chore: bump the npm group with 40 updates

[dependabot]

Bumps the npm group with 40 updates:

Package	From	To
@sentry/react	10.63.0	10.66.0
@tanstack/react-virtual	3.14.5	3.14.6
@vanilla-extract/vite-plugin	5.2.3	5.2.5
dompurify	3.4.11	3.4.12
folds	2.6.2	2.7.0
html-react-parser	6.1.3	6.1.5
i18next	25.10.10	26.3.6
i18next-http-backend	2.7.3	4.0.0
immer	11.1.9	11.1.15
jotai	2.20.1	2.20.2
katex	0.17.0	0.18.0
marked	18.0.5	18.0.6
react	18.3.1	19.2.7
@types/react	18.3.31	19.2.17
react-colorful	5.7.0	5.8.0
react-dom	18.3.1	19.2.7
@types/react-dom	18.3.7	19.2.3
react-i18next	16.6.6	17.0.10
react-leaflet	4.2.1	5.0.0
react-router-dom	6.30.4	7.18.1
slate	0.124.1	0.126.0
slate-dom	0.124.1	0.126.0
slate-react	0.125.1	0.126.0
virtua	0.49.2	0.49.3
@cloudflare/vite-plugin	1.42.4	1.45.1
@sentry/vite-plugin	5.3.0	5.4.0
@types/node	24.13.2	26.1.1
@vitejs/plugin-react	5.2.0	6.0.3
@vitest/coverage-v8	4.1.9	4.1.10
@vitest/ui	4.1.9	4.1.10
knip	6.23.0	6.27.0
oxfmt	0.57.0	0.59.0
oxlint	1.72.0	1.74.0
oxlint-tsgolint	0.24.0	0.25.0
typescript	5.9.3	7.0.2
vite	7.3.5	8.1.5
vite-plugin-static-copy	3.4.0	4.1.1
vite-plugin-svgr	4.5.0	5.2.0
vitest	4.1.9	4.1.10
wrangler	4.106.0	4.112.0

Updates @sentry/react from 10.63.0 to 10.66.0

Release notes

Sourced from @​sentry/react's releases.

10.66.0

• chore(node-core): Deprecate @sentry/node-core package (#22285)
• chore(tanstackstart): Deprecate @sentry/tanstackstart package (#22284)
• deps(server-utils): bump @​apm-js-collab/code-transformer and tracing-hooks (#22172)
• feat(bun): Add initWithoutDefaultIntegrations and getDefaultIntegrationsWithoutPerformance (#22036)
• feat(bundlers): Add orchestrion bundler plugins (#22124)
• feat(cloudflare): Support Cloudflare types v5 & newer wrangler versions (#22180)
• feat(core): Add and use dataCollection.databaseQueryData (for e.g. Supabase filter values and mutation bodies) (#22219)
• feat(core): Add and use dataCollection.graphQL (#22221)
• feat(core): Add stringify helper and make AI-tracing serializers safe (#22163)
• feat(nestjs): Add orchestrion diagnostics-channel instrumentation (#22176)
• feat(nextjs): Add opt-in for orchestrion instrumentation (#22043)
• feat(node): Rewrite knex instrumentation to orchestrion tracing channels (#22237)
• feat(server-utils): Capture and log orchestrion stats (#22269)
• feat(server-utils): Migrate @opentelemetry/instrumentation-kafkajs to orchestrion (#21923)
• feat(server-utils): Migrate @opentelemetry/instrumentation-mysql2 to orchestrion (#22229)
• feat(server-utils): Rewrite @opentelemetry/instrumentation-dataloader to orchestrion (#22236)
• feat(server-utils): Rewrite @opentelemetry/instrumentation-generic-pool to orchestrion (#22240)
• feat(sveltekit): Detect SvelteKit 3 native tracing from the Vite plugin (#21580)
• fix: Include bundler CJS exports to fix Node warning (#22286)
• fix(browser-utils): Remove readystatechange listener to prevent memory leaks (#22216)
• fix(browser): Propagate trace data from active span if http.client span is non-recording (#22246)
• fix(core): Preserve propagation across ignored spans (#22277)
• fix(node): move dc integration swap to _init (#22173)
• fix(react-router): Correct url attributes for history and relative navigations (#22131)
• fix(react): Preserve parent path prefix for descendant route names in react-router (#22225)
• fix(server-utils): Dedupe ioredis orchestrion span for offline-queued commands (#22279)
• fix(vue): Refresh pageload URL attrs on TanStack onResolved (#22140)

• chore: Add external contributor to CHANGELOG.md (#22295)
• chore: Do not treat flaky test issues as bug (#22272)
• chore: stub modules for orchestrion configs, channels (#22195)
• chore: Update claude PR instructions (#22241)
• chore(changelog): Add external contributor to next changelog (#22234)
• chore(ci): Temporarily assign node/node-core reviews to whole JS SDK team (#22226)
• chore(ci): Temporarily assign orchestrion reviews to whole JS SDK team (#22215)
• chore(deps): Bump orchestrion dependencies to latest (#22287)
• chore(deps): Bump @sentry/conventions to 0.16.0 (#22270)
• chore(gitignore): Add .pnpm-store to gitignore (#22223)
• chore(skills): Add bump-conventions skill (#22271)
• fix(ci): Improve flaky test issue deduplication (#22042)
• fix(ci): Unblock external-contributors checkout on fork PR merges (#22235)
• ref(build): Replace ts-node with tsx for build and CI scripts (#22186)
• ref(core): Remove redundant log buffer flush (#22278)
• ref(nestjs): extract shared span helpers (#22175)
• ref(node): Refactor some otel internals in http integrations (#22292)
• ref(nuxt): Build the Nuxt module in-house instead of @​nuxt/module-builder (#22190)

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

10.66.0

• chore(node-core): Deprecate @sentry/node-core package (#22285)
• chore(tanstackstart): Deprecate @sentry/tanstackstart package (#22284)
• deps(server-utils): bump @​apm-js-collab/code-transformer and tracing-hooks (#22172)
• feat(bun): Add initWithoutDefaultIntegrations and getDefaultIntegrationsWithoutPerformance (#22036)
• feat(bundlers): Add orchestrion bundler plugins (#22124)
• feat(cloudflare): Support Cloudflare types v5 & newer wrangler versions (#22180)
• feat(core): Add and use dataCollection.databaseQueryData (for e.g. Supabase filter values and mutation bodies) (#22219)
• feat(core): Add and use dataCollection.graphQL (#22221)
• feat(core): Add stringify helper and make AI-tracing serializers safe (#22163)
• feat(nestjs): Add orchestrion diagnostics-channel instrumentation (#22176)
• feat(nextjs): Add opt-in for orchestrion instrumentation (#22043)
• feat(node): Rewrite knex instrumentation to orchestrion tracing channels (#22237)
• feat(server-utils): Capture and log orchestrion stats (#22269)
• feat(server-utils): Migrate @opentelemetry/instrumentation-kafkajs to orchestrion (#21923)
• feat(server-utils): Migrate @opentelemetry/instrumentation-mysql2 to orchestrion (#22229)
• feat(server-utils): Rewrite @opentelemetry/instrumentation-dataloader to orchestrion (#22236)
• feat(server-utils): Rewrite @opentelemetry/instrumentation-generic-pool to orchestrion (#22240)
• feat(sveltekit): Detect SvelteKit 3 native tracing from the Vite plugin (#21580)
• fix: Include bundler CJS exports to fix Node warning (#22286)
• fix(browser-utils): Remove readystatechange listener to prevent memory leaks (#22216)
• fix(browser): Propagate trace data from active span if http.client span is non-recording (#22246)
• fix(core): Preserve propagation across ignored spans (#22277)
• fix(node): move dc integration swap to _init (#22173)
• fix(react-router): Correct url attributes for history and relative navigations (#22131)
• fix(react): Preserve parent path prefix for descendant route names in react-router (#22225)
• fix(server-utils): Dedupe ioredis orchestrion span for offline-queued commands (#22279)
• fix(vue): Refresh pageload URL attrs on TanStack onResolved (#22140)

• chore: Add external contributor to CHANGELOG.md (#22295)
• chore: Do not treat flaky test issues as bug (#22272)
• chore: stub modules for orchestrion configs, channels (#22195)
• chore: Update claude PR instructions (#22241)
• chore(changelog): Add external contributor to next changelog (#22234)
• chore(ci): Temporarily assign node/node-core reviews to whole JS SDK team (#22226)
• chore(ci): Temporarily assign orchestrion reviews to whole JS SDK team (#22215)
• chore(deps): Bump orchestrion dependencies to latest (#22287)
• chore(deps): Bump @sentry/conventions to 0.16.0 (#22270)
• chore(gitignore): Add .pnpm-store to gitignore (#22223)
• chore(skills): Add bump-conventions skill (#22271)
• fix(ci): Improve flaky test issue deduplication (#22042)
• fix(ci): Unblock external-contributors checkout on fork PR merges (#22235)
• ref(build): Replace ts-node with tsx for build and CI scripts (#22186)
• ref(core): Remove redundant log buffer flush (#22278)
• ref(nestjs): extract shared span helpers (#22175)
• ref(node): Refactor some otel internals in http integrations (#22292)

... (truncated)

Commits

• 323cbf6 release: 10.66.0
• 85d0619 Merge pull request #22315 from getsentry/prepare-release/10.66.0
• bddcb83 meta(changelog): Update changelog for 10.66.0
• 595e940 feat(sveltekit): Detect SvelteKit 3 native tracing from the Vite plugin (#21580)
• 667cb71 fix(browser): Propagate trace data from active span if http.client span is ...
• e8d7bd4 fix(core): Preserve propagation across ignored spans (#22277)
• bd69bd9 chore(node-core): Deprecate @sentry/node-core package (#22285)
• c04ebda fix(react): Preserve parent path prefix for descendant route names in `react-...
• 2cbacb5 feat(node): Rewrite knex instrumentation to orchestrion tracing channels (#22...
• c9716eb feat(server-utils): Capture and log orchestrion stats (#22269)
• Additional commits viewable in compare view

Updates @tanstack/react-virtual from 3.14.5 to 3.14.6

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.6

Patch Changes

• Updated dependencies [6cbecd8, d49cc52, cf7834d]:
  • @​tanstack/virtual-core@​3.17.4

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.6

Patch Changes

• Updated dependencies [6cbecd8, d49cc52, cf7834d]:
  • @​tanstack/virtual-core@​3.17.4

Commits

• e2cb096 ci: Version Packages (#1225)
• d49cc52 fix(virtual-core): invalidate measurements when gap option changes (#1223)
• See full diff in compare view

Updates @vanilla-extract/vite-plugin from 5.2.3 to 5.2.5

Release notes

Sourced from @​vanilla-extract/vite-plugin's releases.

@​vanilla-extract/vite-plugin@​5.2.5

Patch Changes

• #1771 32d8d27 Thanks @​askoufis! - Update @vanilla-extract/compiler dependency to fix a bug that caused Vite to try (and fail) to emit an empty CSS file

• Updated dependencies [32d8d27]:

  • @​vanilla-extract/compiler@​0.7.2

@​vanilla-extract/vite-plugin@​5.2.4

Patch Changes

• #1765 9c28671 Thanks @​askoufis! - Fixed a bug that caused Vite to emit empty CSS files when processing Vanilla Extract modules that emit no CSS

• Updated dependencies [9c28671]:

  • @​vanilla-extract/compiler@​0.7.1

Changelog

Sourced from @​vanilla-extract/vite-plugin's changelog.

5.2.5

Patch Changes

• #1771 32d8d27 Thanks @​askoufis! - Update @vanilla-extract/compiler dependency to fix a bug that caused Vite to try (and fail) to emit an empty CSS file

• Updated dependencies [32d8d27]:

  • @​vanilla-extract/compiler@​0.7.2

5.2.4

Patch Changes

• #1765 9c28671 Thanks @​askoufis! - Fixed a bug that caused Vite to emit empty CSS files when processing Vanilla Extract modules that emit no CSS

• Updated dependencies [9c28671]:

  • @​vanilla-extract/compiler@​0.7.1

Commits

• bcceade Version Packages (#1772)
• b70528d Version Packages (#1766)
• 9c28671 vite: Don't emit empty chunks (#1765)
• See full diff in compare view

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

Commits

• a9ca1e5 release: 3.4.12 (#1537)
• See full diff in compare view

Updates folds from 2.6.2 to 2.7.0

Release notes

Sourced from folds's releases.

v2.7.0

2.7.0 (2026-07-04)

Bug Fixes

• tooltip appears on any key press (#147) (b8cd194)

Features

• progress bar packet animation when max param is missing (#146) (0dfab3c)

Changelog

Sourced from folds's changelog.

2.7.0 (2026-07-04)

Bug Fixes

• tooltip appears on any key press (#147) (b8cd194)

Features

• progress bar packet animation when max param is missing (#146) (0dfab3c)

Commits

• 3fca515 chore(release): 2.7.0 [skip ci]
• b8cd194 fix: tooltip appears on any key press (#147)
• 0dfab3c feat: progress bar packet animation when max param is missing (#146)
• a78ab69 chore(deps): bump nwtgck/actions-netlify from 3.0.0 to 4.0.0 (#143)
• e4d76b4 chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 (#144)
• f0340b4 chore: Validate PR number and update Netlify token secret (#140)
• 85217e5 chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#138)
• 1fbe920 chore(deps): bump dawidd6/action-download-artifact from 20 to 21 (#139)
• d35bfb6 chore(deps): update node.js to v24.15.0 (#127)
• d57fbb9 chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#137)
• Additional commits viewable in compare view

Updates html-react-parser from 6.1.3 to 6.1.5

Release notes

Sourced from html-react-parser's releases.

v6.1.5

6.1.5 (2026-07-17)

Build System

• deps: bump style-to-js from 2.0.1 to 2.0.2 (#2312) (db347ab)

v6.1.4

6.1.4 (2026-07-03)

Build System

• deps: bump style-to-js from 2.0.0 to 2.0.1 (#2292) (cf7bf0f)

Changelog

Sourced from html-react-parser's changelog.

6.1.5 (2026-07-17)

Build System

• deps: bump style-to-js from 2.0.1 to 2.0.2 (#2312) (db347ab)

6.1.4 (2026-07-03)

Build System

• deps: bump style-to-js from 2.0.0 to 2.0.1 (#2292) (cf7bf0f)

Commits

• d2508bc chore(master): release 6.1.5 (#2318)
• 0e1839a build(deps): bump github/codeql-action/upload-sarif (#2324)
• 46dc195 build(deps-dev): bump eslint-plugin-simple-import-sort (#2323)
• 3d4a8a1 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#2321)
• 20c59c4 build(deps-dev): bump typescript-eslint in the eslint group (#2322)
• 5b8e68d build(deps-dev): bump the eslint group with 2 updates (#2320)
• c491c5c build(deps-dev): bump @​arethetypeswrong/cli from 0.18.4 to 0.18.5 (#2319)
• db347ab build(deps): bump style-to-js from 2.0.1 to 2.0.2 (#2312)
• d1fec2f build(deps): bump github/codeql-action/upload-sarif (#2314)
• d8d0178 build(deps-dev): bump preact from 10.29.6 to 10.29.7 (#2317)
• Additional commits viewable in compare view

Updates i18next from 25.10.10 to 26.3.6

Release notes

Sourced from i18next's releases.

v26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

v26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

v26.3.0

• feat(types): introduce ResourceNamespaceMap — a separate mergeable augmentation surface for namespace resource types, designed for monorepos where multiple packages each want to contribute their own namespaces. Previously, every package had to coordinate on a single CustomTypeOptions.resources declaration (or fall back to typing dependency namespaces as any) because resources is a single property of an interface and TypeScript reports TS2717 when two declarations of the same property disagree. The new interface merges naturally across declare module 'i18next' blocks, so each package can ship its own i18next.d.ts independently. Per-property merge handles same-namespace contributions from multiple packages, and same-key/different-literal conflicts are silently dropped to avoid poisoning t() overload resolution. Fully backwards-compatible — existing CustomTypeOptions.resources augmentations continue to work, and both surfaces can coexist. Scalar options (defaultNS, returnNull, enableSelector, etc.) still belong on CustomTypeOptions. Thanks @​sh3xu (#2434). Fixes #2409.

v26.2.0

• feat(types): new parseInterpolation TypeOption (default true). When set to false in CustomTypeOptions, the type-level extractor stops parsing translation strings for {{variable}} patterns. Required by i18next-icu users — the default extractor mistakes ICU MessageFormat nested-brace plurals like {count, plural, one {{count} row} other {{count} rows}} for an interpolation block and demands a phantom variable name. The flag is type-only; runtime interpolation is governed by InterpolationOptions and is unaffected. Fixes i18next-icu#85.
• fix(types): expose enableSelector on InitOptions so i18next.init({ enableSelector: 'strict' }) typechecks without a module augmentation. The runtime already reads opts?.enableSelector from init options; this lands the matching type declaration next to the other selector-resolution knobs. Accepts false | true | 'optimize' | 'strict'. Thanks @​Faithfinder (#2431)

v26.1.0

• feat: enableSelector: 'strict' (TypeOptions + runtime option). Opt-in mode that drops the flattened-primary form from NsResource at the type level — every namespace (primary included) is exposed only under its own key on $, uniformly across single- and multi-ns hooks. At runtime, a leading selector path segment matching the scope's namespace list is always rewritten as a namespace prefix, including the primary. Eliminates the silent-miss surface area where t($ => $.primary.foo) typechecks but doesn't resolve under the default mode (see #2429). Backward-compatible: default enableSelector: false | true | 'optimize' behavior is unchanged. Note: strict mode is incompatible with the #2405 pattern (keys whose names match sibling namespaces) — those users should stay on default mode.

v26.0.10

• feat: getFixedT accepts a fourth optional fixedOpts argument carrying scopeNs — the full namespace list the bound t was created for. The selector API uses scopeNs to detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the bound ns (a single primary string in the typical react-i18next setup), so plain t('key') lookups stay isolated to the primary namespace exactly as before — only t($ => $.secondaryNs.foo) selectors now route correctly under useTranslation([nsA, nsB]). Fixes the runtime side of #2429 for the react-i18next default-nsMode case. The 4th argument is opt-in: existing 3-arg getFixedT(lng, ns, keyPrefix) callers see no behavior change.

v26.0.9

• fix(types): unformatted interpolation values are now typed as string | number (was string). i18next stringifies values at runtime, so requiring callers to wrap numbers in String(...) for plain {{var}} placeholders was unnecessary friction — and could mask the real problem when a non-string value was passed alongside multiple interpolation slots (the t() overload resolution would fall through to the 3-arg form and report a confusing "not assignable to string" error against the options object). Typed format specifiers like {{x, number}}, {{x, currency}}, {{x, datetime}}, etc. keep their precise types; this only relaxes the no-format default. The count variable remains number-only

v26.0.8

• fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

v26.0.7

• fix: when a plural lookup misses, the missingKey debug log now shows the actual plural-resolved key (e.g. foo.bar_many for Polish count: 14) instead of the base key — making it obvious which plural category was expected and missing 2423
• chore: drop @babel/runtime runtime dependency. The build no longer generates any @babel/runtime imports, so the package is unused by consumers. Rollup now uses babelHelpers: 'bundled' so any helpers that are ever needed in the future will be inlined rather than imported externally 2424
• chore: stop emitting dist/esm/i18next.bundled.js. It was byte-identical to dist/esm/i18next.js because no helpers were being imported 2424

v26.0.6

Security release — all issues found via an internal audit. GHSA advisory filed after release.

• security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security docs for mitigation guidance (GHSA-TBD)
• security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .
• security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)

... (truncated)

Changelog

Sourced from i18next's changelog.

26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @​manus-use for the responsible disclosure.

26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and Description has been truncated