build(deps): bump the web group across 1 directory with 24 updates by dependabot[bot] · Pull Request #424 · devlive-community/toolforge

dependabot · 2026-11-11T21:33:04Z

Bumps the web group with 24 updates in the / directory:

Package	From	To
eslint	`10.11.0`	`10.14.0`
globals	`17.12.0`	`17.14.0`
typescript-eslint	`8.70.1`	`8.72.1`
@tauri-apps/api	`2.11.1`	`2.12.4`
i18next	`26.4.2`	`27.0.1`
lucide-react	`1.47.0`	`1.70.0`
react	`19.3.0`	`19.3.1`
react-dom	`19.3.0`	`19.3.1`
react-i18next	`17.0.15`	`18.0.1`
zustand	`5.0.15`	`5.1.0`
@tailwindcss/vite	`4.3.3`	`4.3.5`
@tauri-apps/cli	`2.11.5`	`2.12.4`
@vitejs/plugin-react	`6.1.1`	`6.2.1`
tailwindcss	`4.3.3`	`4.3.5`
vite	`8.3.0`	`8.3.6`
@types/node	`24.13.6`	`26.6.6`
@tauri-apps/plugin-clipboard-manager	`2.3.3`	`2.5.0`
@tauri-apps/plugin-dialog	`2.7.3`	`2.8.4`
@codemirror/language	`6.12.4`	`6.13.1`
@codemirror/legacy-modes	`6.5.4`	`6.5.5`
@codemirror/view	`6.43.13`	`6.43.15`
@lezer/highlight	`1.2.3`	`1.2.5`
@tanstack/react-virtual	`3.14.13`	`3.14.26`
@uiw/react-codemirror	`4.25.11`	`4.25.12`

Updates eslint from 10.11.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)

827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)

161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)

6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)

9155e14 fix: Update @humanfs/node dependency version (#21434) (Nicholas C. Zakas)

cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)

5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)

dab466e docs: Update README (GitHub Actions Bot)

97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)

7697550 docs: Update README (GitHub Actions Bot)

0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)

0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)

e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)

6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])

a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)

67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)

276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])

449724e chore: update ecosystem plugins (#21420) (ESLint Bot)

8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

v10.13.0

Features

48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)

a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)

66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

4783a68 docs: Update README (GitHub Actions Bot)

43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])

95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)

317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)

b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)

47b7063 chore: update dependency @eslint/json to ^2.1.1 (#21398) (renovate[bot])

... (truncated)

Commits

12cbff4 10.14.0
6b696e7 Build: changelog update for 10.14.0
0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
0f94f47 docs: remove zh-hans from docs language switcher (#21437)
dab466e docs: Update README
827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
161558a fix: handle LS, PS and empty hashbang comments (#21419)
Additional commits viewable in compare view

Updates globals from 17.12.0 to 17.14.0

Release notes

Sourced from globals's releases.

v17.14.0

Update globals (2026-11-01) (#355) 7abfb5d

sindresorhus/globals@v17.13.0...v17.14.0

v17.13.0

Update globals (2026-10-01) (#354) b007369

sindresorhus/globals@v17.12.0...v17.13.0

Commits

3080111 17.14.0
c61cc23 Tweaks
7abfb5d Update globals (2026-11-01) (#355)
ce512bc 17.13.0
b007369 Update globals (2026-10-01) (#354)
16cb1fe Meta tweaks
See full diff in compare view

Updates typescript-eslint from 8.70.1 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)

eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)

typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

Evyatar Daud @StyleShit

Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

eslint-plugin: lazy load rules (#13010)

eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)

typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)

eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)

eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)

eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)

eslint-plugin: [require-array-sort-compare] check tuples (#13058)

eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)

type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)

typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

Evyatar Daud @StyleShit

Junichiro Kasuya @jksy

Mitch Fultz @fitchmultz

Shaan GS @ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.1 (2026-10-05)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.0 (2026-09-28)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

4ad6b75 chore(release): publish 8.72.1
7757694 chore: cleanup typecheck & build and fix race condition (#13071)
a4c2603 chore(release): publish 8.72.0
7488d68 chore(release): publish 8.71.2
d57b8da chore(release): publish 8.71.1
8695664 chore(release): publish 8.71.0
See full diff in compare view

Updates @tauri-apps/api from 2.11.1 to 2.12.4

Release notes

Sourced from @tauri-apps/api's releases.

`@tauri-apps/api` v2.12.4

All found vulnerabilities were already reviewed and decided to be ignored
1 ignored: 1 high

[2.12.4]

What's Changed

dc637db65 (#16260) Improve menu documentation.

$ pnpm build && cd ./dist && pnpm publish --access public --loglevel debug --no-git-checks
$ rollup -c --configPlugin typescript
�[36m
�[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts�[22m → �[1m./dist, ./dist�[22m...�[39m
�[32mcreated �[1m./dist, ./dist�[22m in �[1m955ms�[22m�[39m
�[36m
�[1msrc/index.ts�[22m → �[1m../../crates/tauri/scripts/bundle.global.js�[22m...�[39m
�[32mcreated �[1m../../crates/tauri/scripts/bundle.global.js�[22m in �[1m1.5s�[22m�[39m
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/21//idtoken/c37ddb61-7d6d-84f8-af6e-d0b7e7d7955a/56cb7a72-c3b4-5319-90d2-88ed76ba30ee?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 128ms
📦 @tauri-apps/api@2.12.4 → https://registry.npmjs.org/
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/21//idtoken/c37ddb61-7d6d-84f8-af6e-d0b7e7d7955a/56cb7a72-c3b4-5319-90d2-88ed76ba30ee?api-version=2.0&audience=sigstore 200 58ms
Signed provenance statement with source and build information
✅ Published package @tauri-apps/api@2.12.4

`@tauri-apps/api` v2.12.3

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.3]

... (truncated)

Commits

59b63ab Apply Version Updates From Current Changes (#16255)
55883af fix(bundler): Update rpm-rs to 0.30 (#15639)
744ff2b chore(deps): bump rustls to 0.23.46
c95be46 fix(cli): xcode-script tauri CWD rewrite (#16287)
dc637db chore: add missing api change file (#16260)
b948762 fix(macos-sign): import the signing certificate as an explicit pkcs12 (fix: #...
7b673dd fix(core): drop late mobile plugin responses instead of panicking (#16146)
5a61498 fix(bundler): keep script stderr in errors and hint at the Finder permission ...
5a3cbfc fix(macos-codesign): Inline apple-codesign code (#16279)
141d1c0 fix(acl): resolve permission files after the target dir is moved (#16199)
Additional commits viewable in compare view

Updates i18next from 26.4.2 to 27.0.1

Release notes

Sourced from i18next's releases.

v27.0.1

fix: each cached format keeps at most 1000 formatters, dropping the oldest when full. This covers the built-in formats (number, currency, datetime, relativetime, list) with the default cacheInBuiltFormats: true, and formats added with addCached. The cache key holds all t() options, including the interpolated values, so every new amount, date or name added a formatter that was never released: about 50 MB per 100k values, growing without end in a long-running server. A dropped formatter is made again from the same language and options, so the output does not change. Thanks @liustack (#2467).

v27.0.0

This is a major breaking release. It changes defaults that most setups had to override, gives every instance its own logger and post-processors, refuses language codes that look like markup or paths, and removes options that were broken or had no effect. 26.7 warned in debug mode about most of the runtime changes. The migration guide has the details; to keep the v26 behavior where an option exists:
i18next.init({
  fallbackLng: 'dev', // or better your source language: there is no implicit 'dev' any more
  returnEmptyString: true, // an empty translation is a translation again
  cleanCode: false, // keep codes without a region as they are ('EN' stays 'EN')
});
declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: false;
    returnEmptyString: true;
  }
}
Changed defaults

fallbackLng defaults to false instead of ['dev']. Without a fallbackLng, i18next no longer requests dev from the backend (/locales/dev/translation.json with i18next-http-backend), and saveMissing sends missing keys for the current language instead of dev. With supportedLngs and no fallbackLng, an unsupported language leaves language and languages unset, as fallbackLng: false already did. Set fallbackLng to your main language, or to 'dev' for the previous behavior.

returnEmptyString defaults to false: an empty translation falls back like a missing value (to the fallback language, the default value or the key), as null already does. i18next-cli writes '' for untranslated keys in the other languages, which now fall back instead of rendering blank. An explicit '' default from code still counts: t('key', '') and t('key', { defaultValue: '' }) return ''. Set returnEmptyString: true (in init() and in CustomTypeOptions) if an empty translation is meant to render nothing, for example for a Locize project with "preserve empty strings" on.

Language codes without a region get their canonical casing, as codes with one already did: 'EN' becomes 'en'. Only the casing changes: aliases like tl, iw or eng stay as they are ('TL' becomes 'tl'), and so do codes that are not BCP 47 (en_US, my_custom). i18next 26.7.0 and 26.7.1 warned that v27 turns iw into he or tl into fil; that was wrong and 26.7.2 corrects it. iw, tl and the like stay as they are. Set cleanCode: false to keep codes without a region exactly as they are. cleanCode is deprecated.

types: strictInterpolationChecks defaults to true: t() needs the options for a string with variables, so a {{name}} cannot be left out of a call. Type a wrapper around t() with ParseKeysWithoutVariables, declare the variables interpolation.defaultVariables fills in with defaultVariables in CustomTypeOptions, or set strictInterpolationChecks: false to keep the v26 types (also for ICU and MF2 messages, whose arguments are required either way). The fixes below close the gap plural keys left.

types: returnEmptyString defaults to false in TypeOptions too, so a key whose value is '' is typed as the key.

Changed behavior

The logger and the post-processors belong to the instance. use() of a logger or a post-processor on one instance no longer changes the others, and the init() of one instance no longer rewires the logging of all of them. An instance from createInstance() does not see what the default i18next instance (or any other) registered: call use() on each instance. A clone (cloneInstance()) keeps its parent's logger and post-processors, also those its parent registers later, and what it registers itself stays its own. A plugin that calls use() from its own init() (the Locize InContext editor) registers right away, as before. services.logger stays the instance's logger, with forward(). In debug mode, a postProcess name that is not registered on the instance logs a warning.

An object or an array without returnObjects is handled like a missing key: t() returns the default value if one is passed, else the key (with appendNamespaceToMissingKey, parseMissingKeyHandler and the post-processors applied), instead of the sentence key '... (en)' returned an object instead of string., which ended up in the UI. It is not saved as missing, since the key exists. The debug warning stays, and returnedObjectHandler still decides what is returned when it is set (returnedObjectHandler: (key) => `key '${key}' returned an object instead of string.` brings a sentence back).

addResources() keeps every value: numbers, booleans and objects were dropped silently, only strings and arrays were added.

The default escape no longer escapes /: '$10/month' stays '$10/month' instead of '$10/month', and dates in react-i18next's Trans no longer render as 17/12/2025 (discussion 2199). &, <, >, " and ' are still escaped, which covers HTML text and quoted attributes; a / cannot end either. Update snapshots that contain /, or pass your own interpolation.escape to keep escaping it.

A language code from lng, changeLanguage(), a language detector or loadLanguages() that does not have the shape of isSafeLanguageCode() (letters, digits, -, _, @ and ., no .., at most 128 characters) is refused unless it is configured: listed in supportedLngs, in a fallbackLng that is not a function or in preload, or a language in resources, as given to init(). changeLanguage() continues as with an unsupported code: with the detector's next code, else the fallback language, else none (with fallbackLng: false, a code refused at init() leaves language unset); loadLanguages() skips it. With supportedLngs, the input is matched as before ('de-DE;q=0.9' still gives 'de'), and only an unsafe match is refused, which only nonExplicitSupportedLngs can return ('de-<x>' for a supported 'de'). Without supportedLngs, a detector that returned "><img src=x onerror=alert(1)> made that string i18next.language, which apps put into <html lang>, and backends were asked to load it. BCP 47, POSIX (en_US.UTF-8@euro, sr@latin) and private-use codes (en-x-pirate) pass; to use a code with other characters (+, spaces, /), list it in supportedLngs. In debug mode a refused code logs a warning.

createInstance(options) merges the defaults right away, without initializing: before init(), instance.options has the defaults, getFixedT() no longer throws (t() returns '' until init()), and debug: true already shows the warnings before init(). init() still tells the options you set from the defaults, so a keySeparator or nsSeparator passed to createInstance() counts as set by you (#2426). loadNamespaces() before init() does nothing and calls back, as it did for an instance without options.

keySeparator: false means flat keys only: a lookup no longer splits a key at the text false (t('nestedfalsec') returned the value of nested.c), and a selector path is joined with . like a key prefix, so selectors work on the flat keys ($ => $['a.b'] and $ => $.a.b look up the flat key 'a.b'; $ => $.nested.c no longer resolves nested, then c). types: with keySeparator: false in CustomTypeOptions, the keys are the flat keys (no nestedfalsec keys), a key containing false is no longer split, and keyPrefix takes the parts of the flat keys before a ., which is how getFixedT() joins it ('nested' for 'nested.c'). A key prefix combined with selectors is not typed for flat keys.

Removed

The dotted language in the resource store calls: getResource('en.translation.key'), addResource('en.translation.key', value) and addResourceBundle('en.translation', resources). Pass language, namespace and key as separate arguments; addResource(), addResources() and addResourceBundle() throw a TypeError for the dotted form. A language code with a . (de_DE.UTF-8) is now a language like any other.

interpolation.prefixEscaped, suffixEscaped, nestingPrefixEscaped and nestingSuffixEscaped, which were inserted into the RegExp unescaped. Pass the literal delimiters as prefix, suffix, nestingPrefix and nestingSuffix.

types: compatibilityJSON (it had no effect since v24).

types: the option types of plugins. locizeLastUsed is declared by locize-lastused (5.1.0 and later). ReactOptions stays importable from 'i18next' but is empty: react-i18next fills it in (17.1.13 and later, and 18), so the react options are checked when react-i18next is in the program.

types: the _ and $ helpers in typescript/t.d.ts and typescript/options.d.ts ($FirstNamespace, _ValueOf and 84 more) are no longer importable; every declaration of those files counted as exported. The other types of those files (TOptionsBase, TFunctionSignature, ParseTReturn, ...) are now exported on purpose. If you imported one of the hidden helpers, please open an issue: exporting it again does not break anything.

The root index.js, a CommonJS shim that the exports map made unreachable.

... (truncated)

Changelog

Sourced from i18next's changelog.

27.0.1

fix: each cached format keeps at most 1000 formatters, dropping the oldest when full. This covers the built-in formats (number, currency, datetime, relativetime, list) with the default cacheInBuiltFormats: true, and formats added with addCached. The cache key holds all t() options, including the interpolated values, so every new amount, date or name added a formatter that was never released: about 50 MB per 100k values, growing without end in a long-running server. A dropped formatter is made again from the same language and options, so the output does not change. Thanks @liustack (#2467).

27.0.0

This is a major breaking release. It changes defaults that most setups had to override, gives every instance its own logger and post-processors, refuses language codes that look like markup or paths, and removes options that were broken or had no effect. 26.7 warned in debug mode about most of the runtime changes. The migration guide has the details; to keep the v26 behavior where an option exists:
i18next.init({
  fallbackLng: 'dev', // or better your source language: there is no implicit 'dev' any more
  returnEmptyString: true, // an empty translation is a translation again
  cleanCode: false, // keep codes without a region as they are ('EN' stays 'EN')
});
declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: false;
    returnEmptyString: true;
  }
}
Changed defaults

fallbackLng defaults to false instead of ['dev']. Without a fallbackLng, i18next no longer requests dev from the backend (/locales/dev/translation.json with i18next-http-backend), and saveMissing sends missing keys for the current language instead of dev. With supportedLngs and no fallbackLng, an unsupported language leaves language and languages unset, as fallbackLng: false already did. Set fallbackLng to your main language, or to 'dev' for the previous behavior.

returnEmptyString defaults to false: an empty translation falls back like a missing value (to the fallback language, the default value or the key), as null already does. i18next-cli writes '' for untranslated keys in the other languages, which now fall back instead of rendering blank. An explicit '' default from code still counts: t('key', '') and t('key', { defaultValue: '' }) return ''. Set returnEmptyString: true (in init() and in CustomTypeOptions) if an empty translation is meant to render nothing, for example for a Locize project with "preserve empty strings" on.

Language codes without a region get their canonical casing, as codes with one already did: 'EN' becomes 'en'. Only the casing changes: aliases like tl, iw or eng stay as they are ('TL' becomes 'tl'), and so do codes that are not BCP 47 (en_US, my_custom). i18next 26.7.0 and 26.7.1 warned that v27 turns iw into he or tl into fil; that was wrong and 26.7.2 corrects it. iw, tl and the like stay as they are. Set cleanCode: false to keep codes without a region exactly as they are. cleanCode is deprecated.

types: strictInterpolationChecks defaults to true: t() needs the options for a string with variables, so a {{name}} cannot be left out of a call. Type a wrapper around t() with ParseKeysWithoutVariables, declare the variables interpolation.defaultVariables fills in with defaultVariables in CustomTypeOptions, or set strictInterpolationChecks: false to keep the v26 types (also for ICU and MF2 messages, whose arguments are required either way). The fixes below close the gap plural keys left.

types: returnEmptyString defaults to false in TypeOptions too, so a key whose value is '' is typed as the key.

Changed behavior

The logger and the post-processors belong to the instance. use() of a logger or a post-processor on one instance no longer changes the others, and the init() of one instance no longer rewires the logging of all of them. An instance from createInstance() does not see what the default i18next instance (or any other) registered: call use() on each instance. A clone (cloneInstance()) keeps its parent's logger and post-processors, also those its parent registers later, and what it registers itself stays its own. A plugin that calls use() from its own init() (the Locize InContext editor) registers right away, as before. services.logger stays the instance's logger, with forward(). In debug mode, a postProcess name that is not registered on the instance logs a warning.

An object or an array without returnObjects is handled like a missing key: t() returns the default value if one is passed, else the key (with appendNamespaceToMissingKey, parseMissingKeyHandler and the post-processors applied), instead of the sentence key '... (en)' returned an object instead of string., which ended up in the UI. It is not saved as missing, since the key exists. The debug warning stays, and returnedObjectHandler still decides what is returned when it is set (returnedObjectHandler: (key) => `key '${key}' returned an object instead of string.` brings a sentence back).

addResources() keeps every value: numbers, booleans and objects were dropped silently, only strings and arrays were added.

The default escape no longer escapes /: '$10/month' stays '$10/month' instead of '$10/month', and dates in react-i18next's Trans no longer render as 17/12/2025 (discussion 2199). &, <, >, " and ' are still escaped, which covers HTML text and quoted attributes; a / cannot end either. Update snapshots that contain /, or pass your own interpolation.escape to keep escaping it.

A language code from lng, changeLanguage(), a language detector or loadLanguages() that does not have the shape of isSafeLanguageCode() (letters, digits, -, _, @ and ., no .., at most 128 characters) is refused unless it is configured: listed in supportedLngs, in a fallbackLng that is not a function or in preload, or a language in resources, as given to init(). changeLanguage() continues as with an unsupported code: with the detector's next code, else the fallback language, else none (with fallbackLng: false, a code refused at init() leaves language unset); loadLanguages() skips it. With supportedLngs, the input is matched as before ('de-DE;q=0.9' still gives 'de'), and only an unsafe match is refused, which only nonExplicitSupportedLngs can return ('de-<x>' for a supported 'de'). Without supportedLngs, a detector that returned "><img src=x onerror=alert(1)> made that string i18next.language, which apps put into <html lang>, and backends were asked to load it. BCP 47, POSIX (en_US.UTF-8@euro, sr@latin) and private-use codes (en-x-pirate) pass; to use a code with other characters (+, spaces, /), list it in supportedLngs. In debug mode a refused code logs a warning.

createInstance(options) merges the defaults right away, without initializing: before init(), instance.options has the defaults, getFixedT() no longer throws (t() returns '' until init()), and debug: true already shows the warnings before init(). init() still tells the options you set from the defaults, so a keySeparator or nsSeparator passed to createInstance() counts as set by you (#2426). loadNamespaces() before init() does nothing and calls back, as it did for an instance without options.

keySeparator: false means flat keys only: a lookup no longer splits a key at the text false (t('nestedfalsec') returned the value of nested.c), and a selector path is joined with . like a key prefix, so selectors work on the flat keys ($ => $['a.b'] and $ => $.a.b look up the flat key 'a.b'; $ => $.nested.c no longer resolves nested, then c). types: with keySeparator: false in CustomTypeOptions, the keys are the flat keys (no nestedfalsec keys), a key containing false is no longer split, and keyPrefix takes the parts of the flat keys before a ., which is how getFixedT() joins it ('nested' for 'nested.c'). A key prefix combined with selectors is not typed for flat keys.

Removed

The dotted language in the resource store calls: getResource('en.translation.key'), addResource('en.translation.key', value) and addResourceBundle('en.translation', resources). Pass language, namespace and key as separate arguments; addResource(), addResources() and addResourceBundle() throw a TypeError for the dotted form. A language code with a . (de_DE.UTF-8) is now a language like any other.

interpolation.prefixEscaped, suffixEscaped, nestingPrefixEscaped and nestingSuffixEscaped, which were inserted into the RegExp unescaped. Pass the literal delimiters as prefix, suffix, nestingPrefix and nestingSuffix.

types: compatibilityJSON (it had no effect since v24).

types: the option types of plugins. locizeLastUsed is declared by locize-lastused (5.1.0 and later). ReactOptions stays importable from 'i18next' but is empty: react-i18next fills it in (17.1.13 and later, and 18), so the react options are checked when react-i18next is in the program.

types: the _ and $ helpers in typescript/t.d.ts and typescript/options.d.ts ($FirstNamespace, _ValueOf and 84 more) are no longer importable; every declaration of those files counted as exported. The other types of those files (TOptionsBase, TFunctionSignature, ParseTReturn, ...) are now exported on purpose. If you imported one of the hidden helpers, please open an issue: exporting it again does not break anything.

... (truncated)

Commits

1cb5a7a 27.0.1
7f7216b changelog for 27.0.1
35fecdd fix: keep at most 1000 formatters in each cached format (#2467)
e22c212 27.0.0
846c76d changelog for 27.0.0
94320bc feat!: i18next 27, a major version with breaking changes
912869c 26.7.2
d71706a changelog for 26.7.2
4375f9d fix: the bare language code warning only announces v27's casing change, not a...
3cc5774 chore: update dependencies, close the minimatch and deepmerge alerts
Additional commits viewable in compare view

Updates lucide-react from 1.47.0 to 1.70.0

Release notes

Sourced from lucide-react's releases.

Version 1.70.0

What's Changed

fix(site): fix vercel.json redirects that land on 404 by @ericfennis in lucide-icons/lucide#5157

feat(icons): added square-dashed-search icon by @domarku in lucide-icons/lucide#5119

fix(lucide-react-native): emit runtime files for alias icon subpaths by @tlq5l in lucide-icons/lucide#5055

feat(icons): added moped icon by @jamiemlaw in lucide-icons/lucide#3373

feat(icons): added user-exclamation-point, user-round-exclamation-point icons by @ericfennis in lucide-icons/lucide#5144

feat(icons): added grid-3x3-off icon by @gridalchemy in lucide-icons/lucide#5071

New Contributors

@domarku made their first contribution in lucide-icons/lucide#5119

@tlq5l made their first contribution in lucide-icons/lucide#5055

@gridalchemy made their first contribution in lucide-icons/lucide#5071

Full Changelog: lucide-icons/lucide@1.69.0...1.70.0

Version 1.69.0

What's Changed

feat(icons): added package-pen icon by @ericfennis in lucide-icons/lucide#5154

feat(icons): added package-question-mark icon by @ericfennis in lucide-icons/lucide#5155

feat(icons): added opacity icon by @ilyavred in lucide-icons/lucide#4222

feat(icons): added circle-fading-check icon by @n2duc in lucide-icons/lucide#4089

New Contributors

@ilyavred made their first contribution in lucide-icons/lucide#4222

@n2duc made their first contribution in lucide-icons/lucide#4089

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

fix(site): keep sponsor tiers within content width by @ffgenius in lucide-icons/lucide#5149

feat(icons): added mango icon by @Prsenapati09 in lucide-icons/lucide#4902

chore(icons): Renamed *-warning and *-alert to *-exclamation-point by @ericfennis in lucide-icons/lucide#5143

New Contributors

@ffgenius made their first contribution in lucide-icons/lucide#5149

@Prsenapati09 made their first contribution in lucide-icons/lucide#4902

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

feat(site): Add sponsor page by @ericfennis in lucide-icons/lucide#5132

fix(icons): changed chef-hat icon by @karsa-mistmere in lucide-icons/lucide#4577

fix(icons): changed (circle|square)-letter-j by @karsa-mistmere in lucide-icons/lucide#5138

feat(icons): added globe-ban icon by @PrimeTestLab in lucide-icons/lucide#5020

chore(deps): bump playwright to 1.64.1 to support ubuntu 26.04 runners by @ericfennis in lucide-icons/lucide#5140

chore(deps): bump the svelte-deps group across 1 directory with 3 updates by @dependabot[bot] in lucide-icons/lucide#5139

feat(icons): added diagram-flow-horizontal, diagram-flow-vertical icons by @karsa-mistmere in lucide-icons/lucide#5125

... (truncated)

Commits

b196797 Update deps (#5146)

Bumps the web group with 24 updates in the / directory: | Package | From | To | | --- | --- | --- | | [eslint](https://github.com/eslint/eslint) | `10.11.0` | `10.14.0` | | [globals](https://github.com/sindresorhus/globals) | `17.12.0` | `17.14.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.70.1` | `8.72.1` | | [@tauri-apps/api](https://github.com/tauri-apps/tauri) | `2.11.1` | `2.12.4` | | [i18next](https://github.com/i18next/i18next) | `26.4.2` | `27.0.1` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.47.0` | `1.70.0` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [react-i18next](https://github.com/i18next/react-i18next) | `17.0.15` | `18.0.1` | | [zustand](https://github.com/pmndrs/zustand) | `5.0.15` | `5.1.0` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.3` | `4.3.5` | | [@tauri-apps/cli](https://github.com/tauri-apps/tauri) | `2.11.5` | `2.12.4` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.1` | `6.2.1` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.5` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.6` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.13.6` | `26.6.6` | | [@tauri-apps/plugin-clipboard-manager](https://github.com/tauri-apps/plugins-workspace) | `2.3.3` | `2.5.0` | | [@tauri-apps/plugin-dialog](https://github.com/tauri-apps/plugins-workspace) | `2.7.3` | `2.8.4` | | [@codemirror/language](https://github.com/codemirror/language) | `6.12.4` | `6.13.1` | | [@codemirror/legacy-modes](https://github.com/codemirror/legacy-modes) | `6.5.4` | `6.5.5` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.13` | `6.43.15` | | [@lezer/highlight](https://github.com/lezer-parser/highlight) | `1.2.3` | `1.2.5` | | [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.13` | `3.14.26` | | [@uiw/react-codemirror](https://github.com/uiwjs/react-codemirror) | `4.25.11` | `4.25.12` | Updates `eslint` from 10.11.0 to 10.14.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.11.0...v10.14.0) Updates `globals` from 17.12.0 to 17.14.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.12.0...v17.14.0) Updates `typescript-eslint` from 8.70.1 to 8.72.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint) Updates `@tauri-apps/api` from 2.11.1 to 2.12.4 - [Release notes](https://github.com/tauri-apps/tauri/releases) - [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/api-v2.11.1...@tauri-apps/api-v2.12.4) Updates `i18next` from 26.4.2 to 27.0.1 - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](i18next/i18next@v26.4.2...v27.0.1) Updates `lucide-react` from 1.47.0 to 1.70.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.70.0/packages/lucide-react) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `react-i18next` from 17.0.15 to 18.0.1 - [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md) - [Commits](i18next/react-i18next@v17.0.15...v18.0.1) Updates `zustand` from 5.0.15 to 5.1.0 - [Release notes](https://github.com/pmndrs/zustand/releases) - [Commits](pmndrs/zustand@v5.0.15...v5.1.0) Updates `@tailwindcss/vite` from 4.3.3 to 4.3.5 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/@tailwindcss-vite) Updates `@tauri-apps/cli` from 2.11.5 to 2.12.4 - [Release notes](https://github.com/tauri-apps/tauri/releases) - [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.11.5...@tauri-apps/cli-v2.12.4) Updates `@vitejs/plugin-react` from 6.1.1 to 6.2.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.2.1/packages/plugin-react) Updates `tailwindcss` from 4.3.3 to 4.3.5 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/tailwindcss) Updates `vite` from 8.3.0 to 8.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite) Updates `@types/node` from 24.13.6 to 26.6.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@tauri-apps/plugin-clipboard-manager` from 2.3.3 to 2.5.0 - [Release notes](https://github.com/tauri-apps/plugins-workspace/releases) - [Commits](tauri-apps/plugins-workspace@nfc-v2.3.3...fs-v2.5.0) Updates `@tauri-apps/plugin-dialog` from 2.7.3 to 2.8.4 - [Release notes](https://github.com/tauri-apps/plugins-workspace/releases) - [Commits](tauri-apps/plugins-workspace@dialog-v2.7.3...dialog-v2.8.4) Updates `@codemirror/language` from 6.12.4 to 6.13.1 - [Changelog](https://github.com/codemirror/language/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/language/commits) Updates `@codemirror/legacy-modes` from 6.5.4 to 6.5.5 - [Changelog](https://github.com/codemirror/legacy-modes/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/legacy-modes/commits) Updates `@codemirror/view` from 6.43.13 to 6.43.15 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@lezer/highlight` from 1.2.3 to 1.2.5 - [Changelog](https://github.com/lezer-parser/highlight/blob/main/CHANGELOG.md) - [Commits](https://github.com/lezer-parser/highlight/commits) Updates `@tanstack/react-virtual` from 3.14.13 to 3.14.26 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.26/packages/react-virtual) Updates `@uiw/react-codemirror` from 4.25.11 to 4.25.12 - [Release notes](https://github.com/uiwjs/react-codemirror/releases) - [Commits](uiwjs/react-codemirror@v4.25.11...v4.25.12) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web - dependency-name: globals dependency-version: 17.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web - dependency-name: typescript-eslint dependency-version: 8.72.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web - dependency-name: "@tauri-apps/api" dependency-version: 2.12.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web - dependency-name: i18next dependency-version: 27.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: web - dependency-name: lucide-react dependency-version: 1.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web - dependency-name: react-i18next dependency-version: 18.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: web - dependency-name: zustand dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web - dependency-name: "@tauri-apps/cli" dependency-version: 2.12.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: web - dependency-name: "@vitejs/plugin-react" dependency-version: 6.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web - dependency-name: tailwindcss dependency-version: 4.3.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web - dependency-name: vite dependency-version: 8.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web - dependency-name: "@types/node" dependency-version: 26.6.6 dependency-type: direct:development update-type: version-update:semver-major dependency-group: web - dependency-name: "@tauri-apps/plugin-clipboard-manager" dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web - dependency-name: "@tauri-apps/plugin-dialog" dependency-version: 2.8.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web - dependency-name: "@codemirror/language" dependency-version: 6.13.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web - dependency-name: "@codemirror/legacy-modes" dependency-version: 6.5.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web - dependency-name: "@codemirror/view" dependency-version: 6.43.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web - dependency-name: "@lezer/highlight" dependency-version: 1.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web - dependency-name: "@tanstack/react-virtual" dependency-version: 3.14.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web - dependency-name: "@uiw/react-codemirror" dependency-version: 4.25.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 11, 2026

Navigation Menu

Repository navigation

build(deps): bump the web group across 1 directory with 24 updates - #424

build(deps): bump the web group across 1 directory with 24 updates#424
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/web-a2d96df2c3

dependabot Bot commented on behalf of github Nov 11, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 11, 2026

v10.14.0

Features

Bug Fixes

Documentation

Chores

v10.13.0

Features

Bug Fixes

Documentation

Chores

v17.14.0

v17.13.0

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

❤️ Thank You

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

🩹 Fixes

❤️ Thank You

v8.71.2

8.72.1 (2026-10-26)

8.72.0 (2026-10-19)

8.71.2 (2026-10-12)

8.71.1 (2026-10-05)

8.71.0 (2026-09-28)

@​tauri-apps/api v2.12.4

[2.12.4]

What's Changed

@​tauri-apps/api v2.12.3

[2.12.3]

v27.0.1

v27.0.0

Changed defaults

Changed behavior

Removed

27.0.1

27.0.0

Changed defaults

Changed behavior

Removed

Version 1.70.0

What's Changed

New Contributors

Version 1.69.0

What's Changed

New Contributors

Version 1.68.0

What's Changed

New Contributors

Version 1.67.0

What's Changed

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@tauri-apps/api` v2.12.4

`@tauri-apps/api` v2.12.3