Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 13 updates - #109

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-95351ef971
Open

chore(deps): bump the production-dependencies group across 1 directory with 13 updates#109
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-95351ef971

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 13 updates in the / directory:

Package From To
chokidar 4.0.3 5.0.0
@tiptap/core 3.30.4 3.31.3
@tiptap/extension-document 3.30.4 3.31.3
@tiptap/extension-mention 3.30.4 3.31.3
@tiptap/extension-paragraph 3.30.4 3.31.3
@tiptap/extension-text 3.30.4 3.31.3
@tiptap/pm 3.30.4 3.31.3
@tiptap/react 3.30.4 3.31.3
@tiptap/suggestion 3.30.4 3.31.3
i18next 25.10.10 26.4.2
react-i18next 16.6.6 17.0.13
chalk 5.6.2 6.0.0
commander 14.0.3 15.0.0

Updates chokidar from 4.0.3 to 5.0.0

Release notes

Sourced from chokidar's releases.

5.0.0

  • Make the package ESM-only. Reduces on-disk package size from ~150kb to ~80kb
  • Increase minimum node.js version to v20.19. The versions starting from it support loading esm files from cjs
  • fix: Make types more precise paulmillr/chokidar#1424
  • perf: re-use double slash regex paulmillr/chokidar#1435
  • Update readdirp to ESM-only v5
  • Lots of minor improvements in tests
  • Increase security of NPM releases. Switch to token-less Trusted Publishing, with help of jsbt
  • Switch compilation mode to isolatedDeclaration-based typescript for simplified auto-generated docs

New Contributors

Full Changelog: paulmillr/chokidar@4.0.3...5.0.0

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for chokidar since your current version.


Updates @tiptap/core from 3.30.4 to 3.31.3

Release notes

Sourced from @​tiptap/core's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

  • Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

  • Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

  • Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

  • Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

  • e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/core's changelog.

3.31.3

Patch Changes

  • @​tiptap/pm@​3.31.3

3.31.2

Patch Changes

  • Updated dependencies [c56b4c9]
    • @​tiptap/pm@​3.31.2

3.31.1

Patch Changes

  • cd32a2f: Fix freezes in framework-based node views on iOS and Android
    • @​tiptap/pm@​3.31.1

3.31.0

Patch Changes

  • @​tiptap/pm@​3.31.0

3.30.6

Patch Changes

  • 9f844ab: Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.
    • @​tiptap/pm@​3.30.6

3.30.5

Patch Changes

  • d0d499b: Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.
    • @​tiptap/pm@​3.30.5
Commits

Updates @tiptap/extension-document from 3.30.4 to 3.31.3

Release notes

Sourced from @​tiptap/extension-document's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

  • Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

  • Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

  • Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

  • Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

  • e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/extension-document's changelog.

3.31.3

Patch Changes

  • @​tiptap/core@​3.31.3

3.31.2

Patch Changes

  • @​tiptap/core@​3.31.2

3.31.1

Patch Changes

  • Updated dependencies [cd32a2f]
    • @​tiptap/core@​3.31.1

3.31.0

Patch Changes

  • @​tiptap/core@​3.31.0

3.30.6

Patch Changes

  • Updated dependencies [9f844ab]
    • @​tiptap/core@​3.30.6

3.30.5

Patch Changes

  • Updated dependencies [d0d499b]
    • @​tiptap/core@​3.30.5
Commits

Updates @tiptap/extension-mention from 3.30.4 to 3.31.3

Release notes

Sourced from @​tiptap/extension-mention's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

  • Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

  • Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

  • Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

  • Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

  • e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/extension-mention's changelog.

3.31.3

Patch Changes

  • @​tiptap/core@​3.31.3
  • @​tiptap/pm@​3.31.3
  • @​tiptap/suggestion@​3.31.3

3.31.2

Patch Changes

  • Updated dependencies [c56b4c9]
    • @​tiptap/pm@​3.31.2
    • @​tiptap/core@​3.31.2
    • @​tiptap/suggestion@​3.31.2

3.31.1

Patch Changes

  • Updated dependencies [cd32a2f]
    • @​tiptap/core@​3.31.1
    • @​tiptap/suggestion@​3.31.1
    • @​tiptap/pm@​3.31.1

3.31.0

Patch Changes

  • @​tiptap/core@​3.31.0
  • @​tiptap/pm@​3.31.0
  • @​tiptap/suggestion@​3.31.0

3.30.6

Patch Changes

  • Updated dependencies [9f844ab]
    • @​tiptap/core@​3.30.6
    • @​tiptap/suggestion@​3.30.6
    • @​tiptap/pm@​3.30.6

3.30.5

Patch Changes

  • d0d499b: Fix a denial-of-service risk where crafted block or inline Markdown attributes could consume excessive CPU and block the browser or server event loop.
  • Updated dependencies [d0d499b]
    • @​tiptap/core@​3.30.5

... (truncated)

Commits

Updates @tiptap/extension-paragraph from 3.30.4 to 3.31.3

Release notes

Sourced from @​tiptap/extension-paragraph's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

  • Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

  • Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

  • Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

  • Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

  • e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/extension-paragraph's changelog.

3.31.3

Patch Changes

  • @​tiptap/core@​3.31.3

3.31.2

Patch Changes

  • @​tiptap/core@​3.31.2

3.31.1

Patch Changes

  • Updated dependencies [cd32a2f]
    • @​tiptap/core@​3.31.1

3.31.0

Patch Changes

  • @​tiptap/core@​3.31.0

3.30.6

Patch Changes

  • Updated dependencies [9f844ab]
    • @​tiptap/core@​3.30.6

3.30.5

Patch Changes

  • Updated dependencies [d0d499b]
    • @​tiptap/core@​3.30.5
Commits

Updates @tiptap/extension-text from 3.30.4 to 3.31.3

Release notes

Sourced from @​tiptap/extension-text's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

  • Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

  • Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

  • Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

  • Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

  • e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/extension-text's changelog.

3.31.3

Patch Changes

  • @​tiptap/core@​3.31.3

3.31.2

Patch Changes

  • @​tiptap/core@​3.31.2

3.31.1

Patch Changes

  • Updated dependencies [cd32a2f]
    • @​tiptap/core@​3.31.1

3.31.0

Patch Changes

  • @​tiptap/core@​3.31.0

3.30.6

Patch Changes

  • Updated dependencies [9f844ab]
    • @​tiptap/core@​3.30.6

3.30.5

Patch Changes

  • Updated dependencies [d0d499b]
    • @​tiptap/core@​3.30.5
Commits

Updates @tiptap/pm from 3.30.4 to 3.31.3

Release notes

Sourced from @​tiptap/pm's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

  • Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

  • Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

  • Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

  • Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

  • e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/pm's changelog.

3.31.3

3.31.2

Patch Changes

  • c56b4c9: Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

3.31.1

3.31.0

3.30.6

3.30.5

Commits

Updates @tiptap/react from 3.30.4 to 3.31.3

Release notes

Sourced from @​tiptap/react's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

  • Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

  • Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

  • Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

  • Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

  • e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/react's changelog.

3.31.3

Patch Changes

  • 99af46d: Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.
    • @​tiptap/core@​3.31.3
    • @​tiptap/pm@​3.31.3

3.31.2

Patch Changes

  • Updated dependencies [c56b4c9]
    • @​tiptap/pm@​3.31.2
    • @​tiptap/core@​3.31.2

3.31.1

Patch Changes

  • Updated dependencies [cd32a2f]
    • @​tiptap/core@​3.31.1
    • @​tiptap/pm@​3.31.1

3.31.0

Minor Changes

  • 4372d81: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

Patch Changes

  • @​tiptap/core@​3.31.0
  • @​tiptap/pm@​3.31.0

3.30.6

Patch Changes

  • afb3fcc: Reduce overhead in React node views on documents with many nodes.
  • Updated dependencies [9f844ab]
    • @​tiptap/core@​3.30.6
    • @​tiptap/pm@​3.30.6

3.30.5

Patch Changes

  • Updated dependencies [d0d499b]
    • @​tiptap/core@​3.30.5

... (truncated)

Commits
  • 35d2110 chore(release): release new stable release (#8311)
  • 99af46d fix(react): stop importing Editor through the package barrel (#8308)
  • f38fec0 chore(release): release new stable release (#8304)
  • bd35333 chore(release): release new stable release (#8297)
  • 0280f4a chore(release): release new stable release (#8292)
  • 4372d81 Refactor React node view selection tracking (#8289) (#8291)
  • 5302fda chore(release): release new stable release (#8264)
  • afb3fcc add new visual selection handler & refactored react node view selection handl...
  • b0c188b chore(release): release new stable release (#8261)
  • See full diff in compare view

Updates @tiptap/suggestion from 3.30.4 to 3.31.3

Release notes

Sourced from @​tiptap/suggestion's releases.

v3.31.3

@​tiptap/extension-collaboration-caret

Patch Changes

  • Fixed a bug which allowed potentially unsafe color values being sent by other clients. Those unsafe colors received from collaboration users are now ignored.

@​tiptap/react

Patch Changes

  • Fix a TypeScript error (TS2694) in the shipped type declarations when skipLibCheck is turned off.

v3.31.2

@​tiptap/pm

Patch Changes

  • Bump prosemirror-view to ^1.42.3, which fixes an XSS vulnerability where pasting crafted HTML could run arbitrary JavaScript (GHSA-c8x8-7fp4-3x9w).

v3.31.1

@​tiptap/core

Patch Changes

  • Fix freezes in framework-based node views on iOS and Android

v3.31.0

@​tiptap/react

Minor Changes

  • e7bf804: Align selected with ProseMirror node selections by default, expose text selections through selectionInside, and keep selectedOnTextSelection compatible.

v3.30.6

@​tiptap/core

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-list

Patch Changes

  • Nested lists exported to Markdown now keep their hierarchy when the file is read back by other Markdown tools.

@​tiptap/extension-youtube

Patch Changes

... (truncated)

Changelog

Sourced from @​tiptap/suggestion's changelog.

3.31.3

Patch Changes

  • @​tiptap/core@​3.31.3
  • @​tiptap/pm@​3.31.3

3.31.2

Patch Changes

  • Updated dependencies [c56b4c9]
    • @​tiptap/pm@​3.31.2
    • @​tiptap/core@​3.31.2

3.31.1

Patch Changes

  • Updated dependencies [cd32a2f]
    • @​tiptap/core@​3.31.1
    • @​tiptap/pm@​3.31.1

3.31.0

Patch Changes

  • @​tiptap/core@​3.31.0
  • @​tiptap/pm@​3.31.0

3.30.6

Patch Changes

  • Updated dependencies [9f844ab]
    • @​tiptap/core@​3.30.6
    • @​tiptap/pm@​3.30.6

3.30.5

Patch Changes

  • Updated dependencies [d0d499b]
    • @​tiptap/core@​3.30.5
    • @​tiptap/pm@​3.30.5
Commits

Updates i18next from 25.10.10 to 26.4.2

Release notes

Sourced from i18next's releases.

v26.4.2

  • fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

v26.4.1

  • fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).

v26.4.0

  • perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
  • chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

v26.3.6

  • fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

  • fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
  • fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
  • fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

v26.3.4

  • fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

  • fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

  • fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

v26.3.1

  • fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

v26.3.0

  • feat(types): introduce ResourceNamespaceMap — a separate mergeable augmentation surface for namespace resource types, designed for monorepos where multiple packages each want to contribute their own namespaces. Previously, every package had to coordinate on a single CustomTypeOptions.resources declaration (or fall back to typing dependency namespaces as any) because resources is a single property of an interface and TypeScript reports TS2717 when two declarations of the same property disagree. The new interface merges naturally across declare module 'i18next' blocks, so each package can ship its own i18next.d.ts independently. Per-property merge handles same-namespace contributions from multiple packages, and same-key/different-literal conflicts are silently dropped to avoid poisoning t() overload resolution. Fully backwards-compatible — existing CustomTypeOptions.resources augmentations continue to work, and both surfaces can coexist. Scalar options (defaultNS, returnNull, enableSelector, etc.) still belong on CustomTypeOptions. Thanks @​sh3xu (#2434). Fixes #2409.

v26.2.0

  • feat(types): new parseInterpolation TypeOption (default true). When set to false in CustomTypeOptions, the type-level extractor stops parsing translation strings for {{variable}} patterns. Required by i18next-icu users — the default extractor mistakes ICU MessageFormat nested-brace plurals like {count, plural, one {{count} row} other {{count} rows}} for an interpolation block and demands a phantom variable name. The flag is type-only; runtime interpolation is governed by InterpolationOptions and is unaffected. Fixes i18next-icu#85.
  • fix(types): expose enableSelector on InitOptions so i18next.init({ enableSelector: 'strict' }) typechecks without a module augmentation. The runtime already reads opts?.enableSelector from init options; this lands the matching type declaration next to the other...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-95351ef971 branch from 95ee257 to d6d95f2 Compare September 7, 2026 12:03
@dependabot
chore(deps): bump the production-dependencies group across 1 director…
11afdc9 
…y with 13 updates

Bumps the production-dependencies group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [chokidar](https://github.com/paulmillr/chokidar) | `4.0.3` | `5.0.0` |
| [@tiptap/core](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/core) | `3.30.4` | `3.31.3` |
| [@tiptap/extension-document](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-document) | `3.30.4` | `3.31.3` |
| [@tiptap/extension-mention](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-mention) | `3.30.4` | `3.31.3` |
| [@tiptap/extension-paragraph](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-paragraph) | `3.30.4` | `3.31.3` |
| [@tiptap/extension-text](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-text) | `3.30.4` | `3.31.3` |
| [@tiptap/pm](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/pm) | `3.30.4` | `3.31.3` |
| [@tiptap/react](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/react) | `3.30.4` | `3.31.3` |
| [@tiptap/suggestion](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/suggestion) | `3.30.4` | `3.31.3` |
| [i18next](https://github.com/i18next/i18next) | `25.10.10` | `26.4.2` |
| [react-i18next](https://github.com/i18next/react-i18next) | `16.6.6` | `17.0.13` |
| [chalk](https://github.com/chalk/chalk) | `5.6.2` | `6.0.0` |
| [commander](https://github.com/tj/commander.js) | `14.0.3` | `15.0.0` |



Updates `chokidar` from 4.0.3 to 5.0.0
- [Release notes](https://github.com/paulmillr/chokidar/releases)
- [Commits](paulmillr/chokidar@4.0.3...5.0.0)

Updates `@tiptap/core` from 3.30.4 to 3.31.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.3/packages/core/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.3/packages/core)

Updates `@tiptap/extension-document` from 3.30.4 to 3.31.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.3/packages/extension-document/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.3/packages/extension-document)

Updates `@tiptap/extension-mention` from 3.30.4 to 3.31.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.3/packages/extension-mention/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.3/packages/extension-mention)

Updates `@tiptap/extension-paragraph` from 3.30.4 to 3.31.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.3/packages/extension-paragraph/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.3/packages/extension-paragraph)

Updates `@tiptap/extension-text` from 3.30.4 to 3.31.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.3/packages/extension-text/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.3/packages/extension-text)

Updates `@tiptap/pm` from 3.30.4 to 3.31.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.3/packages/pm/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.3/packages/pm)

Updates `@tiptap/react` from 3.30.4 to 3.31.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.3/packages/react/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.3/packages/react)

Updates `@tiptap/suggestion` from 3.30.4 to 3.31.3
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.31.3/packages/suggestion/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.31.3/packages/suggestion)

Updates `i18next` from 25.10.10 to 26.4.2
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v25.10.10...v26.4.2)

Updates `react-i18next` from 16.6.6 to 17.0.13
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v16.6.6...v17.0.13)

Updates `chalk` from 5.6.2 to 6.0.0
- [Release notes](https://github.com/chalk/chalk/releases)
- [Commits](chalk/chalk@v5.6.2...v6.0.0)

Updates `commander` from 14.0.3 to 15.0.0
- [Release notes](https://github.com/tj/commander.js/releases)
- [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md)
- [Commits](tj/commander.js@v14.0.3...v15.0.0)

---
updated-dependencies:
- dependency-name: "@tiptap/core"
  dependency-version: 3.31.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tiptap/extension-document"
  dependency-version: 3.31.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tiptap/extension-mention"
  dependency-version: 3.31.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tiptap/extension-paragraph"
  dependency-version: 3.31.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tiptap/extension-text"
  dependency-version: 3.31.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tiptap/pm"
  dependency-version: 3.31.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tiptap/react"
  dependency-version: 3.31.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tiptap/suggestion"
  dependency-version: 3.31.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: chalk
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: chokidar
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: commander
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: i18next
  dependency-version: 26.4.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: react-i18next
  dependency-version: 17.0.13
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-95351ef971 branch from d6d95f2 to 11afdc9 Compare September 8, 2026 09:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants