chore(deps)(deps): bump the production-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the production-dependencies group with 5 updates in the /webs directory:

Package	From	To
@xyflow/react	12.11.2	12.11.3
i18next	26.3.6	26.4.0
react-i18next	17.0.11	17.0.12
swr	2.5.0	2.5.1
vite	8.2.1	8.2.2

Updates @xyflow/react from 12.11.2 to 12.11.3

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.11.3

Patch Changes

• #5902 393d951 - Allow middle-mouse viewport panning to start from a selection rectangle.

• #5889 ff126a0 - Fix extent: 'parent' not immediately resolving when parent has width or initialWidth.

• #5943 d1def59 - Invoke an error if handle can not be found

• #5947 2ba040f - Use correct nodeExtent for internal setNodes.

• #5918 c5d7442 - Fix selection box appearing when dragging the pane via touch. Prefer touch panning over drag selection when selectionOnDrag is combined with mouse-button-specific panOnDrag settings.

• #5922 392da00 - Allow Control to activate pane panning with a primary-button drag.

• #5929 4c5d7d2 - Allow key combinations of three or more keys (e.g. 'Meta+Shift+s') for useKeyPress.

• #5938 91a052f - Fix <Background /> pattern offset miscalculation.

• Updated dependencies [393d951, ff126a0, e5d86bd, 392da00]:

  • @​xyflow/system@​0.0.80

Changelog

Sourced from @​xyflow/react's changelog.

12.11.3

Patch Changes

• #5902 393d951 - Allow middle-mouse viewport panning to start from a selection rectangle.

• #5889 ff126a0 - Fix extent: 'parent' not immediately resolving when parent has width or initialWidth.

• #5943 d1def59 - Invoke an error if handle can not be found

• #5947 2ba040f - Use correct nodeExtent for internal setNodes.

• #5918 c5d7442 - Fix selection box appearing when dragging the pane via touch. Prefer touch panning over drag selection when selectionOnDrag is combined with mouse-button-specific panOnDrag settings.

• #5922 392da00 - Allow Control to activate pane panning with a primary-button drag.

• #5929 4c5d7d2 - Allow key combinations of three or more keys (e.g. 'Meta+Shift+s') for useKeyPress.

• #5938 91a052f - Fix <Background /> pattern offset miscalculation.

• Updated dependencies [393d951, ff126a0, e5d86bd, 392da00]:

  • @​xyflow/system@​0.0.80

Commits

• 359f70c chore(packages): bump
• e90a1b6 Merge pull request #5938 from Feyyus/fix/background-offset-precedence
• 2ba040f fix(react): use the current nodeExtent in setNodes
• 42f367e Merge pull request #5922 from Skyline-23/fix/control-pan-activation
• d7dbd57 Merge pull request #5929 from Jian-Zhang08/fix/usekeypress-multi-key-combination
• bdcf89a fix(edge-wrapper): pass onError prop closes #5936, closes #5932
• 91a052f fix(react): correct offset math in Background pattern
• 4c5d7d2 fix(react): make useKeyPress work with combinations of three or more keys
• 392da00 fix(system): allow Control key to activate pane panning
• c5d7442 fix(pane): prefer touch panning over drag selection
• See full diff in compare view

Updates i18next from 26.3.6 to 26.4.0

Release notes

Sourced from i18next's releases.

v26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

Changelog

Sourced from i18next's changelog.

26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

Commits

• 652847e 26.4.0
• 6c6025f prettier fix
• 742b9a9 chore: update dependencies and clean up dev tooling
• 06924d9 fix: invalidate toResolveHierarchy cache on in-place fallbackLng mutation
• bb80369 perf: cache toResolveHierarchy (#2444)
• See full diff in compare view

Updates react-i18next from 17.0.11 to 17.0.12

Changelog

Sourced from react-i18next's changelog.

17.0.12

• fix(IcuTrans): key-less icu.macro nodes (<Trans>Welcome, {name}!</Trans>, <Select>, <Plural> without i18nKey) rendered an empty string since 17.0.0. The macro now emits <IcuTrans defaultTranslation="…"> without a key and IcuTrans passed undefined to t(), which returns ''. Like Trans, IcuTrans now uses defaultTranslation as the key when i18nKey is not provided.

Commits

• ea721fb 17.0.12
• 6c2a71e fix(IcuTrans): use defaultTranslation as key when no i18nKey is given
• 258c96d chore(examples): upgrade all example apps off unmaintained toolchains
• b8677c8 chore: update dependencies to close dependabot alerts
• aa9c92b docs: point Trans component links at the current docs (#1929)
• See full diff in compare view

Updates swr from 2.5.0 to 2.5.1

Release notes

Sourced from swr's releases.

v2.5.1

Patches

• fix: hydrate cacheData for hooks without a fetcher by @​yongsk0066 in vercel/swr#4293
• fix: revalidate suspense cacheData on remount by @​javascripter in vercel/swr#4312
• fix: clean up completed subscription state by @​iroiro147 in vercel/swr#4310

Misc

• chore: bump version to 2.5.1 by @​huozhi in vercel/swr#4315
• chore: remove deprecated eslint config files by @​abhiramvsmg in vercel/swr#4308

New Contributors

• @​abhiramvsmg made their first contribution in vercel/swr#4308
• @​yongsk0066 made their first contribution in vercel/swr#4293
• @​iroiro147 made their first contribution in vercel/swr#4310

Full Changelog: vercel/swr@v2.5.0...v2.5.1

Commits

• 7173e55 chore: bump version to 2.5.1 (#4315)
• 9e8b1c9 fix: clean up completed subscription state (#4310)
• a33fba7 fix: revalidate suspense cacheData on remount (#4312)
• ad7b276 fix: hydrate cacheData for hooks without a fetcher (#4293)
• ace8c0f chore: remove deprecated eslint config files (#4308)
• See full diff in compare view

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

[email protected]

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update rolldown-related dependencies (#23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
• use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#23231) (b4d66fe)
• module-runner: add TLA circular import case (#23299) (4a261f2)
• module-runner: simplify server-hmr tests (#23300) (599b44b)
• ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

• use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

Commits

• de1111a release: v8.2.2
• cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
• 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
• 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
• 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
• 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
• 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
• 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
• 599b44b test(module-runner): simplify server-hmr tests (#23300)
• 4a261f2 test(module-runner): add TLA circular import case (#23299)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, frontend. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.