# Dependency round, i18next fix and ReUI controls

Eligible packages advance under the two-day quarantine, a reachable i18next ReDoS is patched and six free ReUI controls join the UI package.

i18next 26.4.4 fixes [GHSA-5jr9-983r-c8x4](https://github.com/advisories/GHSA-5jr9-983r-c8x4), a ReDoS reachable through the intl package. The expired TanStack quarantine exceptions were removed, so the workspace keeps its 2880-minute `minimumReleaseAge` with no exclusions. Vulnerable transitive ranges such as `hono`, `qs`, `undici` and `@modelcontextprotocol/sdk` were re-resolved within their declared ranges.

Direct pins advance for zod, vitest, TanStack Query and Table, evlog, lucide-react, the AWS S3 clients and Takumi 2.15.1. files-sdk 2.6.2 drops the error-identity workaround; the rebased patch keeps upload authorization, Organization prefix, declared size/type and conditional-create checks. Wrangler, the Vite plugin, oxlint and turbo stayed on their previous versions until their releases qualify.

The UI package adds free ReUI `time-picker`, `color-picker`, `signature-pad`, `file-type`, `emoji-picker` and `cascader` components with explicit exports. The cascader brings `@tanstack/react-virtual`. EmojiPicker loads `emojibase-data` from jsDelivr unless local `data` is passed.

- [Libraries and version policy](/docs/libraries)
- [UI package](/docs/packages/ui)

Sources: [security fix](https://github.com/CarlosZiegler/doro/commit/bea0767), [package bumps](https://github.com/CarlosZiegler/doro/commit/40e1390), [transitive ranges](https://github.com/CarlosZiegler/doro/commit/9c59445), [ReUI controls](https://github.com/CarlosZiegler/doro/commit/8fc6177).