build(deps): bump the production-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the production-dependencies group with 6 updates in the / directory:

Package	From	To
@react-navigation/bottom-tabs	7.18.3	7.18.5
@react-navigation/native	7.3.4	7.3.5
@react-navigation/native-stack	7.17.6	7.17.7
expo-modules-core	56.0.17	57.0.1
i18next	26.3.3	26.3.4
react-native-worklets	0.10.0	0.10.1

Updates @react-navigation/bottom-tabs from 7.18.3 to 7.18.5

Release notes

Sourced from @​react-navigation/bottom-tabs's releases.

@​react-navigation/bottom-tabs@​7.18.5

7.18.5 (2026-07-01)

Bug Fixes

• bottom-tabs: pop nested stack to top on blur even when animation is interrupted (#13123) (6baf55b) - by @

Changelog

Sourced from @​react-navigation/bottom-tabs's changelog.

7.18.5 (2026-07-01)

Bug Fixes

• bottom-tabs: pop nested stack to top on blur even when animation is interrupted (#13123) (6baf55b) - by @

7.18.4 (2026-06-30)

Note: Version bump only for package @​react-navigation/bottom-tabs

Commits

• 7d664cb chore: publish
• 6baf55b fix(bottom-tabs): pop nested stack to top on blur even when animation is inte...
• ce68b20 chore: publish
• See full diff in compare view

Updates @react-navigation/native from 7.3.4 to 7.3.5

Changelog

Sourced from @​react-navigation/native's changelog.

7.3.5 (2026-06-30)

Note: Version bump only for package @​react-navigation/native

Commits

• ce68b20 chore: publish
• 913ed5d test: add tests and typechecks for standard navigator integration
• See full diff in compare view

Updates @react-navigation/native-stack from 7.17.6 to 7.17.7

Changelog

Sourced from @​react-navigation/native-stack's changelog.

7.17.7 (2026-06-30)

Note: Version bump only for package @​react-navigation/native-stack

Commits

• ce68b20 chore: publish
• See full diff in compare view

Updates expo-modules-core from 56.0.17 to 57.0.1

Commits

• See full diff in compare view

Updates i18next from 26.3.3 to 26.3.4

Release notes

Sourced from i18next's releases.

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

Changelog

Sourced from i18next's changelog.

26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @​manus-use for the responsible disclosure.

Commits

• 817ede5 26.3.4
• 46d0dd8 build
• 642137b fix(security): prevent deepExtend from recursing into inherited built-ins
• See full diff in compare view

Updates react-native-worklets from 0.10.0 to 0.10.1

Release notes

Sourced from react-native-worklets's releases.

Worklets - 0.10.1

What's Changed

• cherry-pick(worklets-0.10-stable): Normalize Windows paths in bundle mode module IDs (#9721) by @​tjzel in software-mansion/react-native-reanimated#9799
• cherry-pick(worklets-0.10-stable): tie RNR remote function lifetime to TurboModule invalidate status (#9789) by @​tjzel in software-mansion/react-native-reanimated#9800
• cherry-pick(worklets-0.10-stable): time-of-check and time-of-use destructor safety (#9790) by @​tjzel in software-mansion/react-native-reanimated#9801
• release(Worklets): 0.10.1 by @​tjzel in software-mansion/react-native-reanimated#9802

Full Changelog: software-mansion/react-native-reanimated@worklets-0.10.0...worklets-0.10.1

Commits

• b4dfd65 release(Worklets): 0.10.1
• ced2953 fix(Worklets): time-of-check and time-of-use destructor safety (#9790)
• 7dc7ff6 fix(Worklets): tie RNR remote function lifetime to TurboModule invalidate sta...
• 967bd2b fix(Worklets): Normalize Windows paths in bundle mode module IDs (#9721)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions