[dependabot]

Bumps the production-dependencies group with 13 updates in the /apps/ui directory:

Package	From	To
@casl/ability	7.0.1	7.0.2
@hookform/resolvers	5.9.1	6.0.0
@sentry/react	11.2.0	11.8.0
@tanstack/react-query	5.104.0	5.104.4
@tanstack/react-query-devtools	5.104.0	5.104.4
i18next	26.4.2	26.5.2
lucide-react	1.49.0	1.59.0
radix-ui	1.6.7	1.8.1
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
react-hook-form	7.89.0	7.90.0
react-i18next	17.0.15	17.1.0
zod	4.6.5	4.6.7

Updates @casl/ability from 7.0.1 to 7.0.2

Release notes

Sourced from @​casl/ability's releases.

@​casl/ability: v7.0.2

7.0.2 (2026-10-15)

Bug Fixes

• prevent rulesToFields to set properties on prototype and non-objects (#1305) (58242cb)

Changelog

Sourced from @​casl/ability's changelog.

7.0.2 (2026-10-15)

Bug Fixes

• prevent rulesToFields to set properties on prototype and non-objects (#1305) (58242cb)

Commits

• a9bd440 chore: release main (#1306)
• 58242cb fix: prevent rulesToFields to set properties on prototype and non-objects (#1...
• 873cd1f chore: migrates from master to main default branch
• ae625f1 chore: upgrades to ts 6 (#1252)
• 9840dc1 chore(deps): update dependency chai to v6 (#863)
• See full diff in compare view

Updates @hookform/resolvers from 5.9.1 to 6.0.0

Release notes

Sourced from @​hookform/resolvers's releases.

v6.0.0

6.0.0 (2026-10-19)

Features

• effect-ts: support Effect v4 (#880) (a5ab308), closes #878

BREAKING CHANGES

• effect-ts: the effect-ts resolver now requires effect@^4.0.0; Effect v3 is no longer supported. Schemas must be migrated to the Effect v4 Schema API (e.g. Schema.nonEmptyString() -> .check(Schema.isNonEmpty()), Schema.Union(a, b) -> Schema.Union([a, b]), Schema.transform -> Schema.decodeTo). Error type values follow Effect v4 issue tags: Type -> InvalidType, Missing -> MissingKey, Refinement -> Filter, Unexpected -> UnexpectedKey, plus new AnyOf and InvalidValue. Default error messages now come from Effect v4 (e.g. is missing -> Missing key, and the received value is no longer included).

• chore(deps): sync bun.lock with ata-validator ^1.23.0

v5.9.2

5.9.2 (2026-10-17)

Bug Fixes

• ajv: preserve escaped field names in validation errors (#879) (71e6052)

Commits

• a5ab308 feat(effect-ts): support Effect v4 (#880)
• 71e6052 fix(ajv): preserve escaped field names in validation errors (#879)
• 8d088d4 chore(deps): bump ata-validator to ^1.23.0 (#877)
• See full diff in compare view

Updates @sentry/react from 11.2.0 to 11.8.0

Release notes

Sourced from @​sentry/react's releases.

11.8.0

Important Changes

• feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

  The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

  • Node.js 20.19.0 or higher is required.
  • @sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.
  • The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
  • Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

• feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

  OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

• feat(core): Support SuppressedError in LinkedErrors integration (#25246)
• fix(astro): Delete generated source maps for static output (#25310)
• fix(astro): Upload source maps of Astro 7's prerender build (#25309)
• fix(browser): Apply urlQueryParams to the Referer header (#25324)
• fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
• fix(hono): Expose runtime-specific SDK options (#25290)
• fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)
• fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)
• fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)
• fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)
• fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
• fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)
• fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)

• chore: Add external contributor to CHANGELOG.md (#25375)
• ci: Install the pnpm version that Volta pins (#25287)
• license: Add cli FSL notice to package licenses (#25314)
• ref(core): use shared MCP attribute conventions (#25059)
• ref(tanstackstart-react): Reuse shared component annotation options (#25313)
• test(browser): Keep whitespace text out of the handlers-lcp page (#25280)
• test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)
• test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
• test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)
• test(e2e): Add node-openai-send-to-sentry test app (#24824)
• test(e2e): Add nuxt-5-sourcemaps test (#25268)
• test(e2e): Inherit root Volta config in all e2e test apps (#25369)
• test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)
• test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)
• test(nextjs): Switch DEBUG_BUILD with a getter instead of re-importing the SDK (#25279)

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

11.8.0

Important Changes

• feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

  The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

  • Node.js 20.19.0 or higher is required.
  • @sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.
  • The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
  • Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

• feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

  OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

• feat(core): Support SuppressedError in LinkedErrors integration (#25246)
• fix(astro): Delete generated source maps for static output (#25310)
• fix(astro): Upload source maps of Astro 7's prerender build (#25309)
• fix(browser): Apply urlQueryParams to the Referer header (#25324)
• fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
• fix(hono): Expose runtime-specific SDK options (#25290)
• fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)
• fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)
• fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)
• fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)
• fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
• fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)
• fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)

• chore: Add external contributor to CHANGELOG.md (#25375)
• ci: Install the pnpm version that Volta pins (#25287)
• license: Add cli FSL notice to package licenses (#25314)
• ref(core): use shared MCP attribute conventions (#25059)
• ref(tanstackstart-react): Reuse shared component annotation options (#25313)
• test(browser): Keep whitespace text out of the handlers-lcp page (#25280)
• test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)
• test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
• test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)
• test(e2e): Add node-openai-send-to-sentry test app (#24824)
• test(e2e): Add nuxt-5-sourcemaps test (#25268)
• test(e2e): Inherit root Volta config in all e2e test apps (#25369)
• test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)
• test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)

... (truncated)

Commits

• c6492ef release: 11.8.0
• e091f7f meta(changelog): Update changelog for 11.8.0 (#25388)
• 30ec754 meta(changelog): Update changelog for 11.8.0
• a309cf8 test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
• 71f1ef9 test(e2e): Inherit root Volta config in all e2e test apps (#25369)
• e54e577 chore: Add external contributor to CHANGELOG.md (#25375)
• 0ed4606 fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
• 9516aeb fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
• 7471347 feat(core): Support SuppressedError in LinkedErrors integration (#25246)
• f4ae6c5 fix(browser): Apply urlQueryParams to the Referer header (#25324)
• Additional commits viewable in compare view

Updates @tanstack/react-query from 5.104.0 to 5.104.4

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.4

Patch Changes

• #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

  • @​tanstack/query-devtools@​5.104.4
  • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-next-experimental@​5.104.4

Patch Changes

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
• Updated dependencies [c208861, a108398]:
  • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-persist-client@​5.104.4

Patch Changes

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
• Updated dependencies [c208861, a108398]:
  • @​tanstack/react-query@​5.104.4
  • @​tanstack/query-persist-client-core@​5.104.4

@​tanstack/react-query@​5.104.4

Patch Changes

• #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [1fee044, fce89dd]:

  • @​tanstack/query-core@​5.104.4

@​tanstack/react-query-devtools@​5.104.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.3
  • @​tanstack/query-devtools@​5.104.3

@​tanstack/react-query-next-experimental@​5.104.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.3

@​tanstack/react-query-persist-client@​5.104.3

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.4

Patch Changes

• #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [1fee044, fce89dd]:

  • @​tanstack/query-core@​5.104.4

5.104.3

Patch Changes

• Updated dependencies [0f15bc9]:
  • @​tanstack/query-core@​5.104.3

5.104.2

Patch Changes

• Updated dependencies [03e8c39]:
  • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.104.1

Commits

• 1219972 ci: Version Packages (#12062)
• 1fee044 fix(query-core): clear mutations before notifying subscribers (#11470)
• c208861 fix(react-query): retry queries with falsy errors on mount (#11328)
• a108398 fix(react-query*): declare '@​types/react' as an optional peer dependency (#11...
• ee47993 ci: Version Packages (#11998)
• 0f15bc9 fix(query-core): preserve union narrowing in setQueryData updaters (#11935)
• b699b52 ci: Version Packages (#11849)
• e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
• df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
• 833062c chore: replace prettier with oxfmt (#11939)
• Additional commits viewable in compare view

Updates @tanstack/react-query-devtools from 5.104.0 to 5.104.4

Release notes

Sourced from @​tanstack/react-query-devtools's releases.

@​tanstack/react-query-devtools@​5.104.4

Patch Changes

• #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

  • @​tanstack/query-devtools@​5.104.4
  • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-devtools@​5.104.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.3
  • @​tanstack/query-devtools@​5.104.3

Changelog

Sourced from @​tanstack/react-query-devtools's changelog.

5.104.4

Patch Changes

• #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

  • @​tanstack/query-devtools@​5.104.4
  • @​tanstack/react-query@​5.104.4

5.104.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.3
  • @​tanstack/query-devtools@​5.104.3

5.104.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.104.2
  • @​tanstack/react-query@​5.104.2

5.104.1

Patch Changes

• Updated dependencies [ec060b6]:
  • @​tanstack/query-devtools@​5.104.1
  • @​tanstack/react-query@​5.104.1

Commits

• 1219972 ci: Version Packages (#12062)
• a108398 fix(react-query*): declare '@​types/react' as an optional peer dependency (#11...
• 0992a92 fix(react-query-devtools): create the devtools instance lazily with 'useState...
• ee47993 ci: Version Packages (#11998)
• b699b52 ci: Version Packages (#11849)
• e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
• df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
• d0cfa6a chore: replace eslint with oxlint (#11938)
• 688f6e0 docs(*): describe 'shadowDOMTarget' as the shadow DOM the devtools styles are...
• b42166e docs(react-query): add JSDoc to the exported interfaces and type aliases (#11...
• Additional commits viewable in compare view

Updates i18next from 26.4.2 to 26.5.2

Release notes

Sourced from i18next's releases.

v26.5.2

• fix(types): on TypeScript 7, a t() call with a missing, misspelled or wrongly typed option now reports that option again (Property 'album' is missing, Type 'string' is not assignable to type 'number'), as TypeScript 5 and 6 do. TypeScript 7 elaborated the error against the default-value signature instead and ended in '{ count: 3; albm: "Summer"; }' is not assignable to type 'string': on a failed call TypeScript explains the last of the equally matching signatures, and TypeScript 7 sorts the 3-element [key, defaultValue, options?] last. It is now written as two signatures, [key, defaultValue] and [key, defaultValue, options]. This affects the default key checks with i18next {{name}} messages as well as parseInterpolation: 'icu' and 'mf2'. Which calls compile, their return types and the error positions are unchanged on TypeScript 5.9, 6 and 7.

v26.5.1

• perf(types): type-checking t() calls against a large namespace is no longer quadratic in the number of keys. TypeScript does not cache keyof of an object type, and the types rebuilt the union of all keys of a namespace once per key while building the key union, and again in every t() call to look up the return type. Both now use a cached key union, and a literal key is looked up directly instead of being intersected with every key. With 5,000 keys in one namespace and one call per key, the check time went from 14.8s to 1.1s (TypeScript 6); with 1,000 keys from 0.75s to 0.27s. Keys, return types and errors are unchanged.
• perf(types): the selector API (enableSelector: true / 'strict') with context is no longer quadratic in the size of an object. To decide which keys a context keeps, the types scanned all keys of the object once for every key, also when TypeScript checks the selector with context widened to string. With 1,000 keys plus one context variant each, a namespace took 18.7s and failed with "Type instantiation is excessively deep and possibly infinite" (TS2589); 2,500 and more ran out of memory. The context variants of an object are now collected once, in one pass over its keys: 1,000 keys check in 0.69s, 5,000 in 3.1s. Long keys (whole sentences with keySeparator: false) work as before. Selected values and errors are unchanged.

v26.5.0

• feat(types): parseInterpolation: 'icu' and parseInterpolation: 'mf2' type t() options from the message's ICU MessageFormat arguments (i18next-icu) or MessageFormat 2 variables (i18next-mf2), so ICU and MF2 users no longer need parseInterpolation: false and lose argument checking. Missing, misspelled and wrongly typed arguments fail, and so does leaving out the options for a message with arguments (t('greeting')); that error names the missing arguments. Opt-in, default true is unchanged.
  • ICU: {name} takes string | number, {n, number}, plural and selectordinal take number, {d, date} and {t, time} take Date, select takes its case keys or any string (for other), and arguments nested in cases are required too. # and tags are not arguments, apostrophe quoting is read like intl-messageformat does.
  • MF2: {$name} takes string | number, a variable annotated with :number, :integer, :currency, :percent or :unit (inline or through .input / .local) takes number, :datetime, :date and :time take Date, :string takes string, option and markup variables (minimumFractionDigits=$digits, {#link href=$url}) are required too, .local variables are not arguments, and |quoted literals| and \{ escapes are skipped.
  • interpolationFormatTypeMap overrides a type by ICU format or MF2 function name, e.g. date: Date | number or a custom uppercase: string.
  • Applies to t(), getFixedT(), i18n.t, key prefixes, namespaces, the selector API and react-i18next's Trans values. Messages need literal types, as the resources file from i18next-cli's types command has them.
  • Type-check cost with 1,000 messages and one call each: 1.35s instead of 0.86s with false (TypeScript 6), 0.5s instead of 0.26s with TypeScript 7. Messages that no call uses cost nothing.
• fix(types): with the default (non-strict) key checks, an options object with a missing or misspelled interpolation variable now reports the missing variable (Property 'name' is missing) instead of '{ nmae: string }' is not assignable to type 'string' from the default-value overload.

v26.4.7

• perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

v26.4.6

• fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).

v26.4.5

• fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

v26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
• fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

• perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

Changelog

Sourced from i18next's changelog.

26.5.2

• fix(types): on TypeScript 7, a t() call with a missing, misspelled or wrongly typed option now reports that option again (Property 'album' is missing, Type 'string' is not assignable to type 'number'), as TypeScript 5 and 6 do. TypeScript 7 elaborated the error against the default-value signature instead and ended in '{ count: 3; albm: "Summer"; }' is not assignable to type 'string': on a failed call TypeScript explains the last of the equally matching signatures, and TypeScript 7 sorts the 3-element [key, defaultValue, options?] last. It is now written as two signatures, [key, defaultValue] and [key, defaultValue, options]. This affects the default key checks with i18next {{name}} messages as well as parseInterpolation: 'icu' and 'mf2'. Which calls compile, their return types and the error positions are unchanged on TypeScript 5.9, 6 and 7.

26.5.1

• perf(types): type-checking t() calls against a large namespace is no longer quadratic in the number of keys. TypeScript does not cache keyof of an object type, and the types rebuilt the union of all keys of a namespace once per key while building the key union, and again in every t() call to look up the return type. Both now use a cached key union, and a literal key is looked up directly instead of being intersected with every key. With 5,000 keys in one namespace and one call per key, the check time went from 14.8s to 1.1s (TypeScript 6); with 1,000 keys from 0.75s to 0.27s. Keys, return types and errors are unchanged.
• perf(types): the selector API (enableSelector: true / 'strict') with context is no longer quadratic in the size of an object. To decide which keys a context keeps, the types scanned all keys of the object once for every key, also when TypeScript checks the selector with context widened to string. With 1,000 keys plus one context variant each, a namespace took 18.7s and failed with "Type instantiation is excessively deep and possibly infinite" (TS2589); 2,500 and more ran out of memory. The context variants of an object are now collected once, in one pass over its keys: 1,000 keys check in 0.69s, 5,000 in 3.1s. Long keys (whole sentences with keySeparator: false) work as before. Selected values and errors are unchanged.

26.5.0

• feat(types): parseInterpolation: 'icu' and parseInterpolation: 'mf2' type t() options from the message's ICU MessageFormat arguments (i18next-icu) or MessageFormat 2 variables (i18next-mf2), so ICU and MF2 users no longer need parseInterpolation: false and lose argument checking. Missing, misspelled and wrongly typed arguments fail, and so does leaving out the options for a message with arguments (t('greeting')); that error names the missing arguments. Opt-in, default true is unchanged.
  • ICU: {name} takes string | number, {n, number}, plural and selectordinal take number, {d, date} and {t, time} take Date, select takes its case keys or any string (for other), and arguments nested in cases are required too. # and tags are not arguments, apostrophe quoting is read like intl-messageformat does.
  • MF2: {$name} takes string | number, a variable annotated with :number, :integer, :currency, :percent or :unit (inline or through .input / .local) takes number, :datetime, :date and :time take Date, :string takes string, option and markup variables (minimumFractionDigits=$digits, {#link href=$url}) are required too, .local variables are not arguments, and |quoted literals| and \{ escapes are skipped.
  • interpolationFormatTypeMap overrides a type by ICU format or MF2 function name, e.g. date: Date | number or a custom uppercase: string.
  • Applies to t(), getFixedT(), i18n.t, key prefixes, namespaces, the selector API and react-i18next's Trans values. Messages need literal types, as the resources file from i18next-cli's types command has them.
  • Type-check cost with 1,000 messages and one call each: 1.35s instead of 0.86s with false (TypeScript 6), 0.5s instead of 0.26s with TypeScript 7. Messages that no call uses cost nothing.
• fix(types): with the default (non-strict) key checks, an options object with a missing or misspelled interpolation variable now reports the missing variable (Property 'name' is missing) instead of '{ nmae: string }' is not assignable to type 'string' from the default-value overload.

26.4.7

• perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

26.4.6

• fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).

26.4.5

• fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the co...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.