chore(deps)(deps): bump the runtime-deps group across 1 directory with 5 updates by dependabot[bot] · Pull Request #33 · web3settle/merchant-sdk

dependabot · 2026-07-27T01:55:19Z

Bumps the runtime-deps group with 4 updates in the / directory: @noble/curves, @noble/hashes, i18next and react-i18next.

Updates @noble/curves from 1.9.1 to 2.2.0

Release notes

Sourced from @noble/curves's releases.

2.2.0

March 2026 self-audit (all files): no major issues found

Audited for spec compliance and security

ed25519: make zip215 verification logic match spec more strictly (spec vectors were not enough)

ed448: turn off zip215 mode by default, use stricter one

schnorr: reduce rand by mod N instead of throwing

math: hardening of sqrt

babyjubjub: use correct curve and curve params

der: improve parsing

bls: improve point decoding

bls, bn: Fix Fp6 / Fp12 order

hash-to-curve: empty dst / count now throws

Apply Object.freeze to most primitives

Other minor hardening

Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+

TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>

This creates incompatibility of code between versions

Previously, it was hard to use and constantly emitted errors similar to TS2345

See typescript#62240 for more context

Implement FROST threshold signatures from RFC 9591

Fix compilation issues on TypeScript v6

Improve tree-shaking, reduce bundle sizes

Add massive amounts of documentation everywhere

(We're skipping v2.1, to align with other noble packages)

Full Changelog: paulmillr/noble-curves@2.0.1...2.2.0

2.0.1

Disable extension-less imports. If you've used /ed25519, switch to /ed25519.js now. See 2.0.0 for more details.

package.json: specify exported submodules to ensure typescript autocompletion

package.json: bump hashes to 2.0.1 with scrypt & pkg.json changes

ed25519: export map_to_curve_elligator2_curve25519 paulmillr/noble-curves#211

bls: try-catch pairingBatch in bls12_381.verify() by @MegaManSec in paulmillr/noble-curves#212

fft: expose extra info in rootsOfUnity

New Contributors

@MegaManSec made their first contribution in paulmillr/noble-curves#212

GitHub Immutable Releases

This GH release does not include standalone noble-curves.js: use 2.0.0 for now, until we upgrade to newly added Immutable Releases

Full Changelog: paulmillr/noble-curves@2.0.0...2.0.1

2.0.0

High-level

v2 massively simplifies internals, improves security, reduces bundle size and lays path for the future. To simplify upgrading, upgrade first to curves 1.9.x. It would show deprecations in vscode-like text editor.

... (truncated)

Commits

043905d Release 2.2.0.
aa55711 Add more tests for wnaf
1574a6c Remove unused argument from multiplyUnsafe
ea1c7b3 Fix typo in createOPRF. gh-234
22057a1 Merge pull request #235 from ChALkeR/chalker/deepview/endo/0
d04fb69 Merge pull request #236 from ChALkeR/patch-4
8041fec Inline toAffine and assertPointValid
76b26be fix a misleading comment
df0ccf4 Bump noble-hashes to 2.2.0
3e5f1b8 Run prettier format on tests
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @noble/curves since your current version.

Updates @noble/hashes from 1.8.0 to 2.2.0

Release notes

Sourced from @noble/hashes's releases.

2.2.0

March 2026 self-audit (all files): no major issues found

Audited for spec compliance and security

Fix: dkLen=0 handling in pbkdf2, blake2, turboshake, kt

Fix: parallelHash with blockLen=0

Fix: argon2 progress callback now reaches 100%

Improve: digestInto no longer returns a value (better performance)

Improve: argon2, blake2 support non-4-divisible dkLen

Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+

TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>

This creates incompatibility of code between versions

Previously, it was hard to use and constantly emitted errors similar to TS2345

See typescript#62240 for more context

sha3: speed-up by up to 50%. Contributed by @ChALkeR in paulmillr/noble-hashes#126

Fix compilation issues on TypeScript v6

Make package Big Endian friendly. All tests pass on s390x

Improve tree-shaking, reduce bundle sizes

Add massive amounts of documentation everywhere

(We're skipping v2.1, to align with other noble packages)

Full Changelog: paulmillr/noble-hashes@2.0.1...2.2.0

2.0.1

.js extension must be used for all modules

Old: @noble/hashes/sha3

New: @noble/hashes/sha3.js

This simplifies working in browsers natively without transpilers

This was planned for 2.0.0, but was accidentally left out

package.json: specify exported submodules to ensure typescript autocompletion

scrypt: Fix error message for maxmem check by @ChALkeR in paulmillr/noble-hashes#121

scrypt: 4% speed-up by @ChALkeR in paulmillr/noble-hashes#122

Full Changelog: paulmillr/noble-hashes@2.0.0...2.0.1

2.0.0

High-level

The package is now ESM-only. ESM can finally be loaded from common.js on node v20.19+

Node v20.19 is now the minimum required version

Package imports now work correctly in bundler-less environments, such as browsers

Reduces npm package size (traffic consumed): 152KB => 136KB

Reduces unpacked npm size (on-disk space): 1.1MB => 669KB

Make bundle sizes smaller, compared to v1.x

.js extension must be used for all modules

Old: @noble/hashes/sha3

New: @noble/hashes/sha3.js

This simplifies working in browsers natively without transpilers

Changes

... (truncated)

Commits

81983c2 Release 2.2.0.
8883d32 Minor syntax fixes
e5fedba Run prettier format on tests
72e2083 Changes related to March 2026 audit (new tests)
fd9f580 Changes related to March 2026 audit (typed arrays)
9a216b5 Changes related to March 2026 audit
85e35d5 Clarify sha3.
cc8ea40 Merge pull request #126 from ChALkeR/chalker/unroll/sha3/0/chi
46c3129 Bump typescript to 6.0.2
ca90465 Bump devdeps.
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @noble/hashes since your current version.

Updates i18next from 26.3.1 to 26.3.6

Release notes

Sourced from i18next's releases.

v26.3.6

fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @andikapradanaarif.

v26.3.5

fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @spokodev (#2440).

fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @spokodev (#2441).

fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @spokodev (#2442).

v26.3.4

fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @spokodev (#2437).

Changelog

Sourced from i18next's changelog.

26.3.6

fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @andikapradanaarif.

26.3.5

fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @spokodev (#2440).

fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @spokodev (#2441).

fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @spokodev (#2442).

26.3.4

fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @manus-use for the responsible disclosure.

26.3.3

fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @sauravgupta-dotcom (#2438). Fixes #2398.

26.3.2

fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @spokodev (#2437).

Commits

e1c60d4 26.3.6
04da43e fix: allow typescript 7 in optional peerDependencies range (react-i18next#1927)
8eed4ac build
573ae73 26.3.5
cc54b05 docs(changelog): 26.3.5 — multiline $t() options, replace mutation, escaped-l...
3180d67 fix: skip interpolation of placeholders inside escaped values (#2442)
d16f5a2 fix: stop mutating the passed replace object when returning details (#2441)
bed56c1 fix: parse $t() nesting options block that spans multiple lines (#2440)
c19e458 docs(changelog): link GHSA advisory for deepExtend fix
7bb87d0 docs(changelog): reference security advisory for deepExtend fix
Additional commits viewable in compare view

Updates react-i18next from 17.0.8 to 17.0.11

Changelog

Sourced from react-i18next's changelog.

17.0.11

chore: html-parse-stringify updated to ^4.0.1. The parser powering <Trans> is now actively maintained under the i18next org (i18next/html-parse-stringify) after years without upstream releases. 4.x brings modern dual ESM/CJS packaging with an exports map, zero runtime dependencies, reworked TypeScript types and a long list of parser fixes (literal < in text, multiline/CRLF attribute values, comments containing >, doctype handling, quote-aware bracket handling).

refactor(Trans): the internal escapeLiteralLessThan scanner (~80 lines) is replaced by the parser's new allowedTags option with identical semantics: only numbered tags, kept basic HTML tags and known component names are parsed as markup, any other tag-shaped sequence in the translation stays literal text. Rendered output is unchanged (all 493 tests pass, including the #1880 and #1893 escaping cases).

17.0.10

fix(warnings): the useTranslation and Trans "You will need to pass in an i18next instance" warnings now match the useSSR wording, mentioning the props/context alternatives and the most common unexplained cause at scale: duplicate react-i18next copies in monorepo setups. The Trans variant also referenced the internal i18nextReactModule name; it now points to the public initReactI18next API.

feat(warnings): development-only warning (SUSPENDED_WHILE_LOADING, logged once) right before useTranslation suspends while translations are loading. With the default useSuspense: true and no <Suspense> boundary this previously surfaced as a blank screen or a cryptic React error; the warning now names both fixes (add a <Suspense> boundary or set react.useSuspense: false). No-op in production builds; the process.env.NODE_ENV check is wrapped so runtimes without a process global (raw ESM in the browser, some edge runtimes) stay silent instead of throwing.

ci: weekly workflow typechecking the test suite against @types/react@next / @types/react-dom@next, so the next React major's type changes (like the React 18 TFunctionResult/children wave) surface before user reports.

17.0.9

fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. Fixes #1927, thanks @andikapradanaarif.

fix(types): <Trans t={t} ns="ns" …> with a t from useTranslation(['ns']) now typechecks under TypeScript 7. TS7 intersects the Ns inference candidates coming from the t prop (readonly ['ns']) and the ns prop ('ns') into an unsatisfiable 'ns' & readonly ['ns'], where TS6 resolved them. The ns prop on TransProps, TransSelectorProps and IcuTransWithoutContextProps now also accepts a single namespace out of an array-typed Ns (Ns | (Ns extends readonly (infer S extends string)[] ? S : never)) — which matches runtime behavior and is unchanged under TS5/TS6.

Commits

274e2e6 17.0.11
3c4c563 build
1e7ccae chore: html-parse-stringify ^4.0.1 + 17.0.11 changelog
4412e25 html-parse-stringify ^4.0.0: replace escapeLiteralLessThan with the parser's ...
5787979 ci: types-compat falls back to latest when no @types/react pre-release tag ex...
3b71c27 17.0.10
57c3500 build
c62476f chore: sync package-lock with i18next ^26.2.0 devDependency bump
0126bd1 improve instance warnings (monorepo hint) + dev-only suspense warning + weekl...
8b4a9ea 17.0.9
Additional commits viewable in compare view

Updates html-parse-stringify from 3.0.1 to 4.0.1

Release notes

Sourced from html-parse-stringify's releases.

4.0.1

Fixed: allowedTags no longer swallows a valid tag that ends up in the same raw match as a stray < (e.g. Values: <10, <20, and <bold>x</bold>). Only the leading < of a disallowed match is neutralized and scanning resumes right after it, matching the escaping semantics react-i18next used before.

Found by react-i18next's test suite while migrating it to the new allowedTags option. See CHANGELOG.md.

4.0.0

First release from the package's new maintenance home. Functionally builds on 3.1.0; see CHANGELOG.md for the full picture including breaking changes and migration notes.

Breaking: exports map (no deep dist/ imports), boolean attributes are null in the AST and stringify bare, doctype parses as a void node, <script>/<style> content is raw text.

Added: allowedTags parse option, named exports, rewritten TypeScript types (discriminated union incl. CommentNode), zero runtime dependencies, CI with a react-i18next integration gate.

Fixed: comments containing >, unquoted attribute values containing =, double-quote escaping in stringify, and parse no longer mutates the caller's options object.

Changelog

Sourced from html-parse-stringify's changelog.

4.0.1

Fixed

allowedTags: when a stray < and a valid tag ended up in the same raw match (e.g. Values: <10, <20, and <bold>x</bold>), the whole match was treated as text and the valid tag was lost. Now only the leading < of a disallowed match is neutralized and scanning resumes, so glued valid tags are recognized.

4.0.0

First release from the package's new maintenance home: i18next/html-parse-stringify. Functionally it builds on 3.1.0; the breaking changes below are deliberate and small.

Breaking

Modern package entry points: exports map with dual ESM/CJS builds and bundled types. Deep imports like html-parse-stringify/dist/... no longer work; import the package root instead.

Boolean attributes (e.g. disabled) now carry the value null in the AST (was '') and stringify bare: <input disabled/> instead of <input disabled=""/>.

<!DOCTYPE html> parses as a void node and round-trips correctly (#54). Previously the rest of the document was nested inside it and stringify produced </!DOCTYPE>.

<script> and <style> content is treated as raw text: the whole content becomes a single text child, and </> inside it no longer produce bogus tag nodes.

Fixed

Comments containing > (e.g. ) are now parsed fully instead of being cut at the first >.

Unquoted attribute values containing = are no longer truncated at the second = (<div data-x=a=b> now keeps a=b).

stringify escapes double quotes in attribute values as ", so values parsed from single-quoted or multiline attributes can't produce broken markup.

parse no longer mutates the caller's options object.

Added

allowedTags parse option (array of names or predicate): only listed tags are parsed as markup, everything else tag-shaped stays literal text. This is the parser-level version of the escaping that consumers like react-i18next had to implement themselves.

Named exports: import { parse, stringify } from 'html-parse-stringify' (the default export remains for compatibility).

Rewritten TypeScript types with a discriminated union (TagNode | TextNode | CommentNode | ComponentNode) (#56). CommentNode was missing entirely before.

Zero runtime dependencies: the former void-elements dependency is inlined.

CI (lint, tests, build on Node 18–24) plus an integration job that runs the full react-i18next test suite against this parser before anything ships.

3.1.0

Released from the original repository. All community fixes that had been waiting:

LICENSE file added and shipped in the npm package (#66, closes #61) — thanks @monholm

text containing < is no longer truncated (#64, closes #59)

multi-line attribute values are parsed correctly (#63, closes #62) — thanks @steffanhalv

TypeScript declaration shipped and improved (#51, #52, closes #56) — thanks @jiangfengming

text after a comment node is no longer discarded (#53) — thanks @tohosaku

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by adrai, a new releaser for html-parse-stringify since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…h 5 updates Bumps the runtime-deps group with 4 updates in the / directory: [@noble/curves](https://github.com/paulmillr/noble-curves), [@noble/hashes](https://github.com/paulmillr/noble-hashes), [i18next](https://github.com/i18next/i18next) and [react-i18next](https://github.com/i18next/react-i18next). Updates `@noble/curves` from 1.9.1 to 2.2.0 - [Release notes](https://github.com/paulmillr/noble-curves/releases) - [Commits](paulmillr/noble-curves@1.9.1...2.2.0) Updates `@noble/hashes` from 1.8.0 to 2.2.0 - [Release notes](https://github.com/paulmillr/noble-hashes/releases) - [Commits](paulmillr/noble-hashes@1.8.0...2.2.0) Updates `i18next` from 26.3.1 to 26.3.6 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](i18next/i18next@v26.3.1...v26.3.6) Updates `react-i18next` from 17.0.8 to 17.0.11 - [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md) - [Commits](i18next/react-i18next@v17.0.8...v17.0.11) Updates `html-parse-stringify` from 3.0.1 to 4.0.1 - [Release notes](https://github.com/i18next/html-parse-stringify/releases) - [Changelog](https://github.com/i18next/html-parse-stringify/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/html-parse-stringify/commits/v4.0.1) --- updated-dependencies: - dependency-name: "@noble/curves" dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: runtime-deps - dependency-name: "@noble/hashes" dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: runtime-deps - dependency-name: i18next dependency-version: 26.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: react-i18next dependency-version: 17.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-deps - dependency-name: html-parse-stringify dependency-version: 4.0.1 dependency-type: indirect update-type: version-update:semver-major dependency-group: runtime-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-27T01:55:21Z

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 27, 2026

Navigation Menu

Uh oh!

chore(deps)(deps): bump the runtime-deps group across 1 directory with 5 updates - #33

chore(deps)(deps): bump the runtime-deps group across 1 directory with 5 updates#33
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-deps-bb03808c94

dependabot Bot commented on behalf of github Jul 27, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.2.0

2.0.1

New Contributors

GitHub Immutable Releases

2.0.0

High-level

2.2.0

2.0.1

2.0.0

High-level

Changes

v26.3.6

v26.3.5

v26.3.4

v26.3.3

v26.3.2

26.3.6

26.3.5

26.3.4

26.3.3

26.3.2

17.0.11

17.0.10

17.0.9

4.0.1

4.0.0

4.0.1

Fixed

4.0.0

Breaking

Fixed

Added

3.1.0

Uh oh!

dependabot Bot commented on behalf of github Jul 27, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 27, 2026 •

edited

Loading