Home » Oreps » React Native Windows » All Pull Requests » #16471
microsoft/react-native-windows
A framework for building native Windows apps with React.
Watch
0
Commit Activity
Pull Requests
Directory Browser
Velocity History
Releases

📦 [0.84]: Bump the all-dependencies group across 1 directory with 17 updates #16471

Compare code on GitHub
Closed
dependabot[bot] opened 4:15am on October 7, 2026 wanted to merge 1 commit into microsoft/react-native-windows 0.84-stable from
dependabot/npm_and_yarn/0.84-stable/all-dependencies-f9d2792e0a

Pull Request Overview

  • Opened on October 7, 2026
  • Status Closed
  • Commit count 1 with first commit October 7, 2026

Total Delta

0 Total Diff Delta

Open Days

Open 23 weekdays

Test Delta

0 Diff Delta in Test Files
Breakdown by Phase

How long has this pull request spent in each phase of its lifecycle?

Fraction of total time Business days Phase
 
 0 days Authoring 1 commit before pull request opened for review
 
 0 days Awaiting first review
 
 1 day Revising work with 0 commits in response to 1 review that left 3 comments

Total time for pull request 1 business day from first commit to closed PR

Author avatar

📦 [0.84]: Bump the all-dependencies group across 1 directory with 17 updates

Bumps the all-dependencies group with 17 updates in the / directory:

Package
From
To

beachball
2.65.5
2.66.0

lage
2.15.12
2.17.0

ts-jest
29.4.11
29.4.14

@types/react
19.2.15
19.2.18

@rnx-kit/jest-preset
0.3.2
0.3.3

semver
7.8.1
7.8.5

@types/async
3.2.25
3.2.26

@types/lodash
4.17.24
4.17.25

@types/react-test-renderer
19.1.0
19.3.0

metro-runtime
0.83.7
0.83.8

metro-source-map
0.83.7
0.83.8

tinyglobby
0.2.16
0.2.17

@microsoft/1ds-core-js
4.4.1
4.4.4

@microsoft/1ds-post-js
4.4.1
4.4.4

shell-quote
1.8.4
1.11.0

@rnx-kit/metro-config
2.2.4
2.2.6

screenshot-desktop
1.15.4
1.15.6

Updates beachball from 2.65.5 to 2.66.0

Changelog

Sourced from beachball's changelog.



2.66.0


Wed, 09 Sep 2026 03:05:57 GMT


Minor changes



2.65.6


Tue, 25 Aug 2026 01:40:36 GMT


Patches



Commits


Updates lage from 2.15.12 to 2.17.0

Commits


Updates ts-jest from 29.4.11 to 29.4.14

Release notes

Sourced from ts-jest's releases.



v29.4.14


Please refer to CHANGELOG.md for details.


v29.4.13


Please refer to CHANGELOG.md for details.


v29.4.12


Please refer to CHANGELOG.md for details.


Changelog

Sourced from ts-jest's changelog.




29.4.14 (2026-09-25)


Reverts




29.4.13 (2026-09-22)


Features



Performance Improvements




29.4.12 (2026-07-22)


Features




  • compiler: support TypeScript 7 projects through compatibility aliases (#5386)


Commits



  • 2d152f6 chore(release): 29.4.14


  • 01e5a2e revert: bring back prior changes of compiler util (#5471)


  • 8e35da6 build(deps): update dependency typescript-eslint to ^8.70.1


  • 76ec454 build(deps): bump image-size from 2.0.2 to 2.0.4 in /website


  • a0c364f chore(release): 29.4.13


  • 697d337 perf(compiler): cache module resolution modes (#5419)


  • c3a0b57 feat: support Babel 8 (#5466)


  • 5fb44c4 build(deps): update dependency jest-environment-jsdom to ^30.5.2


  • 257a524 build(deps): update dependency jest to v30.5.2


  • 89ba4d9 build(deps): update dependency babel-jest to ^30.5.2

  • Additional commits viewable in compare view


Updates @types/react from 19.2.15 to 19.2.18

Commits


Updates @rnx-kit/jest-preset from 0.3.2 to 0.3.3

Release notes

Sourced from @​rnx-kit/jest-preset's releases.




@​rnx-kit/jest-preset@​0.3.3


Patch Changes



  • 57d86ad: Replaced find-up with the implementation in a transitive dependency


Changelog

Sourced from @​rnx-kit/jest-preset's changelog.



0.3.3


Patch Changes



  • 57d86ad: Replaced find-up with the implementation in a transitive dependency


Commits

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​rnx-kit/jest-preset since your current version.


Updates semver from 7.8.1 to 7.8.5

Release notes

Sourced from semver's releases.



v7.8.5



7.8.5 (2026-06-19)


Bug Fixes



v7.8.4



7.8.4 (2026-06-09)


Bug Fixes



v7.8.3



7.8.3 (2026-06-08)


Bug Fixes



Chores



v7.8.2



7.8.2 (2026-06-04)


Bug Fixes



Changelog

Sourced from semver's changelog.




7.8.5 (2026-06-19)


Bug Fixes




7.8.4 (2026-06-09)


Bug Fixes




7.8.3 (2026-06-08)


Bug Fixes



Chores




7.8.2 (2026-06-04)


Bug Fixes



Commits


Updates @types/async from 3.2.25 to 3.2.26

Commits


Updates @types/lodash from 4.17.24 to 4.17.25

Commits


Updates @types/react-test-renderer from 19.1.0 to 19.3.0

Commits


Updates metro-runtime from 0.83.7 to 0.83.8

Release notes

Sourced from metro-runtime's releases.



v0.83.8


This release is on the 0.83.x branch



Full Changelog: https://github.com/facebook/metro/compare/v0.83.7...v0.83.8


Commits


Updates metro-source-map from 0.83.7 to 0.83.8

Release notes

Sourced from metro-source-map's releases.



v0.83.8


This release is on the 0.83.x branch



Full Changelog: https://github.com/facebook/metro/compare/v0.83.7...v0.83.8


Commits


Updates tinyglobby from 0.2.16 to 0.2.17

Release notes

Sourced from tinyglobby's releases.



0.2.17


Changed



  • Enabled staged publishing for stronger supply-chain security


Fixed



  • Defaults when undefined is passed to any of the options by @​chloeelim

  • Drive-relative paths on Windows by @​Andrej730


  • FileSystemAdapter is now exported again


Consider sponsoring if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem


Changelog

Sourced from tinyglobby's changelog.



0.2.17


Changed



  • Enabled staged publishing for stronger supply-chain security


Fixed



  • Defaults when undefined is passed to any of the options by chloeelim

  • Drive-relative paths on Windows by Andrej730


  • FileSystemAdapter is now exported again


Commits


Updates @microsoft/1ds-core-js from 4.4.1 to 4.4.4

Changelog

Sourced from @​microsoft/1ds-core-js's changelog.



Releases



Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.



<!-- raw HTML omitted -->

3.4.5 (October 5th, 2026)


This release enables internal SDK network statistics and routes them to a dedicated SDK Stats ingestion endpoint. The @microsoft/1ds-post-js channel is numbered 4.4.5 and requires v3.4.5.


Significant Changes (since 3.4.4)




  • Internal SDK Stats: The full SDK now records request successes, failures, retries, throttling, and request duration. Counters are persisted in session storage by customer instrumentation key and endpoint, with a default collection interval of one hour (stats.shrtInt, in seconds).


  • Dedicated Ingestion and Dynamic Configuration: Internal SDK Stats use a separate core and sender, rather than the customer's telemetry pipeline. Sending requires stats.cfgUrl, stats.iKey, and an enabled remote configuration that supplies the destination host. EU customer endpoints use the EU-prefixed configuration host. Configuration and sampling can be updated at runtime, and counters are retained while remote configuration is unavailable.


  • Feature Throttling: Added ThrottleMgr.useFeature() and string-keyed throttleMgrCfg entries for feature operations. Internal SDK Stats have a dedicated daily throttle, separate from internal diagnostic messages. Throttle sampling now honors a zero rate, interval rules are evaluated per configuration, and long-lived instances can send again on the next eligible UTC day.


  • Sender Unload Reliability: Late network responses no longer access the cleared core configuration when looking up internal SDK Stats after unload.


Potential behavioral changes


The internal SDK Stats manager is enabled by default, but it does not send statistics until the required local or CDN-delivered configuration is available and the remote configuration enables sending. Disable this feature with featureOptIn: { sdkStats: { mode: FeatureOptInMode.disable } }. The lowercase sdkStats feature is separate from the existing customer-facing SdkStats feature and its sdkStats.int collection interval.


Internal SDK Stats bypass customer telemetry initializers and plugins. Applications that use those hooks to inspect, modify, or filter customer telemetry should use the internal SDK Stats feature flag to opt out instead.


Changelog




  • #2741 Enable SDK Stats and route to the SDK Stats ingestion endpoint


Full Changelog: https://github.com/microsoft/ApplicationInsights-JS/compare/3.4.4...3.4.5


3.4.4 (September 8th, 2026)


This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The @microsoft/1ds-post-js channel is numbered 4.4.4 and requires v3.4.4.


Significant Changes (since 3.4.3)




  • ESM XHR Instrumentation: Fixed tree shaking of the XHR capability check so automatic XHR instrumentation is preserved in ESM bundles.


  • Vite 8 and Rolldown Compatibility: Normalized generated PURE annotations by expression so invalid annotations on primitive literals no longer produce warnings, while valid call and new expression annotations remain tree-shakable.


  • OpenTelemetry Async Error Propagation: Fixed startActiveSpan() so promise rejections from asynchronous callbacks propagate to callers instead of being swallowed.


  • Dependency Security Hardening: Resolved the repository's npm audit and Component Governance findings by updating vulnerable transitive build dependencies and replacing Puppeteer's vulnerable extract-zip dependency with a maintained compatible package. Rush was upgraded to 5.178.1 and pnpm to 10.34.5, while API Extractor remains on the latest Node.js 18-compatible release. These are build/tooling changes and do not affect the published runtime code.


  • GitHub Actions Supply-Chain Hardening: Pinned third-party GitHub Actions to full-length commit SHAs and added grouped weekly Dependabot updates with a seven-day cooldown.


Changelog




  • #2768 Fix ESM XHR instrumentation tree shaking


  • #2767 docs: fix Offline Channel setup example


  • #2766 fix: normalize PURE annotations for Vite 8 and Rolldown


  • #2761 fix(deps): remediate Component Governance vulnerabilities


  • #2758 Pin GitHub Actions to full-length commit SHAs


  • #2757 fix(otel): propagate promise rejection from startActiveSpan async callback


  • #2754 fix(test): stabilize flaky SpanLifeCycle custom endTime test


<!-- raw HTML omitted -->

... (truncated)

Commits


Updates @microsoft/1ds-post-js from 4.4.1 to 4.4.4

Changelog

Sourced from @​microsoft/1ds-post-js's changelog.



Releases



Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.



<!-- raw HTML omitted -->

3.4.5 (October 5th, 2026)


This release enables internal SDK network statistics and routes them to a dedicated SDK Stats ingestion endpoint. The @microsoft/1ds-post-js channel is numbered 4.4.5 and requires v3.4.5.


Significant Changes (since 3.4.4)




  • Internal SDK Stats: The full SDK now records request successes, failures, retries, throttling, and request duration. Counters are persisted in session storage by customer instrumentation key and endpoint, with a default collection interval of one hour (stats.shrtInt, in seconds).


  • Dedicated Ingestion and Dynamic Configuration: Internal SDK Stats use a separate core and sender, rather than the customer's telemetry pipeline. Sending requires stats.cfgUrl, stats.iKey, and an enabled remote configuration that supplies the destination host. EU customer endpoints use the EU-prefixed configuration host. Configuration and sampling can be updated at runtime, and counters are retained while remote configuration is unavailable.


  • Feature Throttling: Added ThrottleMgr.useFeature() and string-keyed throttleMgrCfg entries for feature operations. Internal SDK Stats have a dedicated daily throttle, separate from internal diagnostic messages. Throttle sampling now honors a zero rate, interval rules are evaluated per configuration, and long-lived instances can send again on the next eligible UTC day.


  • Sender Unload Reliability: Late network responses no longer access the cleared core configuration when looking up internal SDK Stats after unload.


Potential behavioral changes


The internal SDK Stats manager is enabled by default, but it does not send statistics until the required local or CDN-delivered configuration is available and the remote configuration enables sending. Disable this feature with featureOptIn: { sdkStats: { mode: FeatureOptInMode.disable } }. The lowercase sdkStats feature is separate from the existing customer-facing SdkStats feature and its sdkStats.int collection interval.


Internal SDK Stats bypass customer telemetry initializers and plugins. Applications that use those hooks to inspect, modify, or filter customer telemetry should use the internal SDK Stats feature flag to opt out instead.


Changelog




  • #2741 Enable SDK Stats and route to the SDK Stats ingestion endpoint


Full Changelog: https://github.com/microsoft/ApplicationInsights-JS/compare/3.4.4...3.4.5


3.4.4 (September 8th, 2026)


This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The @microsoft/1ds-post-js channel is numbered 4.4.4 and requires v3.4.4.


Significant Changes (since 3.4.3)




  • ESM XHR Instrumentation: Fixed tree shaking of the XHR capability check so automatic XHR instrumentation is preserved in ESM bundles.


  • Vite 8 and Rolldown Compatibility: Normalized generated PURE annotations by expression so invalid annotations on primitive literals no longer produce warnings, while valid call and new expression annotations remain tree-shakable.


  • OpenTelemetry Async Error Propagation: Fixed startActiveSpan() so promise rejections from asynchronous callbacks propagate to callers instead of being swallowed.


  • Dependency Security Hardening: Resolved the repository's npm audit and Component Governance findings by updating vulnerable transitive build dependencies and replacing Puppeteer's vulnerable extract-zip dependency with a maintained compatible package. Rush was upgraded to 5.178.1 and pnpm to 10.34.5, while API Extractor remains on the latest Node.js 18-compatible release. These are build/tooling changes and do not affect the published runtime code.


  • GitHub Actions Supply-Chain Hardening: Pinned third-party GitHub Actions to full-length commit SHAs and added grouped weekly Dependabot updates with a seven-day cooldown.


Changelog




  • #2768 Fix ESM XHR instrumentation tree shaking


  • #2767 docs: fix Offline Channel setup example


  • #2766 fix: normalize PURE annotations for Vite 8 and Rolldown


  • #2761 fix(deps): remediate Component Governance vulnerabilities


  • #2758 Pin GitHub Actions to full-length commit SHAs


  • #2757 fix(otel): propagate promise rejection from startActiveSpan async callback


  • #2754 fix(test): stabilize flaky SpanLifeCycle custom endTime test


<!-- raw HTML omitted -->

... (truncated)

Commits


Updates shell-quote from 1.8.4 to 1.11.0

Changelog

Sourced from shell-quote's changelog.




v1.11.0 - 2026-09-29


Fixed



  • [Refactor] quote: drop a replace that can never match in the single-quote branch #15

  • [New] parse: support bash ANSI-C quoting ($'...') #32


Commits



  • [Fix] quote: reject line terminators in tokens after a comment 6002b2e

  • [Fix] parse: preserve text after special shell parameters 81b08a5

  • [Fix] parse: an escaped backslash does not escape the character after it d708019

  • [Fix] quote: preserve ! in arguments that also contain ' ad39927

  • [Fix] parse: treat $name as a variable name, not $ followed by text 28f88cd

  • [Fix] quote: preserve empty glob patterns 35c9b97

  • [Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c

  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e

  • [meta] npmignore some files ebfc308

  • [actions] add permissions 3429b0d

  • [actions] set least-privilege cache-mode 36f2394

  • [Dev Deps] update eslint 6de9a41



v1.10.0 - 2026-07-10


Merged



  • [New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions #1


Commits



  • [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8

  • [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

  • [readme] remove the space in js code fences so evalmd evaluates them 2116fa3

  • [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f

  • [readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e

  • [readme] document parse's supported parameter-expansion subset e1c75cd

  • [Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3

  • [readme] fix stale example outputs 2de86f5

  • [Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236

  • [readme] quote: use output verbatim; do not re-quote it (#11) 1b36468

  • [Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c

  • [types] fix an error TS v6 ignores but v7 fails on 59bbf8b

  • [Dev Deps] update @arethetypeswrong/cli, evalmd a04d475

  • [Dev Deps] update @arethetypeswrong/ci, eslint d390f9a

  • [Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119



v1.9.0 - 2026-06-24


Commits


<!-- raw HTML omitted -->

... (truncated)

Commits



  • 88241f8 v1.11.0


  • ebfc308 [meta] npmignore some files


  • c4385ec [Refactor] quote: drop a replace that can never match in the single-quote b...


  • e455649 [New] parse: support bash ANSI-C quoting ($'...')


  • d708019 [Fix] parse: an escaped backslash does not escape the character after it


  • b1e406e [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd


  • ad39927 [Fix] quote: preserve ! in arguments that also contain '


  • 6002b2e [Fix] quote: reject line terminators in tokens after a comment


  • 36f2394 [actions] set least-privilege cache-mode


  • 28f88cd [Fix] parse: treat $name as a variable name, not $ followed by text

  • Additional commits viewable in compare view


Updates @rnx-kit/metro-config from 2.2.4 to 2.2.6

Release notes

Sourced from @​rnx-kit/metro-config's releases.




@​rnx-kit/metro-config@​2.2.6


Patch Changes



  • f3bd2b4: Workaround for Expo overwriting what platforms are available

  • Updated dependencies [ff53986]


    • @​rnx-kit/tools-workspaces@​0.2.6





@​rnx-kit/metro-config@​2.2.5


Patch Changes



  • 61c1cb7: Support setup-env.js introduced in 0.88


Changelog

Sourced from @​rnx-kit/metro-config's changelog.



2.2.6


Patch Changes



  • f3bd2b4: Workaround for Expo overwriting what platforms are available

  • Updated dependencies [ff53986]


    • @​rnx-kit/tools-workspaces@​0.2.6




2.2.5


Patch Changes



  • 61c1cb7: Support setup-env.js introduced in 0.88


Commits

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​rnx-kit/metro-config since your current version.


Updates screenshot-desktop from 1.15.4 to 1.15.6

Release notes

Sourced from screenshot-desktop's releases.



v1.15.6


Maintenance



  • Updated vulnerable transitive brace-expansion dependencies to patched versions.

  • Updated vulnerable transitive js-yaml dependencies to patched versions.


  • npm audit now reports zero vulnerabilities.


Full changelog: https://github.com/bencevans/screenshot-desktop/compare/v1.15.5...v1.15.6


v1.15.5


Security


This release fixes a Windows command-injection vulnerability in options.screen. Applications that pass untrusted input to this option could allow command metacharacters to reach cmd.exe. Requested displays are now validated against the identifiers returned by Windows before capture.


Affected screen-injection versions are earlier than 1.15.2 and versions 1.15.3 through 1.15.4. Version 1.15.2 filtered this input but broke canonical Windows display identifiers; version 1.15.5 provides the complete fix. Users should upgrade to 1.15.5.


Thanks to @​arpitjain099 for responsibly reporting this vulnerability.


What's Changed



Full Changelog: https://github.com/bencevans/screenshot-desktop/compare/v1.15.4...v1.15.5


Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

###### Microsoft Reviewers: Open in CodeFlow

Comments Threads Pending Resolution

ljharb reviewed on October 7, 2026
ljharb left a comment

Copilot wasn't able to review any files in this pull request. Check if the **Files changed** in this pull request are included in [default exclusions](https://docs.github.com/en/copilot/reference/review-excluded-files).

Resolved Comment Threads

No resolved comments have been left on this PR.

GitClear uses cookies to ensure you get the best experience on our website. Learn more about our cookie policy