lucide-icons/lucide#4576
• ci(ci.yml): Remove concurrency in ci.yml by @​ericfennis in lucide-icons/lucide#4595
• fix(icons): changed barrel icon by @​karsa-mistmere in lucide-icons/lucide#4592
• feat(lab): Migrate lab to main repo. by @​ericfennis in lucide-icons/lucide#4521
• fix(icons): changed trophy icon by @​karsa-mistmere in lucide-icons/lucide#4591
• feat(analytics): add utm source and medium by @​jguddas in lucide-icons/lucide#4596
• feat(docs): Add lab requirement in pull_request_template.md by @​danielbayley in lucide-icons/lucide#3651
• feat(icons): replaces podcast icon with new mic-* icons by @​karsa-mistmere in lucide-icons/lucide#4583
• feat(icons): add layout-freeform by @​samuelalake in lucide-icons/lucide#4543

New Contributors

• @​NielsLazaroms made their first contribution in lucide-icons/lucide#4439
• @​kapowaz made their first contribution in lucide-icons/lucide#4536
• @​october-learns made their first contribution in lucide-icons/lucide#4496
• @​samuelalake made their first contribution in lucide-icons/lucide#4550
• @​iskepr made their first contribution in lucide-icons/lucide#4494

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

Version 1.26.0

What's Changed

• fix(docs): fix home page package links & accessible labels by @​karsa-mistmere in lucide-icons/lucide#4540
• fix(icons): changed columns-3-cog icon by @​kamilasw in lucide-icons/lucide#4578
• fix(icons): extended metadata of ad icon by @​karsa-mistmere in lucide-icons/lucide#4579
• fix(icons): changed book-open icons by @​karsa-mistmere in lucide-icons/lucide#4565
• feat(icons): added shield-keyhole icon by @​karsa-mistmere in lucide-icons/lucide#4580

New Contributors

• @​kamilasw made their first contribution in lucide-icons/lucide#4578

Full Changelog: lucide-icons/lucide@1.25.0...1.26.0

Version 1.25.0

What's Changed

... (truncated)

Commits

• f229f83 chore(depedencies): Update dependencies (#4553)
• 5ff536e ci(release.yml): Fix workflow and remove version scripts in package scripts...
• See full diff in compare view

Updates react-hook-form from 7.79.0 to 7.83.0

Release notes

Sourced from react-hook-form's releases.

Version 7.83.0

⚡ Improvements

• enhance getEventValue to handle file inputs (#13289)
• type perf: improve TypeScript performance with a hard cap at 10 levels of recursive type depth (#13529)
• type perf: improve type performance (#13528)

🐞 Fixes

• fix: clear internal errors state on argument-less clearErrors() (#13613)
• fix: preserve dirtyFields reference stability (#13612)
• fix: old checkbox/radio elements polluting internal field state (#13080)
• fix(useController): re-subscribe onChange/onBlur when control changes (#13603)
• fix(types): allow validation messages to be defined even if their related value is undefined (#13287)

Version 7.82.0

🚀 feat: add opt-in delayError option for setValue (#13337)

setValue("firstName", "Bill", {
  delayError: 500, // delay validation error updates by 500ms
  shouldValidate: true
});

⚡ perf: improve getDirtyFields performance (#13590)

• Improved dirty field calculation, especially for larger forms and deeply nested values.

🐞 fix: expose resetDefaultValues through form context (#13598)

const { resetDefaultValues } = useFormContext();
resetDefaultValues();

🐞 fix: setValue with shouldDirty now correctly updates dirty state when the form is disabled (#13594) 🐞 fix: preserve dirtyFields boolean values for registered array fields (#13586) 🐞 fix: restore FieldArray component export (#13596) 🧪 test: migrate test suite to Playwright and improve delayError test reliability (#13589)

thanks to @​candymask0712, @​wanxiankai, @​a-y-ibrahim, @​ankit1324 & @​abnud11

Version 7.81.0

⚜️ feat: FieldArray component (#13394)

<FieldArray
  control={control}
</tr></table> 

... (truncated)

Changelog

Sourced from react-hook-form's changelog.

[7.83.0] - 2026-07-25

Improvements

• Enhance getEventValue to handle file inputs
• Improve TypeScript performance with a hard cap at 10 levels of recursive type depth

Fixed

• Clear internal errors state on argument-less clearErrors()
• Preserve dirtyFields reference stability
• Old checkbox/radio elements polluting internal field state
• useController not re-subscribing onChange/onBlur when control changes
• Allow validation messages to be defined even if their related value is undefined

[7.82.0] - 2026-07-18

Added

• Opt-in delayError option for setValue to delay validation error updates

Fixed

• Expose resetDefaultValues through form context
• setValue with shouldDirty not updating dirty state correctly when the form is disabled
• Preserve dirtyFields boolean values for registered array fields
• Restore FieldArray component export

Performance

• Improve getDirtyFields performance, especially for larger forms and deeply nested values

[7.81.0] - 2026-07-05

Added

• FieldArray component built on useFieldArray for controlled field-array rendering

Fixed

• clearErrors changing the name value from form.subscribe
• reset triggering subscribe with the latest name instead of undefined
• setValues leaving stale elements behind when shrinking a field array
• flatten preserving Date values as leaf nodes
• useFieldArray min length validation error changing location in the errors object
• useController not reflecting a cleared parent object in controlled fields

Security

• Harden unset() against prototype-path traversal (__proto__ / constructor / prototype), matching the existing set() guard

... (truncated)

Commits

• ca8106d 7.83.0
• 69da954 🐞 fix: clear internal errors state on argument-less clearErrors() (#13613)
• d96c5ce 🐞 fix: preserve dirtyFields reference stability (#13612)
• ee7593e 🧪 update old checkbox/radio elements polluting internal field state e2e spec ...
• 2726d81 🐞 fix: old checkbox/radio elements polluting internal field state (#13080)
• 4ca98df ✋ fix repo grammar to prevent those silly one line prs
• d920e93 🧪 add test for enhance getEventValue to handle file inputs (#13289)
• 2ebc8d0 🍖 enhance getEventValue to handle file inputs (#13289)
• 6a38628 ☎️ type perf: improve ts perf with hardcap at 10 depth (#13529)
• ac8a3d0 🐞 fix(useController): resubscribe onChange/onBlur when control changes (#13603)
• Additional commits viewable in compare view

Updates react-i18next from 17.0.8 to 17.0.11

Changelog

Sourced from react-i18next's changelog.

17.0.11

• chore: html-parse-stringify updated to ^4.0.1. The parser powering <Trans> is now actively maintained under the i18next org (i18next/html-parse-stringify) after years without upstream releases. 4.x brings modern dual ESM/CJS packaging with an exports map, zero runtime dependencies, reworked TypeScript types and a long list of parser fixes (literal < in text, multiline/CRLF attribute values, comments containing >, doctype handling, quote-aware bracket handling).
• refactor(Trans): the internal escapeLiteralLessThan scanner (~80 lines) is replaced by the parser's new allowedTags option with identical semantics: only numbered tags, kept basic HTML tags and known component names are parsed as markup, any other tag-shaped sequence in the translation stays literal text. Rendered output is unchanged (all 493 tests pass, including the #1880 and #1893 escaping cases).

17.0.10

• fix(warnings): the useTranslation and Trans "You will need to pass in an i18next instance" warnings now match the useSSR wording, mentioning the props/context alternatives and the most common unexplained cause at scale: duplicate react-i18next copies in monorepo setups. The Trans variant also referenced the internal i18nextReactModule name; it now points to the public initReactI18next API.
• feat(warnings): development-only warning (SUSPENDED_WHILE_LOADING, logged once) right before useTranslation suspends while translations are loading. With the default useSuspense: true and no <Suspense> boundary this previously surfaced as a blank screen or a cryptic React error; the warning now names both fixes (add a <Suspense> boundary or set react.useSuspense: false). No-op in production builds; the process.env.NODE_ENV check is wrapped so runtimes without a process global (raw ESM in the browser, some edge runtimes) stay silent instead of throwing.
• ci: weekly workflow typechecking the test suite against @types/react@next / @types/react-dom@next, so the next React major's type changes (like the React 18 TFunctionResult/children wave) surface before user reports.

17.0.9

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. Fixes #1927, thanks @​andikapradanaarif.
• fix(types): <Trans t={t} ns="ns" …> with a t from useTranslation(['ns']) now typechecks under TypeScript 7. TS7 intersects the Ns inference candidates coming from the t prop (readonly ['ns']) and the ns prop ('ns') into an unsatisfiable 'ns' & readonly ['ns'], where TS6 resolved them. The ns prop on TransProps, TransSelectorProps and IcuTransWithoutContextProps now also accepts a single namespace out of an array-typed Ns (Ns | (Ns extends readonly (infer S extends string)[] ? S : never)) — which matches runtime behavior and is unchanged under TS5/TS6.

Commits

• 274e2e6 17.0.11
• 3c4c563 build
• 1e7ccae chore: html-parse-stringify ^4.0.1 + 17.0.11 changelog
• 4412e25 html-parse-stringify ^4.0.0: replace escapeLiteralLessThan with the parser's ...
• 5787979 ci: types-compat falls back to latest when no @​types/react pre-release tag ex...
• 3b71c27 17.0.10
• 57c3500 build
• c62476f chore: sync package-lock with i18next ^26.2.0 devDependency bump
• 0126bd1 improve instance warnings (monorepo hint) + dev-only suspense warning + weekl...
• 8b4a9ea 17.0.9
• Additional commits viewable in compare view

Updates react-icons from 5.6.0 to 5.7.0

Release notes

Sourced from react-icons's releases.

v5.7.0

What's Changed

• update packages by @​kamijin-fanta in react-icons/react-icons#1153

Full Changelog: react-icons/react-icons@v5.6.0...v5.7.0

Icon Library	License	Version	Count
Circum Icons	MPL-2.0 license	1.0.0	288
Font Awesome 5	CC BY 4.0 License	5.15.4-3-gafecf2a	1612
Font Awesome 6	CC BY 4.0 License	6.7.2-1-g840c215	2060
Ionicons 4	MIT	4.6.3	696
Ionicons 5	MIT	5.5.4	1332
Material Design icons	Apache License Version 2.0	4.0.0-161-gf3fb4442b2	4341
Typicons	CC BY-SA 3.0	2.1.2	336
Github Octicons icons	MIT	18.3.0	264
Feather	MIT	4.29.2	287
Lucide	ISCDescription has been truncated Visual regression report Visual changes detected: 10 changed, 0 added, 0 removed, 442 unchanged. Report: https://docs.borgui.com/visual/reports/pr-778/ Workflow run: https://github.com/karanhudia/borg-ui/actions/runs/30245233903 Changed files - `components-wizard-rclone-remote-dialog--custom-backend-remote--mobile.png` (18.99%) - `pages-cloudstorage--add-guided-remote-setup-missing.png` (9.96%) - `pages-cloudstorage--add-guided-remote.png` (9.96%) - `pages-cloudstorage--browse-dialog.png` (10.97%) - `pages-cloudstorage--delete-confirmation--mobile.png` (11.03%) - `pages-cloudstorage--delete-confirmation.png` (5.76%) - `pages-cloudstorage--editing-remote.png` (9.96%) - `remote-machines-connectiondiagnosticsdialog--partial-tcp-failure.png` (9.38%) - `remote-machines-connectiondiagnosticsdialog--success.png` (11.11%) - `remote-machines-connectiondiagnosticsdialog--timeout.png` (10.78%) New screenshots - None Removed screenshots - None

[github-actions]

🔒 Security Scan Results

Commit: 204cdcb

Check	Status
Frontend (npm audit)	✅ PASSED
Backend (pip-audit)	✅ PASSED
Filesystem (Trivy)	✅ PASSED

📊 See workflow artifacts for detailed reports.

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[github-actions]

🔒 Security Scan Results

Commit: 66f99ca

Check	Status
Frontend (npm audit)	❌ FAILED
Backend (pip-audit)	✅ PASSED
Filesystem (Trivy)	✅ PASSED

📊 See workflow artifacts for detailed reports.