i18next 26.4.4 fixes GHSA-5jr9-983r-c8x4, a ReDoS reachable through the intl package. The expired TanStack quarantine exceptions were removed, so the workspace keeps its 2880-minute minimumReleaseAge with no exclusions. Vulnerable transitive ranges such as hono, qs, undici and @modelcontextprotocol/sdk were re-resolved within their declared ranges.
Direct pins advance for zod, vitest, TanStack Query and Table, evlog, lucide-react, the AWS S3 clients and Takumi 2.15.1. files-sdk 2.6.2 drops the error-identity workaround; the rebased patch keeps upload authorization, Organization prefix, declared size/type and conditional-create checks. Wrangler, the Vite plugin, oxlint and turbo stayed on their previous versions until their releases qualify.
The UI package adds free ReUI time-picker, color-picker, signature-pad, file-type, emoji-picker and cascader components with explicit exports. The cascader brings @tanstack/react-virtual. EmojiPicker loads emojibase-data from jsDelivr unless local data is passed.
Sources: security fix, package bumps, transitive ranges, ReUI controls.