Skip to content

chore(deps): bump the patch-updates group across 1 directory with 5 updates - #113

Merged
MarkProminic merged 1 commit into
mainfrom
dependabot/npm_and_yarn/patch-updates-eb9c7821c3
Nov 10, 2026
Merged

chore(deps): bump the patch-updates group across 1 directory with 5 updates#113
MarkProminic merged 1 commit into
mainfrom
dependabot/npm_and_yarn/patch-updates-eb9c7821c3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the patch-updates group with 5 updates in the / directory:

Package From To
@intl-tel-input/react 29.5.5 29.5.11
i18next-http-backend 4.0.4 4.0.10
intl-tel-input 29.5.5 29.5.11
react-router-dom 7.18.4 7.18.5
vite 8.3.4 8.3.6

Updates @intl-tel-input/react from 29.5.5 to 29.5.11

Release notes

Sourced from @​intl-tel-input/react's releases.

v29.5.11

  • Update utils to libphonenumber v9.0.43 (6c6cb3a8)

v29.5.10

  • Fix: strictMode allowed an extra digit in countries whose numbers start with a leading zero (04695a77)

v29.5.9

  • Fix: strictMode max length for countries with non-contiguous valid lengths (#2213) (e08d6dd3)

v29.5.8

  • Update utils to libphonenumber v9.0.42 (e3fb7676)

v29.5.7

  • Fix: use <span> instead of <div> inside the selected-country <button> (#2211) (536d2605)

v29.5.6

  • i18n(pt): native review of Portuguese UI strings (#2210) (e209f6b4)
Changelog

Sourced from @​intl-tel-input/react's changelog.

See the Github Releases page for changelog: https://github.com/jackocnr/intl-tel-input/releases

Or to view a specific version, e.g. v29.5.11, update the URL accordingly, e.g. https://github.com/jackocnr/intl-tel-input/releases/tag/v29.5.11

Breaking changes

Commits

Updates i18next-http-backend from 4.0.4 to 4.0.10

Changelog

Sourced from i18next-http-backend's changelog.

4.0.10

Security release. See advisory GHSA-qh2f-jh77-hfwf.

  • security: refuse a request URL whose scheme or authority (host, port, userinfo) differs from what the loadPath / addPath template gives when the lng and ns values are plain data. With a template that puts {{ns}} in the host, e.g. https://{{ns}}.cdn.example.com/{{lng}}.json, an ns value of @evil.example/x (@ ends the userinfo, since 4.0.1) or evil.example/x (/ ends the host, since 3.0.6) sent the request, with its customHeaders, to evil.example. / and @ stay allowed in ns for nested and scoped namespaces such as @org/pkg, and they keep working in the path. The check runs for read and create, and for loadPath / addPath functions that return a template. It includes the 4.0.3 check for a leading //, which it replaces. The default /locales/{{lng}}/{{ns}}.json and other templates with the placeholders in the path were not affected. A value in the host may now only contain letters, digits and -._~!*'().

4.0.9

  • fix: with i18next 26.7.1 or later, reloadInterval reloads everything i18next loaded or tried to load through the backend: the current languages and the languages loaded for clones (one per request on a server), and it retries the bundles that failed. 4.0.8 passed the fallback and preload languages to i18next's reloadResources(), which skipped a bundle that had failed to load, so a language missing after an outage at startup stayed missing (the backend's own reload before 4.0.8 read it again). With older i18next nothing changes.

4.0.8

  • fix: with i18next 26.7.0 or later, create gets its callback. i18next 26.7.0 deprecates guessing the calling convention of a backend from the number of parameters of its methods; the backend now declares it with callbackApi, so i18next calls read and create with a callback (and passes create its options), and debug mode no longer logs the deprecation notice. Older i18next versions ignore it. create(languages, namespace, key, fallbackValue, callback) has five parameters, the number i18next reserved for the form without a callback, so i18next passed its options object as callback, and with a refused lng or ns value create called that object (a TypeError that i18next swallowed).
  • reloadInterval reloads through services.utils.reloadResources with i18next 26.7.0 or later (with i18next's retries and the loaded event) instead of calling i18next's internal backend connector. It reloads the same languages as before: the fallback and preload languages. With older i18next nothing changes.

4.0.7

  • fix: queryStringParams are now added before a #fragment in loadPath / addPath. They were appended after it, and as the fragment is never sent, the server did not get them: with queryStringParams: { v: '1.2.3' }, /locales/en/ns.json?a=1#x now requests /locales/en/ns.json?a=1&v=1.2.3 instead of /locales/en/ns.json?a=1. URLs without a fragment are unchanged. Thanks @​lprnmns (#204)

4.0.6

  • fix: when XMLHttpRequest throws synchronously (open() with an invalid URL, setRequestHeader() with an invalid customHeaders name, send()), the error is now passed to the callback. It was only logged with console.log, so the load never finished and i18next init() did not resolve. Now i18next takes its usual failed-load path. The XHR path is used when no fetch is available and for file: URLs. An XHR that completes inside send() (some polyfills and fake XHRs) is not called back a second time when its callback throws. Thanks @​lprnmns (#203)

4.0.5

  • fix: a loadPath function whose promise rejects now reports the error to i18next. The read callback was never called, so init() / loadNamespaces() never settled (a react-i18next Suspense fallback stayed up for good) and in Node the unhandled rejection ended the process. i18next now takes its usual failed-load path (failedLoading event, "loading namespace ... failed" log) and init() resolves. The error is passed on without retry, like the other non-network errors. Thanks @​nk-batman21 (#201)
Commits
  • 69b683a 4.0.10
  • cf0fc90 security: refuse URLs whose scheme or host a lng/ns value changes (GHSA-qh2f-...
  • 645ad0c 4.0.9
  • a6085ce build
  • f615d3e changelog for 4.0.9
  • 8784f12 fix: hand the reload to i18next 26.7.1 or later, which retries bundles that f...
  • b674794 4.0.8
  • 03366f9 build
  • 31d62d8 changelog for 4.0.8
  • 334dc53 fix: declare callbackApi, so i18next 26.7 calls create with its callback; rel...
  • Additional commits viewable in compare view

Updates intl-tel-input from 29.5.5 to 29.5.11

Release notes

Sourced from intl-tel-input's releases.

v29.5.11

  • Update utils to libphonenumber v9.0.43 (6c6cb3a8)

v29.5.10

  • Fix: strictMode allowed an extra digit in countries whose numbers start with a leading zero (04695a77)

v29.5.9

  • Fix: strictMode max length for countries with non-contiguous valid lengths (#2213) (e08d6dd3)

v29.5.8

  • Update utils to libphonenumber v9.0.42 (e3fb7676)

v29.5.7

  • Fix: use <span> instead of <div> inside the selected-country <button> (#2211) (536d2605)

v29.5.6

  • i18n(pt): native review of Portuguese UI strings (#2210) (e209f6b4)
Changelog

Sourced from intl-tel-input's changelog.

See the Github Releases page for changelog: https://github.com/jackocnr/intl-tel-input/releases

Or to view a specific version, e.g. v29.5.11, update the URL accordingly, e.g. https://github.com/jackocnr/intl-tel-input/releases/tag/v29.5.11

Breaking changes

Commits
  • a99c873 v29.5.11
  • a0a4553 v29.5.10
  • 04695a7 Fix: strictMode allowed an extra digit in countries whose numbers start with ...
  • 3eab3db v29.5.9
  • e08d6dd Fix: strictMode max length for countries with non-contiguous valid lengths (#...
  • a8d3be7 v29.5.8
  • d50ef5e v29.5.7
  • 536d260 Fix: use <span> instead of <div> inside the selected-country <button> (#2211)
  • 5a5aad0 v29.5.6
  • e209f6b i18n(pt): native review of Portuguese UI strings (#2210)
  • Additional commits viewable in compare view

Updates react-router-dom from 7.18.4 to 7.18.5

Changelog

Sourced from react-router-dom's changelog.

v7.18.5

Patch Changes

Commits

Updates vite from 8.3.4 to 8.3.6

Release notes

Sourced from vite's releases.

v8.3.6

Bug Fixes

  • await overlapping plugin container close calls (#23935) (175bbeb)
  • build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
  • build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
  • bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
  • bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
  • deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
  • deps: update all non-major dependencies (#23896) (46b91c5)
  • deps: update all non-major dependencies (#23966) (b3cb057)
  • deps: update rolldown-related dependencies (#23868) (a63eb87)
  • deps: update rolldown-related dependencies (#23967) (0105733)
  • dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
  • html: remove adjacent module tags on the first line (#23823) (eab1dc2)
  • ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
  • optimizer: detect cache dir precisely (#23912) (cc9bc21)
  • optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
  • respect build.sourcemap from environment (#23879) (82e7aa0)
  • server: escape HTML attributes (#23995) (a270391)
  • server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
  • ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
  • use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
  • wasm: reject .wasm outside server.fs (#23914) (64e2467)
  • watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
  • worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

Miscellaneous Chores

Build System

  • generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)

v8.3.5

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.6 (2026-11-05)

Bug Fixes

  • await overlapping plugin container close calls (#23935) (175bbeb)
  • build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
  • build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
  • bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
  • bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
  • deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
  • deps: update all non-major dependencies (#23896) (46b91c5)
  • deps: update all non-major dependencies (#23966) (b3cb057)
  • deps: update rolldown-related dependencies (#23868) (a63eb87)
  • deps: update rolldown-related dependencies (#23967) (0105733)
  • dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
  • html: remove adjacent module tags on the first line (#23823) (eab1dc2)
  • ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
  • optimizer: detect cache dir precisely (#23912) (cc9bc21)
  • optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
  • respect build.sourcemap from environment (#23879) (82e7aa0)
  • server: escape HTML attributes (#23995) (a270391)
  • server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
  • ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
  • use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
  • wasm: reject .wasm outside server.fs (#23914) (64e2467)
  • watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
  • worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

Miscellaneous Chores

Build System

  • generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)

8.3.5 (2026-10-21)

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)

... (truncated)

Commits
  • 0fd9a29 release: v8.3.6 (#23996)
  • eab1dc2 fix(html): remove adjacent module tags on the first line (#23823)
  • a270391 fix(server): escape HTML attributes (#23995)
  • 7139ef3 fix(worker): keep chunks conflicted with unused workers that are still used b...
  • 0fdd81e fix(optimizer): resolve subpath imports (#) with Vite's resolver (#23959)
  • 8069835 fix(build): use stable module ids in chunk import map hash signatures (fix #2...
  • 95c2daf fix: ignore pnpm's .modules.yaml as a Vite Task input (#23634)
  • b3cb057 fix(deps): update all non-major dependencies (#23966)
  • 0105733 fix(deps): update rolldown-related dependencies (#23967)
  • 90bc034 fix: use top-level input for SSR build when build.ssr: true (#23898)
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
chore(deps): bump the patch-updates group across 1 directory with 5 u…
675914b 
…pdates

Bumps the patch-updates group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@intl-tel-input/react](https://github.com/jackocnr/intl-tel-input/tree/HEAD/packages/react) | `29.5.5` | `29.5.11` |
| [i18next-http-backend](https://github.com/i18next/i18next-http-backend) | `4.0.4` | `4.0.10` |
| [intl-tel-input](https://github.com/jackocnr/intl-tel-input/tree/HEAD/packages/core) | `29.5.5` | `29.5.11` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.4` | `7.18.5` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.4` | `8.3.6` |



Updates `@intl-tel-input/react` from 29.5.5 to 29.5.11
- [Release notes](https://github.com/jackocnr/intl-tel-input/releases)
- [Changelog](https://github.com/jackocnr/intl-tel-input/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jackocnr/intl-tel-input/commits/v29.5.11/packages/react)

Updates `i18next-http-backend` from 4.0.4 to 4.0.10
- [Changelog](https://github.com/i18next/i18next-http-backend/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-http-backend@v4.0.4...v4.0.10)

Updates `intl-tel-input` from 29.5.5 to 29.5.11
- [Release notes](https://github.com/jackocnr/intl-tel-input/releases)
- [Changelog](https://github.com/jackocnr/intl-tel-input/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jackocnr/intl-tel-input/commits/v29.5.11/packages/core)

Updates `react-router-dom` from 7.18.4 to 7.18.5
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.5/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.5/packages/react-router-dom)

Updates `vite` from 8.3.4 to 8.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite)

---
updated-dependencies:
- dependency-name: "@intl-tel-input/react"
  dependency-version: 29.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: i18next-http-backend
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: intl-tel-input
  dependency-version: 29.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: react-router-dom
  dependency-version: 7.18.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: vite
  dependency-version: 8.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/patch-updates-eb9c7821c3 branch from 96b0eb6 to 675914b Compare November 10, 2026 10:37
@MarkProminic
MarkProminic merged commit f2c2774 into main Nov 10, 2026
3 of 4 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/patch-updates-eb9c7821c3 branch November 10, 2026 11:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MarkProminic