chore(deps): bump the production-dependencies group with 5 updates

[dependabot]

Bumps the production-dependencies group with 5 updates:

Package	From	To
framer-motion	13.1.1	13.2.0
i18next	26.4.0	26.4.2
i18next-http-backend	4.0.1	4.0.2
react-i18next	17.0.12	17.0.13
sass	1.103.1	1.104.0

Updates framer-motion from 13.1.1 to 13.2.0

Changelog

Sourced from framer-motion's changelog.

[13.2.0] 2026-unreleased

Added

• animate.addEffect() for registering effects that lets animate drive non-DOM subjects alongside DOM elements.
• threeEffect (motion/three) supporting Three.js objects, materials, shader uniforms, TSL uniform nodes and more.
• vgpuEffect (motion/vgpu) supporting shared uniforms, Effect/Draw/Compute bindings ("params.time"), scene nodes, cameras, lights, materials, orbit controls, CSS colors and vector components.
• createEffect now accepts test, read and step options and exposes bound motion values via effect.get().

Changed

• Reduced filesize and improved performance of spring.

Commits

• 0f1c119 v13.2.0
• f73cbd7 Latest
• d743b79 Latest
• ce2719d Add WebGPURenderer TSL demo
• b800e58 Add TSL uniform node support to Three.js animate
• d60a956 Merge pull request #3800 from motiondivision/add-uniform-effect
• a2d3227 Merge pull request #3799 from motiondivision/generator-filesize-optimisations
• 55c8f8e Remove redundant comment from inertia bounds check
• 84c2599 Add GPU adapter preview examples
• 7b0ac88 Create adapter MotionValues lazily
• Additional commits viewable in compare view

Updates i18next from 26.4.0 to 26.4.2

Release notes

Sourced from i18next's releases.

v26.4.2

• fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

v26.4.1

• fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).

Changelog

Sourced from i18next's changelog.

26.4.2

• fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

26.4.1

• fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).

Commits

• 4dba50f 26.4.2
• e436b62 build
• d955fb0 fix: stringify formatter results in nested values, changelog v26.4.2
• dfafa3c fix: keep replacement patterns literal in nested values (#2447)
• 3c9981e chore: keep dev-only and local files out of the npm package
• c057ee0 26.4.1
• 02e3e16 changelog v26.4.1
• 6f198f2 fix(types): allow selector keyPrefix in getFixedT under enableSelector 'stric...
• See full diff in compare view

Updates i18next-http-backend from 4.0.1 to 4.0.2

Changelog

Sourced from i18next-http-backend's changelog.

4.0.2

Security release. See advisory GHSA-xvq9-wjp8-hwqf.

• security: also reject : in lng and ns values, and // in ns values. With a loadPath / addPath template that starts with the placeholder (e.g. {{lng}}/{{ns}}.json — no origin and no leading /), a value such as http:127.0.0.1:8080 was interpolated into an absolute URL and the request left the intended origin (SSRF / URL injection). The default /locales/{{lng}}/{{ns}}.json and every template with a leading path or origin were not affected, because a colon inside a path segment has no structural meaning there. No BCP-47 language code contains :, and : is i18next's default nsSeparator, so no usable namespace name does either — the tightened check has no legitimate collateral.

Commits

• 7db2f60 4.0.2
• 07e0288 security: reject : in lng/ns and // in ns to close scheme injection (GHSA...
• 08cb05d ci: install npm 11 before npm install
• ff1da48 docs: fix the documented reloadInterval default
• See full diff in compare view

Updates react-i18next from 17.0.12 to 17.0.13

Changelog

Sourced from react-i18next's changelog.

17.0.13

• fix(types): the selector-form keyPrefix overload of useTranslation() is now available under enableSelector: 'strict'. useTranslation was gated on true | 'optimize' only, so under 'strict' it resolved to the legacy signature and the selector overload disappeared entirely (keyPrefix: ($) => $.ns.foo failed with Type '($: any) => any' is not assignable to type 'undefined'). Trans already handled all three modes. Companion to the same fix for getFixedT in i18next#2446. Thanks @​hovelopin (#1930).

Commits

• addf646 17.0.13
• 7c634ee changelog v17.0.13
• 5ceefb0 fix(types): allow selector keyPrefix in useTranslation under enableSelector '...
• aa7ba52 chore(examples): require activesupport >= 7.2.3.1 in the RN Gemfiles
• ec0bb4e chore(examples): drop react_native_windows and the RN Gemfile.locks
• aa5fc43 build
• See full diff in compare view

Updates sass from 1.103.1 to 1.104.0

Release notes

Sourced from sass's releases.

Dart Sass 1.104.0

To install Sass 1.104.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Potentially breaking compatibility fix: Colors now convert the special values NaN and negative zero, as well as infinity and negative infinity for polar-hue channels, to 0 as per the CSS spec.

• The special value negative zero is now serialized as -0 instead of 0 for greater compatibility when using it in CSS calculations.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.104.0

• Potentially breaking compatibility fix: Colors now convert the special values NaN and negative zero, as well as infinity and negative infinity for polar-hue channels, to 0 as per the CSS spec.

• The special value negative zero is now serialized as -0 instead of 0 for greater compatibility when using it in CSS calculations.

Commits

• e01e268 Merge pull request #2845 from sass/dependabot/pub/pub_api_client-4.0.0
• b7b3ce3 Drop unnecessary import
• 0ea3ef0 Implement degenerate colors (#2840)
• ea6a8e2 Use TypeScript 7 without breaking Eslint (#2844)
• c8928c4 Automatically merge dependabot PRs (#2843)
• dfefe28 Bump pub_api_client from 3.2.0 to 4.0.0
• 3c6bf54 Bump browser-actions/setup-chrome from 2.1.2 to 2.2.0 (#2841)
• 9f6876c Bump postcss from 8.5.25 to 8.5.26 in /pkg/sass-parser (#2836)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.