[dependabot]

Bumps the all-dependencies group with 6 updates:

Package	From	To
express-rate-limit	8.7.1	8.7.2
i18next	26.5.10	26.5.12
react-i18next	17.1.8	17.1.9
react-router	8.5.0	8.5.1
electron	45.0.0	45.2.1
marked	18.1.1	18.1.2

Updates express-rate-limit from 8.7.1 to 8.7.2

Release notes

Sourced from express-rate-limit's releases.

v8.7.2

You can view the changelog here.

Commits

• 3fa4577 8.7.2
• 7427a5c v8.7.2 changelog
• da5b115 fix: don't un-count requests that complete after the window resets (#707)
• 28331a7 docs: Restore hyphenated anchor links for error codes (#705)
• 404bc3a docs: show how to reset the key of an IPv6 client (#704)
• e0b3886 docs: fix inverted skipSuccessfulRequests and ipv6Subnet descriptions (#703)
• 97bc073 chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 (#702)
• 991c16d chore(deps): bump ip-address from 10.7.1 to 10.7.3 (#699)
• a6ace2a chore(deps-dev): bump the development-dependencies group with 9 updates (#698)
• 518a0d5 chore(deps): bump ip-address from 10.7.0 to 10.7.1 (#696)
• See full diff in compare view

Updates i18next from 26.5.10 to 26.5.12

Release notes

Sourced from i18next's releases.

v26.5.12

• fix: with keySeparator: false or a custom separator like '::', a nested interpolation value that is 0, false or '' is now inserted. 'You have {{stats.unread}} unread messages' with { stats: { unread: 0 } } kept the raw {{stats.unread}} placeholder (or became '' with skipOnVariables: false), also for formatted values like {{order.total, currency(USD)}} and for nested defaultVariables: a falsy value was looked up again with the configured separator, which does not split stats.unread. The default '.' separator was not affected. When the same name exists both nested and as a flat dotted key ({ a: { b: 0 }, 'a.b': 'flat' }), the nested 0, false or '' now wins, as a truthy one already did; a nested null still falls back to the flat key. Thanks @​nk-batman21 (#2464).
• fix: cloneInstance({ forkResourceStore: true }) no longer changes the options object it is given. It deleted forkResourceStore from it, so reusing the same object for a second clone silently shared the parent's resource store (adding a resource to that clone also changed the parent), and frozen options threw a TypeError. Clones without forkResourceStore are unchanged. Thanks @​edsonsims (#2463).
• perf(types): a selector t(($) => ...) (enableSelector: true / 'strict') no longer filters the whole namespace, and no longer does it again for every distinct context value. To drop keys without anything to select, the filtered type looked at the filtered keys of every nested object, down to the leaves, also for the branches the selector does not read. It now decides from the source value. With 10,000 keys in 100 groups, one call went from 3.3M type instantiations (1.7s) to 0.85M (0.8s), and ten calls with ten contexts from 21.7M (8.8s) to 1.05M (0.9s), on TypeScript 6. Selected values are unchanged for context, plural, ordinal, nested and array keys, with three side effects: a type error on a selector now shows the type as FilterKeysObject<{ ...source keys }, Context> instead of the filtered object, an object whose values are all null or undefined ({ x: null }) is kept as {} instead of being dropped, and a null key next to its plural forms (foo: null, foo_one, foo_other) is typed as the plural value instead of never. Thanks @​GabrielVooDB (#2462).

v26.5.11

• fix: a nested false, 0 or '' is now returned when a flat key with the same dotted name also exists. With { a: { b: false }, 'a.b': 'flat' }, getResource('en', 'translation', 'a.b') and t('a.b') returned 'flat': the nested result was checked for truthiness, so these present values fell through to the flat-key lookup. Without such a flat key they were already returned. A nested null, which is not a valid lookup by default (returnNull: false), still falls back to the flat key. Thanks @​lprnmns (#2461).

Changelog

Sourced from i18next's changelog.

26.5.12

• fix: with keySeparator: false or a custom separator like '::', a nested interpolation value that is 0, false or '' is now inserted. 'You have {{stats.unread}} unread messages' with { stats: { unread: 0 } } kept the raw {{stats.unread}} placeholder (or became '' with skipOnVariables: false), also for formatted values like {{order.total, currency(USD)}} and for nested defaultVariables: a falsy value was looked up again with the configured separator, which does not split stats.unread. The default '.' separator was not affected. When the same name exists both nested and as a flat dotted key ({ a: { b: 0 }, 'a.b': 'flat' }), the nested 0, false or '' now wins, as a truthy one already did; a nested null still falls back to the flat key. Thanks @​nk-batman21 (#2464).
• fix: cloneInstance({ forkResourceStore: true }) no longer changes the options object it is given. It deleted forkResourceStore from it, so reusing the same object for a second clone silently shared the parent's resource store (adding a resource to that clone also changed the parent), and frozen options threw a TypeError. Clones without forkResourceStore are unchanged. Thanks @​edsonsims (#2463).
• perf(types): a selector t(($) => ...) (enableSelector: true / 'strict') no longer filters the whole namespace, and no longer does it again for every distinct context value. To drop keys without anything to select, the filtered type looked at the filtered keys of every nested object, down to the leaves, also for the branches the selector does not read. It now decides from the source value. With 10,000 keys in 100 groups, one call went from 3.3M type instantiations (1.7s) to 0.85M (0.8s), and ten calls with ten contexts from 21.7M (8.8s) to 1.05M (0.9s), on TypeScript 6. Selected values are unchanged for context, plural, ordinal, nested and array keys, with three side effects: a type error on a selector now shows the type as FilterKeysObject<{ ...source keys }, Context> instead of the filtered object, an object whose values are all null or undefined ({ x: null }) is kept as {} instead of being dropped, and a null key next to its plural forms (foo: null, foo_one, foo_other) is typed as the plural value instead of never. Thanks @​GabrielVooDB (#2462).

26.5.11

• fix: a nested false, 0 or '' is now returned when a flat key with the same dotted name also exists. With { a: { b: false }, 'a.b': 'flat' }, getResource('en', 'translation', 'a.b') and t('a.b') returned 'flat': the nested result was checked for truthiness, so these present values fell through to the flat-key lookup. Without such a flat key they were already returned. A nested null, which is not a valid lookup by default (returnNull: false), still falls back to the flat key. Thanks @​lprnmns (#2461).

Commits

• 83f35e4 26.5.12
• a2a354e build
• b6447c1 changelog for 26.5.12
• 8bab707 changelog for unreleased #2464
• 5c43d88 fix: a nested null interpolation value still falls back to a flat key
• 1b7b734 fix: keep nested 0, false and '' interpolation values with a custom keySepara...
• 4184f91 changelog for unreleased #2463
• 4af40e5 fix: preserve caller options when forking instances (#2463)
• 42af830 chore: update dev dependencies to clear the Dependabot alerts
• 39bdcfe perf(types): selector t() no longer filters the whole namespace (#2462)
• Additional commits viewable in compare view

Updates react-i18next from 17.1.8 to 17.1.9

Changelog

Sourced from react-i18next's changelog.

17.1.9

• fix(useTranslation): namespaces added to or removed from the ns array are now picked up. The hook used the array itself as the useMemo dependency list, and React only compares the entries both lists have in common when its length changes, so going from useTranslation(['nsA']) to useTranslation(['nsA', 'nsB']) kept returning ['nsA']: React warned that the dependency array changed size, nsB was never loaded, and with nsMode: 'fallback' keys only in nsB rendered as the key. Removing a namespace kept the old list the same way. The namespaces are now compared by content, so a growing list loads the new namespace (suspending until it is loaded, as switching from 'nsA' to 'nsB' already does) and t uses it. Lists that keep their length behave as before. Thanks @​lprnmns (#1945).

Commits

• 4f4236d 17.1.9
• e1a6945 build
• 8e9b59e changelog for 17.1.9
• 46564b6 fix: refresh translations when namespaces are added (#1945)
• See full diff in compare view

Updates react-router from 8.5.0 to 8.5.1

Release notes

Sourced from react-router's releases.

v8.5.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v851

Changelog

Sourced from react-router's changelog.

v8.5.1

Patch Changes

• Fix URIError: URI malformed when an ssr: false dev server receives a URL path with a malformed percent-encoding (#15649)
• Bound server route manifest processing for paths with expensive route expansion (#15703)
  • Fall back to initial route discovery during server rendering and RSC document/data requests
  • Account for the number and depth of candidate branches when using regex matching
• Encode commas within paths sent to the lazy route discovery manifest endpoint so routes with commas in their paths are discovered correctly (#15640)
• Fix fetcher revalidation errors bubbling to the root error boundary instead of the nearest boundary above the route that owns the fetcher (#15676)
• Avoid duplicate history entries when posting a <Form> to the current URL with an encoded action (#15679)
  • Replace the current history entry when the action contains characters that get percent-encoded, such as spaces or non-ASCII characters
• Fix an unhandled promise rejection when the browser skips a viewTransition navigation, for example in a hidden tab (#15582)
• Bubble rejected lazy.Component imports on loader-less routes to the nearest error boundary (#15658)
  • Render the error boundary instead of a blank page
• Preserve pending fetcher mutation revalidation when an older navigation or background reload completes to prevent stale loader data (#15686)
  • Keep newer fetcher loads cancellable and preserve them when earlier revalidations finish or abort, preventing older responses from overwriting fresh fetcher data
• Retry rejected lazy route imports instead of caching failures permanently (#15689)
• Revalidate loader data when a fetcher action redirect is not followed (#15557)
  • Revalidate when an action redirect is ignored because a newer navigation started or the fetcher unmounted while the action was running
  • Include shared parent loaders when another navigation completed while the action was running
  • Continue to respect shouldRevalidate
  • Return fetchers to idle when a revalidation completes a pending navigation started by another fetcher's redirect
• Avoid adding an incompatible document.startViewTransition() overload to the global Document type (#15680)
  • Allow transition results to be assigned to the DOM ViewTransition type
• Skip deleteData in destroySession when the session has no ID (#15639)
  • Avoid failures when destroying a session without a cookie on storage that rejects an empty key
• Surface the host's 404 response when a SPA fallback route has no prerendered data (#15646)
  • Request single-fetch .data files for hydrating routes with a server loader in an ssr: false app with a prerender config
  • Avoid the internal "No result found for routeId" error for non-prerendered parameterized paths served via the SPA fallback
• Improve turbo-stream decoding validation and object property handling (18e1fbd)

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Add an opt-in <Await unstable_promise={promise}> implementation based on React's use() API (#15678)
  • Use React.use instead of React Router's internal promise tracking
  • Accept promise-like values and retain errorElement, useAsyncValue, and useAsyncError support
  • Handle only promise rejections with errorElement when using unstable_promise, allowing child render errors to bubble to the nearest React error boundary
  • Track streamed promises during decoding so settled server content stays visible during hydration updates with either Await API or direct React.use()
• Fix URIError: URI malformed when an API-only (ssr: "unstable_api-only") server receives a URL path with a malformed percent-encoding (#15649)
• Fix duplicate headers when throwing a redirect from an RSC server function (#15667)

Commits

• a2783e6 Release v8.5.1 (#15656)
• 69465b0 docs: prepare 8.5.1 release notes
• 393d7c1 Bound server route manifest processing (#15703)
• 18e1fbd Improve turbo-stream decoding validation and object property handling
• cc0b62e Add Await unstable_promise and preserve streamed content during hydration (#1...
• a7db797 fix(react-router): retry rejected lazy route imports (#15689)
• 3ef3def fix(react-router): preserve pending mutation revalidation (#15686)
• 6cdc3fa fix(react-router): revalidate when an ignored fetcher action redirect is not ...
• b0a4477 chore: format
• 4f788db Fix 404 on hard load of non-prerendered param route served via SPA fallback (...
• Additional commits viewable in compare view

Updates electron from 45.0.0 to 45.2.1

Release notes

Sourced from electron's releases.

electron v45.2.1

Release Notes for v45.2.1

Other Changes

• Backported fixes from upstream Chromium. #55523
• Updated Chromium to 156.0.8078.75. #55419

electron v45.2.0

Release Notes for v45.2.0

Features

• Added Menu.setHighlightColors() to set menu highlight colors on Windows. #55493 (Also in 46)
• Added support for chrome.storage.sync in extensions. It behaves as a second local storage area with Chrome's sync quotas; there is no cross-device sync. #55253

Fixes

• Fixed DevTools "Save" prompting for a location every time instead of reusing the previously chosen file. #55485
  • Fixed DevTools "Save As" using the old file and Linux cancels treated as saved.
• Fixed fractional opacity being truncated in window.open feature strings. #55499 (Also in 46)
• Fixed webContents.adjustSelection() ignoring the end option. #55462 (Also in 44, 46)

Performance Improvements

• Improved performance of net.fetch() requests without a body. #55446 (Also in 43, 44, 46)
• Improved performance of repeated net.fetch() calls for file: URLs. #55459 (Also in 44, 46)

Other Changes

• Backported fixes from upstream Chromium, Dawn, Skia and V8. #55491

electron v45.1.0

Release Notes for v45.1.0

Features

• Added filtering options to session.registerPreloadScript - matches, excludeMatches, includeGlobs, excludeGlobs, matchOriginAsFallback. #55181 (Also in 44)

Fixes

• Fixed a crash on Linux when a D-Bus method call was made on a disconnected bus. #55292 (Also in 44, 46)
• Fixed a main process crash when onSendHeaders observed Blob uploads. #55169 (Also in 44)
• Fixed extension chrome.webRequest events reporting a tabId of -1 and chrome.declarativeNetRequest rules restricted to tabs never matching. #55283 (Also in 46)
  • Fixed session.clearStorageData() unregistering the service workers of loaded extensions.
  • Fixed chrome.management methods and events being unavailable to extensions with the management permission.
  • Fixed __MSG_*__ placeholders not being localized in extension stylesheets.
  • Fixed extension service workers being stopped after 30 seconds while a WebSocket was active.
  • Fixed sandboxed extension pages being hosted in a process with extension API privileges.
  • Fixed extension service workers running an outdated script after an app restart when the extension's files changed without a version change.

... (truncated)

Commits

• f81ca3d chore: cherry-pick 3 changes from chromium (#55523)
• 19f462d chore: update patches (#55516)
• b4b23b2 chore: bump chromium to 156.0.8078.75 (45-x-y) (#55419)
• 9b4c399 chore: cherry-pick 17 changes from chromium, dawn, skia and v8 (#55491)
• 0d466ef feat: support chrome.storage.sync in extensions (#55253)
• f932043 feat: add Menu.setHighlightColors() for Windows (#55493)
• c74df06 chore: batch backport of #55443, #55441, #55442, #55406, #55381 (#55470)
• 07fe76c fix: preserve fractional window opacity (#55499)
• fa3673f docs: fix netLog.stopLogging() examples (#55497)
• 6671dce fix: handle cancelled and Save As DevTools saves correctly (#55485)
• Additional commits viewable in compare view

Updates marked from 18.1.1 to 18.1.2

Release notes

Sourced from marked's releases.

v18.1.2

18.1.2 (2026-10-26)

Bug Fixes

• allow a tab or end of input after a type 6 html block tag name (#4128) (e09c40d)
• apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145) (5d8e234)
• cli: await config functions before parsing (#4138) (3a11ad1)
• cli: create no-clobber output files atomically (#4135) (e7c4f64)
• do not continue a block quote paragraph from a whitespace-only line (#4134) (42f34a8)
• expand a tab after the block quote marker to the next tab stop (#4110) (2d3899b)
• honor per-call async options when composing hooks (#4139) (379be9d)
• keep a line starting with # but no space in the list item (#4127) (6b63189)
• keep duplicate link definitions in the tokens (#4132) (2784acc)
• keep lazy lines after a list in a nested blockquote (#4137) (38c7e55)
• keep lazy setext underlines in list items as text (#4126) (398234c)
• render nested image alt formatting as plain text (#4131) (15f59bb)
• stop an unclosed inline raw tag from unescaping later blocks (#4130) (4562b6f)

Performance Improvements

• ~16% faster parsing by skipping em/strong masking for runs without *, _ or ~ (#4142) (f0fd3e0)

Commits

• 5beecae chore(release): 18.1.2 [skip ci]
• c1e6ca1 chore(deps): update deps (#4168)
• 3a01ac4 chore: test:redos -> test:recheck (#4167)
• 15f59bb fix: render nested image alt formatting as plain text (#4131)
• 2d3899b fix: expand a tab after the block quote marker to the next tab stop (#4110)
• e09c40d fix: allow a tab or end of input after a type 6 html block tag name (#4128)
• 398234c fix: keep lazy setext underlines in list items as text (#4126)
• 6b63189 fix: keep a line starting with # but no space in the list item (#4127)
• 5d8e234 fix: apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145)
• 3a11ad1 fix(cli): await config functions before parsing (#4138)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions