build: bump the frontend-deps group across 1 directory with 41 updates

[dependabot]

Bumps the frontend-deps group with 41 updates in the /App/frontend-app directory:

Package	From	To
@azure/msal-browser	5.11.0	5.20.0
@azure/msal-react	5.4.2	5.7.0
@fluentui/react	8.125.6	8.125.7
@fluentui/react-components	9.74.1	9.74.7
@fluentui/react-datepicker-compat	0.6.32	0.6.37
@fluentui/react-file-type-icons	8.18.0	8.18.1
@fluentui/react-icons	2.0.328	2.0.339
@microsoft/applicationinsights-react-js	19.4.0	19.4.1
@microsoft/applicationinsights-web	3.4.1	3.4.3
i18next	26.3.0	26.4.0
i18next-http-backend	4.0.0	4.0.1
marked	18.0.4	18.0.11
pdfjs-dist	6.0.227	6.3.289
react	19.2.7	19.2.8
@types/react	19.2.16	19.2.18
react-dom	19.2.7	19.2.8
@types/react-dom	19.2.3	19.2.5
react-dropzone	15.0.0	20.1.1
react-i18next	17.0.8	17.0.12
react-router-dom	7.16.0	7.18.3
react-tiff	0.0.16	0.0.17
@testing-library/jest-dom	6.9.1	7.0.1
@testing-library/react	16.3.2	16.3.3
@typescript-eslint/eslint-plugin	8.60.1	8.68.0
@typescript-eslint/parser	8.60.1	8.68.0
@vitejs/plugin-react	6.0.2	6.1.1
autoprefixer	10.5.0	10.5.4
body-parser	2.2.2	2.3.0
concurrently	10.0.3	10.0.5
eslint	10.4.1	10.9.1
eslint-plugin-react-refresh	0.5.2	0.5.5
jest	30.4.2	30.5.0
jest-environment-jsdom	30.4.1	30.5.0
postcss	8.5.15	8.5.26
prettier	3.8.3	3.9.6
prettier-plugin-tailwindcss	0.8.0	0.8.1
sass	1.100.0	1.103.1
tailwindcss	4.3.0	4.3.3
ts-jest	29.4.11	29.4.12
typescript	6.0.3	7.0.2
vite	8.0.16	8.2.2

Updates @azure/msal-browser from 5.11.0 to 5.20.0

Release notes

Sourced from @​azure/msal-browser's releases.

@​azure/msal-browser v5.20.0

5.20.0

Fri, 28 Aug 2026 21:29:53 GMT

Minor changes

• Enable browser-native PublicClientApplication DPoP acquisition flows #8735 (hectormmg@microsoft.com)
• Export IWebBrokerBridgeMessage from the msal-browser package root #8780 (shylasummers@microsoft.com)
• Bump @​azure/msal-common to v16.14.0 (beachball)

Patches

• Discard local storage events from another client ids #8795 (kshabelko@microsoft.com)
• Relocate the cross-version request adapter into the shared webBrokerBridge module without changing request transformation behavior #8771 (shylasummers@microsoft.com)

@​azure/msal-browser v5.19.0

5.19.0

Tue, 18 Aug 2026 20:10:56 GMT

Minor changes

• Add browser token-binding key lifecycle support for keyId-bound ES256 DPoP keys #8708 (hectormmg@microsoft.com)
• Bump @​azure/msal-common to v16.13.0 (beachball)

Patches

• Route NAA BridgeProxy through the shared webBrokerBridge PendingRequestRegistry and consolidate NestedAppAuthAdapter.fromBridgeError through the shared WebBrokerBridgeErrorMap — internal-only, no NAA public API or on-wire changes #8748 (shylasummers@microsoft.com)

@​azure/msal-browser v5.18.0

5.18.0

Tue, 04 Aug 2026 20:17:38 GMT

Minor changes

• Add attribute-tokens support #8700 (spingale@microsoft.com)
• Bump @​azure/msal-common to v16.12.0 (beachball)

Patches

• Add internal webBrokerBridge scaffold (shared message interfaces, error taxonomy, pending-request registry) — no callers yet, no public API surface change #8729 (shylasummers@microsoft.com)

@​azure/msal-browser v5.17.3

5.17.3

Wed, 29 Jul 2026 00:26:30 GMT

Patches

... (truncated)

Commits

• 5931aa7 Remove legacy authority references (#8794)
• b972fbf Discard local storage events from another client ids (#8795)
• 1d07b68 feat(msal-node)!: default responseMode to form_post and remove ILoopbackClien...
• b2c73e9 Fix @​azure/msal-common DOM type dependency (#8784)
• ee74861 fix(deps): SFI CVE remediation — js-yaml, undici, brace-expansion (#8778)
• 4359701 fix(deps): bump @​angular-devkit/build-angular to 22.1.x (patched http-proxy-m...
• 7bfd824 chore(msal-node): remove disallowedChangeTypes guard to allow v6 major releas...
• 8d562d6 [NAA/PWB One Bridge] PR 4/6: Export shared bridge message interface (#8780)
• 62a6c85 Add gated EAR + platform broker (WAM) e2e tests (#8774)
• 0a0adec build(deps-dev): bump fast-uri from 3.1.4 to 3.1.5 (#8753)
• Additional commits viewable in compare view

Updates @azure/msal-react from 5.4.2 to 5.7.0

Release notes

Sourced from @​azure/msal-react's releases.

@​azure/msal-react v5.7.0

5.7.0

Fri, 28 Aug 2026 21:29:54 GMT

Minor changes

• Bump @​azure/msal-browser to v5.20.0 (beachball)

@​azure/msal-node v5.6.0

5.6.0

Tue, 18 Aug 2026 20:10:56 GMT

Minor changes

• Add Azure Arc user-assigned managed identity support: forward the client_id/object_id/msi_res_id selector and fail closed when the token response does not confirm the requested identity #8761 (90415114+gladjohn@users.noreply.github.com)
• Align node token-binding stubs with the keyId-only DPoP key contract #8708 (hectormmg@microsoft.com)
• Bump @​azure/msal-common to v16.13.0 (beachball)

Patches

• Validate the ID Token nonce against the nonce supplied on authorization code requests #8763 (joarroyo@microsoft.com)

@​azure/msal-react v5.6.0

5.6.0

Tue, 18 Aug 2026 20:10:56 GMT

Minor changes

• Bump @​azure/msal-browser to v5.19.0 (beachball)

@​azure/msal-react v5.5.5

5.5.5

Tue, 04 Aug 2026 20:17:39 GMT

Patches

• Bump @​azure/msal-browser to v5.18.0 (beachball)

@​azure/msal-react v5.5.4

5.5.4

Wed, 29 Jul 2026 00:26:31 GMT

Patches

• Bump @​azure/msal-browser to v5.17.3 (beachball)

... (truncated)

Commits

• 5931aa7 Remove legacy authority references (#8794)
• b972fbf Discard local storage events from another client ids (#8795)
• 1d07b68 feat(msal-node)!: default responseMode to form_post and remove ILoopbackClien...
• b2c73e9 Fix @​azure/msal-common DOM type dependency (#8784)
• ee74861 fix(deps): SFI CVE remediation — js-yaml, undici, brace-expansion (#8778)
• 4359701 fix(deps): bump @​angular-devkit/build-angular to 22.1.x (patched http-proxy-m...
• 7bfd824 chore(msal-node): remove disallowedChangeTypes guard to allow v6 major releas...
• 8d562d6 [NAA/PWB One Bridge] PR 4/6: Export shared bridge message interface (#8780)
• 62a6c85 Add gated EAR + platform broker (WAM) e2e tests (#8774)
• 0a0adec build(deps-dev): bump fast-uri from 3.1.4 to 3.1.5 (#8753)
• Additional commits viewable in compare view

Updates @fluentui/react from 8.125.6 to 8.125.7

Commits

• See full diff in compare view

Updates @fluentui/react-components from 9.74.1 to 9.74.7

Commits

• See full diff in compare view

Updates @fluentui/react-datepicker-compat from 0.6.32 to 0.6.37

Commits

• 03fdfb0 applying package updates
• 3d9960b cherrypPick#17571 - Charting: Callout dismiss on ESC issue solved in all bar ...
• eb1249e Rename Fabric component usage in export to codepen (#17740)
• 0331850 [v7.0] VirtualizedComboBox: ARIA attributes now have valid values after passi...
• e8573af [v7.0] Pickers SuggestionsItems: remove button now visible after receiving ke...
• d2dd7fa [v7.0] BasePicker: added high contrast styling to SASS file when picker is di...
• 121f454 applying package updates
• 4762016 Update Picker semantics to ARIA 1.2 combobox pattern in v7 (#17681)
• 9794bad applying package updates
• 623e53b Accessibility fix for Dropdown, v7 (#17715)
• Additional commits viewable in compare view

Updates @fluentui/react-file-type-icons from 8.18.0 to 8.18.1

Commits

• 0490111 applying package updates
• 2cef92d Publish docs pipeline artifact after azure upload (#17881)
• f40b8af Reassign joschect's owned items (#17880)
• df8bf99 Bump ssri from 6.0.1 to 6.0.2 (#17852)
• 58e5e19 Fix bug where adding an item from outside of UPP forces focus on the input (#...
• 222c38f DetailsList Example: removed text only menu item from CommandBar so it's no l...
• c47093e fix(makeStyles): DOM renderer should not throw in SSR (#17904)
• 0156818 Export Portal from react-components (#17870)
• 619ff0a Remove default document in useOnClickOutside (#17898)
• 10a1982 feat(Popup): add data-popup-trapfocus to differentiate beween dialog and popu...
• Additional commits viewable in compare view

Updates @fluentui/react-icons from 2.0.328 to 2.0.339

Commits

• See full diff in compare view

Updates @microsoft/applicationinsights-react-js from 19.4.0 to 19.4.1

Changelog

Sourced from @​microsoft/applicationinsights-react-js's changelog.

19.4.1 (June 22nd, 2026)

Changes

• Bump @microsoft/applicationinsights-core-js and @microsoft/applicationinsights-properties-js dependency from ^3.4.1 to ^3.4.2.
• Resolved all reported npm audit vulnerabilities (ws, @babel/core, markdown-it, and the js-yaml transitive chain) with no breaking changes to consumers.

Commits

• See full diff in compare view

Updates @microsoft/applicationinsights-web from 3.4.1 to 3.4.3

Changelog

Sourced from @​microsoft/applicationinsights-web's changelog.

3.4.3 (July 2nd, 2026)

This is a maintenance release for the 3.4.x version line adding a new SDK statistics feature, a PostChannel reliability fix, and dependency security hardening. The @microsoft/1ds-post-js channel is numbered 4.4.3 and requires v3.4.3.

Significant Changes (since 3.4.2)

• Customer SDK Stats: Added a new SdkStats feature that periodically collects internal SDK usage/health statistics. It is enabled by default and can be disabled (or explicitly configured) via the featureOptIn configuration (e.g. featureOptIn: { SdkStats: { mode: FeatureOptInMode.disable } }); the collection interval defaults to 15 minutes (sdkStats.int).

• PostChannel Auto-Flush Stall Fix: Fixed a permanent stall in @microsoft/1ds-post-js where, under sustained intermittent send failures (e.g. a load balancer returning occasional 503s), auto flush could wedge behind the flush() wait-for-idle timer and permanently stop draining the in-memory queue — causing telemetry to be silently dropped as QueueFull until the process was restarted. Auto flush is now fire-and-forget and no longer parks the scheduler waiting for the manager to become completely idle.

• Dependency Security Hardening: Pinned tar to >=7.5.16 to remediate CVE-2026-53655 and resolved the remaining npm audit findings in build tooling via dependency overrides (js-yaml, yaml, markdown-it, linkify-it). These are build/tooling changes and do not affect the published runtime packages.

Changelog

• #2746 Fix PostChannel auto-flush permanent stall under sustained intermittent send failures
• #2745 fix(security): pin tar >=7.5.16 to remediate CVE-2026-53655
• #2707 Enable Customer SDK Stats
• Resolve remaining npm audit findings via dependency overrides (js-yaml, yaml, markdown-it, linkify-it)

Full Changelog: microsoft/ApplicationInsights-JS@3.4.2...3.4.3

3.4.2 (June 18th, 2026)

This is a maintenance release for the 3.4.x version line containing security hardening, bug fixes, build tooling improvements, and CI updates. The @microsoft/1ds-post-js channel is numbered 4.4.2 and requires v3.4.2.

Commits

• See full diff in compare view

Updates i18next from 26.3.0 to 26.4.0

Release notes

Sourced from i18next's releases.

v26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

v26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

v26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

Changelog

Sourced from i18next's changelog.

26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @​manus-use for the responsible disclosure.

26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

Commits

• 652847e 26.4.0
• 6c6025f prettier fix
• 742b9a9 chore: update dependencies and clean up dev tooling
• 06924d9 fix: invalidate toResolveHierarchy cache on in-place fallbackLng mutation
• bb80369 perf: cache toResolveHierarchy (#2444)
• e1c60d4 26.3.6
• 04da43e fix: allow typescript 7 in optional peerDependencies range (react-i18next#1927)
• 8eed4ac build
• 573ae73 26.3.5
• cc54b05 docs(changelog): 26.3.5 — multiline $t() options, replace mutation, escaped-l...
• Additional commits viewable in compare view

Updates i18next-http-backend from 4.0.0 to 4.0.1

Changelog

Sourced from i18next-http-backend's changelog.

4.0.1

• fix: allow @ in ns values so scoped-package-style namespace names such as @organization/package-name fetch correctly again (#191). 3.0.6 relaxed the ns check for / but left @ in the shared denylist. In the URL path position @ is a plain RFC 3986 pchar with no structural meaning; it stays blocked for lng, where it marks the userinfo/authority boundary. Every other pattern from the 3.0.5 advisory (.., \, %, ?, #, whitespace, control chars, prototype keys, oversized inputs) remains blocked for both keys.

Commits

• 5658217 4.0.1
• 2b2e771 fix: allow @ in ns values for scoped-package-style namespaces
• 64c1105 Bump next from 16.2.6 to 16.2.11 in /example/next (#190)
• 7be00f7 Remove deprecated baseUrl from tsconfig to fix Deno CI type check
• 8eeafa2 README: mention npx i18next-cli localize as the zero-to-localized path
• 37df2ff Bump i18next-http-backend from 3.0.1 to 3.0.5 in /example/node (#187)
• 175e327 Bump next from 16.2.3 to 16.2.6 in /example/next (#186)
• b74344c Fix typo in Locize advice section ('backed' → 'backend')
• 5521246 Modernize locize.com URLs and refresh UTM tags
• See full diff in compare view

Updates marked from 18.0.4 to 18.0.11

Release notes

Sourced from marked's releases.

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

• do not nest a link inside a link (#4051) (e250e31)
• inlineTokens rebuilds the reflink-mask preamble per call (#4040) (0653c24)
• keep emphasis in the text of a rejected reference link (#4059) (b699db3)

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

• keep the em/strong mask the same length as the source (#4044) (681373c)
• parse EOF backtick fences after paragraphs (#4039) (81bd750)
• place task checkboxes after list loose is finalized (#4046) (b8cf7dc), closes #4045

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

• an unmatched strong run before emphasis stays literal (#4008) (e8544e6)
• Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)
• pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

• fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

• Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes (#4014) (f945fc5), closes #3991
• Avoid O(n^2) masked source rebuild in inline tokenizer (#4017) (9154f8f)
• keep empty list after blockquote as a sibling block (#4004) (3f144a0)
• preserve code spans adjacent to tildes (#4012) (0de7188)
• Recognize setext headings whose first line starts with # (#4015) (f056437), closes #1
• treat a line of only tabs as a blank line between paragraphs (#4007) (bc2f121)

... (truncated)

Commits

• 53cb13f chore(release): 18.0.11 [skip ci]
• 0c6b2a6 docs: add adaptable bullet point (#4058)
• c430a64 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#4069)
• b699db3 fix: keep emphasis in the text of a rejected reference link (#4059)
• 0653c24 fix: inlineTokens rebuilds the reflink-mask preamble per call (#4040)
• e250e31 fix: do not nest a link inside a link (#4051)
• 8698d35 chore(release): 18.0.10 [skip ci]
• 58367a5 chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 (#4055)
• a426c4d chore(deps-dev): bump esbuild from 0.28.1 to 0.28.2 (#4056)
• a5cf277 chore(deps-dev): bump highlight.js from 11.11.1 to 11.12.0 (#4057)
• Additional commits viewable in compare view

Updates pdfjs-dist from 6.0.227 to 6.3.289

Release notes

Sourced from pdfjs-dist's releases.

v6.3.289

This release contains improvements for accessibility, annotation editing, annotation rendering, font conversion, image decoding, performance, text selection and the viewer.

Changes since v6.2.108

• Bump the stable version in pdfjs.config by @​timvandermeij in mozilla/pdf.js#21655
• [Editor] Restore pinch-to-resize on an editor which came back from an undo by @​calixteman in mozilla/pdf.js#21644
• Use more more optional chaining in the src/ folder by @​Snuffleupagus in mozilla/pdf.js#21661
• Avoid duplicate shared object clones by @​calixteman in mozilla/pdf.js#21658
• Avoid mutating source widget parents by @​calixteman in mozilla/pdf.js#21660
• Fix the selection rendering when a page has been destroyed and rendered again (bug 2054348) by @​calixteman in mozilla/pdf.js#21666
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in mozilla/pdf.js#21669
• Sync the viewer chrome with the Firefox design system by @​calixteman in mozilla/pdf.js#21665
• [api-minor] Convert getJSActions to return data in a Map by @​Snuffleupagus in mozilla/pdf.js#21664
• Use the client coordinates for the pinch-zoom origin by @​calixteman in mozilla/pdf.js#21659
• Re-factor the EventBus to use Map/Set internally by @​Snuffleupagus in mozilla/pdf.js#21673
• Replace simple return if statements with ternary operators by @​Snuffleupagus in mozilla/pdf.js#21672
• Let pointerup/cancel propagate in TouchManager by @​calixteman in mozilla/pdf.js#21674
• Shorten the ViewHistory class a little bit by @​Snuffleupagus in mozilla/pdf.js#21678
• Don't throw on an invalid XML character reference by @​calixteman in mozilla/pdf.js#21682
• Fix the regex used to normalize css fonts in XFA by @​calixteman in mozilla/pdf.js#21680
• Trim the response headers with a backward scan by @​calixteman in mozilla/pdf.js#21684
• Find the PDF filename in a URL hash in two linear steps by @​calixteman in mozilla/pdf.js#21685
• Scan backwards to delete a word in a text field by @​calixteman in mozilla/pdf.js#21687
• Add scripts correctly in Field.prototype.setAction (PR 12569 follow-up) by @​Snuffleupagus in mozilla/pdf.js#21691
• Update dependencies to the most recent versions by @​timvandermeij in mozilla/pdf.js#21689
• Exclude "&" from the XML entity names by @​calixteman in mozilla/pdf.js#21692
• [api-minor] Convert getFieldObjects to return data in a Map by @​Snuffleupagus in mozilla/pdf.js#21671
• Anchor the regex used to extract the XFA path positions by @​calixteman in mozilla/pdf.js#21686
• Don't write numbers in exponentia...

  Description has been truncated