chore: bump the npm-major group across 1 directory with 26 updates by dependabot[bot] · Pull Request #714 · SableClient/Sable

dependabot · 2026-04-23T04:10:23Z

Bumps the npm-major group with 26 updates in the / directory:

Package	From	To
@atlaskit/pragmatic-drag-and-drop-auto-scroll	`1.4.0`	`2.1.5`
domhandler	`5.0.3`	`6.0.1`
emojibase	`15.3.1`	`17.0.0`
emojibase-data	`15.3.2`	`17.0.0`
focus-trap-react	`10.3.1`	`12.0.1`
html-dom-parser	`5.1.8`	`7.0.1`
html-react-parser	`4.2.10`	`6.0.1`
i18next	`25.8.17`	`26.0.8`
i18next-http-backend	`2.7.3`	`3.0.6`
immer	`9.0.21`	`11.1.4`
matrix-js-sdk	`38.4.0`	`41.3.0`
react	`18.3.1`	`19.2.5`
@types/react	`18.3.28`	`19.2.14`
react-dom	`18.3.1`	`19.2.5`
@types/react-dom	`18.3.7`	`19.2.3`
react-google-recaptcha	`2.1.0`	`3.1.0`
react-i18next	`16.5.7`	`17.0.6`
react-router-dom	`6.30.3`	`7.14.2`
ua-parser-js	`1.0.41`	`2.0.9`
@types/node	`24.10.13`	`25.6.0`
@vitejs/plugin-react	`5.1.4`	`6.0.1`
knip	`5.85.0`	`6.7.0`
typescript	`5.9.3`	`6.0.3`
vite	`7.3.1`	`8.0.10`
vite-plugin-static-copy	`3.2.0`	`4.1.0`
vite-plugin-svgr	`4.5.0`	`5.2.0`

Updates @atlaskit/pragmatic-drag-and-drop-auto-scroll from 1.4.0 to 2.1.5

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by atlassianartifactteam, a new releaser for @atlaskit/pragmatic-drag-and-drop-auto-scroll since your current version.

Updates domhandler from 5.0.3 to 6.0.1

Release notes

Sourced from domhandler's releases.

v6.0.1

What's Changed

add JSR import map for domelementtype

Full Changelog: fb55/domhandler@v6.0.0...v6.0.1

v6.0.0

What's Changed

BREAKING: domhandler is now ESM-only fb55/domhandler#1867

Full Changelog: fb55/domhandler@v5.0.3...v6.0.0

Commits

8f66071 6.0.1
39183cd ci: add JSR import map for domelementtype
a54417e build(deps-dev): Bump @feedic/eslint-config from 0.2.3 to 0.3.1 (#1865)
1346b9c 6.0.0
4a790c7 refactor!: ESM-only (#1867)
39f39e9 build(deps-dev): Bump typescript-eslint from 8.57.0 to 8.57.1 (#1866)
5a45546 build(deps-dev): Bump @eslint/compat from 2.0.2 to 2.0.3 (#1864)
76be7b1 build(deps-dev): Bump typescript-eslint from 8.56.1 to 8.57.0 (#1863)
07eb031 build(deps-dev): Bump @biomejs/biome from 2.4.6 to 2.4.7 (#1862)
5d68735 chore: Remove Tidelift funding information (#1861)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for domhandler since your current version.

Updates emojibase from 15.3.1 to 17.0.0

Release notes

Sourced from emojibase's releases.

[email protected]

Major Changes

806c507: Update to Emoji v17 and CLDR 48.

Patch Changes

Updated dependencies [806c507]

[email protected]

[email protected]

Major Changes

806c507: Update to Emoji v17 and CLDR 48.

[email protected]

Major Changes

806c507: Update to Emoji v17 and CLDR 48.

Patch Changes

Updated dependencies [806c507]

[email protected]

[email protected]

Major Changes

806c507: Update to Emoji v17 and CLDR 48.

[email protected]

Patch Changes

53fcdc1: Updated Chinese Traditional translations.

[email protected]

Patch Changes

d0e4bcc: Fixed a broken publish.

[email protected]

Patch Changes

3faf950: Add missing files and types for vi data.

[email protected]

Major Changes

e9b9a9a: Add vi (Vietnamese) language.

d237386: Update to Emoji v16 and CLDR 46.

... (truncated)

Changelog

Sourced from emojibase's changelog.

17.0.0

Major Changes

806c507: Update to Emoji v17 and CLDR 48.

16.0.0

Major Changes

e9b9a9a: Add vi (Vietnamese) language.

d237386: Update to Emoji v16 and CLDR 46.

d237386: Drop Node.js v16 support. Requires >= v18.12.

All notable changes to this project will be documented in this file. See Conventional Commits for commit guidelines.

Commits

a5fc630 chore: Version packages (#194)
50f5455 release: Emoji v17 / CLDR 48 (#193)
4f06163 Version Packages (#182)
e9b9a9a new: Add vi (Vietnamese) language (#179)
04b7926 release: Update to Emoji v16 and CLDR 46. (#180)
8af1353 breaking: Drop Node.js v16 support. Requires >= v18.12. (#172)
See full diff in compare view

Updates emojibase-data from 15.3.2 to 17.0.0

Release notes

Sourced from emojibase-data's releases.

[email protected]

Major Changes

806c507: Update to Emoji v17 and CLDR 48.

Patch Changes

Updated dependencies [806c507]

[email protected]

[email protected]

Patch Changes

53fcdc1: Updated Chinese Traditional translations.

[email protected]

Patch Changes

d0e4bcc: Fixed a broken publish.

[email protected]

Patch Changes

3faf950: Add missing files and types for vi data.

[email protected]

Major Changes

e9b9a9a: Add vi (Vietnamese) language.

d237386: Update to Emoji v16 and CLDR 46.

d237386: Drop Node.js v16 support. Requires >= v18.12.

Patch Changes

Updated dependencies [e9b9a9a]

Updated dependencies [d237386]

Updated dependencies [d237386]

[email protected]

Changelog

Sourced from emojibase-data's changelog.

17.0.0

Major Changes

806c507: Update to Emoji v17 and CLDR 48.

Patch Changes

Updated dependencies [806c507]

[email protected]

16.0.3

Patch Changes

53fcdc1: Updated Chinese Traditional translations.

16.0.2

Patch Changes

d0e4bcc: Fixed a broken publish.

16.0.1

Patch Changes

3faf950: Add missing files and types for vi data.

16.0.0

Major Changes

e9b9a9a: Add vi (Vietnamese) language.

d237386: Update to Emoji v16 and CLDR 46.

d237386: Drop Node.js v16 support. Requires >= v18.12.

Patch Changes

Updated dependencies [e9b9a9a]

Updated dependencies [d237386]

Updated dependencies [d237386]

[email protected]

All notable changes to this project will be documented in this file. See Conventional Commits for commit guidelines.

Commits

a5fc630 chore: Version packages (#194)
50f5455 release: Emoji v17 / CLDR 48 (#193)
91c1b15 fix: changed the translation into Russian (#190)
abb21ab chore: Version packages (#188)
53fcdc1 internal: Regenerate data sets.
acc7f6b chore: Version packages (#186)
7361f34 chore: Version packages (#185)
3faf950 fix: Add missing types for vi. (#184)
4f06163 Version Packages (#182)
e9b9a9a new: Add vi (Vietnamese) language (#179)
Additional commits viewable in compare view

Updates focus-trap-react from 10.3.1 to 12.0.1

Release notes

Sourced from focus-trap-react's releases.

v12.0.1

Patch Changes

93c93e9: Update focus-trap dependency to 8.1.0 for new lifecycle hook improvements (onActivate, etc).

v12.0.0

Major Changes

763eae4: BREAKING: Updated focus-trap dependency to v8.0.0. The breaking change is that onPostActivate() is now correctly called after the initial focus node is focused (it was previously called before due to a bug with the initial focus delay). See the focus-trap changelog for more details.

v11.0.6

Patch Changes

c0bd275: Bump focus-trap to 7.8.0 for new aria-hidden support in isolateSubtrees option and bug fix related to trapStack option

v11.0.5

Patch Changes

01712b0: Update focus-trap dependency to 7.6.6 and tabbable to 6.3.0 to get a new displayCheck option in tabbable.

0f8db7c: Bump tabbable to 6.4.0 and focus-trap to 7.7.1 for improved inert handling

v11.0.4

Patch Changes

346e41d: Bump focus-trap to v7.6.5 for shadow DOM bug fix

v11.0.3

Patch Changes

095b3d4: Bump focus-trap dependency to v7.6.4 to get fix to manually-paused traps (see focus-trap|1340 for more info)

v11.0.2

Patch Changes

e766841: Fix deprecation warning in React 19 when accessing ref the pre-v19 way

v11.0.1

Patch Changes

cd75caa: Fix missing default export in typings; props no longer extend React.AllHTMLAttributes<any> to allow things like className (those extra props have always been ignored anyway); deprecate default export; add named export in code (#1396)

v11.0.0

Major Changes

4a37dae: Dropping propTypes and defaultProps no longer supported by React 19 and long deprecated in React 18 (going forward, use TypeScript for prop typings, and if necessary, a runtime library to validate props); Increasing minimum supported React version up to >=18; Bumping focus-trap dependency to v7.6.2

Changelog

Sourced from focus-trap-react's changelog.

12.0.1

Patch Changes

93c93e9: Update focus-trap dependency to 8.1.0 for new lifecycle hook improvements (onActivate, etc).

12.0.0

Major Changes

763eae4: BREAKING: Updated focus-trap dependency to v8.0.0. The breaking change is that onPostActivate() is now correctly called after the initial focus node is focused (it was previously called before due to a bug with the initial focus delay). See the focus-trap changelog for more details.

11.0.6

Patch Changes

c0bd275: Bump focus-trap to 7.8.0 for new aria-hidden support in isolateSubtrees option and bug fix related to trapStack option

11.0.5

Patch Changes

01712b0: Update focus-trap dependency to 7.6.6 and tabbable to 6.3.0 to get a new displayCheck option in tabbable.

0f8db7c: Bump tabbable to 6.4.0 and focus-trap to 7.7.1 for improved inert handling

11.0.4

Patch Changes

346e41d: Bump focus-trap to v7.6.5 for shadow DOM bug fix

11.0.3

Patch Changes

095b3d4: Bump focus-trap dependency to v7.6.4 to get fix to manually-paused traps (see focus-trap|1340 for more info)

11.0.2

Patch Changes

e766841: Fix deprecation warning in React 19 when accessing ref the pre-v19 way

11.0.1

Patch Changes

cd75caa: Fix missing default export in typings; props no longer extend React.AllHTMLAttributes<any> to allow things like className (those extra props have always been ignored anyway); deprecate default export; add named export in code (#1396)

11.0.0

... (truncated)

Commits

95347d3 Version Packages (#1890)
93c93e9 Bump focus-trap to 8.1.0 (#1889)
fd3fe32 [DEPENDABOT]: Bump @typescript-eslint/eslint-plugin from 8.58.2 to 8.59.0 (#1...
591f8af [DEPENDABOT]: Bump @changesets/cli from 2.30.0 to 2.31.0 (#1883)
2d283a7 [DEPENDABOT]: Bump typescript from 6.0.2 to 6.0.3 (#1885)
b6e21d9 [DEPENDABOT]: Bump @typescript-eslint/parser from 8.58.2 to 8.59.0 (#1886)
912a5cc [DEPENDABOT]: Bump cypress from 15.13.1 to 15.14.1 (#1887)
1ce7b6b [DEPENDABOT]: Bump eslint-plugin-react-hooks from 7.0.1 to 7.1.1 (#1888)
b5dcc57 [DEPENDABOT]: Bump eslint-plugin-cypress from 6.2.3 to 6.3.1 (#1874)
65d02f5 [DEPENDABOT]: Bump prettier from 3.8.1 to 3.8.3 (#1876)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for focus-trap-react since your current version.

Updates html-dom-parser from 5.1.8 to 7.0.1

Release notes

Sourced from html-dom-parser's releases.

v7.0.1

7.0.1 (2026-04-07)

Bug Fixes

bundle ESM-only deps into CJS output with Rollup (#1409) (901f1b4) @athenacfr

v7.0.0

7.0.0 (2026-03-30)

⚠ BREAKING CHANGES

deps: bump htmlparser2 from 11.0.0 to 12.0.0

Build System

deps: bump htmlparser2 from 11.0.0 to 12.0.0 (#1389) (9e72885)

v6.0.0

6.0.0 (2026-03-20)

⚠ BREAKING CHANGES

client: remove exports formatAttributes and CARRIAGE_RETURN constants

deps: bump htmlparser2 from 10.1.0 to 11.0.0

deps: bump domhandler from 5.0.3 to 6.0.1

Code Refactoring

client: remove exports formatAttributes and CARRIAGE_RETURN (77c2e92)

Build System

deps: bump domhandler from 5.0.3 to 6.0.1 (24b7e31)

deps: bump htmlparser2 from 10.1.0 to 11.0.0 (cb389eb)

Changelog

Sourced from html-dom-parser's changelog.

7.0.1 (2026-04-07)

Bug Fixes

bundle ESM-only deps into CJS output with Rollup (#1409) (901f1b4)

7.0.0 (2026-03-30)

⚠ BREAKING CHANGES

deps: bump htmlparser2 from 11.0.0 to 12.0.0

Build System

deps: bump htmlparser2 from 11.0.0 to 12.0.0 (#1389) (9e72885)

6.0.0 (2026-03-20)

⚠ BREAKING CHANGES

client: remove exports formatAttributes and CARRIAGE_RETURN constants

deps: bump htmlparser2 from 10.1.0 to 11.0.0

deps: bump domhandler from 5.0.3 to 6.0.1

Code Refactoring

client: remove exports formatAttributes and CARRIAGE_RETURN (77c2e92)

Build System

deps: bump domhandler from 5.0.3 to 6.0.1 (24b7e31)

deps: bump htmlparser2 from 10.1.0 to 11.0.0 (cb389eb)

Commits

f047400 Merge pull request #1410 from remarkablemark/release-please--branches--master...
fcab789 chore(master): release 7.0.1
1c6f4b2 build(package): update package-lock.json
e906aaa Merge pull request #1409 from athenacfr/fix/cjs-esm-compat
901f1b4 fix: bundle ESM-only deps into CJS output with Rollup
fda4c22 build(deps-dev): bump the vitest group with 4 updates (#1407)
1d57633 build(deps-dev): bump jsdom from 29.0.1 to 29.0.2 (#1408)
7ebee14 build(deps-dev): bump eslint-plugin-simple-import-sort (#1406)
6a428e0 build(deps-dev): bump vite from 8.0.1 to 8.0.5 (#1405)
8462d61 build(deps-dev): bump @types/node from 25.5.1 to 25.5.2 (#1404)
Additional commits viewable in compare view

Updates html-react-parser from 4.2.10 to 6.0.1

Release notes

Sourced from html-react-parser's releases.

v6.0.1

6.0.1 (2026-04-08)

Build System

deps: bump html-dom-parser from 7.0.0 to 7.0.1 (#2189) (c1f9856)

v6.0.0

6.0.0 (2026-04-02)

⚠ BREAKING CHANGES

deps: bump html-dom-parser from 5.1.8 to 7.0.0

deps: bump domhandler from 5.0.3 to 6.0.1

tsconfig: change build target from es5 to es2016

Build System

deps: bump domhandler from 5.0.3 to 6.0.1 (#2163) (c3d3092)

deps: bump html-dom-parser from 5.1.8 to 7.0.0 (#2177) (1ae59e6)

tsconfig: change target from es5 to es2016 (796f4de)

v5.2.17

5.2.17 (2026-02-07)

Bug Fixes

deps: bump html-dom-parser from 5.1.7 to 5.1.8 (#2113) (c53a612)

v5.2.16

5.2.16 (2026-02-03)

Build System

deps: bump html-dom-parser from 5.1.4 to 5.1.7 (#2100) (461624b)

v5.2.15

5.2.15 (2026-01-31)

Bug Fixes

esm: set explicit file extension for ./lib/utilities (d8fd0c5)

v5.2.14

5.2.14 (2026-01-28)

... (truncated)

Changelog

Sourced from html-react-parser's changelog.

6.0.1 (2026-04-08)

Build System

deps: bump html-dom-parser from 7.0.0 to 7.0.1 (#2189) (c1f9856)

6.0.0 (2026-04-02)

⚠ BREAKING CHANGES

deps: bump html-dom-parser from 5.1.8 to 7.0.0

deps: bump domhandler from 5.0.3 to 6.0.1

tsconfig: change build target from es5 to es2016

Build System

deps: bump domhandler from 5.0.3 to 6.0.1 (#2163) (c3d3092)

deps: bump html-dom-parser from 5.1.8 to 7.0.0 (#2177) (1ae59e6)

tsconfig: change target from es5 to es2016 (796f4de)

5.2.17 (2026-02-07)

Bug Fixes

deps: bump html-dom-parser from 5.1.7 to 5.1.8 (#2113) (c53a612)

5.2.16 (2026-02-03)

Build System

deps: bump html-dom-parser from 5.1.4 to 5.1.7 (#2100) (461624b)

5.2.15 (2026-01-31)

Bug Fixes

esm: set explicit file extension for ./lib/utilities (d8fd0c5)

5.2.14 (2026-01-28)

Reverts

downgrade html-dom-parser from 5.1.5 to 5.1.4 (#2093) (994cf93)

... (truncated)

Commits

60d0fa3 Merge pull request #2190 from remarkablemark/release-please--branches--master...
1e17e4d build(deps-dev): bump typescript-eslint from 8.58.0 to 8.58.1 (#2188)
b9399b9 chore(master): release 6.0.1
c1f9856 build(deps): bump html-dom-parser from 7.0.0 to 7.0.1 (#2189)
fb5cbe7 build(deps-dev): bump the vitest group with 4 updates (#2187)
26198c5 build(deps-dev): bump the eslint group across 1 directory with 3 updates (#2186)
5a19a80 build(deps-dev): bump @types/node from 25.5.0 to 25.5.2 (#2184)
17e9674 build(deps-dev): bump preact from 10.29.0 to 10.29.1 (#2183)
fabcd70 build(deps-dev): bump vite from 8.0.3 to 8.0.5 (#2185)
a7db894 docs(readme): add migration v6
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for html-react-parser since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates i18next from 25.8.17 to 26.0.8

Release notes

Sourced from i18next's releases.

v26.0.8

fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

v26.0.7

fix: when a plural lookup misses, the missingKey debug log now shows the actual plural-resolved key (e.g. foo.bar_many for Polish count: 14) instead of the base key — making it obvious which plural category was expected and missing 2423

chore: drop @babel/runtime runtime dependency. The build no longer generates any @babel/runtime imports, so the package is unused by consumers. Rollup now uses babelHelpers: 'bundled' so any helpers that are ever needed in the future will be inlined rather than imported externally 2424

chore: stop emitting dist/esm/i18next.bundled.js. It was byte-identical to dist/esm/i18next.js because no helpers were being imported 2424

v26.0.6

Security release — all issues found via an internal audit. GHSA advisory filed after release.

security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security docs for mitigation guidance (GHSA-TBD)

security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .

security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)

chore: ignore .env* and *.pem/*.key files in .gitignore

v26.0.5

fix: cloneInstance().changeLanguage() no longer fails to update language state when the target language is not yet loaded — a race between init()'s deferred load() and the user's changeLanguage() could overwrite isLanguageChangingTo, causing setLngProps to be skipped 2422

v26.0.4

fix(types): inline formatting options like {{price, currency(EUR)}} are now correctly resolved to their base format type (e.g. number for currency) instead of falling back to string 2378

v26.0.3

fix(types): addResourceBundle now accepts an optional 6th options parameter ({ silent?: boolean; skipCopy?: boolean }) matching the runtime API 2419

v26.0.2

fix(types): t("key", {} as TOptions) no longer produces a type error — the context constraint now bypasses strict checking when context is unknown (e.g. from TOptions) 2418

v26.0.1

fix: Formatter no longer crashes when alwaysFormat is true and no format specifier is present (format is undefined)

fix: Formatter now returns undefined/null values as-is instead of producing NaN when the value is missing

v26.0.0

This is a major breaking release:

Breaking Changes

Remove deprecated initImmediate option — the backward-compatibility mapping from initImmediate to initAsync (introduced in v24) has been removed. Use initAsync instead.

Remove legacy interpolation.format function — the old monolithic format function (interpolation: { format: (value, format, lng) => ... }) is no longer supported. The built-in Formatter (or a custom Formatter module via .use()) is now always used. Migrate to the new formatting approach using i18next.services.formatter.add() or .addCached() for custom formatters.

Remove console support notice — the console support notice introduced in v25.8.0 has been removed, along with the showSupportNotice option and all related internal suppression logic (globalThis.__i18next_supportNoticeShown, I18NEXT_NO_SUPPORT_NOTICE env var). See our blog post for the full story.

Remove simplifyPluralSuffix option — this option was unused by the core PluralResolver (which relies entirely on Intl.PluralRules). It only had an effect in the old v1/v2/v3 compatibility layer. The v4 test compatibility layer now defaults to true internally.

Remove deprecated @babel/polyfill from devDependencies.

Improvements

Code modernization across all source files:

Replace indexOf() > -1 / indexOf() < 0 with .includes() (~40+ occurrences)

Replace indexOf() === 0 with .startsWith() where appropriate

Replace var with const, '' + object with String(object), .substring() with .slice()

Replace .apply(observer, [event, ...args]) with direct call observer(event, ...args)

... (truncated)

Changelog

Sourced from i18next's changelog.

26.0.8

fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

26.0.7

fix: when a plural lookup misses, the missingKey debug log now shows the actual plural-resolved key (e.g. foo.bar_many for Polish count: 14) instead of the base key — making it obvious which plural category was expected and missing 2423

chore: drop @babel/runtime runtime dependency. The build no longer generates any @babel/runtime imports, so the package is unused by consumers. Rollup now uses babelHelpers: 'bundled' so any helpers that are ever needed in the future will be inlined rather than imported externally 2424

chore: stop emitting dist/esm/i18next.bundled.js. It was byte-identical to dist/esm/i18next.js because no helpers were being imported 2424

26.0.6

Security release — all issues found via an internal audit.

security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security note in the Nesting docs for the full pattern and mitigations

security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .

security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)

chore: ignore .env* and *.pem/*.key files in .gitignore

26.0.5

fix: cloneInstance().changeLanguage() no longer fails to update language state when the target language is not yet loaded — a race between init()'s deferred load() and the user's changeLanguage() could overwrite isLanguageChangingTo, causing setLngProps to be skipped 2422

26.0.4

fix(types): inline formatting options like {{price, currency(EUR)}} are now correctly resolved to their base format type (e.g. number for currency) instead of falling back to string 2378

26.0.3

fix(types): addResourceBundle now accepts an optional 6th options parameter ({ silent?: boolean; skipCopy?: boolean }) matching the runtime API 2419

26.0.2

fix(types): t("key", {} as TOptions) no longer produces a type error — the context constraint now bypasses strict checking when context is unknown (e.g. from TOptions) 2418

26.0.1

fix: Formatter no longer crashes when alwaysFormat is true and no format specifier is present (format is undefined)

fix: Formatter now returns undefined/null values as-is instead of producing NaN when the value is missing

26.0.0

This is a major breaking release:

Breaking Changes

Remove deprecated initImmediate option — the backward-compatibility mapping from initImmediate to initAsync (introduced in v24) has been removed. Use initAsync instead.

Remove legacy interpolation.format function — the old monolithic format function (interpolation: { format: (value, format, lng) => ... }) is no longer supported. The built-in Formatter (or a custom Formatter module via .use()) is now always used. Migrate to the new formatting approach using i18next.services.formatter.add() or .addCached() for custom formatters.

Remove console support notice — the console support notice introduced in v25.8.0 has been removed, along with the showSupportNotice option and all related internal suppression logic (globalThis.__i18next_supportNoticeShown, I18NEXT_NO_SUPPORT_NOTICE env var). See our blog post for the full story.

Remove simplifyPluralSuffix option — this option was unused by the core PluralResolver (which relies entirely on Intl.PluralRules). It only had an effect in the old v1/v2/v3 compatibility layer. The v4 test compatibility layer now defaults to true internally.

... (truncated)

Commits

3ea438f 26.0.8
5176bbd retry version bump
10b48c6 26.0.8
9fdd99a retry version bump
9ee7da1 changelog
8ce5e26 26.0.8
e802567 fix(types): restore ExistsFunction shape to keep arrow-function wrappers as...
ce06fba 26.0.7
ca33377 chore: drop unused @babel/runtime dep and redundant bundled ESM output
8abe4e6 fix: show resolved plural key in missingKey debug log
Additional commits viewable in compare view

Updates i18next-http-backend from 2.7.3 to 3.0.6

Changelog

Sourced from i18next-http-backend's changelog.

3.0.6

fix: allow forward slashes in ns values so nested namespace names (mapping to URL layouts such as /locales/en/a/b.json) fetch correctly again. 3.0.5's security fix applied the same strict URL-segment check to both lng and ns, which was correct for lng (no BCP-47 shape contains /) but over-strict for ns — nested namespaces containing / were never officially supported, but the behaviour fell out of the implicit string-substitution semantics of loadPath and is common enough in the wild to be worth accommodating. isSafeUrlSegment is now split into isSafeLangUrlSegment (strict — still rejects /) and isSafeNsUrlSegment (loose — allows / but still rejects .., \, URL-structure characters, control chars, prototype keys, and oversized inputs). isSafeUrlSegment is kept as a backwards-compatible alias for the strict check. The 3.0.5 security fix remains in force for every concrete attack pattern from the original advisory.

3.0.5

Security release — all issues found via an internal audit. See published advisory GHSA-q89c-q3h5-w34g.

security: refuse to build request URLs when lng or ns values contain path-traversal, URL-structure (?, #, %, @, whitespace), path separators, control characters, prototype keys, or exceed 128 chars. Prevents path traversal / SSRF / URL injection via attacker-controlled language-code values. isSafeUrlSegment is permissive for legitimate i18next language codes (any BCP-47-like shape, underscores, hyphens, dots, +-joined multi-language requests) (GHSA-q89c-q3h5-w34g)

security: per-instance omitFetchOptions — the fetch-options-stripping fallback is now scoped to a single backend instance via options._omitFetchOptions instead of a module-level boolean. One instance hitting a "not implemented" fetch error no longer permanently strips requestOptions (including credentials, mode, cache) from every other backend instance in the same process

security: strip CR/LF/NUL and other C0/C1 control characters from lng/ns / URL values before they appear in error-callback strings (CWE-117 log forging)

security: redact user:password credentials from URLs before including them in error-callback strings — prevents leaking basic-auth credentials embedded in loadPath / addPath

security: iterate own enumerable keys only (Object.keys + prototype-key guard) in addQueryString and in the customHeaders loop in XHR mode — prevents prototype-pollution amplification into the URL and request headers

chore: ignore .env* and *.pem/*.key files in .gitignore

3.0.4

use own interpolation function for loadPath and addPath instead of relying on i18next's interpolator i18next#2420 — this means only {{lng}} and {{ns}} placeholders are supported; custom interpolation prefix/suffix from i18next config no longer applies to backend paths

3.0.2

optimize fetchApi selector

3.0.1

try to get rid of top-level await

3.0.0

fix for Deno 2 and removal of unnecessary .cjs file

for esm build environments not supporting top-level await, you should import the i18next-http-backend/cjs export or stay at v2.6.2 or v2.7.1

Commits

ddf1048 3.0.6
d73cfdc fix: allow forward slashes in ns values
9abbdee Bump i18next-http-backend from 1.4.0 to 3.0.5 in /example/i18next-vue (#184)
b4ca8bb Bump i18next-http-backend from 3.0.1 to 3.0.5 in /example/fallback (#183)
dffddd4 Bump i18next-http-backend from 3.0.2 to 3.0.5 in /example/next (#182)
fd29b40 Bump i18next-http-backend from 1.3.2 to 3.0.5 in /example/vue (#181)
dc68dbe docs: link published GHSA advisory in v3.0.5 notes
5757fa3 3.0.5
4cee84f security: hardening for 3.0.5
4cbc487 Bump next from 16.2.1 to 16.2.3 in /example/next (

Bumps the npm-major group with 26 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@atlaskit/pragmatic-drag-and-drop-auto-scroll](https://github.com/atlassian/pragmatic-drag-and-drop) | `1.4.0` | `2.1.5` | | [domhandler](https://github.com/fb55/domhandler) | `5.0.3` | `6.0.1` | | [emojibase](https://github.com/milesj/emojibase/tree/HEAD/packages/core) | `15.3.1` | `17.0.0` | | [emojibase-data](https://github.com/milesj/emojibase/tree/HEAD/packages/data) | `15.3.2` | `17.0.0` | | [focus-trap-react](https://github.com/focus-trap/focus-trap-react) | `10.3.1` | `12.0.1` | | [html-dom-parser](https://github.com/remarkablemark/html-dom-parser) | `5.1.8` | `7.0.1` | | [html-react-parser](https://github.com/remarkablemark/html-react-parser) | `4.2.10` | `6.0.1` | | [i18next](https://github.com/i18next/i18next) | `25.8.17` | `26.0.8` | | [i18next-http-backend](https://github.com/i18next/i18next-http-backend) | `2.7.3` | `3.0.6` | | [immer](https://github.com/immerjs/immer) | `9.0.21` | `11.1.4` | | [matrix-js-sdk](https://github.com/matrix-org/matrix-js-sdk) | `38.4.0` | `41.3.0` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `18.3.1` | `19.2.5` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `18.3.28` | `19.2.14` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `18.3.1` | `19.2.5` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `18.3.7` | `19.2.3` | | [react-google-recaptcha](https://github.com/dozoisch/react-google-recaptcha) | `2.1.0` | `3.1.0` | | [react-i18next](https://github.com/i18next/react-i18next) | `16.5.7` | `17.0.6` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `6.30.3` | `7.14.2` | | [ua-parser-js](https://github.com/faisalman/ua-parser-js) | `1.0.41` | `2.0.9` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.10.13` | `25.6.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `5.1.4` | `6.0.1` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `5.85.0` | `6.7.0` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.3` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.1` | `8.0.10` | | [vite-plugin-static-copy](https://github.com/sapphi-red/vite-plugin-static-copy) | `3.2.0` | `4.1.0` | | [vite-plugin-svgr](https://github.com/pd4d10/vite-plugin-svgr) | `4.5.0` | `5.2.0` | Updates `@atlaskit/pragmatic-drag-and-drop-auto-scroll` from 1.4.0 to 2.1.5 - [Commits](https://github.com/atlassian/pragmatic-drag-and-drop/commits) Updates `domhandler` from 5.0.3 to 6.0.1 - [Release notes](https://github.com/fb55/domhandler/releases) - [Commits](fb55/domhandler@v5.0.3...v6.0.1) Updates `emojibase` from 15.3.1 to 17.0.0 - [Release notes](https://github.com/milesj/emojibase/releases) - [Changelog](https://github.com/milesj/emojibase/blob/master/packages/core/CHANGELOG.md) - [Commits](https://github.com/milesj/emojibase/commits/[email protected]/packages/core) Updates `emojibase-data` from 15.3.2 to 17.0.0 - [Release notes](https://github.com/milesj/emojibase/releases) - [Changelog](https://github.com/milesj/emojibase/blob/master/packages/data/CHANGELOG.md) - [Commits](https://github.com/milesj/emojibase/commits/[email protected]/packages/data) Updates `focus-trap-react` from 10.3.1 to 12.0.1 - [Release notes](https://github.com/focus-trap/focus-trap-react/releases) - [Changelog](https://github.com/focus-trap/focus-trap-react/blob/master/CHANGELOG.md) - [Commits](focus-trap/focus-trap-react@v10.3.1...v12.0.1) Updates `html-dom-parser` from 5.1.8 to 7.0.1 - [Release notes](https://github.com/remarkablemark/html-dom-parser/releases) - [Changelog](https://github.com/remarkablemark/html-dom-parser/blob/master/CHANGELOG.md) - [Commits](remarkablemark/html-dom-parser@v5.1.8...v7.0.1) Updates `html-react-parser` from 4.2.10 to 6.0.1 - [Release notes](https://github.com/remarkablemark/html-react-parser/releases) - [Changelog](https://github.com/remarkablemark/html-react-parser/blob/master/CHANGELOG.md) - [Commits](remarkablemark/html-react-parser@v4.2.10...v6.0.1) Updates `i18next` from 25.8.17 to 26.0.8 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](i18next/i18next@v25.8.17...v26.0.8) Updates `i18next-http-backend` from 2.7.3 to 3.0.6 - [Changelog](https://github.com/i18next/i18next-http-backend/blob/master/CHANGELOG.md) - [Commits](i18next/i18next-http-backend@v2.7.3...v3.0.6) Updates `immer` from 9.0.21 to 11.1.4 - [Release notes](https://github.com/immerjs/immer/releases) - [Commits](immerjs/immer@v9.0.21...v11.1.4) Updates `matrix-js-sdk` from 38.4.0 to 41.3.0 - [Release notes](https://github.com/matrix-org/matrix-js-sdk/releases) - [Changelog](https://github.com/matrix-org/matrix-js-sdk/blob/develop/CHANGELOG.md) - [Commits](matrix-org/matrix-js-sdk@v38.4.0...v41.3.0) Updates `react` from 18.3.1 to 19.2.5 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react) Updates `@types/react` from 18.3.28 to 19.2.14 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 18.3.1 to 19.2.5 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react-dom) Updates `@types/react-dom` from 18.3.7 to 19.2.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `react-google-recaptcha` from 2.1.0 to 3.1.0 - [Changelog](https://github.com/dozoisch/react-google-recaptcha/blob/master/CHANGELOG.md) - [Commits](https://github.com/dozoisch/react-google-recaptcha/commits) Updates `react-i18next` from 16.5.7 to 17.0.6 - [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md) - [Commits](i18next/react-i18next@v16.5.7...v17.0.6) Updates `react-router-dom` from 6.30.3 to 7.14.2 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/[email protected]/packages/react-router-dom) Updates `ua-parser-js` from 1.0.41 to 2.0.9 - [Release notes](https://github.com/faisalman/ua-parser-js/releases) - [Changelog](https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md) - [Commits](faisalman/ua-parser-js@1.0.41...2.0.9) Updates `@types/node` from 24.10.13 to 25.6.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 18.3.28 to 19.2.14 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 18.3.7 to 19.2.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@vitejs/plugin-react` from 5.1.4 to 6.0.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/[email protected]/packages/plugin-react) Updates `knip` from 5.85.0 to 6.7.0 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/[email protected]/packages/knip) Updates `typescript` from 5.9.3 to 6.0.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v6.0.3) Updates `vite` from 7.3.1 to 8.0.10 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.10/packages/vite) Updates `vite-plugin-static-copy` from 3.2.0 to 4.1.0 - [Release notes](https://github.com/sapphi-red/vite-plugin-static-copy/releases) - [Changelog](https://github.com/sapphi-red/vite-plugin-static-copy/blob/main/CHANGELOG.md) - [Commits](https://github.com/sapphi-red/vite-plugin-static-copy/compare/[email protected]@4.1.0) Updates `vite-plugin-svgr` from 4.5.0 to 5.2.0 - [Release notes](https://github.com/pd4d10/vite-plugin-svgr/releases) - [Commits](pd4d10/vite-plugin-svgr@v4.5.0...v5.2.0) --- updated-dependencies: - dependency-name: "@atlaskit/pragmatic-drag-and-drop-auto-scroll" dependency-version: 2.1.5 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: "@types/node" dependency-version: 25.6.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-major - dependency-name: "@types/react" dependency-version: 19.2.14 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-major - dependency-name: "@types/react" dependency-version: 19.2.14 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-major - dependency-name: "@types/react-dom" dependency-version: 19.2.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-major - dependency-name: "@types/react-dom" dependency-version: 19.2.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-major - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-major - dependency-name: domhandler dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: emojibase dependency-version: 17.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: emojibase-data dependency-version: 17.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: focus-trap-react dependency-version: 12.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: html-dom-parser dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: html-react-parser dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: i18next dependency-version: 26.0.5 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: i18next-http-backend dependency-version: 3.0.4 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: immer dependency-version: 11.1.4 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: knip dependency-version: 6.4.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-major - dependency-name: matrix-js-sdk dependency-version: 41.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: react dependency-version: 19.2.5 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: react-dom dependency-version: 19.2.5 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: react-google-recaptcha dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: react-i18next dependency-version: 17.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: react-router-dom dependency-version: 7.14.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: typescript dependency-version: 6.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-major - dependency-name: ua-parser-js dependency-version: 2.0.9 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-major - dependency-name: vite dependency-version: 8.0.8 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-major - dependency-name: vite-plugin-static-copy dependency-version: 4.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-major - dependency-name: vite-plugin-svgr dependency-version: 5.2.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-major ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot Bot added the internal label Apr 23, 2026

dependabot Bot requested review from 7w1 and hazre as code owners April 23, 2026 04:10

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-major-45471c72fc branch 3 times, most recently from 18a9986 to 6b816b5 Compare April 30, 2026 01:37

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-major-45471c72fc branch 2 times, most recently from 84ab88a to 5b7c460 Compare May 4, 2026 21:52

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-major-45471c72fc branch from 5b7c460 to f62da71 Compare May 5, 2026 03:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump the npm-major group across 1 directory with 26 updates#714

chore: bump the npm-major group across 1 directory with 26 updates#714
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/npm_and_yarn/npm-major-45471c72fc

dependabot Bot commented on behalf of github Apr 23, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.0.1

What's Changed

v6.0.0

What's Changed

Major Changes

Patch Changes

Major Changes

Major Changes

Patch Changes

Major Changes

Patch Changes

Patch Changes

Patch Changes

Major Changes

17.0.0

Major Changes

16.0.0

Major Changes

Major Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Major Changes

Patch Changes

17.0.0

Major Changes

Patch Changes

16.0.3

Patch Changes

16.0.2

Patch Changes

16.0.1

Patch Changes

16.0.0

Major Changes

Patch Changes

v12.0.1

Patch Changes

v12.0.0

Major Changes

v11.0.6

Patch Changes

v11.0.5

Patch Changes

v11.0.4

Patch Changes

v11.0.3

Patch Changes

v11.0.2

Patch Changes

v11.0.1

Patch Changes

v11.0.0

Major Changes

12.0.1

Patch Changes

12.0.0

Major Changes

11.0.6

Patch Changes

11.0.5

Patch Changes

11.0.4

Patch Changes

11.0.3

Patch Changes

11.0.2

Patch Changes

11.0.1

Patch Changes

11.0.0

v7.0.1

7.0.1 (2026-04-07)

Bug Fixes

v7.0.0

7.0.0 (2026-03-30)

dependabot Bot commented on behalf of github Apr 23, 2026 •

edited

Loading