fix(deps): update dependency i18next to v26#35
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #35 +/- ##
=======================================
Coverage 51.00% 51.00%
=======================================
Files 51 51
Lines 896 896
Branches 202 200 -2
=======================================
Hits 457 457
Misses 435 435
Partials 4 4 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/i18next-26.x
branch
from
6737fdd to
9b2d991
Compare
🦋 Changeset detectedLatest commit: 6cb7928 The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Not approving: Build & Typecheck failed (i18next v26 type breaks in http-framework-i18n and i18next-backend), and this is a major dependency bump that needs manual migration. @RedStar071 is already requested for review.
Sent by Cursor Approval Agent: Pull Request Approver
renovate
Bot
force-pushed
the
renovate/i18next-26.x
branch
from
9b2d991 to
b45521d
Compare
|
renovate
Bot
force-pushed
the
renovate/i18next-26.x
branch
from
b45521d to
ca8bb8c
Compare
wolfstarbot
added
packages:http-framework-i18n
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
2 participants
This PR contains the following updates:
^25.10.10→^26.3.3^22.5.1→^26.3.3Release Notes
i18next/i18next (i18next)
v26.3.3Compare Source
t($ => $.arr, { returnObjects: true, context })on a JSON array of heterogeneous objects now preserves each element's full shape (e.g.{ transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1)FilterKeysevaluated the whole array element type at once, sokeyof (A | B)only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optionalundefinedkeys (e.g.transKey1_withContext?: undefinedon elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed asundefined. Also adds a dedicatedcontext+returnObjects: trueselector overload usingconst Fn+ReturnType<Fn>, soTargetis no longer collapsed tounknownviaApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @sauravgupta-dotcom (#2438). Fixes #2398.v26.3.2Compare Source
join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repairedformats[0], so{{v, uppercase, join(separator: ', ')}}split thejoin(...)option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @spokodev (#2437).v26.3.1Compare Source
t()with akeyPrefixno longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the[Res] extends [never]guards added toKeysBuilderWithReturnObjects/KeysBuilderWithoutReturnObjectsturned the builders into deferred conditional types, soKeyPrefix<Ns>stopped resolving to a literal union andkeyPrefixinference widened to the whole namespace. Symptom:useTranslation(ns, { keyPrefix: 'a.b' })thent('title')would resolve to'<a.b>.title' | '<other.path>.title' | ...instead of just the scoped value. Affected everyreact-i18nextuser usingkeyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via_DropConflictKeysat the merge layer (inoptions.d.ts). Thanks @aaronrosenthal (#2436).v26.3.0Compare Source
ResourceNamespaceMap— a separate mergeable augmentation surface for namespace resource types, designed for monorepos where multiple packages each want to contribute their own namespaces. Previously, every package had to coordinate on a singleCustomTypeOptions.resourcesdeclaration (or fall back to typing dependency namespaces asany) becauseresourcesis a single property of an interface and TypeScript reports TS2717 when two declarations of the same property disagree. The new interface merges naturally acrossdeclare module 'i18next'blocks, so each package can ship its owni18next.d.tsindependently. Per-property merge handles same-namespace contributions from multiple packages, and same-key/different-literal conflicts are silently dropped to avoid poisoningt()overload resolution. Fully backwards-compatible — existingCustomTypeOptions.resourcesaugmentations continue to work, and both surfaces can coexist. Scalar options (defaultNS,returnNull,enableSelector, etc.) still belong onCustomTypeOptions. Thanks @sh3xu (#2434). Fixes #2409.v26.2.0Compare Source
parseInterpolationTypeOption (defaulttrue). When set tofalseinCustomTypeOptions, the type-level extractor stops parsing translation strings for{{variable}}patterns. Required byi18next-icuusers — the default extractor mistakes ICU MessageFormat nested-brace plurals like{count, plural, one {{count} row} other {{count} rows}}for an interpolation block and demands a phantom variable name. The flag is type-only; runtime interpolation is governed byInterpolationOptionsand is unaffected. Fixes i18next-icu#85.enableSelectoronInitOptionssoi18next.init({ enableSelector: 'strict' })typechecks without a module augmentation. The runtime already readsopts?.enableSelectorfrom init options; this lands the matching type declaration next to the other selector-resolution knobs. Acceptsfalse | true | 'optimize' | 'strict'. Thanks @Faithfinder (#2431)v26.1.0Compare Source
enableSelector: 'strict'(TypeOptions + runtime option). Opt-in mode that drops the flattened-primary form fromNsResourceat the type level — every namespace (primary included) is exposed only under its own key on$, uniformly across single- and multi-ns hooks. At runtime, a leading selector path segment matching the scope's namespace list is always rewritten as a namespace prefix, including the primary. Eliminates the silent-miss surface area wheret($ => $.primary.foo)typechecks but doesn't resolve under the default mode (see #2429). Backward-compatible: defaultenableSelector: false | true | 'optimize'behavior is unchanged. Note: strict mode is incompatible with the #2405 pattern (keys whose names match sibling namespaces) — those users should stay on default mode.v26.0.10Compare Source
getFixedTaccepts a fourth optionalfixedOptsargument carryingscopeNs— the full namespace list the boundtwas created for. The selector API usesscopeNsto detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the boundns(a single primary string in the typical react-i18next setup), so plaint('key')lookups stay isolated to the primary namespace exactly as before — onlyt($ => $.secondaryNs.foo)selectors now route correctly underuseTranslation([nsA, nsB]). Fixes the runtime side of #2429 for thereact-i18nextdefault-nsModecase. The 4th argument is opt-in: existing 3-arggetFixedT(lng, ns, keyPrefix)callers see no behavior change.v26.0.9Compare Source
string | number(wasstring). i18next stringifies values at runtime, so requiring callers to wrap numbers inString(...)for plain{{var}}placeholders was unnecessary friction — and could mask the real problem when a non-string value was passed alongside multiple interpolation slots (thet()overload resolution would fall through to the 3-arg form and report a confusing "not assignable to string" error against the options object). Typed format specifiers like{{x, number}},{{x, currency}},{{x, datetime}}, etc. keep their precise types; this only relaxes the no-format default. Thecountvariable remainsnumber-onlyv26.0.8Compare Source
ExistsFunctionshape so plain arrow functions can again be assigned toExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Directi18next.exists(key)calls still narrowkeytoSelectorKey— the predicate is now declared inline oni18n.exists. Custom wrappers that want the narrowing can type themselves astypeof i18next.exists2425v26.0.7Compare Source
missingKeydebug log now shows the actual plural-resolved key (e.g.foo.bar_manyfor Polishcount: 14) instead of the base key — making it obvious which plural category was expected and missing 2423@babel/runtimeruntime dependency. The build no longer generates any@babel/runtimeimports, so the package is unused by consumers. Rollup now usesbabelHelpers: 'bundled'so any helpers that are ever needed in the future will be inlined rather than imported externally 2424dist/esm/i18next.bundled.js. It was byte-identical todist/esm/i18next.jsbecause no helpers were being imported 2424v26.0.6Compare Source
Security release — all issues found via an internal audit.
escapeValue: falsewith interpolated variables inside a$t(key, { ... "{{var}}" ... })nesting-options block. In that narrow combination, attacker-controlled string values containing"can break out of the JSON options literal and inject additional nesting options (e.g. redirectlng/ns). The defaultescapeValue: trueconfiguration is unaffected because HTML-escaping neutralises the quote beforeJSON.parse. See the security note in the Nesting docs for the full pattern and mitigationsregexEscapetounescapePrefix/unescapeSuffixon par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the{{- var}}syntax when the delimiter contains characters like(,[,..env*and*.pem/*.keyfiles in.gitignorev26.0.5Compare Source
cloneInstance().changeLanguage()no longer fails to update language state when the target language is not yet loaded — a race betweeninit()'s deferredload()and the user'schangeLanguage()could overwriteisLanguageChangingTo, causingsetLngPropsto be skipped 2422v26.0.4Compare Source
{{price, currency(EUR)}}are now correctly resolved to their base format type (e.g.numberforcurrency) instead of falling back tostring2378v26.0.3Compare Source
addResourceBundlenow accepts an optional 6thoptionsparameter ({ silent?: boolean; skipCopy?: boolean }) matching the runtime API 2419v26.0.2Compare Source
t("key", {} as TOptions)no longer produces a type error — the context constraint now bypasses strict checking whencontextisunknown(e.g. fromTOptions) 2418v26.0.1Compare Source
getFixedTaccepts a fourth optionalfixedOptsargument carryingscopeNs— the full namespace list the boundtwas created for. The selector API usesscopeNsto detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the boundns(a single primary string in the typical react-i18next setup), so plaint('key')lookups stay isolated to the primary namespace exactly as before — onlyt($ => $.secondaryNs.foo)selectors now route correctly underuseTranslation([nsA, nsB]). Fixes the runtime side of #2429 for thereact-i18nextdefault-nsModecase. The 4th argument is opt-in: existing 3-arggetFixedT(lng, ns, keyPrefix)callers see no behavior change.v26.0.0Compare Source
This is a major breaking release:
Breaking Changes
initImmediateoption — the backward-compatibility mapping frominitImmediatetoinitAsync(introduced in v24) has been removed. UseinitAsyncinstead.interpolation.formatfunction — the old monolithic format function (interpolation: { format: (value, format, lng) => ... }) is no longer supported. The built-in Formatter (or a custom Formatter module via.use()) is now always used. Migrate to the new formatting approach usingi18next.services.formatter.add()or.addCached()for custom formatters.showSupportNoticeoption and all related internal suppression logic (globalThis.__i18next_supportNoticeShown,I18NEXT_NO_SUPPORT_NOTICEenv var). See our blog post for the full story.simplifyPluralSuffixoption — this option was unused by the core PluralResolver (which relies entirely onIntl.PluralRules). It only had an effect in the old v1/v2/v3 compatibility layer. The v4 test compatibility layer now defaults totrueinternally.@babel/polyfillfrom devDependencies.Improvements
indexOf() > -1/indexOf() < 0with.includes()(~40+ occurrences)indexOf() === 0with.startsWith()where appropriatevarwithconst,'' + objectwithString(object),.substring()with.slice().apply(observer, [event, ...args])with direct callobserver(event, ...args).call(this, ...)in BackendConnector retry logicarray-callback-returnin LanguageUtilsgetBestMatchFromCodeseslint-disablecomments from source filesonce()method for one-time event subscriptionscheckedLoadedForcache to Translator instance, preventing cross-instance state leakageBackendModulegeneric parameter naming inconsistency between CJS and ESM type definitionsonce()method toi18nandResourceStoretype interfacestest.projectsconfigConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.