Skip to content

chore: bump the npm-all group with 5 updates - #30

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-all-0b8d3afd59
Open

chore: bump the npm-all group with 5 updates#30
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-all-0b8d3afd59

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-all group with 5 updates:

Package From To
i18next 26.5.6 26.5.10
react-i18next 17.1.4 17.1.8
i18next-cli 1.80.0 1.80.4
knip 6.42.1 6.43.0
vitest 4.1.12 5.0.5

Updates i18next from 26.5.6 to 26.5.10

Release notes

Sourced from i18next's releases.

v26.5.10

  • fix: when none of the detected languages is in supportedLngs, the best match no longer picks a different language whose code only starts with the same letters. The last fuzzy check took any supported code starting with the language part, so with supportedLngs: ['en', 'fil-PH'] a Finnish user (fi-FI) got Filipino instead of the fallback language, and ha (Hausa) picked haw-US (Hawaiian). Other regions of the same language still match as before (de-CH → de-DE, pt-PT → pt-BR, fil → fil-PH). Compatibility note: a two-letter code no longer matches a supported three-letter code that extends it, like ar → arz-EG, sw → swh-KE or no → nob-NO; list the two-letter code in supportedLngs (or map it with fallbackLng) if you relied on that. Thanks @​Pharex38 (#2460).

v26.5.9

  • fix: nested lookups no longer resolve to methods inherited from the prototype, like constructor, toString or map. Only the top level was guarded, so {{constructor}} was treated as missing, but {{user.constructor}} rendered the function source (with a class instance, the full source code of the class), and {{user.toString}}, {{items.map}} or a class method like {{user.greet}} did the same. The same lookup is used for translation keys when ignoreJSONStructure is on (the default): a nested key named like an inherited method that is missing in the current language (t('roles.constructor') with roles.constructor only in the fallback language) returned function Object() { [native code] } instead of falling back, and exists('roles.valueOf') returned true. These keys are now missing, so the fallback language, missingInterpolationHandler, saveMissing and the missing key handler apply as for any other missing key. Getters defined on a class ({{user.fullName}} with get fullName()) still work. Nested lookups also no longer walk into the prototype via __proto__, so {{user.__proto__.constructor}} no longer prints the class source either. Thanks @​Pharex38 (#2459).

v26.5.8

  • fix: arrays returned with joinArrays now get the same resolved details as strings. The joined value was extended with lastKey in the place of the resolved lookup, so with postProcessPassResolved a post processor got no usedLng, usedNS or exactUsedKey (t('steps', { joinArrays: ' / ' }) reported undefined/undefined:undefined). This affected the subliminal post processor used by the locize InContext editor, which could not map a joined array to its key. The nesting recursion guard did not get the parent key either, so arrays that nest each other (listA: ['a', '$t(listB)'], listB: ['b', '$t(listA)']) threw Maximum call stack size exceeded. They now stop at the guard, as strings do. An i18nFormat plugin with handleAsObject and parse also no longer throws Cannot read properties of undefined (reading 'usedNS') on joined arrays. Thanks @​nk-batman21 (#2458).

v26.5.7

  • fix: with the default cacheInBuiltFormats: true, built-in formats now also work when the t() options contain a BigInt or a circular object. The cache key was built with JSON.stringify over all options, including the interpolation values, which throws on those, so every built-in format in that call returned the raw value: t('num', { val: 12345678901234567890n }) with 'Total: {{val, number}}' returned 'Total: 12345678901234567890' instead of 'Total: 12,345,678,901,234,567,890', and passing an object with a back-reference (like an ORM entity) left all numbers, dates and lists of that call unformatted. When the key cannot be built, the value is now formatted without the cache, as with cacheInBuiltFormats: false. This also applies to formatters added with addCached. Other calls still use the cache as before. Thanks @​nk-batman21 (#2457).
Changelog

Sourced from i18next's changelog.

26.5.10

  • fix: when none of the detected languages is in supportedLngs, the best match no longer picks a different language whose code only starts with the same letters. The last fuzzy check took any supported code starting with the language part, so with supportedLngs: ['en', 'fil-PH'] a Finnish user (fi-FI) got Filipino instead of the fallback language, and ha (Hausa) picked haw-US (Hawaiian). Other regions of the same language still match as before (de-CH → de-DE, pt-PT → pt-BR, fil → fil-PH). Compatibility note: a two-letter code no longer matches a supported three-letter code that extends it, like ar → arz-EG, sw → swh-KE or no → nob-NO; list the two-letter code in supportedLngs (or map it with fallbackLng) if you relied on that. Thanks @​Pharex38 (#2460).

26.5.9

  • fix: nested lookups no longer resolve to methods inherited from the prototype, like constructor, toString or map. Only the top level was guarded, so {{constructor}} was treated as missing, but {{user.constructor}} rendered the function source (with a class instance, the full source code of the class), and {{user.toString}}, {{items.map}} or a class method like {{user.greet}} did the same. The same lookup is used for translation keys when ignoreJSONStructure is on (the default): a nested key named like an inherited method that is missing in the current language (t('roles.constructor') with roles.constructor only in the fallback language) returned function Object() { [native code] } instead of falling back, and exists('roles.valueOf') returned true. These keys are now missing, so the fallback language, missingInterpolationHandler, saveMissing and the missing key handler apply as for any other missing key. Getters defined on a class ({{user.fullName}} with get fullName()) still work. Nested lookups also no longer walk into the prototype via __proto__, so {{user.__proto__.constructor}} no longer prints the class source either. Thanks @​Pharex38 (#2459).

26.5.8

  • fix: arrays returned with joinArrays now get the same resolved details as strings. The joined value was extended with lastKey in the place of the resolved lookup, so with postProcessPassResolved a post processor got no usedLng, usedNS or exactUsedKey (t('steps', { joinArrays: ' / ' }) reported undefined/undefined:undefined). This affected the subliminal post processor used by the locize InContext editor, which could not map a joined array to its key. The nesting recursion guard did not get the parent key either, so arrays that nest each other (listA: ['a', '$t(listB)'], listB: ['b', '$t(listA)']) threw Maximum call stack size exceeded. They now stop at the guard, as strings do. An i18nFormat plugin with handleAsObject and parse also no longer throws Cannot read properties of undefined (reading 'usedNS') on joined arrays. Thanks @​nk-batman21 (#2458).

26.5.7

  • fix: with the default cacheInBuiltFormats: true, built-in formats now also work when the t() options contain a BigInt or a circular object. The cache key was built with JSON.stringify over all options, including the interpolation values, which throws on those, so every built-in format in that call returned the raw value: t('num', { val: 12345678901234567890n }) with 'Total: {{val, number}}' returned 'Total: 12345678901234567890' instead of 'Total: 12,345,678,901,234,567,890', and passing an object with a back-reference (like an ORM entity) left all numbers, dates and lists of that call unformatted. When the key cannot be built, the value is now formatted without the cache, as with cacheInBuiltFormats: false. This also applies to formatters added with addCached. Other calls still use the cache as before. Thanks @​nk-batman21 (#2457).
Commits
  • 00b6a3f 26.5.10
  • 9bdd4f6 build
  • fb168f3 changelog for 26.5.10
  • 2584a56 fix: don't match a supported language that only starts with the same letters ...
  • 6c98e55 build
  • 3465ae4 26.5.9
  • 5888c16 changelog for 26.5.9
  • db036c8 fix: don't walk into the prototype via proto in nested lookups
  • 0815882 fix: don't interpolate inherited methods like constructor from nested values ...
  • 45ae264 26.5.8
  • Additional commits viewable in compare view

Updates react-i18next from 17.1.4 to 17.1.8

Changelog

Sourced from react-i18next's changelog.

17.1.8

  • fix(Trans): an interpolation variable named format is no longer dropped. Trans reads format in an interpolation object as the formatter name ({{ value, format }}), so with {{ format }} as the only key nothing was left: <Trans>Export as {{ format }}</Trans> warned TRANS_INVALID_OBJ and used the default string Export as instead of Export as {{format}}. When format is the object's only key it is now treated as the variable. {{ value, format }} works as before. Without an i18nKey, the key derived from the children changes accordingly, from Export as to Export as {{format}}. i18next-cli serializes Trans children with react-i18next, so extracting with this version produces the same key. Thanks @​Pharex38 (#1944).

17.1.7

  • fix(IcuTrans): each HTML entity in a translation is now decoded exactly once. Named, decimal and hexadecimal entities were decoded in three passes, and each pass decoded the output of the previous one, so an escaped numeric entity was decoded twice: "Write &amp;[#169](https://github.com/i18next/react-i18next/issues/169); to get &[#169](https://github.com/i18next/react-i18next/issues/169);" rendered Write © to get © instead of Write &[#169](https://github.com/i18next/react-i18next/issues/169); to get ©, and &amp;[#60](https://github.com/i18next/react-i18next/issues/60); rendered < instead of &[#60](https://github.com/i18next/react-i18next/issues/60);. This also hit interpolated values with escapeValue: true, where a value containing &[#60](https://github.com/i18next/react-i18next/issues/60); is escaped to &amp;[#60](https://github.com/i18next/react-i18next/issues/60);. Escaped named entities like &amp;lt; already stayed &lt;, as browsers and Trans decode them. Unknown named entities and entities above U+10FFFF still stay as written. Thanks @​Pharex38 (#1943).

17.1.6

  • fix(Trans): a count passed in tOptions is now used. Trans spread tOptions and then set its own count prop, so a count only in tOptions was overwritten with undefined: <Trans i18nKey="items" tOptions={{ count: 5 }} /> rendered the key items instead of 5 items, and with children Trans could pick the wrong plural form. Like context, Trans now falls back to tOptions.count, handled the same way as the count prop. A count prop, a count in the children or values.count still take precedence, and tOptions is not modified. Thanks @​nk-batman21 (#1942).

17.1.5

  • fix(Trans): with an array of keys and no children, Trans now falls back to the last key when none of them has a translation, as t() does. It used the array itself as defaultValue, which i18next handles as an object, so <Trans i18nKey={['notifications.crm_item_created', 'crm_item_created']} components={[<strong />]} /> rendered key 'crm_item_created (en)' returned an object instead of string. instead of crm_item_created. An array of selectors falls back to the key of the last selector. The first key that has a translation still wins, and children, defaults and tOptions.defaultValue are used as before. With saveMissing, these calls now report the missing key, like a single i18nKey does. Thanks @​nk-batman21 (#1941).
Commits

Updates i18next-cli from 1.80.0 to 1.80.4

Changelog

Sourced from i18next-cli's changelog.

1.80.4

  • fix(rename-key): calls with a string default value are renamed in the source. t('key', 'Default') and t('key', 'Default', { … }) were left untouched while the translation files were renamed, so the next extract brought the old key back. Moving such a key to another namespace keeps the default value: t('key', 'Default', { ns: 'ns2' }).
  • fix(extract): plural forms of a key stored flat stay flat in secondary locales. With "Loading..._one" in ru/translation.json, extract also wrote a nested copy, { "Loading": { "": { "": { "_one": … } } } }; the same happened for generated forms (_few, _many), preserved _zero forms, context variants and preservePatterns. A file that already has these nested copies loses them on the next extract.

1.80.3

  • fix(rename-key): keys the extractor stores flat are renamed in the translation files. Renaming "Loading..." to "Saving..." left the old key in place and wrote { "Saving": { "": { "": { "": "Loading..." } } } }; renaming common.ok to "Okay, thanks." wrote { "Okay, thanks": { "": "OK" } }. The new key is now written where the next extract puts it (flat for "Loading...", natural-language and <Trans> keys), and the old key is removed however the file stores it. #311

1.80.2

  • fix(sync): flat keys that contain the key separator keep their translations. The extractor writes keys like "Loading..." or "Hello world. Bye" as one flat key, but sync split them on the separator, so a secondary file with { "Loading...": "Lädt..." } became { "Loading": { "": { "": { "": "" } } } } and the translation was lost. sync now writes them flat, and status, localize and rename-key find their values too. A secondary file already broken this way gets its flat key back (with an empty value) on the next sync. #310
  • fix(types): placeholders with spaces on one side only ({{ name}}) are trimmed, and enableSelector no longer throws on plural keys whose base name is constructor, toString, … or also an object (i18next-resources-for-ts 2.1.2).

1.80.1

  • fix(extract): a <Trans> interpolation variable named format is extracted. <Trans>Export as {{ format }}</Trans> was extracted as Export as , because react-i18next read format as the formatter name and dropped the variable; it is now Export as {{format}}, as react-i18next 17.1.8 renders it. Requires react-i18next ^17.1.8.
  • chore(deps): update dependencies within their ranges and neostandard to 0.14.
Commits
  • be52852 1.80.4
  • c77cae2 fix(rename-key, extract): rename calls with a default value, keep plural form...
  • a8830f9 1.80.3
  • 63d076f docs: changelog for 1.80.3, fix flat-key example in comments
  • 43d27c0 fix(rename-key): rename keys the extractor stores flat (#311)
  • 7e74173 1.80.2
  • 8cbed12 chore(deps): i18next-resources-for-ts 2.1.2, changelog
  • 108a745 fix(sync): keep flat keys that contain the key separator (#310)
  • 58d5a03 1.80.1
  • db1ad55 fix(extract): extract a Trans variable named format, update deps
  • See full diff in compare view

Updates knip from 6.42.1 to 6.43.0

Release notes

Sourced from knip's releases.

Release 6.43.0

  • Document and pin exports that only keep each other alive (#2160) (39af70abb32523a992a7d6152b8cd95ef317f237)
  • Don't add config files without an extension as entry files (resolve #2168) (46a825ddf15d3073b899ed6ef34689e5da5508f2)
  • Recognize unscoped ~name workspace packages (resolve #2172) (ba527f7386e7741507f2f18d84864058e02ac907)
  • Follow imports and re-exports in ambient modules (resolve #2174) (dbd3a8b8b0429433e5385371c09e805b808a32c2) - thanks @​tlq5l!
  • Follow @reference in Tailwind CSS compiler (#2177) (219f16de95e174cdcfd6a90782bcef13cf79bd64) - thanks @​mkantautas!
  • Support { find, replacement } array form of Vite alias (#2179) (5d0779bc4cf8c0469c50d5b2cda1a6bd1f053d81) - thanks @​mkantautas!
  • fix(expo): treat local config plugins as entry files (#2176) (100ef491509a88b00ea9956ba40dbc1b0ac0c205) - thanks @​Cayan!
  • fix(next): detect Turbopack loaders in shared config factories (#2161) (9cf928be5022928a38c12fe8001cec7bf467040c) - thanks @​jakeleventhal!
  • Ignore osascript as global binary (#2182) (c301e44c7975442d4d25595f084e6b853f07a434) - thanks @​abrahamguo!
  • Skip --fix for exports in multi-declarator variable statements (#2178) (326afd9c1e66eef04d986b83ed829b506f506c48) - thanks @​mkantautas!
  • Watch the project directory instead of process.cwd() (#2183) (16d9932d0239f649cf2c1349cc7bc893850cd4f0) - thanks @​abrahamguo!
  • Follow directory paths in tsconfig references (#2186) (d741c46e3f2a9caaf6bf4e81e9d4c8cfca48623e) - thanks @​mkantautas!
  • Handle @plugin options blocks in Tailwind CSS compiler (#2187) (9fae773eb75bcba03e62f44ce3e9aa0b889bf4ac) - thanks @​mkantautas!
  • Remove anonymous default-exported functions and classes in --fix (#2188) (6748259fbb2ea9a5940ea3861626f77677610a86) - thanks @​mkantautas!
  • Recognize bun fmt as a built-in command (#2189) (e971b0924bcb7ff8dcab01a180d3016cc08b675d) - thanks @​TomasHubelbauer!
  • Add plugin for @​bufbuild/buf (#2142) (90216c261c2273967125669beb611bf763d762c7) - thanks @​ryanquinn3!
  • Pass isSsrBuild to Vite config functions (#2191) (d2aa101c55e5d7e8d26548808ce008b214622099) - thanks @​mkantautas!
  • Follow src of <script> and <style> blocks in Vue SFCs (#2193) (3d148393d5129a096a182fab36a873b9f710f388) - thanks @​mkantautas!
  • Remove import attributes with emptied re-exports in --fix (#2192) (231026cf9c21cc7890f21d048f4af6ea7233d7b8) - thanks @​mkantautas!
  • Update npmx.dev snapshot (b2cc439006ec98ff5bbc1c99b99bc1ac5203b6b2)
  • Read string parserOptions.parser in ESLint flat configs (#2198) (302f908aa135669d6fe96869ec6452b7570856a4) - thanks @​mkantautas!
  • Resolve directory matches in Vitest test.projects to their config (#2195) (4d386138011c27e01e6e910be6d58266e07c9cf1) - thanks @​fixfon!
  • Ignore custom elements named script-* when extracting script blocks (#2199) (23e6479b233e1882ddaf29736390309d0f3f040f) - thanks @​mkantautas!
  • feat(mcp): add MCP plugin (#2180) (fc92470a9f687e2f1da60b84612ebf3e59a8bbb9) - thanks @​jakeleventhal!
  • Handle non-Error plugin config failures (8f21ea2182fac5a96edd7d6d4280a0fa1051e434)
  • Update articles list (6569cdcde1a79a6196a35a934b6c0d9d0e23faa4)
  • Skip --fix export ranges inside a larger removal (204a8091baf91cb8cfb4e7a9aa70d461cc926baa)
  • Detect .travis.yml with a stat instead of a glob (3601c6e32afef3d1d76a3944e540225da5190b9b)
  • Mark YAML catalog entries fixed only when their line is removed (#2201) (813fa30e55ef3a8ed749d9d6d5a02a00810cfe72) - thanks @​mkantautas!
  • Add Electron Forge plugin (#2158) (12e4355a43ea63c417d3b9ebfbbac1c8510b139e) - thanks @​mehdimirzafaruk!
  • Resolve function and promise entries in Vitest test.projects (#2197) (ec293d1a33d30a8b0521725d1148e6e72c6e4220) - thanks @​mkantautas!
  • Follow npm lifecycle scripts and run-script aliases (#2202) (89dfdc881e6865aef326c2b9dc700cf5c46b73b4) - thanks @​sushanta-neupane!
  • Follow pnpm t, tst and run-script aliases (ce91e230e0823433dfcc1ee4562335c34d2b73ef)
  • Treat vitest-environment-nuxt as optional (it comes with @nuxt/test-utils) (db9aa7443c5b3839df5c0fe320d78ea42f0f3446)
  • Ignore tool output before the first report section in ecosystem snapshots (9434bf678e60d16832f13e892d7c1ebc2b9e6ed1)
  • Update dependencies (21c3b75fc4ae94208311abb630ff129fcd9fe820)
  • Bump engines.node to follow Astro's (9d7a5e07212b093f9d422cab813fad5d01273fc6)
Commits
  • 0712156 Release knip@6.43.0
  • 21c3b75 Update dependencies
  • db9aa74 Treat vitest-environment-nuxt as optional (it comes with @nuxt/test-utils)
  • ce91e23 Follow pnpm t, tst and run-script aliases
  • 89dfdc8 Follow npm lifecycle scripts and run-script aliases (#2202)
  • ec293d1 Resolve function and promise entries in Vitest test.projects (#2197)
  • 12e4355 Add Electron Forge plugin (#2158)
  • 813fa30 Mark YAML catalog entries fixed only when their line is removed (#2201)
  • 3601c6e Detect .travis.yml with a stat instead of a glob
  • 204a809 Skip --fix export ranges inside a larger removal
  • Additional commits viewable in compare view

Updates vitest from 4.1.12 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore: bump the npm-all group with 5 updates
1222544 
Bumps the npm-all group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [i18next](https://github.com/i18next/i18next) | `26.5.6` | `26.5.10` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.1.4` | `17.1.8` |
| [i18next-cli](https://github.com/i18next/i18next-cli) | `1.80.0` | `1.80.4` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.42.1` | `6.43.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.12` | `5.0.5` |


Updates `i18next` from 26.5.6 to 26.5.10
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.5.6...v26.5.10)

Updates `react-i18next` from 17.1.4 to 17.1.8
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.1.4...v17.1.8)

Updates `i18next-cli` from 1.80.0 to 1.80.4
- [Changelog](https://github.com/i18next/i18next-cli/blob/main/CHANGELOG.md)
- [Commits](i18next/i18next-cli@v1.80.0...v1.80.4)

Updates `knip` from 6.42.1 to 6.43.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.43.0/packages/knip)

Updates `vitest` from 4.1.12 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: i18next
  dependency-version: 26.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-all
- dependency-name: react-i18next
  dependency-version: 17.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-all
- dependency-name: i18next-cli
  dependency-version: 1.80.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-all
- dependency-name: knip
  dependency-version: 6.43.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-all
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 1, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants