chore(deps): update i18next to 26.2.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
i18next (source)	25.7.4 → 26.2.0

---

Release Notes

i18next/i18next (i18next)

v26.2.0

Compare Source

• feat(types): new parseInterpolation TypeOption (default true). When set to false in CustomTypeOptions, the type-level extractor stops parsing translation strings for {{variable}} patterns. Required by i18next-icu users — the default extractor mistakes ICU MessageFormat nested-brace plurals like {count, plural, one {{count} row} other {{count} rows}} for an interpolation block and demands a phantom variable name. The flag is type-only; runtime interpolation is governed by InterpolationOptions and is unaffected. Fixes i18next-icu#85.
• fix(types): expose enableSelector on InitOptions so i18next.init({ enableSelector: 'strict' }) typechecks without a module augmentation. The runtime already reads opts?.enableSelector from init options; this lands the matching type declaration next to the other selector-resolution knobs. Accepts false | true | 'optimize' | 'strict'. Thanks @​Faithfinder (#​2431)

v26.1.0

Compare Source

• feat: enableSelector: 'strict' (TypeOptions + runtime option). Opt-in mode that drops the flattened-primary form from NsResource at the type level — every namespace (primary included) is exposed only under its own key on $, uniformly across single- and multi-ns hooks. At runtime, a leading selector path segment matching the scope's namespace list is always rewritten as a namespace prefix, including the primary. Eliminates the silent-miss surface area where t($ => $.primary.foo) typechecks but doesn't resolve under the default mode (see #​2429). Backward-compatible: default enableSelector: false | true | 'optimize' behavior is unchanged. Note: strict mode is incompatible with the #​2405 pattern (keys whose names match sibling namespaces) — those users should stay on default mode.

v26.0.10

Compare Source

• feat: getFixedT accepts a fourth optional fixedOpts argument carrying scopeNs — the full namespace list the bound t was created for. The selector API uses scopeNs to detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the bound ns (a single primary string in the typical react-i18next setup), so plain t('key') lookups stay isolated to the primary namespace exactly as before — only t($ => $.secondaryNs.foo) selectors now route correctly under useTranslation([nsA, nsB]). Fixes the runtime side of #​2429 for the react-i18next default-nsMode case. The 4th argument is opt-in: existing 3-arg getFixedT(lng, ns, keyPrefix) callers see no behavior change.

v26.0.9

Compare Source

• fix(types): unformatted interpolation values are now typed as string | number (was string). i18next stringifies values at runtime, so requiring callers to wrap numbers in String(...) for plain {{var}} placeholders was unnecessary friction — and could mask the real problem when a non-string value was passed alongside multiple interpolation slots (the t() overload resolution would fall through to the 3-arg form and report a confusing "not assignable to string" error against the options object). Typed format specifiers like {{x, number}}, {{x, currency}}, {{x, datetime}}, etc. keep their precise types; this only relaxes the no-format default. The count variable remains number-only

v26.0.8

Compare Source

• fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

v26.0.7

Compare Source

• fix: when a plural lookup misses, the missingKey debug log now shows the actual plural-resolved key (e.g. foo.bar_many for Polish count: 14) instead of the base key — making it obvious which plural category was expected and missing 2423
• chore: drop @babel/runtime runtime dependency. The build no longer generates any @babel/runtime imports, so the package is unused by consumers. Rollup now uses babelHelpers: 'bundled' so any helpers that are ever needed in the future will be inlined rather than imported externally 2424
• chore: stop emitting dist/esm/i18next.bundled.js. It was byte-identical to dist/esm/i18next.js because no helpers were being imported 2424

v26.0.6

Compare Source

Security release — all issues found via an internal audit.

• security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security note in the Nesting docs for the full pattern and mitigations
• security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .
• security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)
• chore: ignore .env* and *.pem/*.key files in .gitignore

v26.0.5

Compare Source

• fix: cloneInstance().changeLanguage() no longer fails to update language state when the target language is not yet loaded — a race between init()'s deferred load() and the user's changeLanguage() could overwrite isLanguageChangingTo, causing setLngProps to be skipped 2422

v26.0.4

Compare Source

v26.0.3

Compare Source

v26.0.2

Compare Source

v26.0.1

Compare Source

v26.0.0

Compare Source

v25.10.10

Compare Source

v25.10.9

Compare Source

v25.10.8

Compare Source

v25.10.7

Compare Source

v25.10.6

Compare Source

v25.10.5

Compare Source

• feat(types): selector functions as keyPrefix in getFixedT now provide full type-safe key narrowing — the returned t function is scoped to the prefix subtree 2367

v25.10.4

Compare Source

• feat(types): exists() is now a type guard that narrows the key to SelectorKey, so a validated key can be passed directly to t() 2364

v25.10.3

Compare Source

• check also for I18NEXT_NO_SUPPORT_NOTICE env variable

v25.10.2

Compare Source

• feat(types): keyFromSelector is now type-safe — the selector callback is constrained against your resource definitions, catching invalid keys at compile time. Supports optional ns and keyPrefix options for non-default namespace/prefix contexts 2364

v25.10.1

Compare Source

• fix(types): FilterKeys now correctly excludes base keys that have context variants when the provided context doesn't match any of them (e.g. key some with variant some_me is no longer accessible with context="one")

v25.10.0

Compare Source

• feat(types): keyFromSelector now returns a branded SelectorKey type that t() accepts directly, enabling pre-computed and reusable translation keys 2364
• feat: support selector syntax for keyPrefix in getFixedT and per-call options 2367
• feat(types): interpolation values are now automatically typed based on built-in format specifiers — {{val, number}} requires number, {{val, datetime}} requires Date, {{name}} requires string, etc. Custom formatters can be typed via interpolationFormatTypeMap in CustomTypeOptions 2378
• fix(types): FilterKeys in selector mode now preserves non-context, non-plural leaf keys when context is provided, fixing incorrect type narrowing when combining returnObjects: true with context 2398

v25.9.0

Compare Source

• feat(types): selector API now enforces { count: number } when a key resolves to plural forms 2373
• fix(types): string unions with invalid members are now correctly detected as type errors when used as context option 2172

v25.8.20

Compare Source

• • fix: getFixedT() selector now resolves namespaces against the effective ns rather than the global init options #​2406

v25.8.19

Compare Source

• fix: selector API namespace resolution regression for single-string ns and primary namespace in array #​2405. Reverts the broad namespace-prefix rewrite from v25.8.15 and replaces it with a targeted fix that only rewrites paths starting with a secondary namespace in a multi-namespace array, matching the type-level contract of GetSource

v25.8.18

Compare Source

• improve selector api to accept array of selector functions, analogous to array of keys 2404

v25.8.17

Compare Source

• update deps

v25.8.16

Compare Source

• fix(types): on() method now correctly returns this instead of void, matching the runtime behavior and enabling proper method chaining in TypeScript

v25.8.15

Compare Source

• fix: Selector API unable to resolve namespaces #​2402

v25.8.14

Compare Source

• fix: getCleanedCode now replaces all underscores

v25.8.13

Compare Source

• improve support notice shown logic

v25.8.12

Compare Source

• improve support notice shown logic

v25.8.11

Compare Source

• revert fix: compatibility with moduleResolution bundler (issue 2380) 2381

v25.8.10

Compare Source

• fix(interpolator): guard null matchedDoubleQuotes in nesting option parsing 2395

v25.8.9

Compare Source

• fix(interpolator): escape nestingOptionsSeparator in nesting option parsing 2394

v25.8.8

Compare Source

• types(i18n): add missing toJSON() declaration 2393

v25.8.7

Compare Source

• avoid crash due to ReferenceError without Intl API 2391

v25.8.6

Compare Source

• ts: address incomplete type definition for getFixedT() return value 2318

v25.8.5

Compare Source

• fix: compatibility with moduleResolution bundler (issue 2380) 2381

v25.8.4

Compare Source

• fix: crashes when backend in backends array has no name property 2386

v25.8.3

Compare Source

• ts: document option to suppress the support message 2385

v25.8.2

Compare Source

• option to suppress the support message 2385

v25.8.1

Compare Source

• fix(types): Selector API - fix Namespace inference for selector ns option 2384

v25.8.0

Compare Source

• fix: TFunctionReturn fallback 2360

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.