[dependabot]

Bumps the npm-production group with 30 updates in the / directory:

Package	From	To
@lingui/core	6.9.0	6.10.1
@lingui/react	6.9.0	6.10.1
yaml	2.9.0	2.9.1
@capacitor/core	8.5.3	8.6.0
electron	44.9.0	45.1.0
react	19.2.8	19.3.1
react-dom	19.2.8	19.3.1
@citation-js/plugin-csl	0.8.2	0.9.0
@tanstack/react-table	9.2.4	9.3.1
@tanstack/react-virtual	3.14.13	3.14.22
@zip.js/zip.js	2.8.36	2.24.0
dockview-react	8.3.1	8.6.2
@codemirror/autocomplete	6.20.3	6.20.4
@codemirror/commands	6.10.4	6.11.1
@codemirror/language	6.12.4	6.13.1
@codemirror/search	6.7.1	6.7.2
@codemirror/state	6.7.1	6.7.6
@codemirror/view	6.43.8	6.43.15
@lezer/highlight	1.2.3	1.2.5
@readium/navigator	2.8.2	2.14.0
@readium/shared	2.4.0	2.8.0
fast-xml-parser	5.10.1	5.11.2
@embedpdf/engines	2.15.0	2.15.1
@embedpdf/models	2.15.0	2.15.1
@embedpdf/plugin-annotation	2.15.0	2.15.1
@embedpdf/plugin-capture	2.15.0	2.15.1
@embedpdf/plugin-search	2.15.0	2.15.1
@embedpdf/plugin-selection	2.15.0	2.15.1
@embedpdf/react-pdf-viewer	2.15.0	2.15.1
defuddle	0.19.5	0.19.6

Updates @lingui/core from 6.9.0 to 6.10.1

Release notes

Sourced from @​lingui/core's releases.

v6.10.1

6.10.1 (2026-10-22)

Bug Fixes

• conf: do not mutate config objects when replacing <rootDir> (#2730) (60e823f)
• core: put the plural offset first and unescape meta option keys in the runtime macro (#2726) (0255d73)
• detect-locale: read subdomains from the host only and return null for missing segments (#2733) (735036e)
• format-po-gettext: respect explicitIdAsDefault when serializing (#2727) (18123cf)
• metro-transformer: forward getCacheKey from the wrapped transformer (#2736) (9acef0b)
• vue-extractor: report the .vue file and line for messages in <script setup> (#2728) (aed4f98)

Performance Improvements

• vite-plugin: resolve catalogs once per build instead of on every catalog import (#2737) (bfa5b76)

v6.10.0

6.10.0 (2026-10-16)

Features

• core: runtime core macro (#2618) (bd79e85) (Announcement)
• core: add default global variables support to i18n instance (#2661) (7fa9acd) (Documentation)

Bug Fixes

• cli: don't compile twice per change in watch mode without --debounce (#2722) (92c8622)

v6.9.1

6.9.1 (2026-10-09)

Bug Fixes

• format-csv: read catalogs that end with a line break (#2696) (c3b7838)
• vite-plugin: fail early when native transform is used with Solid (#2708) (15549f3)
• vite-plugin: strip query from module id before native macro transform (#2703) (10c1b79)

Performance Improvements

• cli: write experimental extractor catalogs in worker pool (#2715) (f7731f2)

Changelog

Sourced from @​lingui/core's changelog.

6.10.1 (2026-10-22)

Bug Fixes

• core: put the plural offset first and unescape meta option keys in the runtime macro (#2726) (0255d73)

6.10.0 (2026-10-16)

Features

• core: add default global variables support to i18n instance (#2661) (7fa9acd)
• runtime core macro (#2618) (bd79e85)

6.9.1 (2026-10-09)

Note: Version bump only for package @​lingui/core

Commits

• ce5aa25 chore(release): published v6.10.1 [skip ci] (#2742)
• 0255d73 fix(core): put the plural offset first and unescape meta option keys in the r...
• b0355f2 chore(release): published v6.10.0 [skip ci] (#2724)
• bd79e85 feat: runtime core macro (#2618)
• 7fa9acd feat(core): add default global variables support to i18n instance (#2661)
• 4d33903 chore(release): published v6.9.1 [skip ci] (#2716)
• See full diff in compare view

Updates @lingui/react from 6.9.0 to 6.10.1

Release notes

Sourced from @​lingui/react's releases.

v6.10.1

6.10.1 (2026-10-22)

Bug Fixes

• conf: do not mutate config objects when replacing <rootDir> (#2730) (60e823f)
• core: put the plural offset first and unescape meta option keys in the runtime macro (#2726) (0255d73)
• detect-locale: read subdomains from the host only and return null for missing segments (#2733) (735036e)
• format-po-gettext: respect explicitIdAsDefault when serializing (#2727) (18123cf)
• metro-transformer: forward getCacheKey from the wrapped transformer (#2736) (9acef0b)
• vue-extractor: report the .vue file and line for messages in <script setup> (#2728) (aed4f98)

Performance Improvements

• vite-plugin: resolve catalogs once per build instead of on every catalog import (#2737) (bfa5b76)

v6.10.0

6.10.0 (2026-10-16)

Features

• core: runtime core macro (#2618) (bd79e85) (Announcement)
• core: add default global variables support to i18n instance (#2661) (7fa9acd) (Documentation)

Bug Fixes

• cli: don't compile twice per change in watch mode without --debounce (#2722) (92c8622)

v6.9.1

6.9.1 (2026-10-09)

Bug Fixes

• format-csv: read catalogs that end with a line break (#2696) (c3b7838)
• vite-plugin: fail early when native transform is used with Solid (#2708) (15549f3)
• vite-plugin: strip query from module id before native macro transform (#2703) (10c1b79)

Performance Improvements

• cli: write experimental extractor catalogs in worker pool (#2715) (f7731f2)

Changelog

Sourced from @​lingui/react's changelog.

6.10.1 (2026-10-22)

Note: Version bump only for package @​lingui/react

6.10.0 (2026-10-16)

Features

• core: add default global variables support to i18n instance (#2661) (7fa9acd)

6.9.1 (2026-10-09)

Note: Version bump only for package @​lingui/react

Commits

• ce5aa25 chore(release): published v6.10.1 [skip ci] (#2742)
• b0355f2 chore(release): published v6.10.0 [skip ci] (#2724)
• 7fa9acd feat(core): add default global variables support to i18n instance (#2661)
• 4d33903 chore(release): published v6.9.1 [skip ci] (#2716)
• See full diff in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

• Limit recursive merge aliases (#685, #713)
• Simplify line unfolding during quoted string parsing (#714)

Commits

• 1440ecd 2.9.1
• c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
• d11ce77 fix: Limit recursive merge aliases (#713)
• c5f49f4 chore: Update docs-slate
• See full diff in compare view

Updates @capacitor/core from 8.5.3 to 8.6.0

Release notes

Sourced from @​capacitor/core's releases.

8.6.0

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

Changelog

Sourced from @​capacitor/core's changelog.

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

Commits

• ef3ce6e Release 8.6.0
• 4b40f4b chore: add Backstage catalog-info.yaml
• 463225f fix(cli): bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674)
• d19f1ea fix(cli): redact sensitive values from telemetry payloads (#8665)
• 02e43f8 fix(android): keep callbacks on non-public base classes from R8
• 19d2a40 feat(android): recognize @​capacitor-community/ssl-pinning for cert pinning (#...
• 50a3c51 feat(cli): recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666)
• 841017a fix(cli): report npm 12 blocked install scripts in doctor and migrate (#8655)
• acaa9e6 docs: minor correction (#8660)
• 9dc5aeb fix(android): keep plugin annotation types from R8 full mode (#8646)
• Additional commits viewable in compare view

Updates electron from 44.9.0 to 45.1.0

Release notes

Sourced from electron's releases.

electron v45.1.0

Release Notes for v45.1.0

Features

• Added filtering options to session.registerPreloadScript - matches, excludeMatches, includeGlobs, excludeGlobs, matchOriginAsFallback. #55181 (Also in 44)

Fixes

• Fixed a crash on Linux when a D-Bus method call was made on a disconnected bus. #55292 (Also in 44, 46)
• Fixed a main process crash when onSendHeaders observed Blob uploads. #55169 (Also in 44)
• Fixed extension chrome.webRequest events reporting a tabId of -1 and chrome.declarativeNetRequest rules restricted to tabs never matching. #55283 (Also in 46)
  • Fixed session.clearStorageData() unregistering the service workers of loaded extensions.
  • Fixed chrome.management methods and events being unavailable to extensions with the management permission.
  • Fixed __MSG_*__ placeholders not being localized in extension stylesheets.
  • Fixed extension service workers being stopped after 30 seconds while a WebSocket was active.
  • Fixed sandboxed extension pages being hosted in a process with extension API privileges.
  • Fixed extension service workers running an outdated script after an app restart when the extension's files changed without a version change.
  • Fixed chrome.alarms and content scripts registered with persistAcrossSessions not persisting across app restarts.
• Fixed File System Access blocklist gaps for .git/hooks writes and hypervisor UNC shares. #55329
• Fixed handling of malformed asar archives whose size fields do not match the file length. #55175 (Also in 43, 44)
• Fixed inconsistent handling of asar archive paths between the main process and child processes. #55184 (Also in 43, 44)
• Fixed Menu.popup() on macOS sometimes not showing a menu after another closed. #55326 (Also in 44, 46)
• Fixed MV3 extension events not arriving to background service workers. #55154 (Also in 43, 44)
• Fixed protocol.registerSource schemes not applying the same fetch rules as protocol.handle schemes. #55178 (Also in 44)
• Fixed requests stalling when an extension used a blocking chrome.webRequest listener. #55271 (Also in 46)
• Fixed utilityProcess not emitting an exit event when the app quit while the process was still launching. #55274 (Also in 43, 44, 46)

Other Changes

• Updated Chromium to 156.0.8078.49. #55252
• Updated Node.js to v24.22.1. #55163

electron v45.0.0

Release Notes for v45.0.0

Stack Upgrades

• Chromium 156.0.8078.48
  • Chrome 156 Release Notes
  • Chrome 155 Release Notes
  • New in 154
  • New in 153
• Node v24.22.0
  • Node 24.22.0 blog post
• V8 15.6

Breaking Changes

• Reduced sandboxed renderer startup work for preload scripts that do not use Buffer. #54048

... (truncated)

Commits

• 45d20ec chore: batch backport of #55359, #55308 (#55376)
• 474abf4 fix: enforce File System Access .git/hooks write block and hypervisor UNC sha...
• 7c362e4 docs: remove redundant shell requires in application menu tutorial (#55363)
• 29059ae build: enable more performance-* clang-tidy checks (#55299)
• f8af3ec chore: batch backport of #55297, #54862, #55287 (#55357)
• 1de314b chore: batch backport of #55227, #55223, #55226 (#55342)
• 1daac91 fix: show macOS context menus reliably after a previous one is cancelled (#55...
• 2667154 test: poll the window server without blocking the app shim specs (#55301)
• 0e574f3 ci: label PGO profile update PRs with their target branch (#55307)
• 376b87d fix: handle a null pending call in dbus::ObjectProxy (#55292)
• Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe wh...

    Description has been truncated

[callumalpass]

Two changes on top of Dependabot's update, so this group can merge:

• 177d806 adapts renderer-epub to Readium navigator 2.14 / shared 2.8: the new required viewportChanged listener, and optional locations.fragments.
• 61f4f4f holds dockview-react at 8.4.1. With 8.5.0 or later, Reader's mobile Library panel renders blank, and the PDF-touch audit times out waiting for the source search box. Bisected locally with dockview core at 8.8.0 throughout: 8.4.1 passes, 8.5.0 / 8.5.1 / 8.6.0 / 8.6.1 / 8.6.2 fail. The likely cause is dockview#1670 (keeping instances across React Activity/StrictMode effect replays). dependabot.yml now ignores dockview-react >= 8.5.0 until Reader is fixed for it.

main is merged in. Locally: the PDF-touch and HTML-SVG audits pass, and the whole repo's typecheck and tests pass.