Bump the frontend-minor-patch group across 1 directory with 21 updates

[dependabot]

Bumps the frontend-minor-patch group with 21 updates in the / directory:

Package	From	To
@azure/msal-browser	5.6.3	5.21.0
@codemirror/lang-markdown	6.5.1	6.5.2
@mui/x-tree-view	9.1.0	9.13.0
canvas	3.2.2	3.2.3
dompurify	3.4.13	3.4.14
flint-chart	0.5.0	0.5.1
i18next	26.0.1	26.4.2
katex	0.16.42	0.18.5
react-animate-height	3.2.3	3.2.4
react-arborist	3.7.0	3.16.0
react-router-dom	7.18.2	7.18.3
react-virtuoso	4.18.3	4.18.12
validator	13.15.26	13.15.35
vega	6.2.0	6.4.0
vega-lite	6.4.1	6.4.3
@testing-library/react	16.3.2	16.3.3
@types/lodash	4.17.24	4.17.25
@typescript-eslint/eslint-plugin	8.65.0	8.68.0
@typescript-eslint/parser	8.65.0	8.68.0
sass	1.102.0	1.103.1
typescript-eslint	8.65.0	8.68.0

Updates @azure/msal-browser from 5.6.3 to 5.21.0

Release notes

Sourced from @​azure/msal-browser's releases.

@​azure/msal-browser v5.21.0

5.21.0

Wed, 02 Sep 2026 21:15:30 GMT

Minor changes

• Validate the relayed request in runPopupRelay before navigating and add an optional allowedAuthorityOrigins pin #8800 (kshabelko@microsoft.com)

@​azure/msal-browser v5.20.0

5.20.0

Fri, 28 Aug 2026 21:29:53 GMT

Minor changes

• Enable browser-native PublicClientApplication DPoP acquisition flows #8735 (hectormmg@microsoft.com)
• Export IWebBrokerBridgeMessage from the msal-browser package root #8780 (shylasummers@microsoft.com)
• Bump @​azure/msal-common to v16.14.0 (beachball)

Patches

• Discard local storage events from another client ids #8795 (kshabelko@microsoft.com)
• Relocate the cross-version request adapter into the shared webBrokerBridge module without changing request transformation behavior #8771 (shylasummers@microsoft.com)

@​azure/msal-browser v5.19.0

5.19.0

Tue, 18 Aug 2026 20:10:56 GMT

Minor changes

• Add browser token-binding key lifecycle support for keyId-bound ES256 DPoP keys #8708 (hectormmg@microsoft.com)
• Bump @​azure/msal-common to v16.13.0 (beachball)

Patches

• Route NAA BridgeProxy through the shared webBrokerBridge PendingRequestRegistry and consolidate NestedAppAuthAdapter.fromBridgeError through the shared WebBrokerBridgeErrorMap — internal-only, no NAA public API or on-wire changes #8748 (shylasummers@microsoft.com)

@​azure/msal-browser v5.18.0

5.18.0

Tue, 04 Aug 2026 20:17:38 GMT

Minor changes

• Add attribute-tokens support #8700 (spingale@microsoft.com)
• Bump @​azure/msal-common to v16.12.0 (beachball)

Patches

... (truncated)

Commits

• e7c704c Validate the relayed request in runPopupRelay before navigating (#8800)
• 965b1c6 Post-release PR (#8798)
• 5931aa7 Remove legacy authority references (#8794)
• b972fbf Discard local storage events from another client ids (#8795)
• 1d07b68 feat(msal-node)!: default responseMode to form_post and remove ILoopbackClien...
• b2c73e9 Fix @​azure/msal-common DOM type dependency (#8784)
• ee74861 fix(deps): SFI CVE remediation — js-yaml, undici, brace-expansion (#8778)
• 4359701 fix(deps): bump @​angular-devkit/build-angular to 22.1.x (patched http-proxy-m...
• 7bfd824 chore(msal-node): remove disallowedChangeTypes guard to allow v6 major releas...
• 8d562d6 [NAA/PWB One Bridge] PR 4/6: Export shared bridge message interface (#8780)
• Additional commits viewable in compare view

Updates @codemirror/lang-markdown from 6.5.1 to 6.5.2

Commits

• See full diff in compare view

Updates @mui/x-tree-view from 9.1.0 to 9.13.0

Release notes

Sourced from @​mui/x-tree-view's releases.

v9.13.0

We'd like to extend a big thank you to the 14 contributors who made this release possible. Here are some highlights ✨:

• 🦮 Improve keyboard navigation features of the Charts.
• 🎨 Improved customization of the edit event dialog in the EventCalendar
• 🐞 Bugfixes
• 📚 Documentation improvements

Special thanks go out to these community members for their valuable contributions: @​Anexus5919, @​jvskriubakken, @​mustafajw07, @​roychan1

The following team members contributed to this release: @​brijeshb42, @​flaviendelangle, @​hasdfa, @​Janpot, @​JCQuintas, @​LukasTy, @​michelengelen, @​noraleonte, @​rita-codes, @​silviuaavram

Data Grid

@mui/x-data-grid@9.13.0

• [DataGrid] Call onValueChange after setEditCellValue in edit cells (#23417) @​michelengelen
• [DataGrid] Add support for replacing rows instead of merging updates (#23323) @​jvskriubakken
• [DataGrid] Always render rowHeader in virtualized setups (#23386) @​silviuaavram
• [DataGrid] Export ToolbarRoot (#23322) @​JCQuintas
• [DataGrid] Fix rowsPerPage selector appearing when autoPageSize is enabled and pageSize is one of pageSizeOptions (#23401) @​roychan1
• [DataGrid] Fix row tree reset when a data source grid becomes visible (#23288) @​JCQuintas

@mui/x-data-grid-pro@9.13.0

Same changes as in @mui/x-data-grid@9.13.0, plus:

• [DataGridPro] Remove rows deleted server-side on nested lazy loading revalidation (#23320) @​JCQuintas
• [DataGridPro] Stop disableDebounce from reaching the DOM in multi select filter (#23445) @​JCQuintas

@mui/x-data-grid-premium@9.13.0

Same changes as in @mui/x-data-grid-pro@9.13.0, plus:

• [DataGridPremium] Refine cell selection and speed up clipboard copy (#23473) @​michelengelen
• [DataGridPremium] Select all cells with Ctrl+A (#23415) @​michelengelen

Date and Time Pickers

@mui/x-date-pickers@9.13.0

Internal changes.

@mui/x-date-pickers-pro@9.13.0

Same changes as in @mui/x-date-pickers@9.13.0.

Charts

... (truncated)

Changelog

Sourced from @​mui/x-tree-view's changelog.

9.13.0

Sep 4, 2026

We'd like to extend a big thank you to the 14 contributors who made this release possible. Here are some highlights ✨:

• 🦮 Improve keyboard navigation features of the Charts.
• 🎨 Improved customization of the edit event dialog in the EventCalendar
• 🐞 Bugfixes
• 📚 Documentation improvements

Special thanks go out to these community members for their valuable contributions: @​Anexus5919, @​jvskriubakken, @​mustafajw07, @​roychan1

The following team members contributed to this release: @​brijeshb42, @​flaviendelangle, @​hasdfa, @​Janpot, @​JCQuintas, @​LukasTy, @​michelengelen, @​noraleonte, @​rita-codes, @​silviuaavram

Data Grid

@mui/x-data-grid@9.13.0

• [DataGrid] Call onValueChange after setEditCellValue in edit cells (#23417) @​michelengelen
• [DataGrid] Add support for replacing rows instead of merging updates (#23323) @​jvskriubakken
• [DataGrid] Always render rowHeader in virtualized setups (#23386) @​silviuaavram
• [DataGrid] Export ToolbarRoot (#23322) @​JCQuintas
• [DataGrid] Fix rowsPerPage selector appearing when autoPageSize is enabled and pageSize is one of pageSizeOptions (#23401) @​roychan1
• [DataGrid] Fix row tree reset when a data source grid becomes visible (#23288) @​JCQuintas

@mui/x-data-grid-pro@9.13.0

Same changes as in @mui/x-data-grid@9.13.0, plus:

• [DataGridPro] Remove rows deleted server-side on nested lazy loading revalidation (#23320) @​JCQuintas
• [DataGridPro] Stop disableDebounce from reaching the DOM in multi select filter (#23445) @​JCQuintas

@mui/x-data-grid-premium@9.13.0

Same changes as in @mui/x-data-grid-pro@9.13.0, plus:

• [DataGridPremium] Refine cell selection and speed up clipboard copy (#23473) @​michelengelen
• [DataGridPremium] Select all cells with Ctrl+A (#23415) @​michelengelen

Date and Time Pickers

@mui/x-date-pickers@9.13.0

Internal changes.

... (truncated)

Commits

• c2809ca [release] v9.13.0 (#23497)
• b5c78e1 [tree view] Remove dead UI from community component (#23487)
• 6b7f6e3 [tree view] Remove unused dependencies (#23488)
• 3e080e5 [tree view] Add loading prop and customizable loading UI (#22251)
• 36c2a0a [code-infra] Run TypeScript 7 alongside the TS6 JS API (#23471)
• 846b709 [code-infra] Replace the sinon spy(fn) usages with vi.fn(fn) (#23460)
• f3784e8 [code-infra] Replace the mechanical sinon spy() usages with vi.fn() (#23443)
• 7df9130 [tree view] Use useId for the default tree id (#23341)
• 2aef1ff [tree view] Reduce selector bundle size (#23412)
• 0b9e55e [code-infra] Use explicit vitest imports in test files (#23375)
• Additional commits viewable in compare view

Updates canvas from 3.2.2 to 3.2.3

Release notes

Sourced from canvas's releases.

v3.2.3

Fixed

• Fix building with gcc (#2559)

Changelog

Sourced from canvas's changelog.

3.2.3

Fixed

• Fix building with gcc (#2559)

Commits

• f91598e v3.2.3
• 1541544 PAGE_SIZE shouldn't be unsigned
• See full diff in compare view

Updates dompurify from 3.4.13 to 3.4.14

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

Commits

• 4e6fe24 release: 3.4.14 (#1587)
• See full diff in compare view

Updates flint-chart from 0.5.0 to 0.5.1

Release notes

Sourced from flint-chart's releases.

0.5.1

flint-chart 0.5.1

Added

• Plotly theme support — theme_spec now realizes onto Plotly figures.
• Calendar Heatmap chart type for Vega-Lite.

Titles

• Headlines and decks are fitted instead of widening the graphic, with or without a theme.
• Axis titles lie flat at the head of their own ruler; units are stated once.

Grid and scales

• Gridded axes round so the plot edge lands on a grid line, and the grid runs out to its number.
• A chart is never left with no way to read a value — where nothing is printed, the grid returns.

Houses — Economist type recalibrated; McKinsey's tick labels no longer outrank its subtitle.

Security — react-router CSRF and two other high-severity dev alerts resolved; production audit clean.

Full changelog: microsoft/flint-chart@0.5...0.5.1 New contributor: @​zl190

Changelog

Sourced from flint-chart's changelog.

[0.5.1] - 2026-08-13

Added

• Theme support for the Plotly backend. theme_spec now realizes onto Plotly figures — surface, typography, axes, marks, series ink, legend, facet chrome, and data labels — reusing the same neutral grounding stage as Vega-Lite. Where Plotly cannot honor a decision it approximates and records what it did in figure._theme.report. assemblePlotly also renders chart_spec.title for the first time.
• A Vega-Lite Calendar Heatmap chart type: daily values on a Monday-first week grid, with a cornerRadius chart property and a canonical GitHub look through a quantile color scale.
• Per-house sparse band fitting through the new layout.bandStepFit field, so each preset states how far it will grow a bar toward its slot when a chart has few categories. All ten presets are calibrated from first-party sources.

Changed

• An axis title that is still needed now lies flat at the head of its own ruler, beside the values it names and on whichever side those values sit, rather than being turned on its side. Where two rulers each carry a measure, both are named: one name cannot say which quantity is horizontal and which is vertical.
• A measure axis that draws a grid rounds its domain to the tick count the axis actually draws, so the plot's edge falls on a grid line instead of stopping short of one and leaving the outermost reading with nothing above it. Axes that draw no grid, and non-linear rulers whose ticks are decades rather than a count, are left alone. On a dot scale the rounding is applied to the data rather than to the domain the renderer has already opened by a dot's radius: rounding the padded domain turned a few pixels of clearance into a whole extra interval, and a score bounded 0 to 100 came out running -10 to 110.
• A measure axis that draws a grid but no ticks carries that grid a few pixels past the plot, in grid ink, so each line ends under its own number. Flush with the last mark — a histogram's final bar — the line led nowhere.
• A unit is stated once. Where the axis title already carries it, the ruler no longer repeats it down every tick.
• Economist axis labels and titles are calibrated against the 300x300 and 400x300 canvases the library actually draws, and the house now lays its axis titles flat rather than turning them on their side.
• McKinsey declares the deck and axisTitle type roles it had left implicit and quiets axisLabel. Raising one role while leaving others to the global defaults had inverted the ranking: the tick labels were the second-largest text on the chart, above the subtitle and the axis title.
• Vega-Lite reserves the margins a chart will actually draw — value labels, tick gutters, the title block, and the legend — before fitting bands, so a wide house no longer sizes bands against room its own furniture will take.
• Long headlines are fitted rather than left to widen the graphic. A headline that only overhangs its block is left alone, one that overhangs further is set down a size, and only a headline that still does not fit is broken — over even lines, with the height taken out of the plot rather than added to the canvas.

... (truncated)

Commits

• 8db6473 fix
• d31da14 fixes
• 2659241 ok
• 8ee8e8a release: 0.5.1
• 57701f7 fixes
• f20b902 fix(calendar): drop the plot frame, and let the caller square the cells
• 118eb55 fix(layout): reserve the margins a chart draws before fitting its bands
• 1071314 fix(theme): never print a house label off a template's working column
• 86d4d0b fix(waterfall): size the step axis as the band it is drawn on
• d1902e4 feat(theme): calibrate sparse band fit per house, and keep straight labels ho...
• Additional commits viewable in compare view

Updates i18next from 26.0.1 to 26.4.2

Release notes

Sourced from i18next's releases.

v26.4.2

• fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

v26.4.1

• fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).

v26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

v26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

v26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

v26.3.0

• feat(types): introduce ResourceNamespaceMap — a separate mergeable augmentation surface for namespace resource types, designed for monorepos where multiple packages each want to contribute their own namespaces. Previously, every package had to coordinate on a single CustomTypeOptions.resources declaration (or fall back to typing dependency namespaces as any) because resources is a single property of an interface and TypeScript reports TS2717 when two declarations of the same property disagree. The new interface merges naturally across declare module 'i18next' blocks, so each package can ship its own i18next.d.ts independently. Per-property merge handles same-namespace contributions from multiple packages, and same-key/different-literal conflicts are silently dropped to avoid poisoning t() overload resolution. Fully backwards-compatible — existing CustomTypeOptions.resources augmentations continue to work, and both surfaces can coexist. Scalar options (defaultNS, returnNull, enableSelector, etc.) still belong on CustomTypeOptions. Thanks @​sh3xu (#2434). Fixes #2409.

v26.2.0

• feat(types): new parseInterpolation TypeOption (default true). When set to false in CustomTypeOptions, the type-level extractor stops parsing translation strings for {{variable}} patterns. Required by i18next-icu users — the default extractor mistakes ICU MessageFormat nested-brace plurals like {count, plural, one {{count} row} other {{count} rows}} for an interpolation block and demands a phantom variable name. The flag is type-only; runtime interpolation is governed by InterpolationOptions and is unaffected. Fixes i18next-icu#85.
• fix(types): expose enableSelector on InitOptions so i18next.init({ enableSelector: 'strict' }) typechecks without a module augmentation. The runtime already reads opts?.enableSelector from init options; this lands the matching type declaration next to the other selector-resolution knobs. Accepts false | true | 'optimize' | 'strict'. Thanks @​Faithfinder (#2431)

v26.1.0

• feat: enableSelector: 'strict' (TypeOptions + runtime option). Opt-in mode that drops the flattened-primary form from NsResource at the type level — every namespace (primary included) is exposed only under its own key on $, uniformly across single- and multi-ns hooks. At runtime, a leading selector path segment matching the scope's namespace list is always rewritten as a namespace prefix, including the primary. Eliminates the silent-miss surface area where t($ => $.primary.foo) typechecks but doesn't resolve under the default mode (see #2429). Backward-compatible: default enableSelector: false | true | 'optimize' behavior is unchanged. Note: strict mode is incompatible with the #2405 pattern (keys whose names match sibling namespaces) — those users should stay on default mode.

v26.0.10

• feat: getFixedT accepts a fourth optional fixedOpts argument carrying scopeNs — the full namespace list the bound t was created for. The selector API uses scopeNs to detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the bound ns (a single primary string in the typical react-i18next setup), so plain t('key') lookups stay isolated to the primary namespace exactly as before — only t($ => $.secondaryNs.foo) selectors now route correctly under useTranslation([nsA, nsB]). Fixes the runtime side of #2429 for the react-i18next default-nsMode case. The 4th argument is opt-in: existing 3-arg getFixedT(lng, ns, keyPrefix) callers see no behavior change.

v26.0.9

• fix(types): unformatted interpolation values are now typed as string | number (was string). i18next stringifies values at runtime, so requiring callers to wrap numbers in String(...) for plain {{var}} placeholders was unnecessary friction — and could mask the real problem when a non-string value was passed alongside multiple interpolation slots (the t() overload resolution would fall through to the 3-arg form and report a confusing "not assignable to string" error against the options object). Typed format specifiers like {{x, number}}, {{x, currency}}, {{x, datetime}}, etc. keep their precise types; this only relaxes the no-format default. The count variable remains number-only

v26.0.8

• fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

v26.0.7

... (truncated)

Changelog

Sourced from i18next's changelog.

26.4.2

• fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

26.4.1

• fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).

26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @​manus-use for the responsible disclosure.

26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

26.3.0

• feat(types): introduce ResourceNamespaceMap — a separate mergeable augmentation surface for namespace resource types, designed for monorepos where multiple packages each want to contribute their own namespaces. Previously, every package had to coordinate on a single CustomTypeOptions.resources declaration (or fall back to typing dependency namespaces as any) because resources is a single property of an interface and TypeScript reports TS2717 when two declarations of the same property disagree. The new interface merges naturally across declare module 'i18next' blocks, so each package can ship its own i18next.d.ts independently. Per-property merge handles same-namespace contributions from multiple packages, and same-key/different-literal conflicts are silently dropped to avoid poisoning t() overload resolution. Fully backwards-compatible — existing CustomTypeOptions.resources augmentations continue to work, and both surfaces can coexist. Scalar options (defaultNS, returnNull, enableSelector, etc.) still belong on CustomTypeOptions. Thanks @​sh3xu (#2434). Fixes #2409.

26.2.0

• feat(types): new parseInterpolation TypeOption (default true). When set to false in CustomTypeOptions, the type-level extractor stops parsing translation strings for {{variable}} patterns. Required by i18next-icu users — the default extractor mistakes ICU MessageFormat nested-brace plurals like {count, plural, one {{count} row} other {{count} rows}} for an interpolation block and demands a phantom variable name. The flag is type-only; runtime interpolation is governed by InterpolationOptions and is unaffected. Fixes i18next-icu#85.
• fix(types): expose enableSelector on InitOptions so i18next.init({ enableSelector: 'strict' }) typechecks without a module augmentation. The runtime already reads Description has been truncated