Update all non-major dependencies (master)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@tailwindcss/vite (source)	4.3.1 → 4.3.2
@tanstack/react-query (source)	5.101.1 → 5.101.2
@tanstack/react-query-devtools (source)	5.101.1 → 5.101.2
@tanstack/react-virtual (source)	3.14.4 → 3.14.5
i18next (source)	26.3.3 → 26.3.4
prettier (source)	3.9.1 → 3.9.4
tailwindcss (source)	4.3.1 → 4.3.2
vite (source)	8.1.0 → 8.1.2

---

Release Notes

tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.3.2

Compare Source

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#​20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#​20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#​20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#​20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#​20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#​20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#​20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#​20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#​20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#​20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#​20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#​20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#​20289)

TanStack/query (@​tanstack/react-query)

v5.101.2

Compare Source

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.2

TanStack/query (@​tanstack/react-query-devtools)

v5.101.2

Compare Source

Patch Changes

• Updated dependencies [f5bf180, 25cdd97, ecd89c8, 01c7634, 49012db]:
  • @​tanstack/query-devtools@​5.101.2
  • @​tanstack/react-query@​5.101.2

TanStack/virtual (@​tanstack/react-virtual)

v3.14.5

Compare Source

Patch Changes

• Updated dependencies [767ead4, bc8643b]:
  • @​tanstack/virtual-core@​3.17.3

i18next/i18next (i18next)

v26.3.4

Compare Source

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @​manus-use for the responsible disclosure.

prettier/prettier (prettier)

v3.9.4

Compare Source

v3.9.3

Compare Source

v3.9.2

Compare Source

vitejs/vite (vite)

v8.1.2

Compare Source

Bug Fixes

• deps: revert es-module-lexer to 2.1.0 (#​22827) (0d3bd7c)
• restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757)" (#​22825) (efb98cc)
• revert, "fix: escape ids with multiple null bytes (#​22687)" (cccef55)
• revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757)" (cf97711)

v8.1.1

Compare Source

Features

• update dynamic import warning to link to Vite docs (#​22823) (62bd7af)

Bug Fixes

• bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#​22797) (709eb8e)
• bundled-dev: serve assets emitted during HMR/lazy compile (#​22745) (5876b2c)
• bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#​22778) (8f925e2)
• css: preserve dollar signs in external @import urls with lightningcss (#​22718) (9fa7ab4)
• css: resolve tsconfig paths in CSS and Sass @​import (#​22775) (ef0b891)
• deps: update all non-major dependencies (#​22734) (e635f49)
• deps: update all non-major dependencies (#​22804) (8837400)
• deps: update rolldown-related dependencies (#​22591) (2ce6677)
• escape ids with multiple null bytes (#​22687) (833fc30)
• hide console window when running 'net use' on Windows (#​22698) (92b63f2)
• ignore bundled config temp dir (#​22800) (043a810)
• invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#​22809) (33895ba)
• optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#​22784) (085a0ab)
• optimizer: scanner should resolve input from root (#​22769) (9722b07)
• resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757) (2531ac7)
• return sourcemap field from some plugins that were lacking (#​22782) (7e18bf8)
• server: handle malformed URI in indexHtmlMiddleware (#​22781) (84f5ccc)

Miscellaneous Chores

• improve dependency optimizer messages (#​22549) (092cb3b)

Code Refactoring

• css: remove lightningcss null byte bug workaround (#​22822) (2dafd3b)
• use pre-defined environments variable to avoid duplicate Object.values calls (#​22790) (1113acf)

Tests

• enable "manual chunk path" test and remove "worker.format error" test (#​22824) (c088511)

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.