build(deps): Bump the minor-and-patch group across 1 directory with 11 updates

[dependabot]

Bumps the minor-and-patch group with 11 updates in the / directory:

Package	From	To
onnxruntime-web	1.29.0	1.30.0
react-i18next	17.0.14	17.0.15
three	0.186.0	0.186.1
autoprefixer	10.5.5	10.6.1
electron	44.3.0	44.5.1
eslint	10.10.0	10.12.0
eslint-plugin-react-refresh	0.5.6	0.5.7
globals	17.12.0	17.13.0
typescript-eslint	8.70.0	8.71.0
vite	8.2.2	8.3.2
wait-on	9.1.0	9.5.1

Updates onnxruntime-web from 1.29.0 to 1.30.0

Release notes

Sourced from onnxruntime-web's releases.

ONNX Runtime v1.30.0

ONNX Runtime 1.30.0 expands generative AI inference, improves CPU and GPU performance, adds Go bindings, and strengthens runtime reliability. These notes cover changes since ONNX Runtime 1.29.1.

Highlights

• Expanded CUDA inference support with variable-length causal convolution for continuous batching, speculative decoding in paged XQA, and INT4 paged KV caches with per-channel scales (#32168, #32340, #32515).
• Improved WebGPU PagedAttention, added GPT-OSS support and INT8 KV-cache block quantization, and extended convolution optimizations (#31727, #32277, #32284, #32420).
• Added fused CPU LinearAttention kernels for AVX-512, Arm64 NEON, and SVE, plus AVX2 LayerNorm/RMSNorm acceleration (#31674, #31973, #32178, #32356).
• Added Go bindings for the ONNX Runtime C API and DeepSeek Engram contrib operators (#29615, #32268).

Announcements & Compatibility

• FP4 QMoE kernels are now enabled by default in CUDA builds, with Windows build support added in this release. Source builds can opt out with -Donnxruntime_USE_FP4_QMOE=OFF (#32096, #32163).
• CUDA fpA-intB builds now default to a compact kernel set for FP16 activations, INT4/INT8 weights, scale-only quantization, and block_size=32. Set -Donnxruntime_USE_FPA_INTB_GEMM_FULL=ON when building from source to retain the full kernel set, including BF16, zero-point, bias, larger-block-size, and native Hopper variants (#32324).
• CPU FP16 Gemm and MatMul execution is gated on hardware acceleration. CPU-assigned FP16 nodes without a matching kernel now fall back to FP32 (#32301, #32197).
• WebGPU plugin EP packaging now supports Linux AArch64. Plugin versions were advanced to WebGPU 0.4.0 and CUDA 0.2 (#32287, #31960, #31970).

Security & Reliability

Model Loading, Memory, and Input Validation

• Limited nested model-graph depth and canonicalized external-data locations to harden model loading (#32344, #32135).
• Added checked rounding for BFC arena allocations and fixed prepacked-weight reference lifetimes (#32010, #32040).
• Strengthened shape, rank, and parameter validation for Split, Scan, GatherND, ScatterND, SpaceToDepth/DepthToSpace, Crop, Conv, Normalizer, and pooling (#29461, #31668, #32034, #32039, #32076, #32157, #32160, #32161, #32345, #32349).
• Hardened generation and attention input handling, including attention-attribute narrowing, BifurcationDetector inputs, generation subgraph shapes, and QEmbed segment inputs. BeamSearch buffer expansion now uses dynamic shape storage (#31648, #31701, #32009, #32078, #32144).
• Validated TreeEnsemble node references and bounded subtree comparison, rejected non-finite CPU RoiAlign coordinates, and required ImageScaler bias to match the channel count (#32031, #32043, #32011, #32002).
• Added an allowlist of safe LoRA adapter parameter data types, validated MatMulFpQ4 shape inputs, and checked MLAS blockwise quantization/dequantization index ranges (#31682, #32032, #32007).

GPU Bounds and Resource Lifetimes

• Hardened CUDA indexing and buffer-size arithmetic in MatMulNBits, RemovePadding, RotaryEmbedding, SparseAttention, Whisper beam search, NMS, QDQ, and GatherElements (#31643, #31994, #31995, #31996, #31998, #32014, #32029, #32030).
• Fixed overflow in CUDA reduction scans and Softmax offset arithmetic, and handled zero-sized outputs in CUDA random-generator kernels (#32137, #32330, #31997).
• Fixed CUDA MultiHeadAttention shared-cache scratch lifetimes and kept CudaAsyncBuffer staging storage alive across CUDA graph replay (#31968, #32121).
• Fixed WebGPU out-of-bounds subgroup-matrix loads for partial tiles, zero-initialized writable device-allocator buffers, and rejected foreign GPU handles in built-in data transfers (#32364, #32063, #32317).

Dependencies and Tooling

• Upgraded Protobuf to 33.6 and refreshed Python documentation dependencies, including an ONNX security-related update (#29906, #32190, #32424).
• Updated JavaScript dependencies including js-yaml, joi, fast-uri, and the Next.js end-to-end fixture (#32397, #32486, #32488, #32505, #32508).
• Pinned GitHub Actions to full-length commit SHAs and strengthened packaging infrastructure with authenticated package feeds and NPM network isolation (#32176, #32005, #32440).

New Features

Core APIs & Runtime

• Added Go bindings for the ONNX Runtime C API (#29615).
• Extended memory importing with host-pointer support and added access to preallocated outputs through KernelContext::GetPreallocatedOutput (#29726, #32089).
• Added packed-attention workspace recipes and estimates, and made workspace input-shape handling aware of optional inputs (#32283, #32321, #32312).
• Added DeepSeek Engram contrib operators, EngramGate and NGramHashMapping, and expanded kernel coverage for Qwen-3.5 operators (#32268, #32106).

... (truncated)

Commits

• f2c39fe [CUDA] Add INT4 paged KV cache with per-channel scales (#32515)
• 5894ba8 Add portable random-access file reads to Env (#32503)
• a2ee3eb Fix CUDA plugin device discovery on WSL (#32517)
• b652e59 [WebGPU] Prepack Conv weights for the im2col-matmul path (#32420)
• 0f0f29f Get rid of spurious warning about not being able to find spectre mitigation (...
• 23dd651 Register ONNX schemas only when static registration is disabled (#32353)
• 33af5d3 Release external data loaders after graph initialization (#32502)
• 2e3c24d Clarify external initializer and EP context path interaction (#32442)
• e76036b [CUDA] Pin FP8 GEMV residency for grids just past two blocks per SM (#32433)
• 82583c5 Add session option for a BNHS GroupQueryAttention Value cache layout (#32139)
• Additional commits viewable in compare view

Updates react-i18next from 17.0.14 to 17.0.15

Changelog

Sourced from react-i18next's changelog.

17.0.15

• fix(Trans): empty paired component tags now preserve a component's single valid React-element child, whether supplied through a named component map (<wrap></wrap>), a component array (<0></0>), or indexed JSX children (<1></1>). This matches the existing behavior for two or more children and self-closing tags. React represents one JSX child as an element and multiple children as an array; the previous array-only check silently rendered the one-child case empty. Compatibility note: when that sole element contains an interpolation object, the restored raw children can expose an existing React rendering limitation as an error instead of silently rendering empty; the same shape already errors with two children. Fixes #1932.

Commits

• 7d38e09 17.0.15
• 875b327 fix(Trans): preserve single-element children in empty slots
• See full diff in compare view

Updates three from 0.186.0 to 0.186.1

Commits

• See full diff in compare view

Updates autoprefixer from 10.5.5 to 10.6.1

Release notes

Sourced from autoprefixer's releases.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

Changelog

Sourced from autoprefixer's changelog.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

Commits

• c99614d Release 10.6.1 version
• f1d08cb Update dependencies
• cf1ebcb Fix grid gap inheritance from row-gap and column-gap longhands (#1557)
• e1212dc Release 10.6.0 version
• dac3c5f Add support for prefixing initial-letter (#1556)
• b031690 Release 10.5.6 version
• da65c36 Add warning when Autoprefixer can cover CSS for old Safari
• 604f8d9 Update dependencies
• 54608ca Fix old WebKit gradients with color hints (#1554)
• See full diff in compare view

Updates electron from 44.3.0 to 44.5.1

Release notes

Sourced from electron's releases.

electron v44.5.1

Release Notes for v44.5.1

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn and V8. #54564

electron v44.5.0

Release Notes for v44.5.0

Features

• Added launch-failure reporting with systemErrorCode to the app child-process-gone event. #54231 (Also in 45)

Fixes

• Changed the default trash implementation on KDE Plasma 6 to kioclient. #54361 (Also in 45)
• DevTools zoom in/out now uses the same zoom steps as Chromium. #54387 (Also in 45)
• Fixed --xdg-portal-required-version having no effect and a spurious portal warning being logged for file dialogs on Linux. #54303 (Also in 43, 45)
• Fixed a child WebContentsView losing focus when its window is reactivated. #54455 (Also in 43, 45)
• Fixed a crash when a WebAuthn request used a security key that required its PIN. #54403 (Also in 45)
• Fixed a crash when creating a framed window on Wayland in environments where GTK could not initialize. #54420 (Also in 45)
• Fixed a crash when sending a DevTools protocol command with a non-string value for an optional string parameter via webContents.debugger. #54445 (Also in 43, 45)
• Fixed a GPU process crash on startup when another instance of the app is using the same session data directory. #54469
• Fixed a grey border around frameless windows on Linux WMs without compositing. #54391 (Also in 43, 45)
• Fixed a main process crash when a native API method was called with a this value of a different native type; it now throws a TypeError. #54315 (Also in 43)
• Fixed a possible crash during process exit when vm.Script or vm contexts created in the main process had been garbage collected shortly before quitting. #54266 (Also in 43, 45)
• Fixed a possible crash on Windows on ARM when powerMonitor is torn down. #54408 (Also in 45)
• Fixed a renderer crash calling image.toPNG() from a sandboxed preload script. #54502 (Also in 43, 45)
• Fixed a renderer crash when a ResizeObserver loop-limit error handler modified layout. #54290 (Also in 45)
• Fixed accent-color-changed on Windows reporting a colour that differed from systemPreferences.getAccentColor(). #54409 (Also in 45)
• Fixed an issue where crashReporter.setUploadToServer() had no effect after crashReporter.start() was called. #54518 (Also in 45)
• Fixed app.getRecentDocuments() omitting documents with non-ASCII paths on Windows. #54407 (Also in 45)
• Fixed clipboard.read(), readText() and has() resolving seconds late on Linux while the app was idle. #54308 (Also in 42, 43, 45)
• Fixed desktopCapturer.getSources() leaving non-resizable windows resizable on macOS. #54397 (Also in 43, 45)
• Fixed fs.rmSync failing to remove read-only files on Windows. #54255 (Also in 42, 43, 45)
• Fixed GDK_BACKEND leaking into processes spawned by Electron apps on Linux. #54425 (Also in 43, 45)
• Fixed hidden windows continuing to render at full frame rate after setBackgroundThrottling(false) followed by setBackgroundThrottling(true). #54341 (Also in 45)
• Fixed pointerLock permission requests from some iframes reporting the parent frame. #54464 (Also in 42, 43, 45)
• Fixed setContentProtection(true) having no effect in Windows remote sessions. #54500 (Also in 45)
• Fixed setIgnoreMouseEvents() taking effect late on X11. #54497 (Also in 43, 45)
• Fixed setIgnoreMouseEvents(true) being undone by the next resize on X11. #54393 (Also in 43, 45)
  • Added setIgnoreMouseEvents support on Wayland.
• Fixed shell.showItemInFolder() on Linux for paths containing #, ? or % when the file manager is reached over D-Bus. #54406 (Also in 45)
• Fixed the default action label on Linux notifications not being localized. #54401 (Also in 43, 45)
• Fixed the GPU process crash-looping on Windows when the sandbox cannot read the install folder; the folder is now reported instead. #54484 (Also in 43, 45)
• Fixed the zoom level resetting on file: and other host-less pages after a location.hash change. #54442 (Also in 43, 45)
• Fixed typing not working after closing an alert() or confirm() on Windows. #54461 (Also in 43, 45)
• Fixed utilityProcess dropping stdout/stderr output that the child wrote immediately before exiting. #54278 (Also in 42, 43, 45)
• Fixed visual zoom limits resetting on navigation and not applying to webviews. #54449 (Also in 43, 45)

... (truncated)

Commits

• 19c6011 chore: cherry-pick 27 changes from angle, chromium, dawn and v8 (#54564)
• 435b189 test: parse all custom page size PDFs in one pdf.js process (#54544)
• a2db7a8 test: wait for child output before asserting on it (#54541)
• fa180db fix: crashReporter.setUploadToServer() having no effect after start (#54518)
• 60f40fe test: wait for focus before requesting pointer lock in spec (#54533)
• f0a852d test: wait for earlier Electron workers to exit before serial specs (#54512)
• 42ed175 fix: apply the X11 input shape before setIgnoreMouseEvents() returns (#54497)
• 71490d8 fix: apply setContentProtection() in Windows remote sessions again (#54500)
• d4bd178 fix: throw instead of crashing when nativeImage cannot create a Buffer (#54502)
• 614efcd fix: report install folders that the sandbox cannot read on Windows instead o...
• Additional commits viewable in compare view

Updates eslint from 10.10.0 to 10.12.0

Release notes

Sourced from eslint's releases.

v10.12.0

Features

• 4618052 feat: handle astral letters in new-cap (#21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

... (truncated)

Commits

• a438ec3 10.12.0
• 32a73f1 Build: changelog update for 10.12.0
• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332)
• 152067f chore: update ecosystem plugins (#21362)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376)
• 67eb586 docs: Update README
• bfaea12 perf: cache normalized config globals per languageOptions (#21364)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369)
• d166567 chore: update dependency prettier to v3.9.9 (#21371)
• Additional commits viewable in compare view

Updates eslint-plugin-react-refresh from 0.5.6 to 0.5.7

Release notes

Sourced from eslint-plugin-react-refresh's releases.

v0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

Changelog

Sourced from eslint-plugin-react-refresh's changelog.

0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

Commits

• fd40d83 Add allowCompoundComponents option [publish] (#117)
• See full diff in compare view

Updates globals from 17.12.0 to 17.13.0

Release notes

Sourced from globals's releases.

v17.13.0

• Update globals (2026-10-01) (#354) b007369

---

sindresorhus/globals@v17.12.0...v17.13.0

Commits

• ce512bc 17.13.0
• b007369 Update globals (2026-10-01) (#354)
• 16cb1fe Meta tweaks
• See full diff in compare view

Updates typescript-eslint from 8.70.0 to 8.71.0

Release notes

Sourced from typescript-eslint's releases.

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

• eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

• eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)
• eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
• eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)
• eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Fatih Çakır @​wfatih
• Josh Goldberg
• Josh Goldberg ✨
• Zamiell @​Zamiell

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

• ast-spec: narrow import attribute keys to identifiers and strings (#12879)
• eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
• eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
• eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
• eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
• eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
• eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
• eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
• eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
• eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
• eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
• eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
• eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
• rule-tester: test the final autofix output instead of the first pass (#12867)
• scope-manager: merge implicit global definitions (#12809)
• type-utils: match package specifiers on whole path components (#12838)
• typescript-estree: resolve symlinked paths when matching files to projects (#12725)
• typescript-estree: add missing < token opening type arguments (#12821)

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.71.0 (2026-09-28)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 8695664 chore(release): publish 8.71.0
• 23d38ce chore(release): publish 8.70.1
• eb42d9b chore: cleanup and fix Nx dependencies and missing tasks (#12897)
• 8c80531 chore: fix typos in comments and docs (#12846)
• b6b86a1 chore: migrate to nx 23.2.0 (#12843)
• See full diff in compare view

Updates vite from 8.2.2 to 8.3.2

Release notes

Sourced from vite's releases.

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps:Description has been truncated