build(deps): bump react-intersection-observer from 10.1.0 to 11.0.0

[dependabot]

Bumps react-intersection-observer from 10.1.0 to 11.0.0.

Release notes

Sourced from react-intersection-observer's releases.

v11.0.0

v11 delivers a ground-up observer lifecycle rewrite, making observation and cleanup more resilient across React 17, 18, and 19. Shared callback-ref handling, idempotent cleanup, and improved threshold behavior make hooks more predictable in real-world mounting and unmounting scenarios.

It also introduces a new Blume-powered documentation site with clearer guides and examples. Storybook and the README have been refreshed to make getting started easier.

Smaller improvements include private vulnerability reporting, stronger PR quality checks with Fallow, dependency updates, and expanded observer lifecycle tests.

What's Changed

• docs: use private vulnerability reporting by @​thebuilder in thebuilder/react-intersection-observer#759
• Fix callback ref cleanup compatibility across React 17–19 by @​thebuilder in thebuilder/react-intersection-observer#760
• fix: make observe cleanup idempotent by @​thebuilder in thebuilder/react-intersection-observer#763
• fix: respect threshold before trigger once cleanup by @​thebuilder in thebuilder/react-intersection-observer#762
• test: characterize hook observer lifecycle by @​thebuilder in thebuilder/react-intersection-observer#764
• refactor: share callback-ref observation between hooks by @​thebuilder in thebuilder/react-intersection-observer#765
• build(deps-dev): bump postcss from 8.5.6 to 8.5.10 by @​dependabot[bot] in thebuilder/react-intersection-observer#761
• Adopt Fallow as a PR quality gate by @​thebuilder in thebuilder/react-intersection-observer#768
• feat: add Blume documentation site by @​thebuilder in thebuilder/react-intersection-observer#770
• Update dependencies by @​thebuilder in thebuilder/react-intersection-observer#771
• docs: enable vercel analytics by @​thebuilder in thebuilder/react-intersection-observer#772
• Simplify and brand Storybook introduction by @​thebuilder in thebuilder/react-intersection-observer#773
• Update README to simplify bundle size information by @​thebuilder in thebuilder/react-intersection-observer#774
• Use responsive logo lockups in docs header by @​thebuilder in thebuilder/react-intersection-observer#775

Full Changelog: thebuilder/react-intersection-observer@v10.1.0...v11.0.0

Commits

• 43e9a4d chore: release v11.0.0
• 49e3fcc Fix docs callouts and logo theming
• 8ccf00d Use responsive logo lockups in docs header (#775)
• 629b131 Update README to simplify bundle size information (#774)
• 87c8e4e Simplify and brand Storybook introduction (#773)
• 51ef93c docs: enable vercel analytics (#772)
• c8a9566 Update dependencies (#771)
• e364bfb feat: add Blume documentation site (#770)
• e52dfaa Adopt Fallow as a PR quality gate (#768)
• 8a31336 build(deps-dev): bump postcss from 8.5.6 to 8.5.10 (#761)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[mozilla-blender]

Reviewing this major version bump. Workflow run

[mozilla-blender]

NEEDS_REVIEW: this major version bump needs code-owner review

Confidence: medium
Reason: v11.0.0 ships no removed or renamed exports, and the only import in this repo (useInView + the IntersectionOptions type in frontend/src/hooks/gaViewPing.ts) still exists, so the bump compiles and CI is fully green. However, the release is described as a 'ground-up observer lifecycle rewrite' with three behavioral fixes that land squarely on the API this repo depends on: 'fix: respect threshold before trigger once cleanup', 'fix: make observe cleanup idempotent', and 'Fix callback ref cleanup compatibility across React 17-19'. useGaViewPing drives Google Analytics 'View' pings exclusively from the useInView onChange callback with threshold: 1, and it re-dispatches a caller-supplied onChange by hand. A lifecycle/threshold timing change would cause view pings to fire twice or not at all. That is a silent analytics regression: it produces no type error, no render error, and no test failure, which is consistent with CI passing. There is no test for gaViewPing.ts (no gaViewPing.test.ts sibling), jest.config.js contains no IntersectionObserver mock or moduleNameMapper, and the full set of useGaViewPing consumers across frontend/src/components and frontend/src/pages could not be enumerated because the Bash/grep tooling failed in this environment (bwrap loopback error), so the blast radius is unverified. Under the conservative rule, unverified blast radius plus an untested behavioral change to the exact callback contract in use means this should get human eyes rather than auto-merge.

Breaking changes: Ground-up observer lifecycle rewrite (observation and cleanup reworked across React 17/18/19) - behavioral, not API-level; fix: respect threshold before trigger once cleanup (thebuilder/react-intersection-observer#762) - changes when the observer fires relative to the configured threshold, and this repo passes threshold: 1; fix: make observe cleanup idempotent (#763) - repeat cleanup no longer double-unobserves, which can change onChange emission on remount; Fix callback ref cleanup compatibility across React 17-19 (#760) - changes callback-ref teardown semantics for the ref returned by useInView; refactor: share callback-ref observation between hooks (#765) - useInView and useOnInView now share observation internals; No exports were removed or renamed in v11.0.0; useInView and IntersectionOptions remain available; Inherited from v10.0.0 (already adopted at 10.1.0, so not new in this bump): useInView/useOnInView/InView ignore the browser's initial inView === false emission for onChange
Affected code: frontend/src/hooks/gaViewPing.ts:1 - import { IntersectionOptions, useInView } from "react-intersection-observer"; frontend/src/hooks/gaViewPing.ts:13-38 - useGaViewPing calls useInView({ threshold: 1, ...options, onChange }) and only destructures { ref }; the onChange handler sends the GA 'View' event and manually re-invokes options.onChange(inView, entry); frontend/src/hooks/gaViewPing.ts:20 - caller-supplied options are spread in, so any consumer may inject triggerOnce/skip/rootMargin/root/initialInView, all of which are touched by the #762 triggerOnce-vs-threshold cleanup fix; frontend/package.json:34 - sole declaration of the dependency (frontend workspace only; root package.json does not declare it); UNVERIFIED: all useGaViewPing consumers under frontend/src/components/** and frontend/src/pages/** could not be enumerated (no working grep/glob in this environment), so the number of affected components is unknown
Test coverage: Effectively none for the dependency's behavior. There is no gaViewPing.test.ts alongside frontend/src/hooks/gaViewPing.ts. frontend/jest.config.js (jest-environment-jsdom, setupFilesAfterEnv: jest.setup.ts) contains no reference to 'intersection' and no moduleNameMapper, and frontend/jest.setup.ts could not be read to confirm whether an IntersectionObserver polyfill or mock exists; jsdom does not implement IntersectionObserver natively. Coverage thresholds are branches 70 / functions 70 / lines 80 / statements 80 over src/**, which says nothing about this specific hook. Frontend Tests, Mypy, CodeQL, the Docker build and the netlify deploy preview all pass, which confirms the bump type-checks, builds and does not crash renders, but passing CI cannot detect the failure mode at issue here (a GA view ping firing zero or two times instead of once), because no test asserts onChange emission timing for useGaViewPing.

[mozilla-blender]

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 92%, no advisories).