Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 20 updates - #70

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-de69af9c76
Open

build(deps): bump the minor-and-patch group across 1 directory with 20 updates#70
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-de69af9c76

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 20 updates in the / directory:

Package From To
@aws-sdk/client-s3 3.1089.0 3.1150.0
@aws-sdk/lib-storage 3.1089.0 3.1150.0
@aws-sdk/s3-request-presigner 3.1089.0 3.1150.0
@tanstack/react-query 5.101.2 5.104.2
i18next 26.3.6 26.4.4
node-sqlite3-wasm 0.8.59 0.8.60
react 19.2.7 19.3.0
@types/react 19.2.17 19.3.0
react-dom 19.2.7 19.3.0
@types/react-dom 19.2.3 19.3.0
react-i18next 17.0.10 17.0.16
@testing-library/react 16.3.2 16.3.3
@testing-library/user-event 14.6.1 14.6.8
@types/node 26.1.1 26.6.5
@types/react 19.2.17 19.3.0
@types/react-dom 19.2.3 19.3.0
@vitejs/plugin-react 6.0.3 6.1.2
conventional-changelog-conventionalcommits 10.2.1 10.4.1
eslint 10.7.0 10.12.0
globals 17.7.0 17.13.0
typescript-eslint 8.65.0 8.71.2
vite 8.1.5 8.3.4

Updates @aws-sdk/client-s3 from 3.1089.0 to 3.1150.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1150.0

3.1150.0(2026-10-12)

Documentation Changes
  • client-lambda: Doc updates to reposition Lambda Functions as Lambda Event Functions (618497da)
New Features
  • clients: update client endpoints as of 2026-10-12 (39b07192)
  • client-pcs: Adding scheduler version to RegisterComputeNodeGroup API. A compute node uses this value to run the matching scheduler version. (8085dcda)
  • client-bedrock-agentcore-control: AgentCore Memory now supports configuring Long-Term Memory Time-to-Live (TTL) on Memory Strategies. (93d530e9)
  • client-lambda-core: Lambda Network Connector now supports Lambda Web Functions, letting them reach private VPC resources, and adds versioning, each connector update creates an immutable version that revisions pin to, so customers can roll out and roll back networking changes without affecting running workloads (7ca09fa2)
  • client-lambda-web: Lambda Web Functions GA launch. Lambda Web Functions enable customers to run web applications and API backends (e817ea05)
  • client-sagemakertrainingsessionruntime: Amazon SageMaker Training Session Runtime provides APIs for executing operations within active training sessions, including asynchronous training operations, sampling and inference requests, and streaming real-time model responses, enabling programmatic control over the training loop. (9c1af7bd)
  • client-sagemaker: Amazon SageMaker Training Session is a managed service for training on shared GPU infrastructure. It provides full lifecycle management of training sessions and exposes low-level primitive APIs for operations like forward-backward passes, optimizer steps, and state management. (94f32429)
  • client-observabilityadmin: Adding support for TransactionSearch telemetry rules. (49992d7e)
  • client-glue: Adds new AWS Glue Data Quality APIs to retrieve and list data quality evaluation results. The new GetDataQualityResultV2, BatchGetDataQualityResultV2, and ListDataQualityResultsV2 operations return data quality results published from any supported data processing engine. (0f677b72)
  • client-bedrock-agentcore: AgentCore Memory now supports Long-Term Memory Time-to-Live on Batch APIs. (39cfa46b)
  • client-pinpoint-sms-voice-v2: DescribePhoneNumbers and DescribeSenderIds now return an optional PricingTier field that indicates whether a phone number, sender ID, short code, or long code is classified as Domestic or International, enabling customers to identify origination identities eligible for local pricing. (47e4631e)
  • client-omics: AWS HealthOmics now supports private workflow runs using VPC resources shared across accounts via AWS RAM. A new optional vpcOwnerAccountId field in CreateConfiguration's VpcConfig allows customers to specify the account that owns the shared subnets and security groups. (a5ee15fe)
  • client-devops-agent: Adds support for the includedData field in GetAgentSpace and ListAgentSpaces APIs (1613a423)
  • client-mediaconnect: This release adds support for MediaConnect Router high-bitrate tiers. It also adds a configurable audio reference level for NDI flows, and enhanced source metadata that includes color information and transport stream ID. (187bb041)
  • client-securityagent: Adds support for Jira integration provider in AWS Security Agent. (892b1e4e)
  • client-cloudwatchomni: Adds support for updating agentCoreEvaluationRoleArn in UpdateSpace API (afef0038)
Bug Fixes
  • core/httpAuthSchemes: skip clock-skew sampling for event-stream outputs (#8346) (345466f4)

For list of updated packages, view updated-packages.md in assets-3.1150.0.zip

v3.1149.0

3.1149.0(2026-10-09)

Chores
  • codegen: sync for endpoint cache fix and pre-schema error fallback (#8341) (5773a751)
New Features
  • client-quicksight: Adds granular custom permissions for the Gong action connector (GongAction, CreateAndUpdateGongAction, ShareGongAction, UseGongAction) and for create, update, and share operations on 45 data source connectors, such as Amazon S3 and Snowflake, through the Custom Permissions APIs. (c5d26e39)
  • client-deadline: The new ListMemberships API enables users to discover their memberships across Deadline Cloud resources, enabling scoped users of Deadline resources to discover and interact with the resources they have been provided scoped access to. (0d7406c7)
  • client-marketplace-metering: AWS Marketplace Metering Service adds AgreementId to ResolveCustomer API response. (9653f5cc)
  • client-mediatailor: Add caching settings to http functions (7ac7530b)
  • client-securityagent: Adds a test scope field to specify whether a pentest targets a web application or a generative AI application. (1cc5ba6a)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1150.0 (2026-10-12)

Note: Version bump only for package @​aws-sdk/client-s3

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/client-s3

3.1148.0 (2026-10-08)

Note: Version bump only for package @​aws-sdk/client-s3

3.1147.0 (2026-10-06)

Note: Version bump only for package @​aws-sdk/client-s3

3.1146.0 (2026-10-02)

Note: Version bump only for package @​aws-sdk/client-s3

3.1145.0 (2026-10-01)

Note: Version bump only for package @​aws-sdk/client-s3

3.1144.0 (2026-09-30)

... (truncated)

Commits
  • 4c9a334 Publish v3.1150.0
  • a960c14 Publish v3.1149.0
  • 5773a75 chore(codegen): sync for endpoint cache fix and pre-schema error fallback (#8...
  • 1bc0425 Publish v3.1148.0
  • 663046d Publish v3.1147.0
  • 054298b Publish v3.1146.0
  • 0199117 Publish v3.1145.0
  • ce26281 Publish v3.1144.0
  • 82bbbdc feat(client-s3): Amazon S3 adds a new optional S3 Inventory field, Intelligen...
  • 81afad0 Publish v3.1143.0
  • Additional commits viewable in compare view

Updates @aws-sdk/lib-storage from 3.1089.0 to 3.1150.0

Release notes

Sourced from @​aws-sdk/lib-storage's releases.

v3.1150.0

3.1150.0(2026-10-12)

Documentation Changes
  • client-lambda: Doc updates to reposition Lambda Functions as Lambda Event Functions (618497da)
New Features
  • clients: update client endpoints as of 2026-10-12 (39b07192)
  • client-pcs: Adding scheduler version to RegisterComputeNodeGroup API. A compute node uses this value to run the matching scheduler version. (8085dcda)
  • client-bedrock-agentcore-control: AgentCore Memory now supports configuring Long-Term Memory Time-to-Live (TTL) on Memory Strategies. (93d530e9)
  • client-lambda-core: Lambda Network Connector now supports Lambda Web Functions, letting them reach private VPC resources, and adds versioning, each connector update creates an immutable version that revisions pin to, so customers can roll out and roll back networking changes without affecting running workloads (7ca09fa2)
  • client-lambda-web: Lambda Web Functions GA launch. Lambda Web Functions enable customers to run web applications and API backends (e817ea05)
  • client-sagemakertrainingsessionruntime: Amazon SageMaker Training Session Runtime provides APIs for executing operations within active training sessions, including asynchronous training operations, sampling and inference requests, and streaming real-time model responses, enabling programmatic control over the training loop. (9c1af7bd)
  • client-sagemaker: Amazon SageMaker Training Session is a managed service for training on shared GPU infrastructure. It provides full lifecycle management of training sessions and exposes low-level primitive APIs for operations like forward-backward passes, optimizer steps, and state management. (94f32429)
  • client-observabilityadmin: Adding support for TransactionSearch telemetry rules. (49992d7e)
  • client-glue: Adds new AWS Glue Data Quality APIs to retrieve and list data quality evaluation results. The new GetDataQualityResultV2, BatchGetDataQualityResultV2, and ListDataQualityResultsV2 operations return data quality results published from any supported data processing engine. (0f677b72)
  • client-bedrock-agentcore: AgentCore Memory now supports Long-Term Memory Time-to-Live on Batch APIs. (39cfa46b)
  • client-pinpoint-sms-voice-v2: DescribePhoneNumbers and DescribeSenderIds now return an optional PricingTier field that indicates whether a phone number, sender ID, short code, or long code is classified as Domestic or International, enabling customers to identify origination identities eligible for local pricing. (47e4631e)
  • client-omics: AWS HealthOmics now supports private workflow runs using VPC resources shared across accounts via AWS RAM. A new optional vpcOwnerAccountId field in CreateConfiguration's VpcConfig allows customers to specify the account that owns the shared subnets and security groups. (a5ee15fe)
  • client-devops-agent: Adds support for the includedData field in GetAgentSpace and ListAgentSpaces APIs (1613a423)
  • client-mediaconnect: This release adds support for MediaConnect Router high-bitrate tiers. It also adds a configurable audio reference level for NDI flows, and enhanced source metadata that includes color information and transport stream ID. (187bb041)
  • client-securityagent: Adds support for Jira integration provider in AWS Security Agent. (892b1e4e)
  • client-cloudwatchomni: Adds support for updating agentCoreEvaluationRoleArn in UpdateSpace API (afef0038)
Bug Fixes
  • core/httpAuthSchemes: skip clock-skew sampling for event-stream outputs (#8346) (345466f4)

For list of updated packages, view updated-packages.md in assets-3.1150.0.zip

v3.1149.0

3.1149.0(2026-10-09)

Chores
  • codegen: sync for endpoint cache fix and pre-schema error fallback (#8341) (5773a751)
New Features
  • client-quicksight: Adds granular custom permissions for the Gong action connector (GongAction, CreateAndUpdateGongAction, ShareGongAction, UseGongAction) and for create, update, and share operations on 45 data source connectors, such as Amazon S3 and Snowflake, through the Custom Permissions APIs. (c5d26e39)
  • client-deadline: The new ListMemberships API enables users to discover their memberships across Deadline Cloud resources, enabling scoped users of Deadline resources to discover and interact with the resources they have been provided scoped access to. (0d7406c7)
  • client-marketplace-metering: AWS Marketplace Metering Service adds AgreementId to ResolveCustomer API response. (9653f5cc)
  • client-mediatailor: Add caching settings to http functions (7ac7530b)
  • client-securityagent: Adds a test scope field to specify whether a pentest targets a web application or a generative AI application. (1cc5ba6a)

... (truncated)

Changelog

Sourced from @​aws-sdk/lib-storage's changelog.

3.1150.0 (2026-10-12)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1148.0 (2026-10-08)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1147.0 (2026-10-06)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1146.0 (2026-10-02)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1145.0 (2026-10-01)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1144.0 (2026-09-30)

... (truncated)

Commits

Updates @aws-sdk/s3-request-presigner from 3.1089.0 to 3.1150.0

Release notes

Sourced from @​aws-sdk/s3-request-presigner's releases.

v3.1150.0

3.1150.0(2026-10-12)

Documentation Changes
  • client-lambda: Doc updates to reposition Lambda Functions as Lambda Event Functions (618497da)
New Features
  • clients: update client endpoints as of 2026-10-12 (39b07192)
  • client-pcs: Adding scheduler version to RegisterComputeNodeGroup API. A compute node uses this value to run the matching scheduler version. (8085dcda)
  • client-bedrock-agentcore-control: AgentCore Memory now supports configuring Long-Term Memory Time-to-Live (TTL) on Memory Strategies. (93d530e9)
  • client-lambda-core: Lambda Network Connector now supports Lambda Web Functions, letting them reach private VPC resources, and adds versioning, each connector update creates an immutable version that revisions pin to, so customers can roll out and roll back networking changes without affecting running workloads (7ca09fa2)
  • client-lambda-web: Lambda Web Functions GA launch. Lambda Web Functions enable customers to run web applications and API backends (e817ea05)
  • client-sagemakertrainingsessionruntime: Amazon SageMaker Training Session Runtime provides APIs for executing operations within active training sessions, including asynchronous training operations, sampling and inference requests, and streaming real-time model responses, enabling programmatic control over the training loop. (9c1af7bd)
  • client-sagemaker: Amazon SageMaker Training Session is a managed service for training on shared GPU infrastructure. It provides full lifecycle management of training sessions and exposes low-level primitive APIs for operations like forward-backward passes, optimizer steps, and state management. (94f32429)
  • client-observabilityadmin: Adding support for TransactionSearch telemetry rules. (49992d7e)
  • client-glue: Adds new AWS Glue Data Quality APIs to retrieve and list data quality evaluation results. The new GetDataQualityResultV2, BatchGetDataQualityResultV2, and ListDataQualityResultsV2 operations return data quality results published from any supported data processing engine. (0f677b72)
  • client-bedrock-agentcore: AgentCore Memory now supports Long-Term Memory Time-to-Live on Batch APIs. (39cfa46b)
  • client-pinpoint-sms-voice-v2: DescribePhoneNumbers and DescribeSenderIds now return an optional PricingTier field that indicates whether a phone number, sender ID, short code, or long code is classified as Domestic or International, enabling customers to identify origination identities eligible for local pricing. (47e4631e)
  • client-omics: AWS HealthOmics now supports private workflow runs using VPC resources shared across accounts via AWS RAM. A new optional vpcOwnerAccountId field in CreateConfiguration's VpcConfig allows customers to specify the account that owns the shared subnets and security groups. (a5ee15fe)
  • client-devops-agent: Adds support for the includedData field in GetAgentSpace and ListAgentSpaces APIs (1613a423)
  • client-mediaconnect: This release adds support for MediaConnect Router high-bitrate tiers. It also adds a configurable audio reference level for NDI flows, and enhanced source metadata that includes color information and transport stream ID. (187bb041)
  • client-securityagent: Adds support for Jira integration provider in AWS Security Agent. (892b1e4e)
  • client-cloudwatchomni: Adds support for updating agentCoreEvaluationRoleArn in UpdateSpace API (afef0038)
Bug Fixes
  • core/httpAuthSchemes: skip clock-skew sampling for event-stream outputs (#8346) (345466f4)

For list of updated packages, view updated-packages.md in assets-3.1150.0.zip

v3.1149.0

3.1149.0(2026-10-09)

Chores
  • codegen: sync for endpoint cache fix and pre-schema error fallback (#8341) (5773a751)
New Features
  • client-quicksight: Adds granular custom permissions for the Gong action connector (GongAction, CreateAndUpdateGongAction, ShareGongAction, UseGongAction) and for create, update, and share operations on 45 data source connectors, such as Amazon S3 and Snowflake, through the Custom Permissions APIs. (c5d26e39)
  • client-deadline: The new ListMemberships API enables users to discover their memberships across Deadline Cloud resources, enabling scoped users of Deadline resources to discover and interact with the resources they have been provided scoped access to. (0d7406c7)
  • client-marketplace-metering: AWS Marketplace Metering Service adds AgreementId to ResolveCustomer API response. (9653f5cc)
  • client-mediatailor: Add caching settings to http functions (7ac7530b)
  • client-securityagent: Adds a test scope field to specify whether a pentest targets a web application or a generative AI application. (1cc5ba6a)

... (truncated)

Changelog

Sourced from @​aws-sdk/s3-request-presigner's changelog.

3.1150.0 (2026-10-12)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1148.0 (2026-10-08)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1147.0 (2026-10-06)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1146.0 (2026-10-02)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1145.0 (2026-10-01)

Note: Version bump only for package @​aws-sdk/s3-request-presigner

3.1144.0 (2026-09-30)

... (truncated)

Commits

Updates @tanstack/react-query from 5.101.2 to 5.104.2

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.104.2
    • @​tanstack/react-query@​5.104.2

@​tanstack/react-query-next-experimental@​5.104.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.104.2

@​tanstack/react-query-persist-client@​5.104.2

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.104.2
    • @​tanstack/react-query@​5.104.2

@​tanstack/react-query@​5.104.2

Patch Changes

  • Updated dependencies [03e8c39]:
    • @​tanstack/query-core@​5.104.2

@​tanstack/react-query-devtools@​5.104.1

Patch Changes

  • Updated dependencies [ec060b6]:
    • @​tanstack/query-devtools@​5.104.1
    • @​tanstack/react-query@​5.104.1

@​tanstack/react-query-next-experimental@​5.104.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.104.1

@​tanstack/react-query-persist-client@​5.104.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.104.1
    • @​tanstack/react-query@​5.104.1

@​tanstack/react-query@​5.104.1

Patch Changes

  • Updated dependencies []:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.2

Patch Changes

  • Updated dependencies [03e8c39]:
    • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.104.1

5.104.0

Minor Changes

Patch Changes

  • Updated dependencies [5279b05]:
    • @​tanstack/query-core@​5.104.0

5.103.3

Patch Changes

  • #11647 1c9693e - fix(codemods): avoid copying unnecessary files from codemods project
  • Updated dependencies []:
    • @​tanstack/query-core@​5.103.3

5.103.2

Patch Changes

  • Updated dependencies [8a28904]:
    • @​tanstack/query-core@​5.103.2

5.103.1

Patch Changes

5.103.0

Patch Changes

... (truncated)

Commits
  • b699b52 ci: Version Packages (#11849)
  • e22e7c4 chore: test TypeScript 7.1 preview and drop 5.6 (#11947)
  • df78a9d chore(*): pass the root 'settings' to the package oxlint configs, which 'exte...
  • 833062c chore: replace prettier with oxfmt (#11939)
  • d0cfa6a chore: replace eslint with oxlint (#11938)
  • 0012ec1 docs(react-query): add JSDoc to the properties of the exported interfaces and...
  • b5e8e7b docs(react-query): add JSDoc to the exported classes, methods, and arrow func...
  • 01abab3 docs(*): note that 'throwOnError' makes the hook rethrow the errors of 'mutat...
  • b42166e docs(react-query): add JSDoc to the exported interfaces and type aliases (#11...
  • 205d422 docs(*): add missing JSDoc descriptions and enforce 'jsdoc/require-descriptio...
  • Additional commits viewable in compare view

Updates i18next from 26.3.6 to 26.4.4

Release notes

Sourced from i18next's releases.

v26.4.4

  • fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
  • fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

  • perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

v26.4.2

  • fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

v26.4.1

  • fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).

v26.4.0

  • perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
  • chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.
Changelog

Sourced from i18next's changelog.

26.4.4

  • fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. See advisory GHSA-5jr9-983r-c8x4, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
  • fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

26.4.3

  • perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

26.4.2

  • fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

26.4.1

  • fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).

26.4.0

  • perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
  • chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.
Commits
  • f6a7746 26.4.4
  • 25988d5 build
  • c9f8eba fix(security): nesting regexp ReDoS on unclosed $t( and single-pass nest(), c...
  • 0d2845a 26.4.3
  • a2dbe15 build
  • e75843f perf: cache non-empty bundles in hasLanguageSomeTranslations, changelog v26.4.3
  • edaea71 Fix TypeScript examples build and update them to i18next v26 (#2448)
  • 4ebd19d docs: "For AI assistants" paragraph in the README and a fuller saveMissing JSDoc
  • 4dba50f 26.4.2
  • e436b62 build
  • Additional commits viewable in compare view

Updates node-sqlite3-wasm from 0.8.59 to 0.8.60

Release notes

Sourced from node-sqlite3-wasm's releases.

v0.8.60

What's Changed

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/minor-and-patch-de69af9c76 branch from 7df583c to 7cb86b5 Compare October 9, 2026 18:26
@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 2…
7414ddd 
…0 updates

Bumps the minor-and-patch group with 20 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1089.0` | `3.1150.0` |
| [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) | `3.1089.0` | `3.1150.0` |
| [@aws-sdk/s3-request-presigner](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/s3-request-presigner) | `3.1089.0` | `3.1150.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.2` | `5.104.2` |
| [i18next](https://github.com/i18next/i18next) | `26.3.6` | `26.4.4` |
| [node-sqlite3-wasm](https://github.com/tndrle/node-sqlite3-wasm) | `0.8.59` | `0.8.60` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.3.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.3.0` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.10` | `17.0.16` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.1` | `14.6.8` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.6.5` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.3.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.3` | `6.1.2` |
| [conventional-changelog-conventionalcommits](https://github.com/conventional-changelog/conventional-changelog/tree/HEAD/packages/conventional-changelog-conventionalcommits) | `10.2.1` | `10.4.1` |
| [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.12.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.7.0` | `17.13.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.65.0` | `8.71.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.3.4` |



Updates `@aws-sdk/client-s3` from 3.1089.0 to 3.1150.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1150.0/clients/client-s3)

Updates `@aws-sdk/lib-storage` from 3.1089.0 to 3.1150.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1150.0/lib/lib-storage)

Updates `@aws-sdk/s3-request-presigner` from 3.1089.0 to 3.1150.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/s3-request-presigner/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1150.0/packages/s3-request-presigner)

Updates `@tanstack/react-query` from 5.101.2 to 5.104.2
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.2/packages/react-query)

Updates `i18next` from 26.3.6 to 26.4.4
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.3.6...v26.4.4)

Updates `node-sqlite3-wasm` from 0.8.59 to 0.8.60
- [Release notes](https://github.com/tndrle/node-sqlite3-wasm/releases)
- [Commits](tndrle/node-sqlite3-wasm@v0.8.59...v0.8.60)

Updates `react` from 19.2.7 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `@types/react` from 19.2.17 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.7 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `@types/react-dom` from 19.2.3 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-i18next` from 17.0.10 to 17.0.16
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.10...v17.0.16)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

Updates `@testing-library/user-event` from 14.6.1 to 14.6.8
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.1...v14.6.8)

Updates `@types/node` from 26.1.1 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.17 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.3 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.0.3 to 6.1.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react)

Updates `conventional-changelog-conventionalcommits` from 10.2.1 to 10.4.1
- [Release notes](https://github.com/conventional-changelog/conventional-changelog/releases)
- [Changelog](https://github.com/conventional-changelog/conventional-changelog/blob/master/packages/conventional-changelog-conventionalcommits/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/conventional-changelog/commits/conventional-changelog-conventionalcommits-v10.4.1/packages/conventional-changelog-conventionalcommits)

Updates `eslint` from 10.7.0 to 10.12.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.7.0...v10.12.0)

Updates `globals` from 17.7.0 to 17.13.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.7.0...v17.13.0)

Updates `typescript-eslint` from 8.65.0 to 8.71.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/typescript-eslint)

Updates `vite` from 8.1.5 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1127.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/lib-storage"
  dependency-version: 3.1127.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/s3-request-presigner"
  dependency-version: 3.1127.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.102.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: conventional-changelog-conventionalcommits
  dependency-version: 10.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint
  dependency-version: 10.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: globals
  dependency-version: 17.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: i18next
  dependency-version: 26.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: node-sqlite3-wasm
  dependency-version: 0.8.60
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-i18next
  dependency-version: 17.0.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: typescript-eslint
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/minor-and-patch-de69af9c76 branch from 7cb86b5 to 7414ddd Compare October 16, 2026 18:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants