chore(deps): bump the frontend-dependencies group across 1 directory with 36 updates

[dependabot]

Bumps the frontend-dependencies group with 35 updates in the /frontend directory:

Package	From	To
@sentry/react	9.47.1	10.70.0
@stellar/stellar-sdk	12.3.0	16.2.0
framer-motion	10.18.0	13.1.0
i18next	23.16.8	26.3.6
lucide-react	0.263.1	1.32.0
react	18.3.1	19.2.8
@types/react	18.3.31	19.2.18
react-dom	18.3.1	19.2.8
@types/react-dom	18.3.7	19.2.4
react-i18next	13.5.0	17.0.11
recharts	2.15.4	3.10.1
@axe-core/playwright	4.12.1	4.13.0
@chromatic-com/storybook	5.2.1	5.3.0
@playwright/test	1.62.0	1.62.1
@storybook/addon-a11y	10.5.5	10.5.9
@storybook/addon-docs	10.5.5	10.5.9
@storybook/addon-mcp	0.6.0	0.7.0
@storybook/addon-vitest	10.5.5	10.5.9
@storybook/react	10.5.5	10.5.9
@storybook/react-vite	10.5.5	10.5.9
@testing-library/jest-dom	6.9.1	7.0.1
@testing-library/user-event	14.6.1	14.6.5
@types/node	24.13.3	26.2.0
@vitejs/plugin-react	4.7.0	6.0.5
@vitest/browser-playwright	4.1.10	4.1.11
@vitest/coverage-v8	4.1.10	4.1.11
esbuild	0.28.1	0.28.2
eslint-plugin-storybook	10.5.5	10.5.9
jsdom	26.1.0	30.0.1
postcss	8.5.25	8.5.26
storybook	10.5.5	10.5.9
tailwindcss	3.4.19	4.3.3
typescript	5.9.3	7.0.2
vite	4.5.14	8.2.1
vitest	4.1.10	4.1.11

Updates @sentry/react from 9.47.1 to 10.70.0

Release notes

Sourced from @​sentry/react's releases.

10.70.0

• feat(v10/core): Support stable MCP SDK v2 (#22986)
• feat(v10/deps): Bump @sentry/node-cpu-profiler to 2.4.3 (#22992)
• feat(v10/solid,solidstart): Support @solidjs/router v1 (#23163)
• fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23189)
• fix(v10/cloudflare): Get original waituntil in workflows (#23192)
• fix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy (#23190)
• fix(v10/cloudflare): Set agent conversation id on the onRequest path (#22985)
• fix(v10/cloudflare): Set conversation id independent of session name (#23193)
• fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)
• fix(v10/cloudflare): Use gen_ai.agent.name for class names (#22987)
• fix(v10/core,browser): Handle errors from other realms (#23201)
• fix(v10/core): Sample errors after beforeSend while preserving session updates (#22819)
• fix(v10/hono): Include originalException in captured exception hint (#22990)
• fix(v10/nextjs): meriyah issue for standalone build (#23055)
• fix(v10/nextjs): Remove tracing from middleware wrappers (#22904)
• fix(v10/profiling-node): Respect profileSessionSampleRate in trace profile lifecycle (#22940)
• fix(v10/react-router): Preserve sourcemaps.disable when unstable_sentryVitePluginOptions is set (#22966)
• fix(v10/react): Remove routes from shared set on <Routes> unmount (#22948)
• fix(v10/sveltekit): Export metrics from worker entry point (#23027)

• test(v10/e2e): Add missing @sentry/core dep to nextjs-16-userfeedback (#23009)
• test(v10/e2e): Fix failing sveltekit-3 test (#23016)
• test(v10/e2e): Fix type error in nextjs ai-error tests (#23011)
• test(v10/e2e): Pin tanstackstart-react e2e deps to unblock tunnel tests (#23048)

Work in this release was contributed by @​davidmurdoch, @​Jxxunnn, and @​kamilogorek. Thank you for your contributions!

Bundle size 📦

Path	Size
@​sentry/browser	27.09 KB
@​sentry/browser - with treeshaking flags	25.58 KB
@​sentry/browser (incl. Tracing)	45.5 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.24 KB
@​sentry/browser (incl. Tracing, Profiling)	50.13 KB
@​sentry/browser (incl. Tracing, Replay)	83.82 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.7 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	88.42 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	100.78 KB
@​sentry/browser (incl. Feedback)	43.87 KB
@​sentry/browser (incl. sendFeedback)	31.78 KB
@​sentry/browser (incl. FeedbackAsync)	36.79 KB
@​sentry/browser (incl. Metrics)	28.16 KB

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

10.70.0

• feat(v10/core): Support stable MCP SDK v2 (#22986)
• feat(v10/deps): Bump @sentry/node-cpu-profiler to 2.4.3 (#22992)
• feat(v10/solid,solidstart): Support @solidjs/router v1 (#23163)
• fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23189)
• fix(v10/cloudflare): Get original waituntil in workflows (#23192)
• fix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy (#23190)
• fix(v10/cloudflare): Set agent conversation id on the onRequest path (#22985)
• fix(v10/cloudflare): Set conversation id independent of session name (#23193)
• fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)
• fix(v10/cloudflare): Use gen_ai.agent.name for class names (#22987)
• fix(v10/core,browser): Handle errors from other realms (#23201)
• fix(v10/core): Sample errors after beforeSend while preserving session updates (#22819)
• fix(v10/hono): Include originalException in captured exception hint (#22990)
• fix(v10/nextjs): meriyah issue for standalone build (#23055)
• fix(v10/nextjs): Remove tracing from middleware wrappers (#22904)
• fix(v10/profiling-node): Respect profileSessionSampleRate in trace profile lifecycle (#22940)
• fix(v10/react-router): Preserve sourcemaps.disable when unstable_sentryVitePluginOptions is set (#22966)
• fix(v10/react): Remove routes from shared set on <Routes> unmount (#22948)
• fix(v10/sveltekit): Export metrics from worker entry point (#23027)

• test(v10/e2e): Add missing @sentry/core dep to nextjs-16-userfeedback (#23009)
• test(v10/e2e): Fix failing sveltekit-3 test (#23016)
• test(v10/e2e): Fix type error in nextjs ai-error tests (#23011)
• test(v10/e2e): Pin tanstackstart-react e2e deps to unblock tunnel tests (#23048)

Work in this release was contributed by @​davidmurdoch, @​Jxxunnn, and @​kamilogorek. Thank you for your contributions!

10.69.0

Important Changes

• feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#22786)

The Cloudflare SDK adds a new instrumentAgentWithSentry API for Cloudflare Agents. It works like instrumentDurableObjectWithSentry for Agent classes from the agents SDK and additionally creates spans for @callable RPC methods and automatically sets the conversationId based on the agent's name. When building with the Sentry Vite plugin, Agents are instrumented automatically (#22788).

Other Changes

• feat(v10/cloudflare): Add Spotlight integration for local dev event forwarding (#22796)
• feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)
• feat(v10/cloudflare): Filter framework-internal Durable Object storage spans (#22770)
• feat(v10/cloudflare): Instrument Agents automatically (#22788)
• feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)
• fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)

... (truncated)

Commits

• 0356ffd release: 10.70.0
• c2ac1be meta(changelog): Update changelog for 10.70.0 (#23217)
• 9c2f31d fix(v10/core,browser): Handle errors from other realms (#23201)
• 8ad6cd1 fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)
• 4b5e80a fix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy ...
• 91af62c fix(v10/cloudflare): Set conversation id independent of session name (#23193)
• 2096839 fix(v10/cloudflare): Get original waituntil in workflows (#23192)
• 0062819 fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23...
• 390b05a feat(v10/core): Support stable MCP SDK v2 (#22986)
• 3b56ecb feat(v10/solid,solidstart): Support @solidjs/router v1 (#23163)
• Additional commits viewable in compare view

Updates @stellar/stellar-sdk from 12.3.0 to 16.2.0

Release notes

Sourced from @​stellar/stellar-sdk's releases.

v16.2.0

v16.2.0

Added

• rpc.Server.simulateTransaction accepts an optional useUpgradedAuth flag, and contract.AssembledTransaction accepts it as a method option (useUpgradedAuth) or per-call (tx.simulate({ useUpgradedAuth: true })). When set, RPC simulation records v2 address credentials (CAP-71) instead of the legacy v1 credentials. It only affects the recording auth modes and is silently ignored on hosts that cannot emit v2 credentials. The flag is deprecated from the start: it is transitional and becomes a no-op once the network returns v2 credentials by default (protocol 28) (#1562).
• @stellar/stellar-sdk/base subpath export: import offline primitives like StrKey and Keypair without loading Horizon, RPC, or the SEP helpers and their networking dependencies (#1550).
• authorizeEntry / authorizeInvocation signing callbacks now receive the 32-byte signing payload (hash(preimage.toXDR())) as a second argument alongside the preimage, so signers — including HSMs and remote signers that only accept a digest — never have to re-derive it. Existing single-argument callbacks are unaffected (#1532).
• authorizeEntry / authorizeInvocation now support non-Ed25519 signers: the signing callback may return { signatureScVal: xdr.ScVal, address?: string }, and the given ScVal is written verbatim as the credentials' signature — no Ed25519 verification, no {public_key, signature} map, no scvVec wrapping. This lets smart-wallet / custom-account contracts (whose __check_auth expects its own signature structure) use the helper instead of hand-rolling preimage construction and credential assembly. The optional address routes the signature to a specific credential node, like forAddress (#1530).
• contract.Signer: an interface pairing an address with the SEP-43 signTransaction and optional signAuthEntry methods, plus contract.KeypairSigner, a Keypair-backed implementation. The signTransaction and signAuthEntry options — on ClientOptions, MethodOptions, and AssembledTransaction's sign / signAndSend / signAuthEntries — now accept a Signer or a bare Keypair in addition to a callback. Adds the contract.SignTransactionLike and contract.SignAuthEntryLike types. When signAuthEntries gets a Signer or Keypair, its default target address is now the signer's own address rather than publicKey. Existing callbacks work unchanged; one type-only caveat: the option fields are no longer plain function types, so derive callback shapes from contract.SignTransaction / contract.SignAuthEntry instead of the option field (#1567).
• contract.Spec now reads SEP-48 event declarations: events() and findEvent(name, occurrence?) list a contract's declared events, parseEvent(topics, data) decodes a fired event into { name, data }, with topic-carried params merged into data (returns undefined when nothing matches), and eventTopicFilter(name, topicValues?, occurrence?) builds a getEvents filter row, with "*" for any topic param left unset. Generated client bindings gain a typed <Name>Event interface per event, a ContractEvent union, a parseEvent() method, and per-event <name>EventFilter() methods. A contract may declare the same event name more than once (composed modules each emitting their own transfer); each declaration gets its own interface and filter method, and occurrence — a 0-based index in declaration order — selects among them. Generated names receive a numeric suffix when needed to avoid a collision, and stellar-sdk bindings warns about duplicate declarations and renames. Adds the contract.ParsedEvent type (#1556, #1565, #1572).

Fixed

• Spec.scValToNative now handles contract values typed as Val (scSpecTypeVal) by delegating to the generic scValToNative converter, mirroring the encoding-side support added in #1485. Decoding a response containing a Val-typed string, symbol, vec, or map — e.g. a struct with a Vec<Val> field — no longer throws ScSpecType scSpecTypeVal was not string or symbol; each value decodes to its natural native representation (Address → string, u32 → number, Symbol → string, vecs/maps recurse). (#1551)

Full Changelog: stellar/js-stellar-sdk@v16.1.0...v16.2.0

v16.1.0

v16.1.0

Added

• inspectAuthEntry(entry): decodes a xdr.SorobanAuthorizationEntry into a typed summary — credential type, authorizing address, nonce, signatureExpirationLedger, and a signers list covering top-level credentials and CAP-71 delegates. Adds the AuthEntryInfo, AuthEntrySigner, AuthEntrySignature, and AuthEntryCredentialType types (#1529).
• checkAuthEntryReadiness(entry, currentLedgerSeq): reports whether an auth entry is ready to submit — { ready, expired, unsignedBy } — as a pure decode with no network call (#1529).
• Spec.nativeToScVal now supports contract parameters typed as Val (scSpecTypeVal), so raw JS values can be passed to Val-typed arguments without building xdr.ScVal objects by hand (#1485).
• rpc.Server.queryContract<T>(contractId, method, args?, networkPassphrase?): a one-line read-only contract call that returns { result, isReadCall }, no transaction assembly or signing. Works for Wasm contracts and built-in Stellar Asset Contracts (SACs) (#1502).
• rpc.Server.getContractMethods(contractId, networkPassphrase?): lists a contract's callable methods and their signatures. Adds the Api.ContractMethod and Api.ContractMethodInput types (#1502).
• rpc.Server.getContractInstance(contractId): returns a contract's xdr.ScContractInstance (#1501).
• contract.Client.from, fromWasm, and fromWasmHash are now generic (<T>) and return Client & T, giving typed contract methods without code generation. T defaults to unknown, so untyped calls are unchanged (#1502).
• ClientOptions.server: pass an existing rpc.Server to contract.Client.from to reuse its transport instead of building a new one (#1502).
• Keypair.signMessage(message) and Keypair.verifyMessage(message, signature): sign and verify arbitrary messages per SEP-53, matching the Python and Java SDKs and stellar-cli (#1513).
• TransactionFailedError: raised by Horizon.Server.submitTransaction and submitAsyncTransaction when Horizon rejects a transaction with result codes. Extends BadResponseError and adds getResultCodes() and getTransactionResult() (#1526).

Changed

• HorizonApi.TransactionFailedResultCodes gained the transaction result codes it was missing: tx_bad_sponsorship, tx_bad_min_seq_age_or_gap, tx_malformed, tx_soroban_invalid, and tx_frozen_key_accessed (#1526).
• contract.Client.from now supports built-in Stellar Asset Contracts (SACs), building the client from the embedded SAC spec instead of downloading Wasm (#1501).
• rpc.Server.getContractWasmByContractId now rejects a SAC with a structured { code: 400 } error pointing to contract.Client.from. The not-found rejection is now { code: 404, message: "Could not obtain contract instance from server" } (#1501).
• The UMD (dist/) build now sets inlineDynamicImports so the single-file bundle stays whole despite the SAC spec's lazy import() (#1501).

Fixed

• Horizon.Server.submitTransaction and submitAsyncTransaction now reject with SDK error types on HTTP failures, as documented: a TransactionFailedError for Horizon result codes, a BadResponseError otherwise. The wrapping branch used to be unreachable, so failures leaked through as raw HTTP-client errors. err.response.data and err.response.status are unchanged; the original error is now preserved as err.cause (#1526).
• Federation.Server resolution methods (resolveAddress, resolveAccountId, resolveTransactionId, forDomain) had the same unreachable branch and now reject HTTP failures with BadResponseError (#1526).
• contract.AssembledTransaction.needsNonInvokerSigningBy now treats an empty scvVec signature as unsigned, matching the existing scvVoid check. Such entries used to count as already signed and were left off the list (#1529).

... (truncated)

Changelog

Sourced from @​stellar/stellar-sdk's changelog.

v16.2.0

Added

• rpc.Server.simulateTransaction accepts an optional useUpgradedAuth flag, and contract.AssembledTransaction accepts it as a method option (useUpgradedAuth) or per-call (tx.simulate({ useUpgradedAuth: true })). When set, RPC simulation records v2 address credentials (CAP-71) instead of the legacy v1 credentials. It only affects the recording auth modes and is silently ignored on hosts that cannot emit v2 credentials. The flag is deprecated from the start: it is transitional and becomes a no-op once the network returns v2 credentials by default (protocol 28) (#1562).
• @stellar/stellar-sdk/base subpath export: import offline primitives like StrKey and Keypair without loading Horizon, RPC, or the SEP helpers and their networking dependencies (#1550).
• authorizeEntry / authorizeInvocation signing callbacks now receive the 32-byte signing payload (hash(preimage.toXDR())) as a second argument alongside the preimage, so signers — including HSMs and remote signers that only accept a digest — never have to re-derive it. Existing single-argument callbacks are unaffected (#1532).
• authorizeEntry / authorizeInvocation now support non-Ed25519 signers: the signing callback may return { signatureScVal: xdr.ScVal, address?: string }, and the given ScVal is written verbatim as the credentials' signature — no Ed25519 verification, no {public_key, signature} map, no scvVec wrapping. This lets smart-wallet / custom-account contracts (whose __check_auth expects its own signature structure) use the helper instead of hand-rolling preimage construction and credential assembly. The optional address routes the signature to a specific credential node, like forAddress (#1530).
• contract.Signer: an interface pairing an address with the SEP-43 signTransaction and optional signAuthEntry methods, plus contract.KeypairSigner, a Keypair-backed implementation. The signTransaction and signAuthEntry options — on ClientOptions, MethodOptions, and AssembledTransaction's sign / signAndSend / signAuthEntries — now accept a Signer or a bare Keypair in addition to a callback. Adds the contract.SignTransactionLike and contract.SignAuthEntryLike types. When signAuthEntries gets a Signer or Keypair, its default target address is now the signer's own address rather than publicKey. Existing callbacks work unchanged; one type-only caveat: the option fields are no longer plain function types, so derive callback shapes from contract.SignTransaction / contract.SignAuthEntry instead of the option field (#1567, closes #1462 and #1063).
• contract.Spec now reads SEP-48 event declarations: events() and findEvent(name, occurrence?) list a contract's declared events, parseEvent(topics, data) decodes a fired event into { name, data }, with topic-carried params merged into data (returns undefined when nothing matches), and eventTopicFilter(name, topicValues?, occurrence?) builds a getEvents filter row, with "*" for any topic param left unset. Generated client bindings gain a typed <Name>Event interface per event, a ContractEvent union, a parseEvent() method, and per-event <name>EventFilter() methods. A contract may declare the same event name more than once (composed modules each emitting their own transfer); each declaration gets its own interface and filter method, and occurrence — a 0-based index in declaration order — selects among them. Generated names receive a numeric suffix when needed to avoid a collision, and stellar-sdk bindings warns about duplicate declarations and renames. Adds the contract.ParsedEvent type (#1556, #1565, #1572).

Fixed

• Spec.scValToNative now handles contract values typed as Val (scSpecTypeVal) by delegating to the generic scValToNative converter, mirroring the encoding-side support added in #1485. Decoding a response containing a Val-typed string, symbol, vec, or map — e.g. a struct with a Vec<Val> field — no longer throws ScSpecType scSpecTypeVal was not string or symbol; each value decodes to its natural native representation (Address → string, u32 → number, Symbol → string, vecs/maps recurse). (#1551)

v16.1.0

Added

• inspectAuthEntry(entry): decodes a xdr.SorobanAuthorizationEntry into a typed summary — credential type, authorizing address, nonce, signatureExpirationLedger, and a signers list covering top-level credentials and CAP-71 delegates. Adds the AuthEntryInfo, AuthEntrySigner, AuthEntrySignature, and AuthEntryCredentialType types (#1529).
• checkAuthEntryReadiness(entry, currentLedgerSeq): reports whether an auth entry is ready to submit — { ready, expired, unsignedBy } — as a pure decode with no network call (#1529).
• Spec.nativeToScVal now supports contract parameters typed as Val (scSpecTypeVal), so raw JS values can be passed to Val-typed arguments without building xdr.ScVal objects by hand (#1485).
• rpc.Server.queryContract<T>(contractId, method, args?, networkPassphrase?): a one-line read-only contract call that returns { result, isReadCall }, no transaction assembly or signing. Works for Wasm contracts and built-in Stellar Asset Contracts (SACs) (#1502).
• rpc.Server.getContractMethods(contractId, networkPassphrase?): lists a contract's callable methods and their signatures. Adds the Api.ContractMethod and Api.ContractMethodInput types (#1502).
• rpc.Server.getContractInstance(contractId): returns a contract's xdr.ScContractInstance (#1501).
• contract.Client.from, fromWasm, and fromWasmHash are now generic (<T>) and return Client & T, giving typed contract methods without code generation. T defaults to unknown, so untyped calls are unchanged (#1502).
• ClientOptions.server: pass an existing rpc.Server to contract.Client.from to reuse its transport instead of building a new one (#1502).
• Keypair.signMessage(message) and Keypair.verifyMessage(message, signature): sign and verify arbitrary messages per SEP-53, matching the Python and Java SDKs and stellar-cli (#1513).
• TransactionFailedError: raised by Horizon.Server.submitTransaction and submitAsyncTransaction when Horizon rejects a transaction with result codes. Extends BadResponseError and adds getResultCodes() and getTransactionResult() (#1526).

Changed

• HorizonApi.TransactionFailedResultCodes gained the transaction result codes it was missing: tx_bad_sponsorship, tx_bad_min_seq_age_or_gap, tx_malformed, tx_soroban_invalid, and tx_frozen_key_accessed (#1526).
• contract.Client.from now supports built-in Stellar Asset Contracts (SACs), building the client from the embedded SAC spec instead of downloading Wasm (#1501).
• rpc.Server.getContractWasmByContractId now rejects a SAC with a structured { code: 400 } error pointing to contract.Client.from. The not-found rejection is now { code: 404, message: "Could not obtain contract instance from server" } (#1501).
• The UMD (dist/) build now sets inlineDynamicImports so the single-file bundle stays whole despite the SAC spec's lazy import() (#1501).

Fixed

• Horizon.ManageDataOperationResponse.value is now typed as string, matching what Horizon actually returns (a base64 string in JSON, which the SDK never decodes). It was previously mistyped as Buffer (#1564).
• Horizon.Server.submitTransaction and submitAsyncTransaction now reject with SDK error types on HTTP failures, as documented: a TransactionFailedError for Horizon result codes, a BadResponseError otherwise. The wrapping branch used to be unreachable, so failures leaked through as raw HTTP-client errors. err.response.data and err.response.status are unchanged; the original error is now preserved as err.cause (#1526).
• Federation.Server resolution methods (resolveAddress, resolveAccountId, resolveTransactionId, forDomain) had the same unreachable branch and now reject HTTP failures with BadResponseError (#1526).

... (truncated)

Commits

• 0336c41 feat(contract): add occurrence param to Spec.findEvent (#1574)
• 22b013a Support duplicate event names in generated bindings (#1572)
• 513da91 release V16.2.0 (#1569)
• b1a4814 Review fixes for event bindings and contract signers (#1570)
• c93797c Add useUpgradedAuth simulation flag for CAP-71 v2 address credentials (#1568)
• 52717e4 Accept a Signer or Keypair wherever signTransaction is accepted (#1567)
• 5aaba3c Event bindings review fixes (#1565)
• 1e1ba81 Bump astro from 6.4.8 to 7.1.0 (#1557)
• aa00dd1 feat(bindings): generate typed event interfaces and filter helpers (#1556)
• 9526bd3 Extend authorizeEntry signing callbacks: payload argument and custom signatur...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​stellar/stellar-sdk since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates framer-motion from 10.18.0 to 13.1.0

Changelog

Sourced from framer-motion's changelog.

[13.1.0] 2026-08-10

Added

• Reorder: Multidimensional reorder.
• Reorder: Automatic axis detection.
• Reorder: RTL support.

[13.0.0] 2026-08-05

Changed

• Removed optional @emotion/is-prop-valid dependency in favour of explicit <MotionConfig isValidProp={isPropValid}>.

Fixed

• Hardware-accelerated SVG elements correctly apply final style on animation complete.
• AnimatePresence: Ensure nodes are marked as safe to remove when rendering propagate with no motion children.

[12.43.0] 2026-07-27

Added

• Hardware acceleration for backgroundColor in supported browsers.
• Hardware acceleration for SVG elements.

Fixed

• AnimatePresence: Exiting children no longer interleave with entering children, which could reorder and remount children present in both renders.
• motion: Throw error when passing a custom motion component an incorrect ref type.

[12.42.2] 2026-07-01

Fixed

• animateView: Cropped group layers now animate border-radius from the old to new radius.

[12.42.1] 2026-06-30

Fixed

• animateView: Old layer fade out now cancelled when defining .new().

[12.42.0] 2026-06-24

Changed

• animateView: Layers are automatically grouped to match their DOM-hierarchy. New .group(false) method opts-out.

Fixed

... (truncated)

Commits

• adaf7a4 v13.1.0
• e713759 Updating changelog
• bc81c03 Updating publish
• 092b771 Merge pull request #3785 from motiondivision/feature/1400-reorder-grid
• 025b0f4 Merge pull request #3789 from motiondivision/dependabot/npm_and_yarn/nanoid-3...
• 2f05af8 Bump nanoid from 3.3.11 to 3.3.18
• e0780bb Merge pull request #3788 from motiondivision/dependabot/npm_and_yarn/js-yaml-...
• 29af841 Fix wrapped Reorder insertion behavior
• 0035e3c Bump js-yaml from 3.15.0 to 3.15.1
• e4029ce v13.0.0
• Additional commits viewable in compare view

Updates i18next from 23.16.8 to 26.3.6

Release notes

Sourced from i18next's releases.

v26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

v26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

v26.3.0

• feat(types): introduce ResourceNamespaceMap — a separate mergeable augmentation surface for namespace resource types, designed for monorepos where multiple packages each want to contribute their own namespaces. Previously, every package had to coordinate on a single CustomTypeOptions.resources declaration (or fall back to typing dependency namespaces as any) because resources is a single property of an interface and TypeScript reports TS2717 when two declarations of the same property disagree. The new interface merges naturally across declare module 'i18next' blocks, so each package can ship its own i18next.d.ts independently. Per-property merge handles same-namespace contributions from multiple packages, and same-key/different-literal conflicts are silently dropped to avoid poisoning t() overload resolution. Fully backwards-compatible — existing CustomTypeOptions.resources augmentations continue to work, and both surfaces can coexist. Scalar options (defaultNS, returnNull, enableSelector, etc.) still belong on CustomTypeOptions. Thanks @​sh3xu (#2434). Fixes #2409.

v26.2.0

• feat(types): new parseInterpolation TypeOption (default true). When set to false in CustomTypeOptions, the type-level extractor stops parsing translation strings for {{variable}} patterns. Required by i18next-icu users — the default extractor mistakes ICU MessageFormat nested-brace plurals like {count, plural, one {{count} row} other {{count} rows}} for an interpolation block and demands a phantom variable name. The flag is type-only; runtime interpolation is governed by InterpolationOptions and is unaffected. Fixes i18next-icu#85.
• fix(types): expose enableSelector on InitOptions so i18next.init({ enableSelector: 'strict' }) typechecks without a module augmentation. The runtime already reads opts?.enableSelector from init options; this lands the matching type declaration next to the other selector-resolution knobs. Accepts false | true | 'optimize' | 'strict'. Thanks @​Faithfinder (#2431)

v26.1.0

• feat: enableSelector: 'strict' (TypeOptions + runtime option). Opt-in mode that drops the flattened-primary form from NsResource at the type level — every namespace (primary included) is exposed only under its own key on $, uniformly across single- and multi-ns hooks. At runtime, a leading selector path segment matching the scope's namespace list is always rewritten as a namespace prefix, including the primary. Eliminates the silent-miss surface area where t($ => $.primary.foo) typechecks but doesn't resolve under the default mode (see #2429). Backward-compatible: default enableSelector: false | true | 'optimize' behavior is unchanged. Note: strict mode is incompatible with the #2405 pattern (keys whose names match sibling namespaces) — those users should stay on default mode.

v26.0.10

• feat: getFixedT accepts a fourth optional fixedOpts argument carrying scopeNs — the full namespace list the bound t was created for. The selector API uses scopeNs to detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the bound ns (a single primary string in the typical react-i18next setup), so plain t('key') lookups stay isolated to the primary namespace exactly as before — only t($ => $.secondaryNs.foo) selectors now route correctly under useTranslation([nsA, nsB]). Fixes the runtime side of #2429 for the react-i18next default-nsMode case. The 4th argument is opt-in: existing 3-arg getFixedT(lng, ns, keyPrefix) callers see no behavior change.

v26.0.9

• fix(types): unformatted interpolation values are now typed as string | number (was string). i18next stringifies values at runtime, so requiring callers to wrap numbers in String(...) for plain {{var}} placeholders was unnecessary friction — and could mask the real problem when a non-string value was passed alongside multiple interpolation slots (the t() overload resolution would fall through to the 3-arg form and report a confusing "not assignable to string" error against the options object). Typed format specifiers like {{x, number}}, {{x, currency}...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stellar-portfolio-rebalancer	Error		Aug 22, 2026 5:16am

[github-actions]

🔒 Security Update: This PR will NOT be auto-merged. Security advisories require manual review and approval.