[dependabot]

Bumps the production-dependencies group with 15 updates in the /apps/ui directory:

Package	From	To
@casl/ability	7.0.1	7.0.2
@hookform/resolvers	5.9.1	6.0.0
@sentry/react	11.2.0	11.9.0
@tanstack/react-query	5.104.0	5.104.5
@tanstack/react-query-devtools	5.104.0	5.104.5
i18next	26.4.2	26.5.11
i18next-browser-languagedetector	8.2.1	8.2.3
lucide-react	1.49.0	1.61.0
radix-ui	1.6.7	1.8.1
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
react-hook-form	7.89.0	7.91.0
react-i18next	17.0.15	17.1.9
zod	4.6.5	4.6.7
zustand	5.0.15	5.0.16

Updates @casl/ability from 7.0.1 to 7.0.2

Release notes

Sourced from @​casl/ability's releases.

@​casl/ability: v7.0.2

7.0.2 (2026-10-15)

Bug Fixes

• prevent rulesToFields to set properties on prototype and non-objects (#1305) (58242cb)

Changelog

Sourced from @​casl/ability's changelog.

7.0.2 (2026-10-15)

Bug Fixes

• prevent rulesToFields to set properties on prototype and non-objects (#1305) (58242cb)

Commits

• a9bd440 chore: release main (#1306)
• 58242cb fix: prevent rulesToFields to set properties on prototype and non-objects (#1...
• 873cd1f chore: migrates from master to main default branch
• ae625f1 chore: upgrades to ts 6 (#1252)
• 9840dc1 chore(deps): update dependency chai to v6 (#863)
• See full diff in compare view

Updates @hookform/resolvers from 5.9.1 to 6.0.0

Release notes

Sourced from @​hookform/resolvers's releases.

v6.0.0

6.0.0 (2026-10-19)

Features

• effect-ts: support Effect v4 (#880) (a5ab308), closes #878

BREAKING CHANGES

• effect-ts: the effect-ts resolver now requires effect@^4.0.0; Effect v3 is no longer supported. Schemas must be migrated to the Effect v4 Schema API (e.g. Schema.nonEmptyString() -> .check(Schema.isNonEmpty()), Schema.Union(a, b) -> Schema.Union([a, b]), Schema.transform -> Schema.decodeTo). Error type values follow Effect v4 issue tags: Type -> InvalidType, Missing -> MissingKey, Refinement -> Filter, Unexpected -> UnexpectedKey, plus new AnyOf and InvalidValue. Default error messages now come from Effect v4 (e.g. is missing -> Missing key, and the received value is no longer included).

• chore(deps): sync bun.lock with ata-validator ^1.23.0

v5.9.2

5.9.2 (2026-10-17)

Bug Fixes

• ajv: preserve escaped field names in validation errors (#879) (71e6052)

Commits

• a5ab308 feat(effect-ts): support Effect v4 (#880)
• 71e6052 fix(ajv): preserve escaped field names in validation errors (#879)
• 8d088d4 chore(deps): bump ata-validator to ^1.23.0 (#877)
• See full diff in compare view

Updates @sentry/react from 11.2.0 to 11.9.0

Release notes

Sourced from @​sentry/react's releases.

11.9.0

Important Changes

• feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)

  Some span origins changed their names to match the other v11 origins:

  • auto.graphql.diagnostic_channel is now auto.graphql.graphql.
  • auto.db.redis.diagnostic_channel, auto.db.mysql2.diagnostic_channel and auto.db.mongoose.diagnostic_channel now end in .native_channel.
  • auto.http.wintercg_fetch is now auto.http.fetch, as on Bun, Deno and Cloudflare.
  • auto.grpc.serverless is now auto.grpc.google_cloud.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(deno): Add incoming request options to denoServeIntegration (#25493)

  denoServeIntegration now accepts ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated and onSpanEnd, with the same meaning as in denoHttpIntegration. The callbacks receive the web Request.

  ignoreStaticAssets defaults to true, so Deno.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set denoServeIntegration({ ignoreStaticAssets: false }). Deno.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled.

• feat(deno): Record request sessions for Deno.serve (#25496)

  denoServeIntegration now records a request session for each incoming request, as denoHttpIntegration does for node:http. This gives release health and crash-free rates for Deno.serve apps. Sessions are sent only when a release is set. To turn them off, set denoServeIntegration({ sessions: false }). sessionFlushingDelayMS sets how long the SDK waits before it sends the session aggregate.

• feat(deno): Register channel injection hooks from init() (#25546)

  Sentry.init() in @sentry/deno now registers the diagnostics-channel injection hooks, as @sentry/node does. The channel integrations now record spans without --preload=npm:@sentry/deno/import, for modules that you import after init(). To also instrument modules that load before init(), such as static imports in your entry module, keep the preload. With debug: true, the SDK logs a warning when no injection is active.

  On Node.js, tracing-hooks messages now show with debug: true instead of with DEBUG=@apm-js-collab/*.

• feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25456)

  The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

  // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
  export { POST } from '@sentry/nextjs/tunnel';

  The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

  Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

• feat(nextjs): Never emit trace meta tags from a prerender (#25141)

  Pageloads of apps with cacheComponents enabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell.

  If you set up OpenTelemetry yourself and register SentryPropagator, register NextSentryPropagator instead and pass your tracer provider to markPrerendersOnTracerProvider, so that your prerendered pages carry no trace information either.

• feat(nextjs): Send tunnel route requests with credentials: 'omit' (#25509)

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

11.9.0

Important Changes

• feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)

  Some span origins changed their names to match the other v11 origins:

  • auto.graphql.diagnostic_channel is now auto.graphql.graphql.
  • auto.db.redis.diagnostic_channel, auto.db.mysql2.diagnostic_channel and auto.db.mongoose.diagnostic_channel now end in .native_channel.
  • auto.http.wintercg_fetch is now auto.http.fetch, as on Bun, Deno and Cloudflare.
  • auto.grpc.serverless is now auto.grpc.google_cloud.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(deno): Add incoming request options to denoServeIntegration (#25493)

  denoServeIntegration now accepts ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated and onSpanEnd, with the same meaning as in denoHttpIntegration. The callbacks receive the web Request.

  ignoreStaticAssets defaults to true, so Deno.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set denoServeIntegration({ ignoreStaticAssets: false }). Deno.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled.

• feat(deno): Record request sessions for Deno.serve (#25496)

  denoServeIntegration now records a request session for each incoming request, as denoHttpIntegration does for node:http. This gives release health and crash-free rates for Deno.serve apps. Sessions are sent only when a release is set. To turn them off, set denoServeIntegration({ sessions: false }). sessionFlushingDelayMS sets how long the SDK waits before it sends the session aggregate.

• feat(deno): Register channel injection hooks from init() (#25546)

  Sentry.init() in @sentry/deno now registers the diagnostics-channel injection hooks, as @sentry/node does. The channel integrations now record spans without --preload=npm:@sentry/deno/import, for modules that you import after init(). To also instrument modules that load before init(), such as static imports in your entry module, keep the preload. With debug: true, the SDK logs a warning when no injection is active.

  On Node.js, tracing-hooks messages now show with debug: true instead of with DEBUG=@apm-js-collab/*.

• feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25456)

  The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

  // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
  export { POST } from '@sentry/nextjs/tunnel';

  The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

  Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

• feat(nextjs): Never emit trace meta tags from a prerender (#25141)

  Pageloads of apps with cacheComponents enabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell.

  If you set up OpenTelemetry yourself and register SentryPropagator, register NextSentryPropagator instead and pass your tracer provider to markPrerendersOnTracerProvider, so that your prerendered pages carry no trace information either.

• feat(nextjs): Send tunnel route requests with credentials: 'omit' (#25509)

... (truncated)

Commits

• 7b8ce4f meta(changelog): Add cherry-picked PRs to 11.9.0 changelog
• 487097d ci: Stop uploading duplicate tarballs to the release artifact (#25688)
• 1276d41 fix(deps): Allow @opentelemetry/api 1.9 again (#25684)
• c74f77f test(nextjs): Bump nextjs-16 E2E app to Next.js 16.4.2 (#25686)
• 47dec2a release: 11.9.0
• cc40f95 Merge pull request #25628 from getsentry/prepare-release/11.9.0
• 4689484 meta(changelog): Update changelog for 11.9.0
• b94aeb0 fix(hono): Read connection info from the runtime instead of Hono helpers (#25...
• ded8524 test(e2e): Retry tests in all dev-mode variants (#25640)
• 24186f0 feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)
• Additional commits viewable in compare view

Updates @tanstack/react-query from 5.104.0 to 5.104.5

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5
  • @​tanstack/query-devtools@​5.104.5

@​tanstack/react-query-next-experimental@​5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5

@​tanstack/react-query-persist-client@​5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5
  • @​tanstack/query-persist-client-core@​5.104.5

@​tanstack/react-query@​5.104.5

Patch Changes

• #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
• Updated dependencies [f608f93]:
  • @​tanstack/query-core@​5.104.5

@​tanstack/react-query-devtools@​5.104.4

Patch Changes

• #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

  • @​tanstack/query-devtools@​5.104.4
  • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-next-experimental@​5.104.4

Patch Changes

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
• Updated dependencies [c208861, a108398]:
  • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-persist-client@​5.104.4

Patch Changes

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
• Updated dependencies [c208861, a108398]:
  • @​tanstack/react-query@​5.104.4

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.5

Patch Changes

• #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
• Updated dependencies [f608f93]:
  • @​tanstack/query-core@​5.104.5

5.104.4

Patch Changes

• #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [1fee044, fce89dd]:

  • @​tanstack/query-core@​5.104.4

5.104.3

Patch Changes

• Updated dependencies [0f15bc9]:
  • @​tanstack/query-core@​5.104.3

5.104.2

Patch Changes

• Updated dependencies [03e8c39]:
  • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.104.1

Commits

• a8ecc8d ci: Version Packages (#12128)
• 1f8d134 fix(react, preact): recompute mutation state snapshots (#12117)
• 1219972 ci: Version Packages (#12062)
• 1fee044 fix(query-core): clear mutations before notifying subscribers (#11470)
• c208861 fix(react-query): retry queries with falsy errors on mount (#11328)
• a108398 fix(react-query*): declare '@​types/react' as an optional peer dependency (#11...
• ee47993 ci: Version Packages (#11998)
• 0f15bc9 fix(query-core): preserve union narrowing in setQueryData updaters (#11935)
• b699b52 ci: Version Packages (#11849)
• e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
• Additional commits viewable in compare view

Updates @tanstack/react-query-devtools from 5.104.0 to 5.104.5

Release notes

Sourced from @​tanstack/react-query-devtools's releases.

@​tanstack/react-query-devtools@​5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5
  • @​tanstack/query-devtools@​5.104.5

@​tanstack/react-query-devtools@​5.104.4

Patch Changes

• #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

  • @​tanstack/query-devtools@​5.104.4
  • @​tanstack/react-query@​5.104.4

Changelog

Sourced from @​tanstack/react-query-devtools's changelog.

5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5
  • @​tanstack/query-devtools@​5.104.5

5.104.4

Patch Changes

• #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

  • @​tanstack/query-devtools@​5.104.4
  • @​tanstack/react-query@​5.104.4

5.104.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.3
  • @​tanstack/query-devtools@​5.104.3

5.104.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.104.2
  • @​tanstack/react-query@​5.104.2

5.104.1

Patch Changes

• Updated dependencies [ec060b6]:
  • @​tanstack/query-devtools@​5.104.1
  • @​tanstack/react-query@​5.104.1

Commits

• a8ecc8d ci: Version Packages (#12128)
• 1219972 ci: Version Packages (#12062)
• a108398 fix(react-query*): declare '@​types/react' as an optional peer dependency (#11...
• 0992a92 fix(react-query-devtools): create the devtools instance lazily with 'useState...
• ee47993 ci: Version Packages (#11998)
• b699b52 ci: Version Packages (#11849)
• e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
• df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
• d0cfa6a chore: replace eslint with oxlint (#11938)
• 688f6e0 docs(*): describe 'shadowDOMTarget' as the shadow DOM the devtools styles are...
• Additional commits viewable in compare view

Updates i18next from 26.4.2 to 26.5.11

Release notes

Sourced from i18next's releases.

v26.5.11

• fix: a nested false, 0 or '' is now returned when a flat key with the same dotted name also exists. With { a: { b: false }, 'a.b': 'flat' }, getResource('en', 'translation', 'a.b') and t('a.b') returned 'flat': the nested result was checked for truthiness, so these present values fell through to the flat-key lookup. Without such a flat key they were already returned. A nested null, which is not a valid lookup by default (returnNull: false), still falls back to the flat key. Thanks @​lprnmns (#2461).

v26.5.10

• fix: when none of the detected languages is in supportedLngs, the best match no longer picks a different language whose code only starts with the same letters. The last fuzzy check took any supported code starting with the language part, so with supportedLngs: ['en', 'fil-PH'] a Finnish user (fi-FI) got Filipino instead of the fallback language, and ha (Hausa) picked haw-US (Hawaiian). Other regions of the same language still match as before (de-CH → de-DE, pt-PT → pt-BR, fil → fil-PH). Compatibility note: a two-letter code no longer matches a supported three-letter code that extends it, like ar → arz-EG, sw → swh-KE or no → nob-NO; list the two-letter code in supportedLngs (or map it with fallbackLng) if you relied on that. Thanks @​Pharex38 (#2460).

v26.5.9

• fix: nested lookups no longer resolve to methods inherited from the prototype, like constructor, toString or map. Only the top level was guarded, so {{constructor}} was treated as missing, but {{user.constructor}} rendered the function source (with a class instance, the full source code of the class), and {{user.toString}}, {{items.map}} or a class method like {{user.greet}} did the same. The same lookup is used for translation keys when ignoreJSONStructure is on (the default): a nested key named like an inherited method that is missing in the current language (t('roles.constructor') with roles.constructor only in the fallback language) returned function Object() { [native code] } instead of falling back, and exists('roles.valueOf') returned true. These keys are now missing, so the fallback language, missingInterpolationHandler, saveMissing and the missing key handler apply as for any other missing key. Getters defined on a class ({{user.fullName}} with get fullName()) still work. Nested lookups also no longer walk into the prototype via __proto__, so {{user.__proto__.constructor}} no longer prints the class source either. Thanks @​Pharex38 (#2459).

v26.5.8

• fix: arrays returned with joinArrays now get the same resolved details as strings. The joined value was extended with lastKey in the place of the resolved lookup, so with postProcessPassResolved a post processor got no usedLng, usedNS or exactUsedKey (t('steps', { joinArrays: ' / ' }) reported undefined/undefined:undefined). This affected the subliminal post processor used by the locize InContext editor, which could not map a joined array to its key. The nesting recursion guard did not get the parent key either, so arrays that nest each other (listA: ['a', '$t(listB)'], listB: ['b', '$t(listA)']) threw Maximum call stack size exceeded. They now stop at the guard, as strings do. An i18nFormat plugin with handleAsObject and parse also no longer throws Cannot read properties of undefined (reading 'usedNS') on joined arrays. Thanks @​nk-batman21 (#2458).

v26.5.7

• fix: with the default cacheInBuiltFormats: true, built-in formats now also work when the t() options contain a BigInt or a circular object. The cache key was built with JSON.stringify over all options, including the interpolation values, which throws on those, so every built-in format in that call returned the raw value: t('num', { val: 12345678901234567890n }) with 'Total: {{val, number}}' returned 'Total: 12345678901234567890' instead of 'Total: 12,345,678,901,234,567,890', and passing an object with a back-reference (like an ORM entity) left all numbers, dates and lists of that call unformatted. When the key cannot be built, the value is now formatted without the cache, as with cacheInBuiltFormats: false. This also applies to formatters added with addCached. Other calls still use the cache as before. Thanks @​nk-batman21 (#2457).

v26.5.6

• fix: cloneInstance({ forkResourceStore: true }) now copies the resources at every level. It copied them only down to the namespace objects, so nested keys and arrays stayed shared with the original instance: addResource() with a nested key (fork.addResource('en', 'translation', 'greeting.hello', 'Hi')) or a deep addResourceBundle() on the fork also changed the original instance and every other fork. Flat keys were already isolated. Forking a large store takes a bit longer: with 300k keys in nested groups, about 11 ms instead of 3 ms per fork. Clones without forkResourceStore still share the store as before. Thanks @​nk-batman21 (#2456, follow-up to #2270).

v26.5.5

• fix: with the default skipOnVariables: true, a {{placeholder}} inside a value inserted with an unescaped {{- var}} now stays literal, as it already did for {{var}}. The escape pass ran after the unescaped values were written and scanned them again, so t('{{- a}}', { a: '{{b}}', b: 'c' }) returned 'c' instead of '{{b}}'. With pre-built HTML that carries user text, like t('You may contact {{name}} at {{- emailHTML}}.', { name, emailHTML }), that text could pull another variable of the same t() call into the output. Results with skipOnVariables: false, and values without placeholders, are unchanged. Compatibility note: a {{- var}} value whose placeholders were meant to be filled from the same t() call now keeps them literally; skipOnVariables: false restores the old behavior. Thanks @​nk-batman21 (#2455, reported in #1595).

v26.5.4

• fix: with the default skipOnVariables: true, a {{placeholder}} inside an interpolated value now stays literal also when the same placeholder appears later in the translation. Each value was written with String.replace, which replaces the first copy of the placeholder text, and that could be the copy inside an earlier value: t('{{name}} has {{count}} items', { name: '{{count}}', count: 5 }) returned '5 has {{count}} items' instead of '{{count}} has 5 items'. The value is now written at the position of the matched placeholder. Results with skipOnVariables: false are unchanged. Thanks @​nk-batman21 (#2454, reported in #1595).
• fix: with useRawValueToEscape: true, a non-string value in an unescaped {{- var}} placeholder or with escapeValue: false no longer throws val.replace is not a function; it is converted to a string like any other value.

v26.5.3

• fix(types): with the selector API, a plural key now requires count also when the call passes an explicit ns. t(($) => $.item) already failed without count, but t(($) => $.item, { ns: 'items' }) compiled, although at runtime it looks up item instead of item_one / item_other and returns the key. It now fails the same way, also with ordinal: true, defaultValue, an ns array, a key prefix and i18n.t. Calls with count, context, returnObjects: true and arrays of selectors, as well as return types, are unchanged. Thanks @​nyarthan (#2452).

v26.5.2

• fix(types): on TypeScript 7, a t() call with a missing, misspelled or wrongly typed option now reports that option again (Property 'album' is missing, Type 'string' is not assignable to type 'number'), as TypeScript 5 and 6 do. TypeScript 7 elaborated the error against the default-value signature instead and ended in '{ count: 3; albm: "Summer"; }' is not assignable to type 'string': on a failed call TypeScript explains the last of the equally matching signatures, and TypeScript 7 sorts the 3-element [key, defaultValue, options?] last. It is now written as two signatures, [key, defaultValue] and [key, defaultValue, options]. This affects the default key checks with i18next {{name}} messages as well as parseInterpolation: 'icu' and 'mf2'. Which calls compile, their return types and the error positions are unchanged on TypeScript 5.9, 6 and 7.

v26.5.1

• perf(types): type-checking t() calls against a large namespace is no longer quadratic in the number of keys. TypeScript does not cache keyof of an object type, and the types rebuilt the union of all keys of a namespace once per key while building the key union, and again in every t() call to look up the return type. Both now use a cached key union, and a literal key is looked up directly instead of being intersected with every key. With 5,000 keys in one namespace and one call per key, the check time went from 14.8s to 1.1s (TypeScript 6); with 1,000 keys from 0.75s to 0.27s. Keys, return types and errors are unchanged.
• perf(types): the selector API (enableSelector: true / 'strict') with context is no longer quadratic in the size of an object. To decide which keys a context keeps, the types scanned all keys of the object once for every key, also when TypeScript checks the selector with context widened to string. With 1,000 keys plus one context variant each, a namespace took 18.7s and failed with "Type instantiation is excessively deep and possibly infinite" (TS2589); 2,500 and more ran out of memory. The context variants of an object are now collected once, in one pass over its keys: 1,000 keys check in 0.69s, 5,000 in 3.1s. Long keys (whole sentences with keySeparator: false) work as before. Selected values and errors are unchanged.

v26.5.0

• feat(types): parseInterpolation: 'icu' and parseInterpolation: 'mf2' type t() options from the message's ICU MessageFormat arguments (i18next-icu) or MessageFormat 2 variables (i18next-mf2), so ICU and MF2 users no longer need parseInterpolation: false and lose argument checking. Missing, misspelled and wrongly typed arguments fail, and so does leaving out the options for a message with arguments (t('greeting')); that error names the missing arguments. Opt-in, default true is unchanged.
  • ICU: {name} takes string | number, {n, number}, plural and selectordinal take number, {d, date} and {t, time} take Date, select takes its case keys or any string (for other), and arguments nested in cases are required too. # and tags are not arguments, apostrophe quoting is read like intl-messageformat does.
  • MF2: {$name} takes string | number, a variable annotated with :number, :integer, :currency, :percent or :unit (inline or through .input / .local) takes number, :datetime, :date and :time take Date, :string takes string, option and markup variables (minimumFractionDigits=$digits, {#link href=$url}) are required too, .local variables are not arguments, and |quoted literals| and \{ escapes are skipped.
  • interpolationFormatTypeMap overrides a type by ICU format or MF2 function name, e.g. date: Date | number or a custom uppercase: string.
  • Applies to t(), getFixedT(), i18n.t, key prefixes, namespaces, the selector API and react-i18next's Trans values. Messages need literal types, as the resources file from i18next-cli's types command has them.
  • Type-check cost with 1,000 messages and one call each: 1.35s instead of 0.86s with false (TypeScript 6), 0.5s instead of 0.26s with TypeScript 7. Messages that no call uses cost nothing.
• fix(types): with the default (non-strict) key checks, an options object with a missing or misspelled interpolation variable now reports the missing variable (Property 'name' is missing) instead of '{ nmae: string }' is not assignable to type 'string' from the default-value overload.

v26.4.7

• perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

v26.4.6

• fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).

... (truncated)

Changelog

Sourced from i18next's changelog.

26.5.11

• fix: a nested false, 0 or '' is now returned when a flat key with the same dotted name also exists. With { a: { b: false }, 'a.b': 'flat' }, getResource('en', 'translation', 'a.b') and t('a.b') returned 'flat': the nested result was checked for truthiness, so these present values fell through to the flat-key lookup. Without such a flat key they were already returned. A nested null, which is not a valid lookup by default (returnNull: false), still falls back to the flat key. Thanks @​lprnmns (#2461).

26.5.10

• fix: when none of the detected languages is in supportedLngs, the best match no longer picks a different language whose code only starts with the same letters. The last fuzzy check took any supported code starting with the language part, so with supportedLngs: ['en', 'fil-PH'] a Finnish user (fi-FI) got Filipino instead of the fallback language, and ha (Hausa) picked haw-US (Hawaiian). Other regions of the same language still match as before (de-CH → de-DE, pt-PT → pt-BR, fil → fil-PH). Compatibility note: a two-letter code no longer matches a supported three-letter code that extends it, like ar → arz-EG, sw → swh-KE or no → nob-NO; list the two-letter code in supportedLngs (or map it with fallbackLng) if you relied on that. Thanks @​Pharex38 (#2460).

26.5.9

• fix: nested lookups no longer resolve to methods inherited from the prototype, like constructor, toString or map. Only the top level was guarded, so {{constructor}} was treated as missing, but {{user.constructor}} rendered the function source (with a class instance, the full source code of the class), and {{user.toString}}, {{items.map}} or a class method like {{user.greet}} did the same. The same lookup is used for translation keys when ignoreJSONStructure is on (the default): a nested key named like an inherited method that is missing in the current language (t('roles.constructor') with roles.constructor only in the fallback language) returned function Object() { [native code] } instead of falling back, and exists('roles.valueOf') returned true. These keys are now missing, so the fallback language, missingInterpolationHandler, saveMissing and the missing key handler apply as for any other missing key. Getters defined on a class ({{user.fullName}} with get fullName()) still work. Nested lookups also no longer walk into the prototype via __proto__, so {{user.__proto__.constructor}} no longer prints the class source either. Thanks @​Pharex38 (#2459).

26.5.8

• fix: arrays returned with joinArrays now get the same resolved details as strings. The joined value was extended with lastKey in the place of the resolved lookup, so with postProcessPassResolved a post processor got no usedLng, usedNS or exactUsedKey (t('steps', { joinArrays: ' / ' }) reported undefined/undefined:undefined). This affected the subliminal post processor used by the locize InContext editor, which could not map a joined array to its key. The nesting recursion guard did not get the parent key either, so arrays that nest each other (listA: ['a', '$t(listB)'], listB: ['b', '$t(listA)']) threw Maximum call stack size exceeded. They now stop at the guard, as strings do. An i18nFormat plugin with handleAsObject and parse also no longer throws Cannot read properties of undefined (reading 'usedNS') on joined arrays. Thanks @​nk-batman21 (#2458).

26.5.7

• fix: with the default cacheInBuiltFormats: true, built-in formats now also work when the t() options contain a BigInt or a circular object. The cache key was built with JSON.stringify over all options, including the interpolation values, which throws on those, so every built-in format in that call returned the raw value: t('num', { val: 12345678901234567890n }) with 'Total: {{val, number}}' returned 'Total: 12345678901234567890' instead of 'Total: 12,345,678,901,...

  Description has been truncated