[dependabot]

Bumps the npm-minor-and-patch group with 28 updates:

Package	From	To
@lingui/cli	6.9.0	6.9.1
@lingui/conf	6.9.0	6.9.1
@lingui/format-po	6.9.0	6.9.1
wrangler	4.147.0	4.149.0
xpath	0.0.34	0.0.35
canvaskit-wasm	0.41.1	0.42.0
@angular/common	22.2.1	22.2.2
@angular/core	22.2.1	22.2.2
@angular/router	22.2.1	22.2.2
astro	7.3.6	7.3.8
electron	44.5.1	44.7.0
react-native	0.86.3	0.87.1
next	16.3.8	16.4.0
nuxt	4.6.0	4.6.1
@base-ui/react	1.8.0	1.9.0
@cloudflare/vite-plugin	1.62.5	1.63.1
@cloudflare/workers-types	5.20261006.1	5.20261010.1
@lingui/babel-plugin-lingui-macro	6.9.0	6.9.1
@lingui/core	6.9.0	6.9.1
@lingui/react	6.9.0	6.9.1
@lingui/vite-plugin	6.9.0	6.9.1
@tanstack/react-router	1.170.41	1.170.42
@tanstack/react-table	9.2.6	9.2.8
@types/node	26.6.4	26.6.5
drizzle-orm	0.45.3	0.45.4
pkijs	3.4.0	3.4.1
solid-js	1.9.15	1.9.17
vite	8.3.3	8.3.4

Updates @lingui/cli from 6.9.0 to 6.9.1

Release notes

Sourced from @​lingui/cli's releases.

v6.9.1

6.9.1 (2026-10-09)

Bug Fixes

• format-csv: read catalogs that end with a line break (#2696) (c3b7838)
• vite-plugin: fail early when native transform is used with Solid (#2708) (15549f3)
• vite-plugin: strip query from module id before native macro transform (#2703) (10c1b79)

Performance Improvements

• cli: write experimental extractor catalogs in worker pool (#2715) (f7731f2)

Changelog

Sourced from @​lingui/cli's changelog.

6.9.1 (2026-10-09)

Performance Improvements

• cli: write experimental extractor catalogs in worker pool (#2715) (f7731f2)

Commits

• 4d33903 chore(release): published v6.9.1 [skip ci] (#2716)
• f7731f2 perf(cli): write experimental extractor catalogs in worker pool (#2715)
• cd0ac4d chore: bump native-tools to 0.1.6 (#2713)
• See full diff in compare view

Updates @lingui/conf from 6.9.0 to 6.9.1

Release notes

Sourced from @​lingui/conf's releases.

v6.9.1

6.9.1 (2026-10-09)

Bug Fixes

• format-csv: read catalogs that end with a line break (#2696) (c3b7838)
• vite-plugin: fail early when native transform is used with Solid (#2708) (15549f3)
• vite-plugin: strip query from module id before native macro transform (#2703) (10c1b79)

Performance Improvements

• cli: write experimental extractor catalogs in worker pool (#2715) (f7731f2)

Changelog

Sourced from @​lingui/conf's changelog.

6.9.1 (2026-10-09)

Note: Version bump only for package @​lingui/conf

Commits

• 4d33903 chore(release): published v6.9.1 [skip ci] (#2716)
• See full diff in compare view

Updates @lingui/format-po from 6.9.0 to 6.9.1

Release notes

Sourced from @​lingui/format-po's releases.

v6.9.1

6.9.1 (2026-10-09)

Bug Fixes

• format-csv: read catalogs that end with a line break (#2696) (c3b7838)
• vite-plugin: fail early when native transform is used with Solid (#2708) (15549f3)
• vite-plugin: strip query from module id before native macro transform (#2703) (10c1b79)

Performance Improvements

• cli: write experimental extractor catalogs in worker pool (#2715) (f7731f2)

Changelog

Sourced from @​lingui/format-po's changelog.

6.9.1 (2026-10-09)

Note: Version bump only for package @​lingui/format-po

Commits

• 4d33903 chore(release): published v6.9.1 [skip ci] (#2716)
• See full diff in compare view

Updates wrangler from 4.147.0 to 4.149.0

Release notes

Sourced from wrangler's releases.

wrangler@4.149.0

Minor Changes

• #16036 9a58244 Thanks @​edevil! - Support temporary event accounts in R2 and Containers commands

  wrangler r2 and wrangler containers commands now accept the hidden --temporary flag, so accounts created for an event can manage buckets, objects and containers directly. Every command that supports --temporary now also accepts a hidden --event-code flag, so the first command a participant runs can create the event account:

  wrangler r2 bucket create my-bucket --temporary --event-code <code>

  R2 and Containers are only available on event accounts. R2 custom domains, Sippy, external container registries and wrangler cloudchamber commands still require a logged-in account.

Patch Changes

• #16139 2d1d563 Thanks @​cpojer! - Update esbuild to 0.28.2

  Align esbuild dependency with tooling using the latest 0.28 patch so package managers can share one installation instead of downloading a second native binary.

• #15632 85b14e7 Thanks @​petebacondarwin! - Honor Retry-After directives during static asset uploads

  Static asset uploads now pause retries and pending uploads until the latest outstanding deadline requested by the API. A per-request limiter also keeps gateway retries at the reduced concurrency after the pause ends, preventing a deployment from immediately overloading a constrained asset service again.

• #16098 fe607f9 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  sharp	0.35.4	0.35.5

• #16093 ad7ff45 Thanks @​DiogoSantoss! - Document that addresses catch-all entries must use the zone apex

  A *@domain entry in addresses must use the zone apex, such as *@example.com. The zone catch-all also receives mail for every subdomain in the zone that has no literal rule.

• #16102 757faa6 Thanks @​tlq5l! - Keep Preview secrets when deploying to an existing Preview

  Secrets added to a Preview with wrangler preview secret put or wrangler preview secret bulk were lost the next time wrangler preview ran, because each new deployment was created from the Wrangler config, --var and --secrets-file values only.

  wrangler preview now carries over the secrets of the Preview's latest deployment. A value passed in this deployment (--secrets-file, --var or a previews binding with the same name) still replaces the existing secret, and wrangler preview secret delete removes one.

• #15617 93c1069 Thanks @​jpatel3! - Stop the update check from recommending deprecated versions

  Previously, the "update available" notice shown by wrangler and @cloudflare/vite-plugin always pointed at whichever version was tagged latest on npm, even after that version had been deprecated for shipping a bug. Deprecated versions are now never recommended: if the latest release has been deprecated, the newest non-deprecated stable release below it is suggested instead, or nothing at all if you are already on it.

  The check now reads the npm registry directly instead of going through the update-check package, which discarded the deprecation information. The on-disk cache location and one-hour refresh interval are unchanged.

• #16003 6947df3 Thanks @​oddharsh! - Ship using and await using declarations to the runtime as written, for smaller Worker bundles

  Workers and Pages Functions that use explicit resource management no longer carry about 1 KB of bundled helper code to emulate it. workerd supports using and await using natively at every compatibility date, so wrangler deploy, wrangler versions upload and Pages Functions builds now leave these declarations untouched.

• #15958 82acf3c Thanks @​breken-ai! - Apply each action's own condition in wrangler r2 bucket lifecycle add

... (truncated)

Commits

• 84c4e95 Version Packages (#16099)
• 82acf3c [wrangler] Apply each action's own condition in r2 bucket lifecycle add (#1...
• 757faa6 [wrangler] Keep Preview secrets when deploying to an existing Preview (#16102)
• 85b14e7 [deploy-helpers] respect Retry-After during asset uploads (#15632)
• 6947df3 [wrangler][vite-plugin] Preserve using declarations when bundling (#16003)
• 9a58244 [wrangler] Support temporary event accounts in R2 and Containers commands (#1...
• 540f084 Version Packages (#16034)
• 42c7219 [wrangler] Fix r2 object put and r2 bulk put storing a different key in local...
• 2dde890 [wrangler] Clarify secret version errors and support versions bulk deletions ...
• b4e1299 [wrangler] Add --source-namespace and --source-repo-name for artifacts.repo q...
• Additional commits viewable in compare view

Updates xpath from 0.0.34 to 0.0.35

Commits

• See full diff in compare view

Updates canvaskit-wasm from 0.41.1 to 0.42.0

Commits

• See full diff in compare view

Updates @angular/common from 22.2.1 to 22.2.2

Release notes

Sourced from @​angular/common's releases.

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

compiler-cli

Commit	Description
	don't mark constructor parameter properties as inherited
	optimize missing directive extended checks

core

Commit	Description
	defer afterRenderEffect sequences registered while hooks run
	strip reserved character from translations
	untrack onError handler to prevent signal write exceptions

forms

Commit	Description
	don't crash when control is missing in setUpValidators
	skip class bindings for orphaned fields
	use Object.is when comparing control bindings in signal forms
	write a pending debounced value when its control is destroyed

language-service

Commit	Description
	add strictUnclaimedEventNames to angularCompilerOptions schema

router

Commit	Description
	fall back when serializing protocol-relative URLs
	remove the navigate event abort listener once it fires
	reset internal state on error handler redirect after state commit

Commits

• See full diff in compare view

Updates @angular/core from 22.2.1 to 22.2.2

Release notes

Sourced from @​angular/core's releases.

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

compiler-cli

Commit	Description
	don't mark constructor parameter properties as inherited
	optimize missing directive extended checks

core

Commit	Description
	defer afterRenderEffect sequences registered while hooks run
	strip reserved character from translations
	untrack onError handler to prevent signal write exceptions

forms

Commit	Description
	don't crash when control is missing in setUpValidators
	skip class bindings for orphaned fields
	use Object.is when comparing control bindings in signal forms
	write a pending debounced value when its control is destroyed

language-service

Commit	Description
	add strictUnclaimedEventNames to angularCompilerOptions schema

router

Commit	Description
	fall back when serializing protocol-relative URLs
	remove the navigate event abort listener once it fires
	reset internal state on error handler redirect after state commit

Commits

• 5ff83c1 fix(compiler): strip script elements regardless of namespace
• 6fa2b08 refactor(compiler): remove img/video src attribute from the URL security cont...
• 54d134b docs: add NG0904 error reference page for UNSAFE_VALUE_IN_RESOURCE_URL
• 7d32808 build: update cross-repo angular dependencies
• db91010 fix(docs-infra): stop generating member anchors that do not exist
• 74bc86d fix(core): untrack onError handler to prevent signal write exceptions
• b20a23d refactor(core): mark runInContext as 3p-only
• 725ffcf fix(compiler): match namespaced root nodes of control flow blocks against ng-...
• 0956441 fix(core): defer afterRenderEffect sequences registered while hooks run
• a312520 fix(core): strip reserved character from translations
• Additional commits viewable in compare view

Updates @angular/router from 22.2.1 to 22.2.2

Release notes

Sourced from @​angular/router's releases.

22.2.2

compiler

Commit	Description
	avoid leaking ::ng-deep detection state between rules
	avoid prototype lookups when resolving entities
	correctly match directives on <ng-template> nested in various namespaces
	ignore @let declarations in the control flow content projection diagnostic
	match namespaced root nodes of control flow blocks against ng-content tag selectors
	strip script elements regardless of namespace

compiler-cli

Commit	Description
	don't mark constructor parameter properties as inherited
	optimize missing directive extended checks

core

Commit	Description
	defer afterRenderEffect sequences registered while hooks run
	strip reserved character from translations
	untrack onError handler to prevent signal write exceptions

forms

Commit	Description
	don't crash when control is missing in setUpValidators
	skip class bindings for orphaned fields
	use Object.is when comparing control bindings in signal forms
	write a pending debounced value when its control is destroyed

language-service

Commit	Description
	add strictUnclaimedEventNames to angularCompilerOptions schema

router

Commit	Description
	fall back when serializing protocol-relative URLs
	remove the navigate event abort listener once it fires
	reset internal state on error handler redirect after state commit

Commits

• 7bc6a1b refactor(router): Remove canLoad from 1p Router
• e0137cb fix(router): remove the navigate event abort listener once it fires
• fc91c72 fix(router): reset internal state on error handler redirect after state commit
• 576df28 fix(router): fall back when serializing protocol-relative URLs
• d98ee02 docs(router): note that shouldReuseRoute doesn't rerun guards and resolvers
• See full diff in compare view

Updates astro from 7.3.6 to 7.3.8

Release notes

Sourced from astro's releases.

astro@7.3.8

Patch Changes

• #18293 28e7410 Thanks @​astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

• #18298 0e9e857 Thanks @​matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

• #18263 882dd98 Thanks @​florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

• #18290 31f13c3 Thanks @​astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

astro@7.3.7

Patch Changes

• #18266 cba76cc Thanks @​astro-factory! - Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

• #18287 38f6793 Thanks @​astro-factory! - Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

• #18222 fcf6ed6 Thanks @​mingjunlu! - Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

• #18240 de4df06 Thanks @​astro-factory! - Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

• #18268 547b572 Thanks @​astro-factory! - Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

Changelog

Sourced from astro's changelog.

7.3.8

Patch Changes

• #18293 28e7410 Thanks @​astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

• #18298 0e9e857 Thanks @​matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

• #18263 882dd98 Thanks @​florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

• #18290 31f13c3 Thanks @​astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

7.3.7

Patch Changes

• #18266 cba76cc Thanks @​astro-factory! - Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

• #18287 38f6793 Thanks @​astro-factory! - Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

• #18222 fcf6ed6 Thanks @​mingjunlu! - Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

• #18240 de4df06 Thanks @​astro-factory! - Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

• #18268 547b572 Thanks @​astro-factory! - Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

Commits

• 3571e2d [ci] release (#18292)
• 0e9e857 Keep existing pnpm allowBuilds approvals in astro add (#18298)
• 882dd98 Replace esbuild with Vite and Rolldown APIs (#18263)
• 28e7410 fix(astro): provide Astro.cache when rendering error pages (#18293)
• 31f13c3 Fix glob() loader watcher ignoring patterns starting with an extglob like `!(...
• 25c19fa [ci] release (#18272)
• 38f6793 fix(astro): approve workerd builds in astro add cloudflare for pnpm v11+ an...
• 547b572 Restore content-type gate in security.checkOrigin so JSON requests are not bl...
• fcf6ed6 fix(assets): return requested format from Sharp transform (#18222)
• bec7d18 Ignore layout frontmatter in Markdown content collection entries with `defe...
• Additional commits viewable in compare view

Updates electron from 44.5.1 to 44.7.0

Release notes

Sourced from electron's releases.

electron v44.7.0

Release Notes for v44.7.0

Features

• The macOS autoUpdater now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. #54204

Fixes

• Fixed an uncatchable TypeError in net.fetch when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. #54672

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. #54666
• Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. #54657

electron v44.6.0

Release Notes for v44.6.0

Features

• Added the experimental protocol.registerSource() to serve a custom scheme from directories on disk without a JavaScript handler. #54522 (Also in 45)

Fixes

• Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. #54596
• Fixed a crash on navigator.usb.requestDevice() in in-memory sessions. #54616 (Also in 45)
• Fixed webview.findInPage() hanging when the host page also has an iframe. #54586 (Also in 43, 45)
• Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. #54623

Documentation

• Documentation changes: #54589

Commits

• 61f55c4 test: bound hidden overlay cold-process runs (#54689)
• a0c11d9 feat: roll Squirrel.Mac for streamed, resumable and delta update downloads (#...
• 44cac48 test: wait for stable focus before checking openExternal removes focus (#54690)
• 505edea test: wait for the webview guest to load before navigating it (#54673)
• fbb54bb test: run WebContentsView focusOnNavigation and shell.openExternal specs seri...
• 06209a5 fix(net): support non-ASCII headers and multiple cookies in net.fetch (#54672)
• 74f6399 chore: cherry-pick 47 changes from angle, chromium, dawn, fontconfig, skia, v...
• 3d7bdb5 test: add mouse-input addon for setIgnoreMouseEvents specs (#54605)
• 0498bc7 chore: cherry-pick 8 changes from angle, chromium, skia, v8 and webrtc (#54657)
• d165ab9 test: listen for both singleton exits before either can happen (#54601)
• Additional commits viewable in compare view

Updates react-native from 0.86.3 to 0.87.1

Release notes

Sourced from react-native's releases.

0.87.1

Added

iOS specific

• SwiftPM: Added hard fail and clear error message when an autolinking plugin host is referenced as a dependency (90a539c92d by @​chrfalch)

Changed

• Hermes: Bump hermes-v1 to 250829098.0.17 (861e2d0bde by @​cipolleschi)

Fixed

• Animated: Animated.Value.addListener() types its callback payload as {value: number} rather than any (3eab03df4c by @​huntie)
• Animated: Animated.event() is typed as an event handler rather than any (3eb330a365 by @​huntie)

iOS specific

• Cocoapods: Keep the quotes on header search paths containing spaces in add_rn_third_party_dependencies (71c6bfbfdc by @​Kudo)
• SwiftPM: Reject colliding or invalid spm.modules names instead of silently dropping a module from the build (39cd1dfc4c by @​chrfalch)
• SwiftPM: Resolve Swift manifest naming collisions (962aeec5e5 by @​chrfalch)
• SwiftPM: Fixed not reading spm.name from react-native.config.js when scaffolding the Swift manifest (482acee824 by @​chrfalch)
• SwiftPM: Removed unused field spm.modules.publicHeaderFiles from react-native.config.js's spm section (5168f5f831 by Christian Falch)
• SwiftPM: SwiftPM pipeline now reads react-native.config.js with default exports correctly (ed76640ba6 by @​chrfalch)
• SwiftPM: Created constants for internal SwiftPM packages so that we can create guards to avoid collisions (d36aa4961d by @​chrfalch)
• SwiftPM: Set SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG when injecting SPM (4433cdbe62 by Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.