fix(deps): update dependency i18next to v26 by renovate[bot] · Pull Request #264 · VictorWinberg/OneList

renovate · 2026-04-01T05:42:42Z

This PR contains the following updates:

Package	Change	Age	Confidence
i18next (source)	`23.16.8` → `26.0.6`

Release Notes

i18next/i18next (i18next)

`v26.0.6`

Compare Source

Security release — all issues found via an internal audit.

security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security note in the Nesting docs for the full pattern and mitigations
security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .
security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)
chore: ignore .env* and *.pem/*.key files in .gitignore

`v26.0.5`

Compare Source

fix: cloneInstance().changeLanguage() no longer fails to update language state when the target language is not yet loaded — a race between init()'s deferred load() and the user's changeLanguage() could overwrite isLanguageChangingTo, causing setLngProps to be skipped 2422

feat(types): selector functions as keyPrefix in getFixedT now provide full type-safe key narrowing — the returned t function is scoped to the prefix subtree 2367

`v25.10.4`

Compare Source

feat(types): exists() is now a type guard that narrows the key to SelectorKey, so a validated key can be passed directly to t() 2364

`v25.10.3`

Compare Source

check also for I18NEXT_NO_SUPPORT_NOTICE env variable

`v25.10.2`

Compare Source

feat(types): keyFromSelector is now type-safe — the selector callback is constrained against your resource definitions, catching invalid keys at compile time. Supports optional ns and keyPrefix options for non-default namespace/prefix contexts 2364

`v25.10.1`

Compare Source

fix(types): FilterKeys now correctly excludes base keys that have context variants when the provided context doesn't match any of them (e.g. key some with variant some_me is no longer accessible with context="one")

`v25.10.0`

Compare Source

feat(types): keyFromSelector now returns a branded SelectorKey type that t() accepts directly, enabling pre-computed and reusable translation keys 2364
feat: support selector syntax for keyPrefix in getFixedT and per-call options 2367
feat(types): interpolation values are now automatically typed based on built-in format specifiers — {{val, number}} requires number, {{val, datetime}} requires Date, {{name}} requires string, etc. Custom formatters can be typed via interpolationFormatTypeMap in CustomTypeOptions 2378
fix(types): FilterKeys in selector mode now preserves non-context, non-plural leaf keys when context is provided, fixing incorrect type narrowing when combining returnObjects: true with context 2398

`v25.9.0`

Compare Source

feat(types): selector API now enforces { count: number } when a key resolves to plural forms 2373
fix(types): string unions with invalid members are now correctly detected as type errors when used as context option 2172

`v25.8.20`

Compare Source

- fix: getFixedT() selector now resolves namespaces against the effective ns rather than the global init options #2406

`v25.8.19`

Compare Source

fix: selector API namespace resolution regression for single-string ns and primary namespace in array #2405. Reverts the broad namespace-prefix rewrite from v25.8.15 and replaces it with a targeted fix that only rewrites paths starting with a secondary namespace in a multi-namespace array, matching the type-level contract of GetSource

`v25.8.18`

Compare Source

improve selector api to accept array of selector functions, analogous to array of keys 2404

`v25.8.17`

Compare Source

update deps

`v25.8.16`

Compare Source

fix(types): on() method now correctly returns this instead of void, matching the runtime behavior and enabling proper method chaining in TypeScript

`v25.8.15`

Compare Source

fix: Selector API unable to resolve namespaces #2402

`v25.8.14`

Compare Source

fix: getCleanedCode now replaces all underscores

`v25.8.13`

Compare Source

improve support notice shown logic

`v25.8.12`

Compare Source

improve support notice shown logic

`v25.8.11`

Compare Source

revert fix: compatibility with moduleResolution bundler (issue 2380) 2381

`v25.8.10`

Compare Source

fix(interpolator): guard null matchedDoubleQuotes in nesting option parsing 2395

`v25.8.9`

Compare Source

fix(interpolator): escape nestingOptionsSeparator in nesting option parsing 2394

`v25.8.8`

Compare Source

types(i18n): add missing toJSON() declaration 2393

`v25.8.7`

Compare Source

avoid crash due to ReferenceError without Intl API 2391

`v25.8.6`

Compare Source

ts: address incomplete type definition for getFixedT() return value 2318

`v25.8.5`

Compare Source

fix: compatibility with moduleResolution bundler (issue 2380) 2381

`v25.8.4`

Compare Source

fix: crashes when backend in backends array has no name property 2386

`v25.8.3`

Compare Source

ts: document option to suppress the support message 2385

`v25.8.2`

Compare Source

option to suppress the support message 2385

`v25.8.1`

Compare Source

fix(types): Selector API - fix Namespace inference for selector ns option 2384

`v25.8.0`

Compare Source

fix: TFunctionReturn fallback 2360

`v25.7.4`

Compare Source

fix: Interpolation breaks when cloning an instance 2376

`v25.7.3`

Compare Source

type definitions for new transDefaultProps option in react-i18next react-i18next: #1895

`v25.7.2`

Compare Source

fix: Invalid overwrite of default value for overloadTranslationOptionHandler 2374.

`v25.7.1`

Compare Source

TS: remove wrong signature 2372.

`v25.7.0`

Compare Source

Enhance cloneInstance to create a new interpolator if interpolation options are passed in. This will address 2371.

`v25.6.3`

Compare Source

chore: dependency updates 2368

`v25.6.2`

Compare Source

types: export InterpolationMap

`v25.6.1`

Compare Source

fix: createInstance does not exist on an instance #2366

`v25.6.0`

Compare Source

feat: exists() method now respects returnObjects option - returns false when accessing an object key with returnObjects: false, enabling detection of object vs string keys 2359

Note: This is a potential behavior change. If you were previously calling exists() with returnObjects: false on object keys, those calls will now return false instead of true. This enables developers to detect whether a key points to an object or string value.

`v25.5.3`

Compare Source

export esm type declaration for keyFromSelector 2356

`v25.5.2`

Compare Source

fix last change => for cjs there is just 1 default export, no named exports, fixes 2348

`v25.5.1`

Compare Source

export keyFromSelector from index.cjs 2347

`v25.5.0`

Compare Source

export keyFromSelector function for testing purposes 2346

`v25.4.2`

Compare Source

fix: enableSelector: true doesn't work with custom keySeparator 2341

`v25.4.1`

Compare Source

fix: KeyPrefix not working with new selector api 2340

`v25.4.0`

Compare Source

add new selector API to improve TypeScript IDE performance 2322
- To enable it, set enableSelector: true in your configuration options
- With enableSelector: "optimize", i18next can now handle translation dictionaries of any size, without affecting IDE performance or build times
- To assist with the migration, we've published the following packages:
  - @i18next-selector/codemod
  - @i18next-selector/vite-plugin

`v25.3.6`

Compare Source

improve fix: Ordinals and non-ordinals don't work together 2337

`v25.3.5`

Compare Source

fix: Ordinals and non-ordinals don't work together 2337

`v25.3.4`

Compare Source

remove unnecessary debug logs

`v25.3.3`

Compare Source

fix: Brackets breaking nesting interpolation 2336

`v25.3.2`

Compare Source

fix dir() for non-Intl language codes 2330

`v25.3.1`

Compare Source

warn if legacy interpolation.format function is still used

`v25.3.0`

Compare Source

feat: support formatting function with plural and interpolation 2325
fix dir() for Latn language codes 2324

`v25.2.1`

Compare Source

streamline fallbackLng option of t call with the init options 2312

`v25.2.0`

Compare Source

introduce cacheInBuiltFormats option to address 2227

`v25.1.3`

Compare Source

Ensure nsSeparator is respected when appendNamespaceToMissingKey is true 2311, fixes 2310

`v25.1.2`

Compare Source

do not mutate t options, fixes 2307

`v25.1.1`

Compare Source

fix options type for parseMissingKeyHandler

`v25.1.0`

Compare Source

feat: parseMissingKeyHandler now takes options as parameter like in missingKeyHandler 2304

`v25.0.2`

Compare Source

fix cloneInstance with forkResourceStore: true addresses 2303

`v25.0.1`

Compare Source

optimize changeLanguage to correctly use getBestMatchFromCodes (string or array) 2299 and improve resolvedLanguage set for non canonical codes

`v25.0.0`

Compare Source

This is a potentially breaking release:

fix multiple changeLanguage call that may have result in wrong order in previous versions 1605 2298
adapt changeLanguage to always (string or array) use getBestMatchFromCodes 2299
getBestMatchFromCodes now tries to fallback to language code with same script 2299

`v24.2.3`

Compare Source

Upgrade @babel/runtime package to version v7.26.10 2293

`v24.2.2`

Compare Source

fix: Interpolation fails with arrays (TypeError) and doesn't work with objects in defaultValue 1829

`v24.2.1`

Compare Source

Standardize null/undefined checks across codebase 2275
fix(typescript): make TFunction augmentable again 2279, fixes 2278

`v24.2.0`

Compare Source

feat(typescript): Add strictKeyChecks option to enforce checking key existence when defaultValue is used 2274, fixes 2043

`v24.1.2`

Compare Source

optimize fix: Bug Report: Unsafe Behavior in i18n.t Function Leading to Potential Code Execution 2273

`v24.1.1`

Compare Source

fix: Bug Report: Unsafe Behavior in i18n.t Function Leading to Potential Code Execution 2273

`v24.1.0`

Compare Source

try to address 2270 by cloning the store data 2271

`v24.0.5`

Compare Source

remove extra log for 2268

`v24.0.4`

Compare Source

simplify fix: incorrect locale detected 2268

`v24.0.3`

Compare Source

fix: incorrect locale detected 2268
fix: Intl.getCanonicalLocales throws with custom regions 2267

`v24.0.2`

Compare Source

if no Intl api, log error and use dummy rule

`v24.0.1`

Compare Source

early return and log error, if no Intl api

`v24.0.0`

Compare Source

This is a major breaking release:

remove support for older environments
remove old i18next JSON formats
- To convert your existing v3 translations to the v4 format, have a look at i18next-v4-format-converter or this web tool.
remove support for compatibility to v1 API
Intl API is mandatory now and will not fallback anymore
possible compatibility layer for older formats: test/compatibility/v4/v4Compatibility.js
rename initImmediate to initAsync
fallback to dev language if plural rule not found
Dropped support for Node.js < v14
remove TypeScript v4 support. TypeScript v5 is now an optional peer dependency
addresses
- 2244
- 2184
- 2213
- 2206
- 2208
- 2148
- 2254

➡️ check out the migration guide

Configuration

📅 Schedule: (in timezone Europe/Stockholm)

Branch creation
- "every 3 months on the first day of the month"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-04-01T05:42:43Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: client/package-lock.json

npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: onelist-client@1.0.0
npm error Found: typescript@4.9.5
npm error node_modules/typescript
npm error   peer typescript@">= 2.7" from fork-ts-checker-webpack-plugin@6.5.3
npm error   node_modules/fork-ts-checker-webpack-plugin
npm error     fork-ts-checker-webpack-plugin@"^6.5.0" from react-dev-utils@12.0.1
npm error     node_modules/react-dev-utils
npm error       react-dev-utils@"^12.0.1" from react-scripts@5.0.1
npm error       node_modules/react-scripts
npm error         dev react-scripts@"5.0.1" from the root project
npm error   typescript@"^4.5.4" from prettier-eslint@15.0.1
npm error   node_modules/prettier-eslint
npm error     dev prettier-eslint@"15.0.1" from the root project
npm error   2 more (react-scripts, tsutils)
npm error
npm error Could not resolve dependency:
npm error i18next@"26.0.6" from the root project
npm error
npm error Conflicting peer dependency: typescript@6.0.3
npm error node_modules/typescript
npm error   peerOptional typescript@"^5 || ^6" from i18next@26.0.6
npm error   node_modules/i18next
npm error     i18next@"26.0.6" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-04-18T17_49_11_286Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-04-18T17_49_11_286Z-debug-0.log

renovate bot force-pushed the renovate/i18next-26.x branch from bbbb1ed to 71822ee Compare April 8, 2026 13:11

renovate bot force-pushed the renovate/i18next-26.x branch from 71822ee to 97ac921 Compare April 16, 2026 10:16

fix(deps): update dependency i18next to v26

c64cbed

renovate bot force-pushed the renovate/i18next-26.x branch from 97ac921 to c64cbed Compare April 18, 2026 17:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency i18next to v26#264

fix(deps): update dependency i18next to v26#264
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/i18next-26.x

renovate bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

renovate bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Configuration

Uh oh!

renovate bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: client/package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Apr 1, 2026 •

edited

Loading

renovate bot commented Apr 1, 2026 •

edited

Loading