[dependabot]

Bumps the major-packages group with 2 updates: i18next and react-i18next.

Updates i18next from 26.7.2 to 27.0.1

Release notes

Sourced from i18next's releases.

v27.0.1

• fix: each cached format keeps at most 1000 formatters, dropping the oldest when full. This covers the built-in formats (number, currency, datetime, relativetime, list) with the default cacheInBuiltFormats: true, and formats added with addCached. The cache key holds all t() options, including the interpolated values, so every new amount, date or name added a formatter that was never released: about 50 MB per 100k values, growing without end in a long-running server. A dropped formatter is made again from the same language and options, so the output does not change. Thanks @​liustack (#2467).

v27.0.0

This is a major breaking release. It changes defaults that most setups had to override, gives every instance its own logger and post-processors, refuses language codes that look like markup or paths, and removes options that were broken or had no effect. 26.7 warned in debug mode about most of the runtime changes. The migration guide has the details; to keep the v26 behavior where an option exists:

i18next.init({
  fallbackLng: 'dev', // or better your source language: there is no implicit 'dev' any more
  returnEmptyString: true, // an empty translation is a translation again
  cleanCode: false, // keep codes without a region as they are ('EN' stays 'EN')
});

declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: false;
    returnEmptyString: true;
  }
}

Changed defaults

• fallbackLng defaults to false instead of ['dev']. Without a fallbackLng, i18next no longer requests dev from the backend (/locales/dev/translation.json with i18next-http-backend), and saveMissing sends missing keys for the current language instead of dev. With supportedLngs and no fallbackLng, an unsupported language leaves language and languages unset, as fallbackLng: false already did. Set fallbackLng to your main language, or to 'dev' for the previous behavior.
• returnEmptyString defaults to false: an empty translation falls back like a missing value (to the fallback language, the default value or the key), as null already does. i18next-cli writes '' for untranslated keys in the other languages, which now fall back instead of rendering blank. An explicit '' default from code still counts: t('key', '') and t('key', { defaultValue: '' }) return ''. Set returnEmptyString: true (in init() and in CustomTypeOptions) if an empty translation is meant to render nothing, for example for a Locize project with "preserve empty strings" on.
• Language codes without a region get their canonical casing, as codes with one already did: 'EN' becomes 'en'. Only the casing changes: aliases like tl, iw or eng stay as they are ('TL' becomes 'tl'), and so do codes that are not BCP 47 (en_US, my_custom). i18next 26.7.0 and 26.7.1 warned that v27 turns iw into he or tl into fil; that was wrong and 26.7.2 corrects it. iw, tl and the like stay as they are. Set cleanCode: false to keep codes without a region exactly as they are. cleanCode is deprecated.
• types: strictInterpolationChecks defaults to true: t() needs the options for a string with variables, so a {{name}} cannot be left out of a call. Type a wrapper around t() with ParseKeysWithoutVariables, declare the variables interpolation.defaultVariables fills in with defaultVariables in CustomTypeOptions, or set strictInterpolationChecks: false to keep the v26 types (also for ICU and MF2 messages, whose arguments are required either way). The fixes below close the gap plural keys left.
• types: returnEmptyString defaults to false in TypeOptions too, so a key whose value is '' is typed as the key.

Changed behavior

• The logger and the post-processors belong to the instance. use() of a logger or a post-processor on one instance no longer changes the others, and the init() of one instance no longer rewires the logging of all of them. An instance from createInstance() does not see what the default i18next instance (or any other) registered: call use() on each instance. A clone (cloneInstance()) keeps its parent's logger and post-processors, also those its parent registers later, and what it registers itself stays its own. A plugin that calls use() from its own init() (the Locize InContext editor) registers right away, as before. services.logger stays the instance's logger, with forward(). In debug mode, a postProcess name that is not registered on the instance logs a warning.
• An object or an array without returnObjects is handled like a missing key: t() returns the default value if one is passed, else the key (with appendNamespaceToMissingKey, parseMissingKeyHandler and the post-processors applied), instead of the sentence key '... (en)' returned an object instead of string., which ended up in the UI. It is not saved as missing, since the key exists. The debug warning stays, and returnedObjectHandler still decides what is returned when it is set (returnedObjectHandler: (key) => `key '${key}' returned an object instead of string.` brings a sentence back).
• addResources() keeps every value: numbers, booleans and objects were dropped silently, only strings and arrays were added.
• The default escape no longer escapes /: '$10/month' stays '$10/month' instead of '$10/month', and dates in react-i18next's Trans no longer render as 17/12/2025 (discussion 2199). &, <, >, " and ' are still escaped, which covers HTML text and quoted attributes; a / cannot end either. Update snapshots that contain /, or pass your own interpolation.escape to keep escaping it.
• A language code from lng, changeLanguage(), a language detector or loadLanguages() that does not have the shape of isSafeLanguageCode() (letters, digits, -, _, @ and ., no .., at most 128 characters) is refused unless it is configured: listed in supportedLngs, in a fallbackLng that is not a function or in preload, or a language in resources, as given to init(). changeLanguage() continues as with an unsupported code: with the detector's next code, else the fallback language, else none (with fallbackLng: false, a code refused at init() leaves language unset); loadLanguages() skips it. With supportedLngs, the input is matched as before ('de-DE;q=0.9' still gives 'de'), and only an unsafe match is refused, which only nonExplicitSupportedLngs can return ('de-<x>' for a supported 'de'). Without supportedLngs, a detector that returned "><img src=x onerror=alert(1)> made that string i18next.language, which apps put into <html lang>, and backends were asked to load it. BCP 47, POSIX (en_US.UTF-8@euro, sr@latin) and private-use codes (en-x-pirate) pass; to use a code with other characters (+, spaces, /), list it in supportedLngs. In debug mode a refused code logs a warning.
• createInstance(options) merges the defaults right away, without initializing: before init(), instance.options has the defaults, getFixedT() no longer throws (t() returns '' until init()), and debug: true already shows the warnings before init(). init() still tells the options you set from the defaults, so a keySeparator or nsSeparator passed to createInstance() counts as set by you (#2426). loadNamespaces() before init() does nothing and calls back, as it did for an instance without options.
• keySeparator: false means flat keys only: a lookup no longer splits a key at the text false (t('nestedfalsec') returned the value of nested.c), and a selector path is joined with . like a key prefix, so selectors work on the flat keys ($ => $['a.b'] and $ => $.a.b look up the flat key 'a.b'; $ => $.nested.c no longer resolves nested, then c). types: with keySeparator: false in CustomTypeOptions, the keys are the flat keys (no nestedfalsec keys), a key containing false is no longer split, and keyPrefix takes the parts of the flat keys before a ., which is how getFixedT() joins it ('nested' for 'nested.c'). A key prefix combined with selectors is not typed for flat keys.

Removed

• The dotted language in the resource store calls: getResource('en.translation.key'), addResource('en.translation.key', value) and addResourceBundle('en.translation', resources). Pass language, namespace and key as separate arguments; addResource(), addResources() and addResourceBundle() throw a TypeError for the dotted form. A language code with a . (de_DE.UTF-8) is now a language like any other.
• interpolation.prefixEscaped, suffixEscaped, nestingPrefixEscaped and nestingSuffixEscaped, which were inserted into the RegExp unescaped. Pass the literal delimiters as prefix, suffix, nestingPrefix and nestingSuffix.
• types: compatibilityJSON (it had no effect since v24).
• types: the option types of plugins. locizeLastUsed is declared by locize-lastused (5.1.0 and later). ReactOptions stays importable from 'i18next' but is empty: react-i18next fills it in (17.1.13 and later, and 18), so the react options are checked when react-i18next is in the program.
• types: the _ and $ helpers in typescript/t.d.ts and typescript/options.d.ts ($FirstNamespace, _ValueOf and 84 more) are no longer importable; every declaration of those files counted as exported. The other types of those files (TOptionsBase, TFunctionSignature, ParseTReturn, ...) are now exported on purpose. If you imported one of the hidden helpers, please open an issue: exporting it again does not break anything.
• The root index.js, a CommonJS shim that the exports map made unreachable.

... (truncated)

Changelog

Sourced from i18next's changelog.

27.0.1

• fix: each cached format keeps at most 1000 formatters, dropping the oldest when full. This covers the built-in formats (number, currency, datetime, relativetime, list) with the default cacheInBuiltFormats: true, and formats added with addCached. The cache key holds all t() options, including the interpolated values, so every new amount, date or name added a formatter that was never released: about 50 MB per 100k values, growing without end in a long-running server. A dropped formatter is made again from the same language and options, so the output does not change. Thanks @​liustack (#2467).

27.0.0

This is a major breaking release. It changes defaults that most setups had to override, gives every instance its own logger and post-processors, refuses language codes that look like markup or paths, and removes options that were broken or had no effect. 26.7 warned in debug mode about most of the runtime changes. The migration guide has the details; to keep the v26 behavior where an option exists:

i18next.init({
  fallbackLng: 'dev', // or better your source language: there is no implicit 'dev' any more
  returnEmptyString: true, // an empty translation is a translation again
  cleanCode: false, // keep codes without a region as they are ('EN' stays 'EN')
});

declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: false;
    returnEmptyString: true;
  }
}

Changed defaults

• fallbackLng defaults to false instead of ['dev']. Without a fallbackLng, i18next no longer requests dev from the backend (/locales/dev/translation.json with i18next-http-backend), and saveMissing sends missing keys for the current language instead of dev. With supportedLngs and no fallbackLng, an unsupported language leaves language and languages unset, as fallbackLng: false already did. Set fallbackLng to your main language, or to 'dev' for the previous behavior.
• returnEmptyString defaults to false: an empty translation falls back like a missing value (to the fallback language, the default value or the key), as null already does. i18next-cli writes '' for untranslated keys in the other languages, which now fall back instead of rendering blank. An explicit '' default from code still counts: t('key', '') and t('key', { defaultValue: '' }) return ''. Set returnEmptyString: true (in init() and in CustomTypeOptions) if an empty translation is meant to render nothing, for example for a Locize project with "preserve empty strings" on.
• Language codes without a region get their canonical casing, as codes with one already did: 'EN' becomes 'en'. Only the casing changes: aliases like tl, iw or eng stay as they are ('TL' becomes 'tl'), and so do codes that are not BCP 47 (en_US, my_custom). i18next 26.7.0 and 26.7.1 warned that v27 turns iw into he or tl into fil; that was wrong and 26.7.2 corrects it. iw, tl and the like stay as they are. Set cleanCode: false to keep codes without a region exactly as they are. cleanCode is deprecated.
• types: strictInterpolationChecks defaults to true: t() needs the options for a string with variables, so a {{name}} cannot be left out of a call. Type a wrapper around t() with ParseKeysWithoutVariables, declare the variables interpolation.defaultVariables fills in with defaultVariables in CustomTypeOptions, or set strictInterpolationChecks: false to keep the v26 types (also for ICU and MF2 messages, whose arguments are required either way). The fixes below close the gap plural keys left.
• types: returnEmptyString defaults to false in TypeOptions too, so a key whose value is '' is typed as the key.

Changed behavior

• The logger and the post-processors belong to the instance. use() of a logger or a post-processor on one instance no longer changes the others, and the init() of one instance no longer rewires the logging of all of them. An instance from createInstance() does not see what the default i18next instance (or any other) registered: call use() on each instance. A clone (cloneInstance()) keeps its parent's logger and post-processors, also those its parent registers later, and what it registers itself stays its own. A plugin that calls use() from its own init() (the Locize InContext editor) registers right away, as before. services.logger stays the instance's logger, with forward(). In debug mode, a postProcess name that is not registered on the instance logs a warning.
• An object or an array without returnObjects is handled like a missing key: t() returns the default value if one is passed, else the key (with appendNamespaceToMissingKey, parseMissingKeyHandler and the post-processors applied), instead of the sentence key '... (en)' returned an object instead of string., which ended up in the UI. It is not saved as missing, since the key exists. The debug warning stays, and returnedObjectHandler still decides what is returned when it is set (returnedObjectHandler: (key) => `key '${key}' returned an object instead of string.` brings a sentence back).
• addResources() keeps every value: numbers, booleans and objects were dropped silently, only strings and arrays were added.
• The default escape no longer escapes /: '$10/month' stays '$10/month' instead of '$10/month', and dates in react-i18next's Trans no longer render as 17/12/2025 (discussion 2199). &, <, >, " and ' are still escaped, which covers HTML text and quoted attributes; a / cannot end either. Update snapshots that contain /, or pass your own interpolation.escape to keep escaping it.
• A language code from lng, changeLanguage(), a language detector or loadLanguages() that does not have the shape of isSafeLanguageCode() (letters, digits, -, _, @ and ., no .., at most 128 characters) is refused unless it is configured: listed in supportedLngs, in a fallbackLng that is not a function or in preload, or a language in resources, as given to init(). changeLanguage() continues as with an unsupported code: with the detector's next code, else the fallback language, else none (with fallbackLng: false, a code refused at init() leaves language unset); loadLanguages() skips it. With supportedLngs, the input is matched as before ('de-DE;q=0.9' still gives 'de'), and only an unsafe match is refused, which only nonExplicitSupportedLngs can return ('de-<x>' for a supported 'de'). Without supportedLngs, a detector that returned "><img src=x onerror=alert(1)> made that string i18next.language, which apps put into <html lang>, and backends were asked to load it. BCP 47, POSIX (en_US.UTF-8@euro, sr@latin) and private-use codes (en-x-pirate) pass; to use a code with other characters (+, spaces, /), list it in supportedLngs. In debug mode a refused code logs a warning.
• createInstance(options) merges the defaults right away, without initializing: before init(), instance.options has the defaults, getFixedT() no longer throws (t() returns '' until init()), and debug: true already shows the warnings before init(). init() still tells the options you set from the defaults, so a keySeparator or nsSeparator passed to createInstance() counts as set by you (#2426). loadNamespaces() before init() does nothing and calls back, as it did for an instance without options.
• keySeparator: false means flat keys only: a lookup no longer splits a key at the text false (t('nestedfalsec') returned the value of nested.c), and a selector path is joined with . like a key prefix, so selectors work on the flat keys ($ => $['a.b'] and $ => $.a.b look up the flat key 'a.b'; $ => $.nested.c no longer resolves nested, then c). types: with keySeparator: false in CustomTypeOptions, the keys are the flat keys (no nestedfalsec keys), a key containing false is no longer split, and keyPrefix takes the parts of the flat keys before a ., which is how getFixedT() joins it ('nested' for 'nested.c'). A key prefix combined with selectors is not typed for flat keys.

Removed

• The dotted language in the resource store calls: getResource('en.translation.key'), addResource('en.translation.key', value) and addResourceBundle('en.translation', resources). Pass language, namespace and key as separate arguments; addResource(), addResources() and addResourceBundle() throw a TypeError for the dotted form. A language code with a . (de_DE.UTF-8) is now a language like any other.
• interpolation.prefixEscaped, suffixEscaped, nestingPrefixEscaped and nestingSuffixEscaped, which were inserted into the RegExp unescaped. Pass the literal delimiters as prefix, suffix, nestingPrefix and nestingSuffix.
• types: compatibilityJSON (it had no effect since v24).
• types: the option types of plugins. locizeLastUsed is declared by locize-lastused (5.1.0 and later). ReactOptions stays importable from 'i18next' but is empty: react-i18next fills it in (17.1.13 and later, and 18), so the react options are checked when react-i18next is in the program.
• types: the _ and $ helpers in typescript/t.d.ts and typescript/options.d.ts ($FirstNamespace, _ValueOf and 84 more) are no longer importable; every declaration of those files counted as exported. The other types of those files (TOptionsBase, TFunctionSignature, ParseTReturn, ...) are now exported on purpose. If you imported one of the hidden helpers, please open an issue: exporting it again does not break anything.

... (truncated)

Commits

• 1cb5a7a 27.0.1
• 7f7216b changelog for 27.0.1
• 35fecdd fix: keep at most 1000 formatters in each cached format (#2467)
• e22c212 27.0.0
• 846c76d changelog for 27.0.0
• 94320bc feat!: i18next 27, a major version with breaking changes
• See full diff in compare view

Updates react-i18next from 17.1.13 to 18.0.0

Changelog

Sourced from react-i18next's changelog.

18.0.0

Released together with i18next 27. The migration guide lists every change with what to do: https://react.i18next.com/latest/migrating-v17-to-v18

Breaking changes

• requires i18next 27 (peer >= 27.0.0) and React 18 or later (peer >= 18.0.0). React 16 and 17 apps stay on react-i18next 17: on i18next 27, use react-i18next 17.1.13 or later (it brings the types of the react init options), or 18. useSyncExternalStore comes from React itself, so use-sync-external-store is no longer a dependency.
• Trans output no longer depends on interpolation.escapeValue: it always decodes HTML entities after parsing, as IcuTrans does, in text and in attribute values, both with react.unescape (attribute values used the built-in decoder before). With i18next's default escapeValue: true, a value Tom & Jerry rendered as Tom & Jerry and a date 17/12/2025 as 17/12/2025; both now render as written, and so do entities in the translation itself (&, <,  , ...). Values still render as text, never as markup (since 17.1.10). The shouldUnescape prop and react.transDefaultProps.shouldUnescape are ignored and warn (DEPRECATED_OPTION, in development and with debug: true); remove them. Snapshot tests that contain entities inside Trans output need an update (#1903, #1893).
• Trans and IcuTrans re-render on language change by themselves: they subscribe to the react.bindI18n (default languageChanged) and react.bindI18nStore events, like useTranslation. Before, they only updated when a parent re-rendered (#1710). They still neither load translations nor suspend; with a t prop, that t still decides the language. TransWithoutContext and IcuTransWithoutContext stay hook-free.
• the react options of an instance stay on that instance. initReactI18next copied them into module-wide defaults, so a second instance without react options inherited, for example, the first one's useSuspense: false. Set them on every instance, or call setDefaults() once.
• the i18n returned by useTranslation (and passed by withTranslation and Translation) forwards reads and writes to the instance. It was a copy taken when the language changed, so after await i18n.changeLanguage('de') the copy still said en, and properties set on it never reached the instance. It is still a new object whenever the language changes, for dependency arrays and the React Compiler. Because the old object now reads the current language too, a check like prevProps.i18n.language !== this.props.i18n.language (or the language of a usePrevious(i18n)) no longer sees a change: compare the objects (prevProps.i18n !== this.props.i18n) or keep the previous language yourself.
• useSSR and withSSR call i18next's hydrate() instead of writing resourceStore.data, options.ns, initializedStoreOnce, isInitialized and initializedLanguageOnce themselves. Same behavior with real instances, including the opt-out for cloned instances. Test mocks of i18n used with useSSR/withSSR now need a hydrate method, mocks that load before init() need once, and mocks used with Trans or IcuTrans need on and off, since both subscribe to events now (with bindI18nStore set, also store.on and store.off): a minimal mock like { t, options, language } throws i18n.on is not a function.
• the react-i18next/icu.macro Babel macro (deprecated since 17.0.21) is removed, with the placeholder exports date, time, number, select, plural and selectOrdinal. Write IcuTrans directly.
• types: the HTMLAttributes['children'] augmentation for allowObjectInHTMLChildren moved to the opt-in react-i18next/augment-react. Default installs no longer change React's DOM types. With allowObjectInHTMLChildren: true, add import 'react-i18next/augment-react'; next to your CustomTypeOptions; with current @types/react it needs skipLibCheck: true (#1928).
• types: I18nContext is typed { i18n: i18n; defaultNS?: string | string[] } | undefined, as at runtime: useContext(I18nContext) is undefined outside an I18nextProvider. getI18n() keeps its type.
• types: react-i18next now declares the react init options. i18next 27 keeps an empty ReactOptions interface that react-i18next fills in, so import type { ReactOptions } from 'i18next' keeps working, and ReactOptions is also exported from react-i18next. The defaultTransParent docs no longer claim a 'div' default.
• the UMD build no longer bundles i18next: it uses the global i18next (load i18next's UMD build first) and shrinks from 71.3 KB to 26.2 KB minified. The AMD build (dist/amd) is removed; AMD loaders can use the UMD file.
• engines.node is >=22, and the build targets ES2020 syntax with a fixed browser list instead of browserslist defaults.

Other changes

• feat: a react-server export condition for react-i18next. In a React Server Component, import { Trans } from 'react-i18next' failed with createContext is not a function; it now resolves to an entry with Trans and IcuTrans (the variants without React context), TransWithoutContext, IcuTransWithoutContext, nodesToString, initReactI18next, setI18n/getI18n and setDefaults/getDefaults. Hooks, HOCs, Translation, I18nextProvider and the SSR helpers stay client-only, so importing them there is a build error. Without an i18n prop, the server Trans and IcuTrans use the global instance (the one initReactI18next registered), which is the wrong one with an instance per request: pass that instance as i18n (t is optional). A t alone is not enough, because a t from getFixedT carries no instance. In development and with debug: true they warn about it (GLOBAL_INSTANCE_ON_SERVER) (#1759, #1840).
• fix(Trans): a component given for a self-closing tag (<0/>) with children of its own is no longer remounted on every render. Trans created a new component type for it each time, so its state and effects were reset.
• fix: warnings are deduplicated per i18next instance instead of once per process, so a second instance reports its own problems. Clones (cloneInstance(), for example one per request in i18next-http-middleware) share their parent's, as they share its logger, so they do not repeat them.
• fix: a translation load waiting for init() uses i18n.once('initialized') instead of removing its listener with a delay.
• fix(types): with keySeparator: false and a key prefix (useTranslation(ns, { keyPrefix }), getFixedT), the values of Trans and IcuTrans are typed from the right key. The prefix and the key were joined with the text false (nestedfalsec), so no variables were checked; they are now joined with ., as getFixedT does.
• fix(types): useSSR takes its third argument { i18n }, and the useTranslation options take bindI18nStore, as at runtime. ErrorCode lists I18N_NOT_INITIALIZED, ICU_TRANS_RENDER_ERROR and GLOBAL_INSTANCE_ON_SERVER.
• chore: a files whitelist replaces .npmignore; @babel/runtime is no longer a dependency.

Commits

• 6b76421 18.0.0
• 16c6116 changelog for 18.0.0
• 209c4be feat!: react-i18next 18, a major version for i18next 27
• 5ca8c86 build
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions