Bump the frontend-minor-patch group with 19 updates

[dependabot]

Bumps the frontend-minor-patch group with 19 updates:

Package	From	To
@azure/msal-browser	5.6.3	5.18.0
@codemirror/lang-markdown	6.5.1	6.5.2
@mui/x-tree-view	9.1.0	9.11.0
canvas	3.2.2	3.2.3
dompurify	3.4.5	3.4.13
echarts	6.0.0	6.1.0
i18next	26.0.1	26.3.6
katex	0.16.42	0.18.4
react-animate-height	3.2.3	3.2.4
react-arborist	3.7.0	3.16.0
react-virtuoso	4.18.3	4.18.11
validator	13.15.26	13.15.35
vega	6.2.0	6.3.1
vega-lite	6.4.1	6.4.3
@types/lodash	4.17.24	4.17.25
@typescript-eslint/eslint-plugin	8.65.0	8.66.0
@typescript-eslint/parser	8.65.0	8.66.0
typescript-eslint	8.65.0	8.66.0
vitest	4.1.1	4.1.10

Updates @azure/msal-browser from 5.6.3 to 5.18.0

Release notes

Sourced from @​azure/msal-browser's releases.

@​azure/msal-browser v5.18.0

5.18.0

Tue, 04 Aug 2026 20:17:38 GMT

Minor changes

• Add attribute-tokens support #8700 (spingale@microsoft.com)
• Bump @​azure/msal-common to v16.12.0 (beachball)

Patches

• Add internal webBrokerBridge scaffold (shared message interfaces, error taxonomy, pending-request registry) — no callers yet, no public API surface change #8729 (shylasummers@microsoft.com)

@​azure/msal-browser v5.17.3

5.17.3

Wed, 29 Jul 2026 00:26:30 GMT

Patches

• Add single retry with 100ms backoff for token POST transport failures #8732 (thomas.norling@microsoft.com)
• Streamline the platform broker request to only include the MSAL JS acquire-token parameters defined in the platform broker contract and params required on the ESTS /token call #8714 (lalima.sharda@gmail.com)
• Fill telemetry gaps in platform brokering flow with extension #8699 (lalima.sharda@gmail.com)
• Bump @​azure/msal-common to v16.11.3 (beachball)

@​azure/msal-browser v5.17.1

5.17.1

Wed, 15 Jul 2026 22:35:35 GMT

Patches

• Add internal ES256/P-256 DPoP crypto support to BrowserCrypto #8683 (hectormmg@microsoft.com)
• Bump @​azure/msal-common to v16.11.2 (beachball)

@​azure/msal-browser v5.17.0

5.17.0

Tue, 07 Jul 2026 22:16:01 GMT

Minor changes

• Add auth.popupRelayUri: a double-popup option for apps that customize COOP/storage-partitioning, relaying acquireTokenPopup/logoutPopup through a top-level same-origin relay page (runPopupRelay) so tokens can be acquired from an untrusted cross-origin iframe. #8687 (kshabelko@microsoft.com)
• Bump @​azure/msal-common to v16.11.1 (beachball)

Patches

• Fix decode logs script for the standalone mode #8697 (kshabelko@microsoft.com)

... (truncated)

Commits

• 5c53ac6 feat: add AttributeToken request and cache partition support (#8700)
• 7d10e6c  [NAA/PWB One Bridge] PR 1/6: webBrokerBridge scaffold — shared interfaces, e...
• 529fdd3 fix(msal-node): use length-prefix encoding for additional cache key hash to p...
• 006de72 Add clientClaims request parameter for confidential client (#8686)
• 2796e9b Bump uuid from 8.3.2 to 14.0.0 (#8575)
• 45ac206 Bump immutable from 5.1.7 to 5.1.9 (#8718)
• 8c1ec2d Bump webpack-dev-server from 5.2.3 to 5.2.6 (#8716)
• cd19b1a Bump postcss from 8.5.15 to 8.5.18 (#8730)
• 86bd093 test(e2e): shared brokering e2e helpers + real KMSI assertion (Foundation PR ...
• a6a32af Post-release PR (#8734)
• Additional commits viewable in compare view

Updates @codemirror/lang-markdown from 6.5.1 to 6.5.2

Commits

• See full diff in compare view

Updates @mui/x-tree-view from 9.1.0 to 9.11.0

Release notes

Sourced from @​mui/x-tree-view's releases.

v9.11.0

We'd like to extend a big thank you to the 14 contributors who made this release possible. Here are some highlights ✨:

• ✨ Add addItems() and getItemSelection() API methods to Tree View

Special thanks go out to these community members for their valuable contributions: @​12joan, @​Anexus5919, @​kevincorizi-sbt, @​mixelburg, @​mustafajw07, @​strazto

The following team members contributed to this release: @​flaviendelangle, @​hasdfa, @​JCQuintas, @​LukasTy, @​MBilalShafi, @​michelengelen, @​noraleonte, @​rita-codes

Data Grid

@mui/x-data-grid@9.11.0

• [DataGrid] Fix updateRows stripping class prototypes from rows in datasource mode (#22288) @​mixelburg
• [DataGrid] Do not re-fetch data when an Activity becomes visible (#22603) @​12joan
• [DataGrid] Fix toolbar button stealing focus when a sibling's disabled state changes (#23204) @​MBilalShafi

@mui/x-data-grid-pro@9.11.0

Same changes as in @mui/x-data-grid@9.11.0.

@mui/x-data-grid-premium@9.11.0

Same changes as in @mui/x-data-grid-pro@9.11.0.

Date and Time Pickers

@mui/x-date-pickers@9.11.0

• [pickers] Fix day shift when editing dates predating timezone standardization (#23296) @​JCQuintas

@mui/x-date-pickers-pro@9.11.0

Same changes as in @mui/x-date-pickers@9.11.0, plus:

• [DateRangePicker] Fix disabled filler cells showing the range highlight (#23293) @​JCQuintas

Charts

@mui/x-charts@9.11.0

• [charts] Activate the focused item with Enter/Space (#23218) @​JCQuintas
• [charts] Extract the axis click payload builders (#23215) @​JCQuintas
• [charts] Fix GestureManager event listener leak on chart unmount (#23283) @​kevincorizi-sbt
• [charts] Fix slotProps.legend.position and direction in RadarChart (#23254) @​JCQuintas
• [charts] Fix axis clicks being discarded on slight pointer movement (#23244) @​noraleonte
• [charts] Fix image export of charts sized by their parent element (#23255) @​JCQuintas
• [charts] Forward experimentalFeatures on RadarChart and Heatmap (#23216) @​JCQuintas

... (truncated)

Changelog

Sourced from @​mui/x-tree-view's changelog.

9.11.0

Aug 6, 2026

We'd like to extend a big thank you to the 14 contributors who made this release possible. Here are some highlights ✨:

• ✨ Add addItems() and getItemSelection() API methods to Tree View

Special thanks go out to these community members for their valuable contributions: @​12joan, @​Anexus5919, @​kevincorizi-sbt, @​mixelburg, @​mustafajw07, @​strazto

The following team members contributed to this release: @​flaviendelangle, @​hasdfa, @​JCQuintas, @​LukasTy, @​MBilalShafi, @​michelengelen, @​noraleonte, @​rita-codes

Data Grid

@mui/x-data-grid@9.11.0

• [DataGrid] Fix updateRows stripping class prototypes from rows in datasource mode (#22288) @​mixelburg
• [DataGrid] Do not re-fetch data when an Activity becomes visible (#22603) @​12joan
• [DataGrid] Fix toolbar button stealing focus when a sibling's disabled state changes (#23204) @​MBilalShafi

@mui/x-data-grid-pro@9.11.0

Same changes as in @mui/x-data-grid@9.11.0.

@mui/x-data-grid-premium@9.11.0

Same changes as in @mui/x-data-grid-pro@9.11.0.

Date and Time Pickers

@mui/x-date-pickers@9.11.0

• [pickers] Fix day shift when editing dates predating timezone standardization (#23296) @​JCQuintas

@mui/x-date-pickers-pro@9.11.0

Same changes as in @mui/x-date-pickers@9.11.0, plus:

• [DateRangePicker] Fix disabled filler cells showing the range highlight (#23293) @​JCQuintas

Charts

@mui/x-charts@9.11.0

• [charts] Activate the focused item with Enter/Space (#23218) @​JCQuintas
• [charts] Extract the axis click payload builders (#23215) @​JCQuintas
• [charts] Fix GestureManager event listener leak on chart unmount (#23283) @​kevincorizi-sbt
• [charts] Fix slotProps.legend.position and direction in RadarChart (#23254) @​JCQuintas

... (truncated)

Commits

• 0486f84 [release] v9.11.0 (#23295)
• eacd695 [docs] Replace README peer dependency lists with an npm install command (#23256)
• c603f8e [tree-view] Add getItemSelection API method (#23257)
• f50ddb4 [tree view] Ignore keepExistingSelection when multiSelect is false (#23...
• 03242c9 [tree-view] Add addItems() API method (#23159)
• df03708 [tree view] Prevent duplicate ids in multi-select arrow navigation (#23006)
• 2822eee [release] v9.10.1 (#23199)
• 340c74b [TreeView] Fix selection propagation to exclude disabled items (#23012)
• 06fc328 [release] v9.10.0 (#23158)
• 273aa3d [core] Allow opt-in data-* attributes on slotProps (#22128)
• Additional commits viewable in compare view

Updates canvas from 3.2.2 to 3.2.3

Release notes

Sourced from canvas's releases.

v3.2.3

Fixed

• Fix building with gcc (#2559)

Changelog

Sourced from canvas's changelog.

3.2.3

Fixed

• Fix building with gcc (#2559)

Commits

• f91598e v3.2.3
• 1541544 PAGE_SIZE shouldn't be unsigned
• See full diff in compare view

Updates dompurify from 3.4.5 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
• Documented the bench and test:happydom scripts in the README
• Completed the Attack Classes & Bypass History wiki page
• Bumped several dependencies where possible

DOMPurify 3.4.9

• Further improved the handling of Trusted Types config options, thanks @​offset
• Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
• Added more test coverage for IN_PLACE and Trusted Types related usage
• Bumped several dependencies where possible
• Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

• Cleaned up the repository root, renamed some and removed unneeded files
• Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
• Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
• Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
• Bumped several dependencies where possible

DOMPurify 3.4.7

• Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker

... (truncated)

Commits

• 3067f77 release: 3.4.13 (#1562)
• a9ca1e5 release: 3.4.12 (#1537)
• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• ca30f07 release: 3.4.7 (#1414)
• bb7739e release: 3.4.6 (#1394)
• See full diff in compare view

Updates echarts from 6.0.0 to 6.1.0

Release notes

Sourced from echarts's releases.

6.1.0

• [Feature] [axis] Support dataMin and dataMax option for calculating a nice axis extent. #20838 (Justin-ZS, Ovilia)
• [Feature] [axis] Comprehensively enable all types of axis (i.e., "value"/"time"/"category"/"log") to render series (typically "bar"/"pictorialBar"/"candlestick"/"boxplot") without overflow (including the case "category" axis with boundaryGap: false); provide containShape option; provide some corresponding clip option. dbfaf6a73 fe932a2aa 3973b21ee (100pah) #21511 (Akash Sonune)
• [Feature] [axis] Automatically exclude non-positive series data values on "log" axis. dedc5dc18 (100pah)
• [Feature] [axis] Enable axisLabel.formatter to receive its index for working with customValues. #21220 #21432 (Szymon Pachucki, Ovilia, plainheart)
• [Feature] [line] Add triggerEvent option for more control over mouse event. #21001 (Steven Cobb, plainheart)
• [Feature] [pie] Add tangential-noflip rotation mode to keep labels tangential without flipping. #21258 (春秋半夏, Ovilia)
• [Feature] [gauge] progress.color supports 'auto'. #21224 (StNimmerlein, Ovilia)
• [Feature] [radar] Add clockwise option. #21143 (Dai Xuezhou, Ovilia)
• [Feature] [candlestick] [dataZoom] Add cursor option for candlestick series and add cursorGrab option & cursorGrabbing for 'inside' dataZoom. #21558 (zuming, Ovilia, 100pah)
• [Feature] [scatter] [effectScatter] [geo] Enable clip option on "scatter"/"effectScatter" on geo. 417592289 (100pah)
• [Feature] [visualMap] Add seriesTargets option for multiple series-dimension mappings. #20703 (Justin-ZS, plainheart)
• [Feature] [matrix] Support matrix.x/y.length for conveniently creating a headless matrix without composing an array. #21191 (100pah, plainheart)
• [Feature] [matrix] Add triggerEvent option to support triggering event on matrix cells. #21390 (Natsuo Kawai, 100pah)
• [Feature] [i18n] add Latvian(LV) translation. #21546 (EPoikans)
• [Fix] [axis] Change and clarify the rounding error and auto-precision utils and solutions. 479dcd454 (100pah)
• [Fix] [axis] Fix chart does not work when using customValues with formatter in time axis (axis.type: 'time') label. #21352 (Srajan Sanjay Saxena, plainheart)
• [Fix] [axis] Fix and clarify alignTick strategy, and fix LogScale precision. a6ab2458f ffcc636fb (100pah)
• [Fix] [axis] Fix duplicate ticks when using time axis (axis.type: 'time') or customValues, which causes jitter of splitArea; fix the showMin/MaxLabel handling of a category axis (axis.type: 'category'); enable a uniform bandWidth calculation in numeric axis (axis.type: 'value' | 'time' | 'log'). 8de2b64fa 15af0db02 8ddaa5c69 (100pah)
• [Fix] [axis] Fix time axis (axis.type: 'time') bug when value scale is in millisecond. 40b77b464 (100pah)
• [Fix] [bar] Fix wrong label position when bar series has a 0 width/height. #21218 (Justin-ZS, Ovilia)
• [Fix] [scatter] Fix jitter layout does not support progressive rendering and cause chart to be frozen and potential NPE. #21436 (plainheart)
• [Fix] [lines] Fix effect symbol flip on unidirectional loop end when roundTrip is not enabled. #21320 (Mayank Mehta, plainheart)
• [Fix] [candlestick] Fix candlestick render error with series.encode on horizontal layout. #21325 (Purbayan Pramanik, 100pah)
• [Fix] [parallel] Fix incorrect axis extent when any subsequent series has a larger value than the first. #21387 (jackhickson, 100pah)
• [Fix] [pie] Support axes extent union pie center automatically when pie is laid out on Cartesian (grid component). 18a23a875 (100pah)
• [Fix] [treemap] Fix treemap can not be zoomed out after a zoom-in when scaleLimit is specified #21427 (TateLiu, 100pah)
• [Fix] [lines] Fix potential tooltip XSS vulnerability in lines series (series.type: 'lines'). #21608 (plainheart)
• [Fix] [map] [geo] Fix the failed synchronization and visual artifacts on geo roaming and animation. 417592289 (100pah)
• [Fix] [tooltip] Fix tooltip content does not refresh when changing tooltip trigger from 'axis' to 'item'. #20710 (Justin-ZS, plainheart)
• [Fix] [tooltip] valueFormatter callback param dataIndex should be rawDataIndex rather than dataZoom filtered dataIndex. #21479 (100pah, plainheart)
• [Fix] [axisPointer] Fix axisPointer shadow and enable clipping - it is previously only applicable to "category" axis, but is buggy in numeric axis with "bar" series. 8de2b64fa (100pah)
• [Fix] [axisPointer] Fix visual artifacts caused by failed axisPointer restoration. 56a32c0bb (100pah)
• [Fix] [hoverLayer] Fix visual artifacts arisen on hover layer. zrender#1151 933585126 (100pah)
• [Fix] [marker] Fix marker fails to render with dataset and encode. #21439 (plainheart, 100pah).
• [Fix] [dataZoom] Fix wrong position of the dataZoom when the series has only one data point. #21196 (alesmit, Ovilia)
• [Fix] [dataZoom] Fix dataZoom bug that data info disappears when dragging released; fix dataZoom dragging cursor style. 64305a4b8 (100pah)
• [Fix] [dataZoom] Apply a better auto-precision method; fix unexpected behaviors when dataZoom controls axes with alignTicks: true. d168bf237 (100pah)
• [Fix] [dataZoom] Fix AxisProxy can not be cleared when dataZoom option changed; fix related onZero behaviors. 52ceb924a 2e82d33c3 (100pah)
• [Fix] [areaStyle] Fix areaStyle render error when dimension name is empty string. #21219 (Justin-ZS, Ovilia)
• [Fix] [sunburst] Fix root node label may not be centered. #21306 (Akash Sonune, Ovilia)
• [Fix] [matrix] Fix matrix label formatter does not work. #21410 (Justin-ZS, Ovilia)
• [Fix] [toolbox] Fix emphasis color is the same as the default color. #21384 (Ovilia) b094f987d (100pah)
• [Fix] [toolbox] Fix the dataView component does not fit the dark mode. #21176 (notthistrain, Ovilia)
• [Fix] [progressive] Fix progressive rendering issues. 91a60fc76 (100pah)
• [Fix] [labelLine] Fix labelLine.smooth can not be reset. #21425 (fanwww, plainheart)
• [Fix] [graphic] Fix stroke corner gap due to not closing path in roundRect helper. zrender#1155 (plainheart)
• [Fix] [svg] Enhance SVG encodeBase64 compatibility to make it available in more environments like Web Worker/NodeJS/Bun. zrender#1145 (plainheart)
• [Fix] [core] Mark echarts instance object as raw in Vue. #21293 (plainheart)
• [Fix] [chord] Add the missing export entry for chord chart. #21197 (plainheart, Ovilia)

... (truncated)

Commits

• c5a48f5 Merge pull request #21612 from apache/release-dev
• 77e5222 release 6.1.0-rc.2
• 21f17be fixRegression(map,geo): Resolve circular dependencies introduced by this vers...
• 830e8b6 chore: Supplement package.json (for module cjs declaration) to source release.
• ed0e210 chore: Fix addHeader tool and add missing license headers.
• cc78ada Merge pull request #21611 from apache/release-dev
• 3f6e012 release: Build release.
• d69405f chore: Add missing headers.
• 6998ed0 release: Upgrade npm version.
• 8cb374b fix(build): Fix build commands.
• Additional commits viewable in compare view

Updates i18next from 26.0.1 to 26.3.6

Release notes

Sourced from i18next's releases.

v26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

v26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

v26.3.0

• feat(types): introduce ResourceNamespaceMap — a separate mergeable augmentation surface for namespace resource types, designed for monorepos where multiple packages each want to contribute their own namespaces. Previously, every package had to coordinate on a single CustomTypeOptions.resources declaration (or fall back to typing dependency namespaces as any) because resources is a single property of an interface and TypeScript reports TS2717 when two declarations of the same property disagree. The new interface merges naturally across declare module 'i18next' blocks, so each package can ship its own i18next.d.ts independently. Per-property merge handles same-namespace contributions from multiple packages, and same-key/different-literal conflicts are silently dropped to avoid poisoning t() overload resolution. Fully backwards-compatible — existing CustomTypeOptions.resources augmentations continue to work, and both surfaces can coexist. Scalar options (defaultNS, returnNull, enableSelector, etc.) still belong on CustomTypeOptions. Thanks @​sh3xu (#2434). Fixes #2409.

v26.2.0

• feat(types): new parseInterpolation TypeOption (default true). When set to false in CustomTypeOptions, the type-level extractor stops parsing translation strings for {{variable}} patterns. Required by i18next-icu users — the default extractor mistakes ICU MessageFormat nested-brace plurals like {count, plural, one {{count} row} other {{count} rows}} for an interpolation block and demands a phantom variable name. The flag is type-only; runtime interpolation is governed by InterpolationOptions and is unaffected. Fixes i18next-icu#85.
• fix(types): expose enableSelector on InitOptions so i18next.init({ enableSelector: 'strict' }) typechecks without a module augmentation. The runtime already reads opts?.enableSelector from init options; this lands the matching type declaration next to the other selector-resolution knobs. Accepts false | true | 'optimize' | 'strict'. Thanks @​Faithfinder (#2431)

v26.1.0

• feat: enableSelector: 'strict' (TypeOptions + runtime option). Opt-in mode that drops the flattened-primary form from NsResource at the type level — every namespace (primary included) is exposed only under its own key on $, uniformly across single- and multi-ns hooks. At runtime, a leading selector path segment matching the scope's namespace list is always rewritten as a namespace prefix, including the primary. Eliminates the silent-miss surface area where t($ => $.primary.foo) typechecks but doesn't resolve under the default mode (see #2429). Backward-compatible: default enableSelector: false | true | 'optimize' behavior is unchanged. Note: strict mode is incompatible with the #2405 pattern (keys whose names match sibling namespaces) — those users should stay on default mode.

v26.0.10

• feat: getFixedT accepts a fourth optional fixedOpts argument carrying scopeNs — the full namespace list the bound t was created for. The selector API uses scopeNs to detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the bound ns (a single primary string in the typical react-i18next setup), so plain t('key') lookups stay isolated to the primary namespace exactly as before — only t($ => $.secondaryNs.foo) selectors now route correctly under useTranslation([nsA, nsB]). Fixes the runtime side of #2429 for the react-i18next default-nsMode case. The 4th argument is opt-in: existing 3-arg getFixedT(lng, ns, keyPrefix) callers see no behavior change.

v26.0.9

• fix(types): unformatted interpolation values are now typed as string | number (was string). i18next stringifies values at runtime, so requiring callers to wrap numbers in String(...) for plain {{var}} placeholders was unnecessary friction — and could mask the real problem when a non-string value was passed alongside multiple interpolation slots (the t() overload resolution would fall through to the 3-arg form and report a confusing "not assignable to string" error against the options object). Typed format specifiers like {{x, number}}, {{x, currency}}, {{x, datetime}}, etc. keep their precise types; this only relaxes the no-format default. The count variable remains number-only

v26.0.8

• fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

v26.0.7

• fix: when a plural lookup misses, the missingKey debug log now shows the actual plural-resolved key (e.g. foo.bar_many for Polish count: 14) instead of the base key — making it obvious which plural category was expected and missing 2423
• chore: drop @babel/runtime runtime dependency. The build no longer generates any @babel/runtime imports, so the package is unused by consumers. Rollup now uses babelHelpers: 'bundled' so any helpers that are ever needed in the future will be inlined rather than imported externally 2424
• chore: stop emitting dist/esm/i18next.bundled.js. It was byte-identical to dist/esm/i18next.js because no helpers were being imported 2424

v26.0.6

Security release — all issues found via an internal audit. GHSA advisory filed after release.

• security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security docs for mitigation guidance (GHSA-TBD)
• security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .
• security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)

... (truncated)

Changelog

Sourced from i18next's changelog.

26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaar...

  Description has been truncated