fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	24.12.4 → 24.13.3
@vitest/coverage-v8 (source)	4.1.9 → 4.1.10
commitlint (source)	21.2.0 → 21.2.1
i18next (source)	26.3.4 → 26.3.5
msw (source)	2.14.6 → 2.15.0
react-router (source)	8.1.0 → 8.2.0
vite (source)	7.3.5 → 7.3.6
vitest (source)	4.1.9 → 4.1.10

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

conventional-changelog/commitlint (commitlint)

v21.2.1

Compare Source

Note: Version bump only for package commitlint

i18next/i18next (i18next)

v26.3.5

Compare Source

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#​2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#​2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#​2442).

mswjs/msw (msw)

v2.15.0

Compare Source

v2.15.0 (2026-07-08)

Features

• sse: invoke finalize on response stream end (#​2741) (7fae0cc) @​kettanaito

v2.14.7

Compare Source

v2.14.7 (2026-07-07)

Bug Fixes

• sse: proper logging for concurrent requests (#​2762) (5c0ae1c) @​kettanaito

remix-run/react-router (react-router)

v8.2.0

Compare Source

Patch Changes

• Fix href() to properly stringify and URL-encode param values, matching generatePath() (#​15277)
  • splat params preserve path separators while encoding each segment individually
• Fix dynamic param extraction for routes with optional static segments (#​15200)
  • When a route path contains optional static segments (e.g. /school?/user/:id), the internal regex's incorrectly shifted parameter indices resulting in incorrect parameter extraction
  • Consecutive optional static segments (e.g. /one?/two?) were only partially handled
• Preserve navigation blocker state through a revalidation (#​15246)
• Fix route ranking for dynamic parameters with static extension suffixes (#​15273)
  • These were not being detected as dynamic param segments and instead got incorrectly scored higher as a static segment
  • This meant they could potentially tie truly static routes like /sitemap.xml and outrank them based on definition order
  • These are now correctly identified as dynamic parameter segments and scored correctly
• Use ReactFormState types instead of unknown (#​15263)

vitejs/vite (vite)

v7.3.6

Compare Source

Please refer to CHANGELOG.md for details.

---

Configuration

📅 Schedule: (in timezone Europe/Istanbul)

• Branch creation
  • Between 07:00 AM and 09:59 AM, only on Monday (* 7-9 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e411518

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR