Skip to content

chore(web): Bump the production-minor-patch group across 1 directory with 3 updates - #1316

Merged
mforce merged 4 commits into
mainfrom
dependabot/npm_and_yarn/web/production-minor-patch-d1187b51e9
Oct 16, 2026
Merged

chore(web): Bump the production-minor-patch group across 1 directory with 3 updates#1316
mforce merged 4 commits into
mainfrom
dependabot/npm_and_yarn/web/production-minor-patch-d1187b51e9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-minor-patch group with 3 updates in the /web directory: @mui/material, i18next and lucide-react.

Updates @mui/material from 9.4.0 to 9.5.0

Release notes

Sourced from @​mui/material's releases.

v9.5.0

A big thanks to the 28 contributors who made this release possible. Here are some highlights ✨:

@mui/material@9.5.0

@mui/icons-material@9.5.0

@mui/system@9.5.0

... (truncated)

Changelog

Sourced from @​mui/material's changelog.

9.5.0

Oct 9, 2026

A big thanks to the 28 contributors who made this release possible. Here are some highlights ✨:

@mui/material@9.5.0

... (truncated)

Commits
  • 1c3f8b4 v9.5.0 (#49370)
  • fecdf80 [material-ui] Keep CSS variable fallbacks in theme.alpha() (@​aarongarciah) ...
  • 2289c13 [skeleton] Fix the background fallback with CSS theme variables (@​aarongarcia...
  • f5fb27a [button] Simplify ExtendButton type (@​sai6855) (#49366)
  • f9a5bf5 [codemod][FormControlLabel] Stop migrating ActionsComponent and remove inputR...
  • 42246c7 [material-ui] Fix theming outliers in Paper, BreadcrumbCollapsed, TablePagina...
  • 2f102d0 [material-ui] Fix slot handling in Autocomplete chips, TextField inputLabel a...
  • cb64823 [docs-infra] Generate the accessibility Known gaps table (@​michelengelen) (#4...
  • c8c40b9 [material-ui] Fix onClose types for Menu, Snackbar and SwipeableDrawer (@​Janp...
  • be73046 [table pagination actions] Maintain consistency in common types with other co...
  • Additional commits viewable in compare view

Updates i18next from 26.4.2 to 26.4.4

Release notes

Sourced from i18next's releases.

v26.4.4

  • fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
  • fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

  • perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).
Changelog

Sourced from i18next's changelog.

26.4.4

  • fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. See advisory GHSA-5jr9-983r-c8x4, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
  • fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

26.4.3

  • perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).
Commits
  • f6a7746 26.4.4
  • 25988d5 build
  • c9f8eba fix(security): nesting regexp ReDoS on unclosed $t( and single-pass nest(), c...
  • 0d2845a 26.4.3
  • a2dbe15 build
  • e75843f perf: cache non-empty bundles in hasLanguageSomeTranslations, changelog v26.4.3
  • edaea71 Fix TypeScript examples build and update them to i18next v26 (#2448)
  • 4ebd19d docs: "For AI assistants" paragraph in the README and a fuller saveMissing JSDoc
  • See full diff in compare view

Updates lucide-react from 1.52.0 to 1.56.0

Release notes

Sourced from lucide-react's releases.

Version 1.56.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

Version 1.55.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.54.0...1.55.0

Version 1.54.0

What's Changed

Full Changelog: lucide-icons/lucide@1.53.0...1.54.0

Version 1.53.0

What's Changed

... (truncated)

Commits
  • 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 16, 2026
@dependabot
chore(web): Bump the production-minor-patch group across 1 directory …
f85ad89 
…with 3 updates

Bumps the production-minor-patch group with 3 updates in the /web directory: [@mui/material](https://github.com/mui/material-ui/tree/HEAD/packages/mui-material), [i18next](https://github.com/i18next/i18next) and [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react).


Updates `@mui/material` from 9.4.0 to 9.5.0
- [Release notes](https://github.com/mui/material-ui/releases)
- [Changelog](https://github.com/mui/material-ui/blob/v9.5.0/CHANGELOG.md)
- [Commits](https://github.com/mui/material-ui/commits/v9.5.0/packages/mui-material)

Updates `i18next` from 26.4.2 to 26.4.4
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.4.2...v26.4.4)

Updates `lucide-react` from 1.52.0 to 1.56.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.56.0/packages/lucide-react)

---
updated-dependencies:
- dependency-name: "@mui/material"
  dependency-version: 9.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: i18next
  dependency-version: 26.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(web): Bump the production-minor-patch group in /web with 3 updates chore(web): Bump the production-minor-patch group across 1 directory with 3 updates Oct 16, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/web/production-minor-patch-d1187b51e9 branch from 19e78db to f85ad89 Compare October 16, 2026 17:42
@mforce mforce mentioned this pull request Oct 16, 2026
Open
mforce added 3 commits October 16, 2026 20:26
@mforce
build(web): raise the precache ceiling to 1,680 KiB for #1316
b69f1cf 
The @mui/material 9.5.0, i18next 26.4.4 and lucide-react 1.55.0 bumps
take the precache to 1,677.86 KiB, over the 1,675 KiB ceiling. The
maintainer approved the raise. #1322 tracks finding savings to lower it.
@mforce
Merge remote-tracking branch 'origin/main' into dependabot/npm_and_ya…
6b1b7da 
…rn/web/production-minor-patch-d1187b51e9
@mforce
build(web): name lucide-react 1.56.0 in the precache ceiling note
685a3c5 
Dependabot's rebase of #1316 moved lucide-react to 1.56.0. The
precache still measures 1,677.86 KiB.
@mforce
mforce merged commit 884b971 into main Oct 16, 2026
21 checks passed
@mforce
mforce deleted the dependabot/npm_and_yarn/web/production-minor-patch-d1187b51e9 branch October 16, 2026 20:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mforce