Home » Oreps » React Native Windows » All Pull Requests » #16487
microsoft/react-native-windows
A framework for building native Windows apps with React.
Watch
0
Commit Activity
Pull Requests
Directory Browser
Velocity History
Releases

📦 Bump the all-dependencies group across 1 directory with 11 updates #16487

Compare code on GitHub
Open
dependabot[bot] opened 4:21am on October 15, 2026 wants to merge 1 commit into microsoft/react-native-windows main from
dependabot/npm_and_yarn/main/all-dependencies-d1f52723e7
dependabot[bot]
microsoft/react-native-windows
dependabot/npm_and_yarn/main/all-dependencies-d1f52723e7
Diff Delta:
0
About 0 Diff Delta/hour
Classified as:  General

dependabot-bot's Description of Work

Bumps the all-dependencies group with 11 updates in the / directory:

Package
From
To

ts-jest
29.4.12
29.4.14

@types/react
19.2.18
19.3.0

@types/async
3.2.25
3.2.26

@types/react-test-renderer
19.1.0
19.3.0

@microsoft/1ds-core-js
4.4.3
4.4.5

@microsoft/1ds-post-js
4.4.3
4.4.5

@microsoft/api-extractor
7.59.0
7.59.4

memfs
4.69.1
4.80.0

shell-quote
1.10.0
1.12.0

resolve
1.22.12
1.22.13

@rnx-kit/metro-config
2.2.4
2.2.6

Updates ts-jest from 29.4.12 to 29.4.14

Release notes

Sourced from ts-jest's releases.



v29.4.14


Please refer to CHANGELOG.md for details.


v29.4.13


Please refer to CHANGELOG.md for details.


Changelog

Sourced from ts-jest's changelog.




29.4.14 (2026-09-25)


Reverts




29.4.13 (2026-09-22)


Features



Performance Improvements



Commits



  • 2d152f6 chore(release): 29.4.14


  • 01e5a2e revert: bring back prior changes of compiler util (#5471)


  • 8e35da6 build(deps): update dependency typescript-eslint to ^8.70.1


  • 76ec454 build(deps): bump image-size from 2.0.2 to 2.0.4 in /website


  • a0c364f chore(release): 29.4.13


  • 697d337 perf(compiler): cache module resolution modes (#5419)


  • c3a0b57 feat: support Babel 8 (#5466)


  • 5fb44c4 build(deps): update dependency jest-environment-jsdom to ^30.5.2


  • 257a524 build(deps): update dependency jest to v30.5.2


  • 89ba4d9 build(deps): update dependency babel-jest to ^30.5.2

  • Additional commits viewable in compare view


Updates @types/react from 19.2.18 to 19.3.0

Commits


Updates @types/async from 3.2.25 to 3.2.26

Commits


Updates @types/react-test-renderer from 19.1.0 to 19.3.0

Commits


Updates @microsoft/1ds-core-js from 4.4.3 to 4.4.5

Changelog

Sourced from @​microsoft/1ds-core-js's changelog.



Releases



Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.



<!-- raw HTML omitted -->

3.4.5 (October 5th, 2026)


This release enables internal SDK network statistics and routes them to a dedicated SDK Stats ingestion endpoint. The @microsoft/1ds-post-js channel is numbered 4.4.5 and requires v3.4.5.


Significant Changes (since 3.4.4)




  • Internal SDK Stats: The full SDK now records request successes, failures, retries, throttling, and request duration. Counters are persisted in session storage by customer instrumentation key and endpoint, with a default collection interval of one hour (stats.shrtInt, in seconds).


  • Dedicated Ingestion and Dynamic Configuration: Internal SDK Stats use a separate core and sender, rather than the customer's telemetry pipeline. Sending requires stats.cfgUrl, stats.iKey, and an enabled remote configuration that supplies the destination host. EU customer endpoints use the EU-prefixed configuration host. Configuration and sampling can be updated at runtime, and counters are retained while remote configuration is unavailable.


  • Feature Throttling: Added ThrottleMgr.useFeature() and string-keyed throttleMgrCfg entries for feature operations. Internal SDK Stats have a dedicated daily throttle, separate from internal diagnostic messages. Throttle sampling now honors a zero rate, interval rules are evaluated per configuration, and long-lived instances can send again on the next eligible UTC day.


  • Sender Unload Reliability: Late network responses no longer access the cleared core configuration when looking up internal SDK Stats after unload.


Potential behavioral changes


The internal SDK Stats manager is enabled by default, but it does not send statistics until the required local or CDN-delivered configuration is available and the remote configuration enables sending. Disable this feature with featureOptIn: { sdkStats: { mode: FeatureOptInMode.disable } }. The lowercase sdkStats feature is separate from the existing customer-facing SdkStats feature and its sdkStats.int collection interval.


Internal SDK Stats bypass customer telemetry initializers and plugins. Applications that use those hooks to inspect, modify, or filter customer telemetry should use the internal SDK Stats feature flag to opt out instead.


Changelog




  • #2741 Enable SDK Stats and route to the SDK Stats ingestion endpoint


Full Changelog: https://github.com/microsoft/ApplicationInsights-JS/compare/3.4.4...3.4.5


3.4.4 (September 8th, 2026)


This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The @microsoft/1ds-post-js channel is numbered 4.4.4 and requires v3.4.4.


Significant Changes (since 3.4.3)




  • ESM XHR Instrumentation: Fixed tree shaking of the XHR capability check so automatic XHR instrumentation is preserved in ESM bundles.


  • Vite 8 and Rolldown Compatibility: Normalized generated PURE annotations by expression so invalid annotations on primitive literals no longer produce warnings, while valid call and new expression annotations remain tree-shakable.


  • OpenTelemetry Async Error Propagation: Fixed startActiveSpan() so promise rejections from asynchronous callbacks propagate to callers instead of being swallowed.


  • Dependency Security Hardening: Resolved the repository's npm audit and Component Governance findings by updating vulnerable transitive build dependencies and replacing Puppeteer's vulnerable extract-zip dependency with a maintained compatible package. Rush was upgraded to 5.178.1 and pnpm to 10.34.5, while API Extractor remains on the latest Node.js 18-compatible release. These are build/tooling changes and do not affect the published runtime code.


  • GitHub Actions Supply-Chain Hardening: Pinned third-party GitHub Actions to full-length commit SHAs and added grouped weekly Dependabot updates with a seven-day cooldown.


Changelog




  • #2768 Fix ESM XHR instrumentation tree shaking


  • #2767 docs: fix Offline Channel setup example


  • #2766 fix: normalize PURE annotations for Vite 8 and Rolldown


  • #2761 fix(deps): remediate Component Governance vulnerabilities


  • #2758 Pin GitHub Actions to full-length commit SHAs


  • #2757 fix(otel): propagate promise rejection from startActiveSpan async callback


  • #2754 fix(test): stabilize flaky SpanLifeCycle custom endTime test


<!-- raw HTML omitted -->

... (truncated)

Commits


Updates @microsoft/1ds-post-js from 4.4.3 to 4.4.5

Changelog

Sourced from @​microsoft/1ds-post-js's changelog.



Releases



Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.



<!-- raw HTML omitted -->

3.4.5 (October 5th, 2026)


This release enables internal SDK network statistics and routes them to a dedicated SDK Stats ingestion endpoint. The @microsoft/1ds-post-js channel is numbered 4.4.5 and requires v3.4.5.


Significant Changes (since 3.4.4)




  • Internal SDK Stats: The full SDK now records request successes, failures, retries, throttling, and request duration. Counters are persisted in session storage by customer instrumentation key and endpoint, with a default collection interval of one hour (stats.shrtInt, in seconds).


  • Dedicated Ingestion and Dynamic Configuration: Internal SDK Stats use a separate core and sender, rather than the customer's telemetry pipeline. Sending requires stats.cfgUrl, stats.iKey, and an enabled remote configuration that supplies the destination host. EU customer endpoints use the EU-prefixed configuration host. Configuration and sampling can be updated at runtime, and counters are retained while remote configuration is unavailable.


  • Feature Throttling: Added ThrottleMgr.useFeature() and string-keyed throttleMgrCfg entries for feature operations. Internal SDK Stats have a dedicated daily throttle, separate from internal diagnostic messages. Throttle sampling now honors a zero rate, interval rules are evaluated per configuration, and long-lived instances can send again on the next eligible UTC day.


  • Sender Unload Reliability: Late network responses no longer access the cleared core configuration when looking up internal SDK Stats after unload.


Potential behavioral changes


The internal SDK Stats manager is enabled by default, but it does not send statistics until the required local or CDN-delivered configuration is available and the remote configuration enables sending. Disable this feature with featureOptIn: { sdkStats: { mode: FeatureOptInMode.disable } }. The lowercase sdkStats feature is separate from the existing customer-facing SdkStats feature and its sdkStats.int collection interval.


Internal SDK Stats bypass customer telemetry initializers and plugins. Applications that use those hooks to inspect, modify, or filter customer telemetry should use the internal SDK Stats feature flag to opt out instead.


Changelog




  • #2741 Enable SDK Stats and route to the SDK Stats ingestion endpoint


Full Changelog: https://github.com/microsoft/ApplicationInsights-JS/compare/3.4.4...3.4.5


3.4.4 (September 8th, 2026)


This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The @microsoft/1ds-post-js channel is numbered 4.4.4 and requires v3.4.4.


Significant Changes (since 3.4.3)




  • ESM XHR Instrumentation: Fixed tree shaking of the XHR capability check so automatic XHR instrumentation is preserved in ESM bundles.


  • Vite 8 and Rolldown Compatibility: Normalized generated PURE annotations by expression so invalid annotations on primitive literals no longer produce warnings, while valid call and new expression annotations remain tree-shakable.


  • OpenTelemetry Async Error Propagation: Fixed startActiveSpan() so promise rejections from asynchronous callbacks propagate to callers instead of being swallowed.


  • Dependency Security Hardening: Resolved the repository's npm audit and Component Governance findings by updating vulnerable transitive build dependencies and replacing Puppeteer's vulnerable extract-zip dependency with a maintained compatible package. Rush was upgraded to 5.178.1 and pnpm to 10.34.5, while API Extractor remains on the latest Node.js 18-compatible release. These are build/tooling changes and do not affect the published runtime code.


  • GitHub Actions Supply-Chain Hardening: Pinned third-party GitHub Actions to full-length commit SHAs and added grouped weekly Dependabot updates with a seven-day cooldown.


Changelog




  • #2768 Fix ESM XHR instrumentation tree shaking


  • #2767 docs: fix Offline Channel setup example


  • #2766 fix: normalize PURE annotations for Vite 8 and Rolldown


  • #2761 fix(deps): remediate Component Governance vulnerabilities


  • #2758 Pin GitHub Actions to full-length commit SHAs


  • #2757 fix(otel): propagate promise rejection from startActiveSpan async callback


  • #2754 fix(test): stabilize flaky SpanLifeCycle custom endTime test


<!-- raw HTML omitted -->

... (truncated)

Commits


Updates @microsoft/api-extractor from 7.59.0 to 7.59.4

Changelog

Sourced from @​microsoft/api-extractor's changelog.



7.59.4


Tue, 06 Oct 2026 00:04:37 GMT


Version update only


7.59.3


Mon, 28 Sep 2026 20:08:26 GMT


Version update only


7.59.2


Tue, 22 Sep 2026 17:35:41 GMT


Patches



  • Update the @microsoft/tsdoc dependency to ~0.17.0 and the @microsoft/tsdoc-config dependency to ~0.18.2.


7.59.1


Sat, 05 Sep 2026 00:15:08 GMT


Version update only


Commits

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for @​microsoft/api-extractor since your current version.


Updates memfs from 4.69.1 to 4.80.0

Release notes

Sourced from memfs's releases.



Release v4.80.0


What's Changed



New Contributors



Full Changelog: https://github.com/streamich/memfs/compare/v4.79.0...v4.80.0


Release v4.79.0


What's Changed



Full Changelog: https://github.com/streamich/memfs/compare/v4.78.1...v4.79.0


Release v4.78.1


What's Changed



Full Changelog: https://github.com/streamich/memfs/compare/v4.78.0...v4.78.1


Release v4.78.0


What's Changed



Full Changelog: https://github.com/streamich/memfs/compare/v4.77.0...v4.78.0


Release v4.77.0


What's Changed



Full Changelog: https://github.com/streamich/memfs/compare/v4.76.0...v4.77.0


Release v4.76.0


What's Changed



Full Changelog: https://github.com/streamich/memfs/compare/v4.75.0...v4.76.0


Release v4.75.0


What's Changed



Full Changelog: https://github.com/streamich/memfs/compare/v4.74.0...v4.75.0


<!-- raw HTML omitted -->

... (truncated)

Commits



  • adae41a chore: release v4.80.0


  • d9cfa18 Merge pull request #1298 from Firatakti/codex/fsa-sync-timeout


  • fe75fbc feat: allow configuring the synchronous FSA worker timeout


  • 02dc814 chore: release v4.79.0


  • bfebfdd Merge pull request #1297 from streamich/fix-improve-fsa-error-handling


  • 55bc790 fix: 🐛 harden stream close behavior


  • b82f6b3 feat: 🎸 improve FS(A) error handling


  • bbcea18 chore: release v4.78.1


  • 8eb7822 Merge pull request #1295 from streamich/fix-fsa-permission-return


  • 0f9bbae fix: 🐛 return correct shape from .queryPermission()

  • Additional commits viewable in compare view


Updates shell-quote from 1.10.0 to 1.12.0

Changelog

Sourced from shell-quote's changelog.




v1.12.0 - 2026-10-02


Fixed



  • [New] parse: support here-documents (&lt;&lt;) #31


Commits



  • [New] parse: support tab-stripping here-documents (&lt;&lt;-) dbfac37

  • [New] parse: support output process substitution (&gt;() 2053315

  • [New] parse: support the case test-next terminator (;;&) 7d688b9

  • [New] parse: support the case fall-through terminator (;&) f27010e

  • [New] parse: support redirecting output despite noclobber (&gt;|) b78d19c

  • [New] parse: support opening a file for reading and writing (&lt;&gt;) 21cc333

  • [New] parse: support redirecting stdout and stderr (&&gt;) 6ad6cd2

  • [New] parse: support appending stdout and stderr (&&gt;&gt;) 90cde9c

  • [Dev Deps] update @ljharb/eslint-config 3a7b4ae



v1.11.0 - 2026-09-29


Fixed



  • [Refactor] quote: drop a replace that can never match in the single-quote branch #15

  • [New] parse: support bash ANSI-C quoting ($'...') #32


Commits



  • [Fix] quote: reject line terminators in tokens after a comment 6002b2e

  • [Fix] parse: preserve text after special shell parameters 81b08a5

  • [Fix] parse: an escaped backslash does not escape the character after it d708019

  • [Fix] quote: preserve ! in arguments that also contain ' ad39927

  • [Fix] parse: treat $name as a variable name, not $ followed by text 28f88cd

  • [Fix] quote: preserve empty glob patterns 35c9b97

  • [Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c

  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e

  • [meta] npmignore some files ebfc308

  • [actions] add permissions 3429b0d

  • [actions] set least-privilege cache-mode 36f2394

  • [Dev Deps] update eslint 6de9a41


Commits



  • 6ecb8aa v1.12.0


  • 3a7b4ae [Dev Deps] update @ljharb/eslint-config


  • 7d688b9 [New] parse: support the case test-next terminator (;;&)


  • f27010e [New] parse: support the case fall-through terminator (;&)


  • 90cde9c [New] parse: support appending stdout and stderr (&>>)


  • 6ad6cd2 [New] parse: support redirecting stdout and stderr (&>)


  • 2053315 [New] parse: support output process substitution (>()


  • b78d19c [New] parse: support redirecting output despite noclobber (>|)


  • 21cc333 [New] parse: support opening a file for reading and writing (&lt;>)


  • dbfac37 [New] parse: support tab-stripping here-documents (<<-)

  • Additional commits viewable in compare view


Updates resolve from 1.22.12 to 1.22.13

Commits


Updates @rnx-kit/metro-config from 2.2.4 to 2.2.6

Release notes

Sourced from @​rnx-kit/metro-config's releases.




@​rnx-kit/metro-config@​2.2.6


Patch Changes



  • f3bd2b4: Workaround for Expo overwriting what platforms are available

  • Updated dependencies [ff53986]


    • @​rnx-kit/tools-workspaces@​0.2.6





@​rnx-kit/metro-config@​2.2.5


Patch Changes



  • 61c1cb7: Support setup-env.js introduced in 0.88


Changelog

Sourced from @​rnx-kit/metro-config's changelog.



2.2.6


Patch Changes



  • f3bd2b4: Workaround for Expo overwriting what platforms are available

  • Updated dependencies [ff53986]


    • @​rnx-kit/tools-workspaces@​0.2.6




2.2.5


Patch Changes



  • 61c1cb7: Support setup-env.js introduced in 0.88


Commits

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​rnx-kit/metro-config since your current version.


1 total changed file
(1 file ignored)
You've made it to the end of the scroll.
The diff well is dry.
GitClear uses cookies to ensure you get the best experience on our website. Learn more about our cookie policy