Bump the production-dependencies group with 4 updates

[dependabot]

Bumps the production-dependencies group with 4 updates: @react-navigation/native-stack, i18next, react-i18next and react-native-paper.

Updates @react-navigation/native-stack from 7.14.10 to 7.14.11

Release notes

Sourced from @​react-navigation/native-stack's releases.

@​react-navigation/native-stack@​7.14.11

7.14.11 (2026-04-13)

Bug Fixes

• use explicit headerTintColor for header title if provided (646390d), closes #13070 - by @

Changelog

Sourced from @​react-navigation/native-stack's changelog.

7.14.11 (2026-04-13)

Bug Fixes

• use explicit headerTintColor for header title if provided (646390d), closes #13070 - by @

Commits

• e844073 chore: publish
• 646390d fix: use explicit headerTintColor for header title if provided
• See full diff in compare view

Updates i18next from 26.0.4 to 26.0.6

Release notes

Sourced from i18next's releases.

v26.0.6

Security release — all issues found via an internal audit. GHSA advisory filed after release.

• security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security docs for mitigation guidance (GHSA-TBD)
• security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .
• security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)
• chore: ignore .env* and *.pem/*.key files in .gitignore

v26.0.5

• fix: cloneInstance().changeLanguage() no longer fails to update language state when the target language is not yet loaded — a race between init()'s deferred load() and the user's changeLanguage() could overwrite isLanguageChangingTo, causing setLngProps to be skipped 2422

Changelog

Sourced from i18next's changelog.

26.0.6

Security release — all issues found via an internal audit.

• security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security note in the Nesting docs for the full pattern and mitigations
• security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .
• security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)
• chore: ignore .env* and *.pem/*.key files in .gitignore

26.0.5

• fix: cloneInstance().changeLanguage() no longer fails to update language state when the target language is not yet loaded — a race between init()'s deferred load() and the user's changeLanguage() could overwrite isLanguageChangingTo, causing setLngProps to be skipped 2422

Commits

• 9d0ed9f 26.0.6
• 8c82564 security: hardening for 26.0.6 — nesting-options warning, regexEscape unescap...
• 0cb018c chore: bump devDependencies
• ab4633f 26.0.5
• bae3b8b fix: cloneInstance().changeLanguage() no longer fails to update language st...
• See full diff in compare view

Updates react-i18next from 17.0.2 to 17.0.4

Changelog

Sourced from react-i18next's changelog.

17.0.4

• fix: avoid React does not recognize the 'i18nIsDynamicList' prop on a DOM element warning 1915

17.0.3

• fix: avoid invalid prop on React.Fragment inside <Trans /> 1914

Commits

• a398b76 17.0.4
• c96f7bc fix: avoid `React does not recognize the i18nIsDynamicList prop on a DOM elem...
• fe111f7 17.0.3
• e7419b8 fix: avoid invalid prop on React.Fragment inside \<Trans /> #1914
• See full diff in compare view

Updates react-native-paper from 5.15.0 to 5.15.1

Release notes

Sourced from react-native-paper's releases.

Release 5.15.1

5.15.1 (2026-04-14)

Bug Fixes

• docs: syntax highlighting (#4857) (8a1c86a)
• fix Menu briefly flashes on first open (#4876) (ad744ff)
• Menu: defer unmounting Portal until hide animation finishes (#4845) (78b2d75)
• replace deprecated absoluteFillObject for react native 0.85 compat (#4890) (febd0c2)

Commits

• 8b6b5e5 chore: release 5.15.1
• febd0c2 fix: replace deprecated absoluteFillObject for react native 0.85 compat (#4890)
• 78b2d75 fix(Menu): defer unmounting Portal until hide animation finishes (#4845)
• cbd4a6e docs: add llms.txt for AI coding assistant context (#4883)
• ad744ff fix: fix Menu briefly flashes on first open (#4876)
• 8a1c86a fix(docs): syntax highlighting (#4857)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions