Skip to content

chore(deps):(deps): bump the production-patches group across 1 directory with 9 updates - #6389

Merged
daggerstuff merged 1 commit into
stagingfrom
dependabot/npm_and_yarn/production-patches-6875858c57
Oct 26, 2026
Merged

chore(deps):(deps): bump the production-patches group across 1 directory with 9 updates#6389
daggerstuff merged 1 commit into
stagingfrom
dependabot/npm_and_yarn/production-patches-6875858c57

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-patches group with 9 updates in the / directory:

Package From To
@cloudflare/ai-chat 0.12.1 0.12.2
@iconify-json/lucide 1.2.145 1.2.147
@tanstack/react-query 5.104.4 5.104.5
i18next 26.5.2 26.5.6
mongoose 9.11.2 9.11.3
react-i18next 17.1.0 17.1.3
workers-ai-provider 4.0.0 4.0.1
zustand 5.0.15 5.0.16
@vercel/connect 2.5.2 2.5.5

Updates @cloudflare/ai-chat from 0.12.1 to 0.12.2

Release notes

Sourced from @​cloudflare/ai-chat's releases.

@​cloudflare/ai-chat@​0.12.2

Patch Changes

  • #2615 05843e4 Thanks @​mattzcarey! - Chat recovery now seals a turn after chatRecovery.maxInterruptedAttempts interrupted attempts (default 5), so a turn that exceeds the Durable Object memory limit on every run no longer retries forever; maxOomRetries is deprecated. See Stream Recovery.
Changelog

Sourced from @​cloudflare/ai-chat's changelog.

0.12.2

Patch Changes

  • #2615 05843e4 Thanks @​mattzcarey! - Chat recovery now seals a turn after chatRecovery.maxInterruptedAttempts interrupted attempts (default 5), so a turn that exceeds the Durable Object memory limit on every run no longer retries forever; maxOomRetries is deprecated. See Stream Recovery.
Commits
  • fc7f59f Version Packages (#2588)
  • 05843e4 fix(chat-recovery): seal a turn after repeated interrupted attempts (#2615)
  • cf7c9e3 fix(chat): release useAgentChat streaming protection when the socket closes (...
  • See full diff in compare view

Updates @iconify-json/lucide from 1.2.145 to 1.2.147

Commits

Updates @tanstack/react-query from 5.104.4 to 5.104.5

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5
    • @​tanstack/query-devtools@​5.104.5

@​tanstack/react-query-next-experimental@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5

@​tanstack/react-query-persist-client@​5.104.5

Patch Changes

  • Updated dependencies [1f8d134]:
    • @​tanstack/react-query@​5.104.5
    • @​tanstack/query-persist-client-core@​5.104.5

@​tanstack/react-query@​5.104.5

Patch Changes

  • #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
  • Updated dependencies [f608f93]:
    • @​tanstack/query-core@​5.104.5
Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.5

Patch Changes

  • #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
  • Updated dependencies [f608f93]:
    • @​tanstack/query-core@​5.104.5
Commits

Updates i18next from 26.5.2 to 26.5.6

Release notes

Sourced from i18next's releases.

v26.5.6

  • fix: cloneInstance({ forkResourceStore: true }) now copies the resources at every level. It copied them only down to the namespace objects, so nested keys and arrays stayed shared with the original instance: addResource() with a nested key (fork.addResource('en', 'translation', 'greeting.hello', 'Hi')) or a deep addResourceBundle() on the fork also changed the original instance and every other fork. Flat keys were already isolated. Forking a large store takes a bit longer: with 300k keys in nested groups, about 11 ms instead of 3 ms per fork. Clones without forkResourceStore still share the store as before. Thanks @​nk-batman21 (#2456, follow-up to #2270).

v26.5.5

  • fix: with the default skipOnVariables: true, a {{placeholder}} inside a value inserted with an unescaped {{- var}} now stays literal, as it already did for {{var}}. The escape pass ran after the unescaped values were written and scanned them again, so t('{{- a}}', { a: '{{b}}', b: 'c' }) returned 'c' instead of '{{b}}'. With pre-built HTML that carries user text, like t('You may contact {{name}} at {{- emailHTML}}.', { name, emailHTML }), that text could pull another variable of the same t() call into the output. Results with skipOnVariables: false, and values without placeholders, are unchanged. Compatibility note: a {{- var}} value whose placeholders were meant to be filled from the same t() call now keeps them literally; skipOnVariables: false restores the old behavior. Thanks @​nk-batman21 (#2455, reported in #1595).

v26.5.4

  • fix: with the default skipOnVariables: true, a {{placeholder}} inside an interpolated value now stays literal also when the same placeholder appears later in the translation. Each value was written with String.replace, which replaces the first copy of the placeholder text, and that could be the copy inside an earlier value: t('{{name}} has {{count}} items', { name: '{{count}}', count: 5 }) returned '5 has {{count}} items' instead of '{{count}} has 5 items'. The value is now written at the position of the matched placeholder. Results with skipOnVariables: false are unchanged. Thanks @​nk-batman21 (#2454, reported in #1595).
  • fix: with useRawValueToEscape: true, a non-string value in an unescaped {{- var}} placeholder or with escapeValue: false no longer throws val.replace is not a function; it is converted to a string like any other value.

v26.5.3

  • fix(types): with the selector API, a plural key now requires count also when the call passes an explicit ns. t(($) => $.item) already failed without count, but t(($) => $.item, { ns: 'items' }) compiled, although at runtime it looks up item instead of item_one / item_other and returns the key. It now fails the same way, also with ordinal: true, defaultValue, an ns array, a key prefix and i18n.t. Calls with count, context, returnObjects: true and arrays of selectors, as well as return types, are unchanged. Thanks @​nyarthan (#2452).
Changelog

Sourced from i18next's changelog.

26.5.6

  • fix: cloneInstance({ forkResourceStore: true }) now copies the resources at every level. It copied them only down to the namespace objects, so nested keys and arrays stayed shared with the original instance: addResource() with a nested key (fork.addResource('en', 'translation', 'greeting.hello', 'Hi')) or a deep addResourceBundle() on the fork also changed the original instance and every other fork. Flat keys were already isolated. Forking a large store takes a bit longer: with 300k keys in nested groups, about 11 ms instead of 3 ms per fork. Clones without forkResourceStore still share the store as before. Thanks @​nk-batman21 (#2456, follow-up to #2270).

26.5.5

  • fix: with the default skipOnVariables: true, a {{placeholder}} inside a value inserted with an unescaped {{- var}} now stays literal, as it already did for {{var}}. The escape pass ran after the unescaped values were written and scanned them again, so t('{{- a}}', { a: '{{b}}', b: 'c' }) returned 'c' instead of '{{b}}'. With pre-built HTML that carries user text, like t('You may contact {{name}} at {{- emailHTML}}.', { name, emailHTML }), that text could pull another variable of the same t() call into the output. Results with skipOnVariables: false, and values without placeholders, are unchanged. Compatibility note: a {{- var}} value whose placeholders were meant to be filled from the same t() call now keeps them literally; skipOnVariables: false restores the old behavior. Thanks @​nk-batman21 (#2455, reported in #1595).

26.5.4

  • fix: with the default skipOnVariables: true, a {{placeholder}} inside an interpolated value now stays literal also when the same placeholder appears later in the translation. Each value was written with String.replace, which replaces the first copy of the placeholder text, and that could be the copy inside an earlier value: t('{{name}} has {{count}} items', { name: '{{count}}', count: 5 }) returned '5 has {{count}} items' instead of '{{count}} has 5 items'. The value is now written at the position of the matched placeholder. Results with skipOnVariables: false are unchanged. Thanks @​nk-batman21 (#2454, reported in #1595).
  • fix: with useRawValueToEscape: true, a non-string value in an unescaped {{- var}} placeholder or with escapeValue: false no longer throws val.replace is not a function; it is converted to a string like any other value.

26.5.3

  • fix(types): with the selector API, a plural key now requires count also when the call passes an explicit ns. t(($) => $.item) already failed without count, but t(($) => $.item, { ns: 'items' }) compiled, although at runtime it looks up item instead of item_one / item_other and returns the key. It now fails the same way, also with ordinal: true, defaultValue, an ns array, a key prefix and i18n.t. Calls with count, context, returnObjects: true and arrays of selectors, as well as return types, are unchanged. Thanks @​nyarthan (#2452).
Commits

Updates mongoose from 9.11.2 to 9.11.3

Release notes

Sourced from mongoose's releases.

9.11.3 / 2026-10-21

Changelog

Sourced from mongoose's changelog.

9.11.3 / 2026-10-21

8.24.6 / 2026-10-20

Commits
  • 2fb34de chore: release 9.11.3
  • 4aa1f5a Merge pull request #16616 from Automattic/vkarpov15/gh-16602
  • bf971b3 Merge pull request #16617 from Automattic/fix/master-bulk-write-ci
  • 9c30393 fix(model): remove duplicate update declaration in bulkWrite
  • 2eb55e7 Merge branch 'master' of github.com:Automattic/mongoose
  • feb1f56 Merge branch '8.x'
  • c7d721d chore: release 8.24.6
  • 6c0b783 fix(connection): avoid ReferenceError in Connection.bulkWrite()
  • e0ef805 Merge pull request #16602 from maxymlyskov/fix/rethrow-write-errors-from-unor...
  • 3a1cce2 Merge pull request #16605 from mrityunjay-pandey/backport-8x/nested-expr-cast
  • Additional commits viewable in compare view

Updates react-i18next from 17.1.0 to 17.1.3

Changelog

Sourced from react-i18next's changelog.

17.1.3

  • fix(IcuTrans): numeric HTML entities above U+FFFF, like emoji, now decode to the right character. "Hello &#x1F44B; <0>friend</0> &[#127881](https://github.com/i18next/react-i18next/issues/127881);" rendered U+F44B and U+F389, private-use glyphs that usually show as a box, instead of 👋 and 🎉: the decoder used String.fromCharCode, which keeps only the low 16 bits of the code point. This shows up with translations that a TMS or CMS exports HTML-encoded. Entities above U+10FFFF, which are no valid code points, now stay as written instead of becoming U+0000. Entities below U+10000, including surrogate pairs written as two entities, decode as before. Thanks @​nk-batman21 (#1940).

17.1.2

  • fix(Trans): when the only child is a string, a tag whose index the children don't have now renders its own text. <Trans i18nKey="welcome">Welcome</Trans> with "Welcome <1>friend</1>" rendered Welcome e, and defaults="Hi <1>there</1>" with the child Hi rendered Hi i. The fallback for a single object of components ({{ 1: <strong /> }}) looked the tag up on the string and rendered one of its characters. It now applies only when that child is an object, so {{ 1: <strong /> }} renders as before, and the tag falls back to its inner text, as it already did with several children or with a number or an element as the only child. This also stops a single-entry array child holding null ({[null]}, e.g. from a .map that returned null) from throwing Cannot read properties of null. Thanks @​Cayan (#1939).

17.1.1

  • fix(Trans): with components as an object with index keys, the component for key 0 is now rendered. components={{ 0: <a href={path} /> }} with "You're eligible. <0>Get started here.</0>" rendered the text without the link, a self-closing <0/> rendered nothing, and in <0>a <1>b</1></0> both elements were lost, while keys 1 and up and the array form worked. The object was passed on as the indexed children, so <0> resolved to the object itself. It is now looked up by key, like a named components map. This also fixes an array components next to react.transDefaultProps.components, which the merge turns into such an object ({ Bold, 0, 1 }) and so lost its first entry, and a self-closing named tag in a mixed object ({ 0: <a />, Bold: <b /> } with <Bold/>), which rendered as the text <Bold />. Arrays, named maps and index objects starting at 1 render as before. Thanks @​nk-batman21 (#1938).
Commits

Updates workers-ai-provider from 4.0.0 to 4.0.1

Release notes

Sourced from workers-ai-provider's releases.

workers-ai-provider@4.0.1

Patch Changes

  • #675 0146296 Thanks @​mattzcarey! - Deprecate both packages. Use createAI from agents/models/ai-sdk, and ai-search-provider for AI Search. Nothing changes at runtime.
Commits
  • f451cc8 Merge pull request #677 from cloudflare/changeset-release/main
  • 70b5fa4 Version Packages
  • 56c548a Merge pull request #675 from cloudflare/deprecate-providers-for-agents
  • b7fa22e chore: deprecate workers-ai-provider's AI Search in favour of ai-search-provider
  • 216177b chore: deprecate the credentials and REST modes too, now createAI takes an ac...
  • acd2dbd chore: deprecation notes match createAI's catalog ids, BYOK options and resume
  • 0146296 chore: deprecate binding paths superseded by createAI from agents/models/ai-sdk
  • 0e5bc3b Merge pull request #630 from cloudflare/changeset-release/main
  • 504f378 Version Packages
  • ee879a6 Merge pull request #658 from superhighfives/fix/unified-gemini-thought-signat...
  • Additional commits viewable in compare view

Updates zustand from 5.0.15 to 5.0.16

Release notes

Sourced from zustand's releases.

v5.0.16

This version has some improvements thanks to contributors: @​MarshallOfSound @​koreahghg @​chungyo @​Godsdar

What's Changed

Full Changelog: pmndrs/zustand@v5.0.15...v5.0.16

Commits
  • 382d29c v5.0.16
  • b488323 chore(deps): update dev dependencies (#3593)
  • da2706c fix(persist): preserve external devtools action arguments (#3592)
  • a1fea2e fix(devtools): preserve shared connections during store cleanup (#3580)
  • d867e6f fix(devtools): apply serialize.reviver when parsing devtools messages (#3568)
  • dac22e1 perf(react): don't memoize getServerSnapshot in useStore (#3563)
  • d7a5583 Clarify maintainer-guided contribution workflow (#3587)
  • b57db4f docs(create): document that state cannot be read during initialization (#3569)
  • f094eeb ci: build the docs with pmndrs/docs@v4 (#3570)
  • ea612a5 docs: fix broken migrating-to-v5 link in README (#3567)
  • Additional commits viewable in compare view

Updates @vercel/connect from 2.5.2 to 2.5.5

Commits

@dependabot
dependabot Bot requested a review from daggerstuff as a code owner October 26, 2026 03:12
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026
@vercel

vercel Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
pixelated Ignored Ignored Preview Oct 26, 2026 7:04am UTC

Request Review

@dependabot dependabot Bot added the pnpm Pull requests that update pnpm dependencies label Oct 26, 2026
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

  • lhr-1792984544984
  • lhr-1792984557127
  • lhr-1792984568808
  • lhr-1792984579906
  • lhr-1792984590836
  • lhr-1792984601863
  • lhr-1792984612818
  • lhr-1792984623770
  • lhr-1792984634732

Reports are also available as workflow artifacts

@daggerstuff

daggerstuff commented Oct 26, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-patches-6875858c57 branch from f93b759 to f7d325e Compare October 26, 2026 06:11
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

  • lhr-1792995221635
  • lhr-1792995234202
  • lhr-1792995246266
  • lhr-1792995257548
  • lhr-1792995268761
  • lhr-1792995280001
  • lhr-1792995291314
  • lhr-1792995302537
  • lhr-1792995313786

Reports are also available as workflow artifacts

@daggerstuff

daggerstuff commented Oct 26, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
chore(deps):(deps): bump the production-patches group across 1 direct…
04472df 
…ory with 9 updates

Bumps the production-patches group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cloudflare/ai-chat](https://github.com/cloudflare/agents/tree/HEAD/packages/ai-chat) | `0.12.1` | `0.12.2` |
| [@iconify-json/lucide](https://github.com/iconify/icon-sets) | `1.2.145` | `1.2.147` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.104.4` | `5.104.5` |
| [i18next](https://github.com/i18next/i18next) | `26.5.2` | `26.5.6` |
| [mongoose](https://github.com/Automattic/mongoose) | `9.11.2` | `9.11.3` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.1.0` | `17.1.3` |
| [workers-ai-provider](https://github.com/cloudflare/ai) | `4.0.0` | `4.0.1` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.15` | `5.0.16` |
| [@vercel/connect](https://github.com/vercel/vercel/tree/HEAD/packages/connect) | `2.5.2` | `2.5.5` |



Updates `@cloudflare/ai-chat` from 0.12.1 to 0.12.2
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/ai-chat/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/@cloudflare/ai-chat@0.12.2/packages/ai-chat)

Updates `@iconify-json/lucide` from 1.2.145 to 1.2.147
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@tanstack/react-query` from 5.104.4 to 5.104.5
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.5/packages/react-query)

Updates `i18next` from 26.5.2 to 26.5.6
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.5.2...v26.5.6)

Updates `mongoose` from 9.11.2 to 9.11.3
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@9.11.2...9.11.3)

Updates `react-i18next` from 17.1.0 to 17.1.3
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.1.0...v17.1.3)

Updates `workers-ai-provider` from 4.0.0 to 4.0.1
- [Release notes](https://github.com/cloudflare/ai/releases)
- [Commits](https://github.com/cloudflare/ai/compare/workers-ai-provider@4.0.0...workers-ai-provider@4.0.1)

Updates `zustand` from 5.0.15 to 5.0.16
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.15...v5.0.16)

Updates `@vercel/connect` from 2.5.2 to 2.5.5
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/connect/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/@vercel/node@2.5.5/packages/connect)

---
updated-dependencies:
- dependency-name: "@cloudflare/ai-chat"
  dependency-version: 0.12.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patches
- dependency-name: "@iconify-json/lucide"
  dependency-version: 1.2.147
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patches
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.104.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patches
- dependency-name: "@vercel/connect"
  dependency-version: 2.5.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patches
- dependency-name: i18next
  dependency-version: 26.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patches
- dependency-name: mongoose
  dependency-version: 9.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patches
- dependency-name: react-i18next
  dependency-version: 17.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patches
- dependency-name: workers-ai-provider
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patches
- dependency-name: zustand
  dependency-version: 5.0.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-patches
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-patches-6875858c57 branch from f7d325e to 04472df Compare October 26, 2026 07:03
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

px Advisor Review

Risk: unknown

No summary available

No findings.

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

  • lhr-1792998496806
  • lhr-1792998508589
  • lhr-1792998519904
  • lhr-1792998530657
  • lhr-1792998541487
  • lhr-1792998552175
  • lhr-1792998562856
  • lhr-1792998573565
  • lhr-1792998584251

Reports are also available as workflow artifacts

@daggerstuff
daggerstuff merged commit 881e051 into staging Oct 26, 2026
41 of 43 checks passed
@daggerstuff
daggerstuff deleted the dependabot/npm_and_yarn/production-patches-6875858c57 branch October 26, 2026 07:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@daggerstuff daggerstuff Awaiting requested review from daggerstuff daggerstuff is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file pnpm Pull requests that update pnpm dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@daggerstuff