[dependabot]

Bumps the frontend-npm group with 17 updates in the /app/frontend directory:

Package	From	To
i18next	26.4.2	26.7.2
lucide-react	1.61.0	1.69.0
next	16.4.0	16.4.5
react	19.3.0	19.3.1
@types/react	19.2.9	19.3.0
react-dom	19.3.0	19.3.1
@types/react-dom	19.2.3	19.3.0
react-i18next	17.1.0	17.1.13
@eslint/eslintrc	3.3.3	3.3.7
@playwright/test	1.63.0	1.65.0
@tailwindcss/postcss	4.1.18	4.3.4
@types/node	26.6.3	26.6.6
@types/react	19.2.9	19.3.0
@types/react-dom	19.2.3	19.3.0
eslint	10.11.0	10.14.0
eslint-config-next	16.3.5	16.4.5
tailwindcss	4.1.18	4.3.4
vite	8.3.5	7.3.7
vitest	5.0.5	5.1.0

Updates i18next from 26.4.2 to 26.7.2

Release notes

Sourced from i18next's releases.

v26.7.2

• fix: the debug-mode deprecation warning for a language code without a region no longer says that v27 replaces aliases. 26.7.0 and 26.7.1 warned that v27 turns 'iw' into 'he' or 'tl' into 'fil' and asked you to rename them. v27 only gives such codes their canonical casing ('EN' becomes 'en', 'IW' becomes 'iw'), so iw, tl, eng and similar codes stay as they are. If you renamed them because of that warning, you can keep or restore the old codes. The warning now only appears when the casing changes.

v26.7.1

• fix: reloadResources() retries the bundles that failed to load. The load queue skipped them also when reloading, so a language whose first load failed (a backend or network outage at startup) stayed missing. i18next-http-backend 4.0.8, i18next-chained-backend 5.0.7 and i18next-locize-backend 10.0.5 reload through reloadResources() with i18next 26.7, so their reloadInterval no longer recovered from such a failure, as their own reload did before.
• fix: reloadResources() without languages reloads the current languages and every language the backend loaded or tried to load, for the instance and its clones, as the API docs describe ("pass languages and namespaces if you don't want to reload all"). It reloaded only the current languages, so on a server (one clone per request with i18next-http-middleware) a backend's reloadInterval never refreshed the languages loaded for requests. It never requests cimode. With languages given, nothing changes.

v26.7.0

The last 26.x minor before v27, which follows in about a week. It adds the APIs v27 builds on, and with debug: true it warns wherever a setup relies on something v27 changes. Most of the v27 defaults are existing options, so you can try them now:

i18next.init({
  debug: true, // prints the warnings below
  fallbackLng: 'en', // v27: fallbackLng defaults to false, set your source language (no implicit 'dev')
  returnEmptyString: false, // v27 default: an empty string falls back like a missing key
  cleanCode: true, // close to v27, which canonicalizes codes without a region ('EN' becomes 'en')
});

declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: true; // v27 default
    returnEmptyString: false; // v27 default
  }
}

The other v27 changes (/ no longer escaped in values, a logger and post-processors per instance, the key instead of a sentence for an object hit, the dotted-language store calls and *Escaped options removed) have no switch; the debug warnings below show where they apply.

• feat: with the default skipOnVariables: true, a missing interpolation variable is now logged in debug mode, once per string and variable: missed to pass in variable name for interpolating Hello {{name}}. The raw {{name}} reached the UI without any log line, even with debug: true, because the warning only ran with skipOnVariables: false. A variable passed as undefined and a missingInterpolationHandler still log nothing.
• feat: i18next.hydrate(resources, lng) puts resources rendered on the server into the store and changes to the server's language, each only the first time. It does what react-i18next's useSSR did by writing resourceStore.data, options.ns, isInitialized, initializedStoreOnce and initializedLanguageOnce directly, and sets the same flags, so integrations can switch to it and stay compatible with code that still reads or writes them. On a clone it does nothing, as useSSR does: a clone shares its parent's store (one clone per request with i18next-http-middleware). Called before init(), it logs a warning and changes nothing.
• feat: services.utils.reloadResources() lets a backend reload its bundles through i18next (as i18next.reloadResources(), with retries and the loaded event), instead of calling backendConnector.read() and loaded() itself as the reloadInterval of i18next-http-backend and i18next-chained-backend does. Without languages (no lng, no detector, the default fallbackLng), reloadResources() reloads nothing instead of throwing Cannot read properties of undefined (reading 'forEach'); a backend that also reloads preload passes its languages.
• feat: backends and async language detectors can declare their calling convention with callbackApi (an instance or static property). true: read(language, namespace, callback), create(languages, namespace, key, fallbackValue, callback, options) and detect(callback); false: they return a promise or a value, and create gets the options as its fifth argument. Without it, i18next keeps guessing from the number of parameters (Function.length), which default and rest parameters change: i18next-chained-backend's create(..., clb = () => {}, opts = {}) has length 4 and never got its options (isUpdate), and i18next-http-backend's callback form of create has length 5, the length reserved for the callback-less form. Guessing is deprecated: in debug mode an unmarked backend or async detector logs a deprecation warning, once per init().
• feat: isSafeLanguageCode(code) is exported for plugins that take a language from a request, a URL or storage: letters, digits, -, _, @ and . (no ..), at most 128 characters, not a prototype key. It is not a BCP 47 check, so en_US, zh_Hant_TW, sr@latin and de_DE.UTF-8 pass; markup, slashes and spaces do not. The language detector, i18next-http-middleware and i18next-http-backend each have their own rule today.
• feat: use() logs a warning in debug mode when a second backend, language detector, i18nFormat or formatter replaces the first one; only one of each is used per instance, and losing an ICU setup this way was silent. As use() usually runs before init(), the warning is printed once init() has set up the logger.
• feat(types): ParseKeysWithoutVariables<Ns, KPrefix>, the keys t() takes without options: their string has no variables, and a plural key is left out when its forms take count. A wrapper typed with it, like (key: ParseKeysWithoutVariables<'common'>) => t(key), compiles with strictInterpolationChecks without a cast.
• feat(types): defaultVariables in CustomTypeOptions declares the variables interpolation.defaultVariables fills in at runtime (defaultVariables: { appName: string }). They become optional in the t() options, also with strictInterpolationChecks; passed, they keep their type.
• feat(types): interpolationFormatSeparator in CustomTypeOptions for a custom interpolation.formatSeparator: the types split {{price, currency}} at a hard-coded ,, so with formatSeparator: ';' the format was not recognized. The per-call skipInterpolation option is typed, and returnedObjectHandler may return a value (what it returns is what t() returns; it was typed as returning void).
• feat(types): SelectorFn, ApplyTarget, ConstrainTarget and GetSource are exported on purpose, under their current names. react-i18next imports them for Trans; they were importable only because every declaration in the type files counts as exported.
• fix(types): with nsSeparator: false in CustomTypeOptions, the key union no longer contains nsfalsekey-style keys for the other namespaces, and a key that contains the text false (isfalsey) is no longer split at it, which typed its t() result as never.
• fix: with clones (i18next-http-middleware makes one per request), saveMissing now checks that the namespace is loaded for the instance that misses the key. Each cloneInstance() pointed the parent's services.utils.hasLoadedNamespace at the new clone, and the backend connector, which all clones share, used that one: a key missing in one request was not saved (did not save key ... as the namespace ... was not yet loaded) while a newer request was still loading its language, and the parent's services.utils answered for the newest clone. A clone's services.utils is now bound to the clone, and the parent keeps its own. A direct services.backendConnector.saveMissing() call, like the missing keys route of i18next-http-middleware, still checks the newest clone (follow-up to #1413).
• fix: dir() without a language (before init(), or with no language resolved) returns 'ltr' instead of 'rtl' ([discussion #2135](Why 'rtl' is default direction in case of language not found? i18next/i18next#2135)).
• fix: t() before init() returns an empty string, as typed (with a warning when debug logging is already on); it returned undefined.
• fix: off('a b', listener) removes the listener from both events, as on('a b', listener) adds it to both. It looked for an event named 'a b', so once('a b', listener) never removed its listener and ran it on every event.
• deprecate: dotted languages in the resource store calls (getResource('en.translation.key'), addResource('en.translation.key', value), addResourceBundle('en.translation', resources)) log a deprecation warning in debug mode; they are removed in v27. Pass language, namespace and key as separate arguments.
• deprecate: interpolation.prefixEscaped, suffixEscaped, nestingPrefixEscaped and nestingSuffixEscaped (inserted into the RegExp unescaped) log a deprecation warning in debug mode and are marked @deprecated; they are removed in v27. Pass the literal delimiters as prefix, suffix, nestingPrefix and nestingSuffix.
• deprecate: compatibilityJSON is marked @deprecated (it has no effect since v24) and removed from the types in v27.
• deprecate: a language code without a region that v27 canonicalizes differently logs a deprecation warning in debug mode: 'EN' stays 'EN' today and becomes 'en' in v27, 'iw' becomes 'he'. cleanCode: true already lower-cases them.
• deprecate: when fallbackLng is not set, the first request for the default fallback language dev (loading it, or saving missing keys to it) logs a notice in debug mode: v27 defaults to fallbackLng: false and no longer requests dev. Set fallbackLng to your source language, or to 'dev' to keep the current behavior.

... (truncated)

Changelog

Sourced from i18next's changelog.

26.7.2

• fix: the debug-mode deprecation warning for a language code without a region no longer says that v27 replaces aliases. 26.7.0 and 26.7.1 warned that v27 turns 'iw' into 'he' or 'tl' into 'fil' and asked you to rename them. v27 only gives such codes their canonical casing ('EN' becomes 'en', 'IW' becomes 'iw'), so iw, tl, eng and similar codes stay as they are. If you renamed them because of that warning, you can keep or restore the old codes. The warning now only appears when the casing changes.

26.7.1

• fix: reloadResources() retries the bundles that failed to load. The load queue skipped them also when reloading, so a language whose first load failed (a backend or network outage at startup) stayed missing. i18next-http-backend 4.0.8, i18next-chained-backend 5.0.7 and i18next-locize-backend 10.0.5 reload through reloadResources() with i18next 26.7, so their reloadInterval no longer recovered from such a failure, as their own reload did before.
• fix: reloadResources() without languages reloads the current languages and every language the backend loaded or tried to load, for the instance and its clones, as the API docs describe ("pass languages and namespaces if you don't want to reload all"). It reloaded only the current languages, so on a server (one clone per request with i18next-http-middleware) a backend's reloadInterval never refreshed the languages loaded for requests. It never requests cimode. With languages given, nothing changes.

26.7.0

The last 26.x minor before v27, which follows in about a week. It adds the APIs v27 builds on, and with debug: true it warns wherever a setup relies on something v27 changes. Most of the v27 defaults are existing options, so you can try them now:

i18next.init({
  debug: true, // prints the warnings below
  fallbackLng: 'en', // v27: fallbackLng defaults to false, set your source language (no implicit 'dev')
  returnEmptyString: false, // v27 default: an empty string falls back like a missing key
  cleanCode: true, // close to v27, which canonicalizes codes without a region ('EN' becomes 'en')
});

declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: true; // v27 default
    returnEmptyString: false; // v27 default
  }
}

The other v27 changes (/ no longer escaped in values, a logger and post-processors per instance, the key instead of a sentence for an object hit, the dotted-language store calls and *Escaped options removed) have no switch; the debug warnings below show where they apply.

• feat: with the default skipOnVariables: true, a missing interpolation variable is now logged in debug mode, once per string and variable: missed to pass in variable name for interpolating Hello {{name}}. The raw {{name}} reached the UI without any log line, even with debug: true, because the warning only ran with skipOnVariables: false. A variable passed as undefined and a missingInterpolationHandler still log nothing.
• feat: i18next.hydrate(resources, lng) puts resources rendered on the server into the store and changes to the server's language, each only the first time. It does what react-i18next's useSSR did by writing resourceStore.data, options.ns, isInitialized, initializedStoreOnce and initializedLanguageOnce directly, and sets the same flags, so integrations can switch to it and stay compatible with code that still reads or writes them. On a clone it does nothing, as useSSR does: a clone shares its parent's store (one clone per request with i18next-http-middleware). Called before init(), it logs a warning and changes nothing.
• feat: services.utils.reloadResources() lets a backend reload its bundles through i18next (as i18next.reloadResources(), with retries and the loaded event), instead of calling backendConnector.read() and loaded() itself as the reloadInterval of i18next-http-backend and i18next-chained-backend does. Without languages (no lng, no detector, the default fallbackLng), reloadResources() reloads nothing instead of throwing Cannot read properties of undefined (reading 'forEach'); a backend that also reloads preload passes its languages.
• feat: backends and async language detectors can declare their calling convention with callbackApi (an instance or static property). true: read(language, namespace, callback), create(languages, namespace, key, fallbackValue, callback, options) and detect(callback); false: they return a promise or a value, and create gets the options as its fifth argument. Without it, i18next keeps guessing from the number of parameters (Function.length), which default and rest parameters change: i18next-chained-backend's create(..., clb = () => {}, opts = {}) has length 4 and never got its options (isUpdate), and i18next-http-backend's callback form of create has length 5, the length reserved for the callback-less form. Guessing is deprecated: in debug mode an unmarked backend or async detector logs a deprecation warning, once per init().
• feat: isSafeLanguageCode(code) is exported for plugins that take a language from a request, a URL or storage: letters, digits, -, _, @ and . (no ..), at most 128 characters, not a prototype key. It is not a BCP 47 check, so en_US, zh_Hant_TW, sr@latin and de_DE.UTF-8 pass; markup, slashes and spaces do not. The language detector, i18next-http-middleware and i18next-http-backend each have their own rule today.
• feat: use() logs a warning in debug mode when a second backend, language detector, i18nFormat or formatter replaces the first one; only one of each is used per instance, and losing an ICU setup this way was silent. As use() usually runs before init(), the warning is printed once init() has set up the logger.
• feat(types): ParseKeysWithoutVariables<Ns, KPrefix>, the keys t() takes without options: their string has no variables, and a plural key is left out when its forms take count. A wrapper typed with it, like (key: ParseKeysWithoutVariables<'common'>) => t(key), compiles with strictInterpolationChecks without a cast.
• feat(types): defaultVariables in CustomTypeOptions declares the variables interpolation.defaultVariables fills in at runtime (defaultVariables: { appName: string }). They become optional in the t() options, also with strictInterpolationChecks; passed, they keep their type.
• feat(types): interpolationFormatSeparator in CustomTypeOptions for a custom interpolation.formatSeparator: the types split {{price, currency}} at a hard-coded ,, so with formatSeparator: ';' the format was not recognized. The per-call skipInterpolation option is typed, and returnedObjectHandler may return a value (what it returns is what t() returns; it was typed as returning void).
• feat(types): SelectorFn, ApplyTarget, ConstrainTarget and GetSource are exported on purpose, under their current names. react-i18next imports them for Trans; they were importable only because every declaration in the type files counts as exported.
• fix(types): with nsSeparator: false in CustomTypeOptions, the key union no longer contains nsfalsekey-style keys for the other namespaces, and a key that contains the text false (isfalsey) is no longer split at it, which typed its t() result as never.
• fix: with clones (i18next-http-middleware makes one per request), saveMissing now checks that the namespace is loaded for the instance that misses the key. Each cloneInstance() pointed the parent's services.utils.hasLoadedNamespace at the new clone, and the backend connector, which all clones share, used that one: a key missing in one request was not saved (did not save key ... as the namespace ... was not yet loaded) while a newer request was still loading its language, and the parent's services.utils answered for the newest clone. A clone's services.utils is now bound to the clone, and the parent keeps its own. A direct services.backendConnector.saveMissing() call, like the missing keys route of i18next-http-middleware, still checks the newest clone (follow-up to #1413).
• fix: dir() without a language (before init(), or with no language resolved) returns 'ltr' instead of 'rtl' ([discussion #2135](Why 'rtl' is default direction in case of language not found? i18next/i18next#2135)).
• fix: t() before init() returns an empty string, as typed (with a warning when debug logging is already on); it returned undefined.
• fix: off('a b', listener) removes the listener from both events, as on('a b', listener) adds it to both. It looked for an event named 'a b', so once('a b', listener) never removed its listener and ran it on every event.
• deprecate: dotted languages in the resource store calls (getResource('en.translation.key'), addResource('en.translation.key', value), addResourceBundle('en.translation', resources)) log a deprecation warning in debug mode; they are removed in v27. Pass language, namespace and key as separate arguments.
• deprecate: interpolation.prefixEscaped, suffixEscaped, nestingPrefixEscaped and nestingSuffixEscaped (inserted into the RegExp unescaped) log a deprecation warning in debug mode and are marked @deprecated; they are removed in v27. Pass the literal delimiters as prefix, suffix, nestingPrefix and nestingSuffix.

... (truncated)

Commits

• 912869c 26.7.2
• d71706a changelog for 26.7.2
• 4375f9d fix: the bare language code warning only announces v27's casing change, not a...
• 3cc5774 chore: update dependencies, close the minimatch and deepmerge alerts
• 14faff4 README: drop the Locize ad image; the sponsor banner and the text saying who ...
• b84e418 26.7.1
• 0a9fc2e changelog for 26.7.1
• 61fae7e fix: reloadResources() retries bundles that failed and, without languages, re...
• 70b64a2 26.7.0
• f98d0c6 changelog for 26.7.0
• Additional commits viewable in compare view

Updates lucide-react from 1.61.0 to 1.69.0

Release notes

Sourced from lucide-react's releases.

Version 1.69.0

What's Changed

• feat(icons): added package-pen icon by @​ericfennis in lucide-icons/lucide#5154
• feat(icons): added package-question-mark icon by @​ericfennis in lucide-icons/lucide#5155
• feat(icons): added opacity icon by @​ilyavred in lucide-icons/lucide#4222
• feat(icons): added circle-fading-check icon by @​n2duc in lucide-icons/lucide#4089

New Contributors

• @​ilyavred made their first contribution in lucide-icons/lucide#4222
• @​n2duc made their first contribution in lucide-icons/lucide#4089

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

• fix(site): keep sponsor tiers within content width by @​ffgenius in lucide-icons/lucide#5149
• feat(icons): added mango icon by @​Prsenapati09 in lucide-icons/lucide#4902
• chore(icons): Renamed *-warning and *-alert to *-exclamation-point by @​ericfennis in lucide-icons/lucide#5143

New Contributors

• @​ffgenius made their first contribution in lucide-icons/lucide#5149
• @​Prsenapati09 made their first contribution in lucide-icons/lucide#4902

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

• feat(site): Add sponsor page by @​ericfennis in lucide-icons/lucide#5132
• fix(icons): changed chef-hat icon by @​karsa-mistmere in lucide-icons/lucide#4577
• fix(icons): changed (circle|square)-letter-j by @​karsa-mistmere in lucide-icons/lucide#5138
• feat(icons): added globe-ban icon by @​PrimeTestLab in lucide-icons/lucide#5020
• chore(deps): bump playwright to 1.64.1 to support ubuntu 26.04 runners by @​ericfennis in lucide-icons/lucide#5140
• chore(deps): bump the svelte-deps group across 1 directory with 3 updates by @​dependabot[bot] in lucide-icons/lucide#5139
• feat(icons): added diagram-flow-horizontal, diagram-flow-vertical icons by @​karsa-mistmere in lucide-icons/lucide#5125
• chore(deps-dev): bump preact from 11.0.2 to 11.1.0 in the preact-deps group across 1 directory by @​dependabot[bot] in lucide-icons/lucide#5135
• feat(icons): added globe-plus icon by @​Turboman3000 in lucide-icons/lucide#4938
• feat(lab): added map-pin-laptop icon by @​k8adev in lucide-icons/lucide#3699
• feat(lab): added circuit-resistor icon by @​synthetic-blood in lucide-icons/lucide#4698
• feat(lab): added flask-conical-titration icon by @​jwlinqx in lucide-icons/lucide#4428
• feat(lab): added soldering-iron icon by @​psjdev in lucide-icons/lucide#4850
• feat(lab): added cup-bubble-tea icon by @​DrashtiC07 in lucide-icons/lucide#5098
• test(build-icons): cover Windows file URL imports by @​vugarbbakhishov-hub in lucide-icons/lucide#4862
• chore(deps-dev): bump the angular-deps group across 1 directory with 15 updates by @​dependabot[bot] in lucide-icons/lucide#5114
• chore(deps-dev): bump react-native from 0.88.0 to 0.88.1 in the react-native-deps group across 1 directory by @​dependabot[bot] in lucide-icons/lucide#5134
• chore(deps-dev): bump the solid-deps group across 1 directory with 6 updates by @​dependabot[bot] in lucide-icons/lucide#5142
• chore(deps): Update dependencies by @​ericfennis in lucide-icons/lucide#5146
• fix(dev): avoid polynomial regex backtracking in toCamelCase helper by @​ericfennis in lucide-icons/lucide#5148
• chore(deps): Fix security vulnerabilities alerts by @​ericfennis in lucide-icons/lucide#5147

New Contributors

... (truncated)

Commits

• b196797 Update deps (#5146)
• 588113e test(build-icons): cover Windows file URL imports (#4862)
• 14cab02 feat(site): Add sponsor page (#5132)
• 1668a0c chore(deps): bump rollup to 4.65.1 and keep typescript on v6 (#5110)
• e8f86fc fix(lucide-react): ignore stale DynamicIcon loads after the name changes (#5060)
• 6657faa chore(deps-dev): bump vite from 8.3.2 to 8.3.3 (#5052)
• 1802f33 feat(lucide-react): add package exports for per-icon imports without changing...
• 20aef31 chore(packages): Update sponsors (#5034)
• See full diff in compare view

Updates next from 16.4.0 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
• [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
• [lts-active] test: Pin react-virtualized (#100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
• [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

... (truncated)

Commits

• 4e5335a v16.4.5
• 809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
• 2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
• 6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
• 18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
• e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
• d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
• 80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
• b175f52 v16.4.4
• ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
• Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates @types/react from 19.2.9 to 19.3.0

Commits

• See full diff in compare view

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

Commits

• 61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.3.0

Commits

• See full diff in compare view

Updates react-i18next from 17.1.0 to 17.1.13

Changelog

Sourced from react-i18next's changelog.

17.1.13

• fix(types): the react init options keep their types with i18next 27. i18next 27 declares ReactOptions (the type of i18next.init({ react })) as an empty interface and leaves its shape to react-i18next, so with react-i18next 17 the react options were no longer checked and getDefaults().useSuspense did not compile. react-i18next now declares them itself, with exactly the types i18next 26 has: TypeScript accepts the repeated declaration on i18next 26, and on i18next 27 it fills in the empty interface. Nothing changes with i18next 26.

17.1.12

• fix(types): type-checking a <Trans> is fast again with large resources. Since 17.0.2 the return type of the key was a type parameter of Trans, so TypeScript also computed it for every key of the namespace: with 50 namespaces of 200 keys, one <Trans> cost about 1.3 million more type instantiations than in 17.0.1, with or without a values prop. The return type is computed inside the values prop again, as in 17.0.1, and values still only needs the variables of the given i18nKey (#1913). The exported TransProps type loses the Ret parameter added in 17.0.2, so its 6th parameter is the element props E again, as before 17.0.2. Thanks @​leshaduduk (#1947), fixes #1946.

17.1.11

• fix(Trans): with i18next 26.7.0 or later and debug: true, the variables of object children are no longer logged as missing. When Trans interpolates before parsing (with count, values, tOptions or interpolation.defaultVariables), its t() call leaves the placeholders of object children like {{ name }} for after parsing, and i18next 26.7 logs each of them as missed to pass in variable name, although the output is right: <Trans count={n}>Hello <b>{{ name }}</b>, you have {{ count }} messages.</Trans> logged it for name. Trans now passes a missingInterpolationHandler to that call that does what i18next does without one (it keeps the placeholder, and a variable passed as undefined becomes empty), so the output is unchanged. It does not with skipOnVariables: false, a missingInterpolationHandler of your own, an i18nFormat plugin, or an escape function that would change the placeholders of the children.

17.1.10

• fix(Trans): markup inside an interpolated value is no longer parsed as translation markup. Trans interpolates values (and count, values in tOptions, or the whole string when there are no children) before it parses the string. With interpolation.escapeValue: false, or with an i18nFormat plugin (i18next-icu, i18next-mf2, i18next-fluent), which inserts values without escaping whatever escapeValue says, a value like <0 href="https://example.com">x</0> was rendered as component 0 with that href, overriding the props of the component, and <strong>x</strong> in a value became a real <strong>. Trans now escapes the values for this t() call (with a plugin, the string values in values) and decodes the entities after parsing, so such a value renders as text, and a " in a value no longer closes an attribute like <Item title="{{name}}" />. {{- var}} stays the explicit way for a translator to insert a value unescaped. As with shouldUnescape, entities written in these translations (for example &) are now decoded instead of shown literally. Output with escapeValue: true and no plugin, with i18next-icu escapeVariables: true, and with children and no values or count is unchanged.
• fix(IcuTrans): the same for IcuTrans with escapeValue: false or an i18nFormat plugin: a value like <0>x</0> no longer becomes the first component, and a value containing an entity like & is no longer decoded a second time.

17.1.9

• fix(useTranslation): namespaces added to or removed from the ns array are now picked up. The hook used the array itself as the useMemo dependency list, and React only compares the entries both lists have in common when its length changes, so going from useTranslation(['nsA']) to useTranslation(['nsA', 'nsB']) kept returning ['nsA']: React warned that the dependency array changed size, nsB was never loaded, and with nsMode: 'fallback' keys only in nsB rendered as the key. Removing a namespace kept the old list the same way. The namespaces are now compared by content, so a growing list loads the new namespace (suspending until it is loaded, as switching from 'nsA' to 'nsB' already does) and t uses it. Lists that keep their length behave as before. Thanks @​lprnmns (#1945).

17.1.8

• fix(Trans): an interpolation variable named format is no longer dropped. Trans reads format in an interpolation object as the formatter name ({{ value, format }}), so with {{ format }} as the only key nothing was left: <Trans>Export as {{ format }}</Trans> warned TRANS_INVALID_OBJ and used the default string Export as instead of Export as {{format}}. When format is the object's only key it is now treated as the variable. {{ value, format }} works as before. Without an i18nKey, the key derived from the children changes accordingly, from Export as to Export as {{format}}. i18next-cli serializes Trans children with react-i18next, so extracting with this version produces the same key. Thanks @​Pharex38 (#1944).

17.1.7

• fix(IcuTrans): each HTML entity in a translation is now decoded exactly once. Named, decimal and hexadecimal entities were decoded in three passes, and each pass decoded the output of the previous one, so an escaped numeric entity was decoded twice: "Write &[#169](https://github.com/i18next/react-i18next/issues/169); to get &[#169](https://github.com/i18next/react-i18next/issues/169);" rendered Write © to get © instead of Write &[#169](https://github.com/i18next/react-i18next/issues/169); to get ©, and &[#60](https://github.com/i18next/react-i18next/issues/60); rendered < instead of &[#60](https://github.com/i18next/react-i18next/issues/60);. This also hit interpolated values with escapeValue: true, where a value containing &[#60](https://github.com/i18next/react-i18next/issues/60); is escaped to &[#60](https://github.com/i18next/react-i18next/issues/60);. Escaped named entities like < already stayed <, as browsers and Trans decode them. Unknown named entities and entities above U+10FFFF still stay as written. Thanks @​Pharex38 (#1943).

17.1.6

• fix(Trans): a count passed in tOptions is now used. Trans spread tOptions and then set its own count prop, so a count only in tOptions was overwritten with undefined: <Trans i18nKey="items" tOptions={{ count: 5 }} /> rendered the key items instead of 5 items, and with children Trans could pick the wrong plural form. Like context, Trans now falls back to tOptions.count, handled the same way as the count prop. A count prop, a count in the children or values.count still take precedence, and tOptions is not modified. Thanks @​nk-batman21 (#1942).

17.1.5

• fix(Trans): with an array of keys and no children, Trans now falls back to the last key when none of them has a translation, as t() does. It used the array itself as defaultValue, which i18next handles as an object, so <Trans i18nKey={['notifications.crm_item_created', 'crm_item_created']} components={[<strong />]} /> rendered key 'crm_item_created (en)' returned an object instead of string. instead of crm_item_created. An array of selectors falls back to the key of the last selector. The first key that has a translation still wins, and children, defaults and tOptions.defaultValue are used as before. With saveMissing, these calls now report the missing key, like a single i18nKey does. Thanks @​nk-batman21 (#1941).

17.1.4

• fix(types): without allowObjectInHTMLChildren, the children of HTML elements now use React's own type (DOMAttributes<T>['children']) instead of the ReactI18NextChildren | Iterable<ReactI18NextChildren> union. Both accept the same children, so nothing compiles differently. For default installs the global HTMLAttributes augmentation now repeats whatever @types/react declares, so changes in React's types flow through instead of meeting a copy, and type errors on element children no longer list an extra Iterable<...>. With allowObjectInHTMLChildren: true nothing changes. First step of #1928.

17.1.3

• fix(IcuTrans): numeric HTML entities above U+FFFF, like emoji, now decode to the right character. "Hello &#x1F44B; <0>friend</0> &[#127881](https://github.com/i18next/react-i18next/issues/127881);" rendered U+F44B and U+F389, private-use glyphs that usually show as a box, instead of 👋 and 🎉: the decoder used String.fromCharCode, which keeps only the low 16 bits of the code point. This shows up with translations that a TMS or CMS exports HTML-encoded. Entities above U+10FFFF, which are no valid code points, now stay as written instead of becoming U+0000. Entities below U+10000, including surrogate pairs written as two entities, decode as before. Thanks @​nk-batman21 (#1940).

17.1.2

• fix(Trans): when the only child is a string, a tag whose index the children don't have now renders its own text. <Trans i18nKey="welcome">Welcome</Trans> with "Welcome <1>friend</1>" rendered Welcome e, and defaults="Hi <1>there</1>" with the child Hi rendered Hi i. The fallback for a single object of components ({{ 1: <strong /> }}) looked the tag up on the string and rendered one of its characters. It now applies only when that child is an object, so {{ 1: <strong /> }} renders as before, and the tag falls back to its inner text, as it already did with several children or with a number or an element as the only child. This also stops a single-entry array child holding null ({[null]}, e.g. from a .map that returned null) from throwing Cannot read properties of null. Thanks @​Cayan (#1939).

17.1.1

... (truncated)

Commits

• 76c1842 17.1.13
• 4dd03fe changelog for 17.1.13
• 2d792a4 fix(types): the react init options keep their types with i18next 27
• a6b635d chore: update dependencies and examples, close the dependabot alerts
• cbac86f README: drop the Locize ad image; the sponsor banner and the text saying who ...
• 95ab2f3 17.1.12
• 91cfa41 changelog for 17.1.12
• a98b743 fix(types): compute the Trans values type inside the prop again (#1947)
• 541e248 17.1.11