fix(deps): update dependency i18next to v26

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
i18next (source)	^25.8.18 → ^26.0.8

---

Release Notes

i18next/i18next (i18next)

v26.0.8

Compare Source

• fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

v26.0.7

Compare Source

• fix: when a plural lookup misses, the missingKey debug log now shows the actual plural-resolved key (e.g. foo.bar_many for Polish count: 14) instead of the base key — making it obvious which plural category was expected and missing 2423
• chore: drop @babel/runtime runtime dependency. The build no longer generates any @babel/runtime imports, so the package is unused by consumers. Rollup now uses babelHelpers: 'bundled' so any helpers that are ever needed in the future will be inlined rather than imported externally 2424
• chore: stop emitting dist/esm/i18next.bundled.js. It was byte-identical to dist/esm/i18next.js because no helpers were being imported 2424

v26.0.6

Compare Source

Security release — all issues found via an internal audit.

• security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security note in the Nesting docs for the full pattern and mitigations
• security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .
• security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)
• chore: ignore .env* and *.pem/*.key files in .gitignore

v26.0.5

Compare Source

• fix: cloneInstance().changeLanguage() no longer fails to update language state when the target language is not yet loaded — a race between init()'s deferred load() and the user's changeLanguage() could overwrite isLanguageChangingTo, causing setLngProps to be skipped 2422

v26.0.4

Compare Source

v26.0.3

Compare Source

v26.0.2

Compare Source

v26.0.1

Compare Source

v26.0.0

Compare Source

v25.10.10

Compare Source

v25.10.9

Compare Source

v25.10.8

Compare Source

v25.10.7

Compare Source

v25.10.6

Compare Source

v25.10.5

Compare Source

• feat(types): selector functions as keyPrefix in getFixedT now provide full type-safe key narrowing — the returned t function is scoped to the prefix subtree 2367

v25.10.4

Compare Source

• feat(types): exists() is now a type guard that narrows the key to SelectorKey, so a validated key can be passed directly to t() 2364

v25.10.3

Compare Source

• check also for I18NEXT_NO_SUPPORT_NOTICE env variable

v25.10.2

Compare Source

• feat(types): keyFromSelector is now type-safe — the selector callback is constrained against your resource definitions, catching invalid keys at compile time. Supports optional ns and keyPrefix options for non-default namespace/prefix contexts 2364

v25.10.1

Compare Source

• fix(types): FilterKeys now correctly excludes base keys that have context variants when the provided context doesn't match any of them (e.g. key some with variant some_me is no longer accessible with context="one")

v25.10.0

Compare Source

• feat(types): keyFromSelector now returns a branded SelectorKey type that t() accepts directly, enabling pre-computed and reusable translation keys 2364
• feat: support selector syntax for keyPrefix in getFixedT and per-call options 2367
• feat(types): interpolation values are now automatically typed based on built-in format specifiers — {{val, number}} requires number, {{val, datetime}} requires Date, {{name}} requires string, etc. Custom formatters can be typed via interpolationFormatTypeMap in CustomTypeOptions 2378
• fix(types): FilterKeys in selector mode now preserves non-context, non-plural leaf keys when context is provided, fixing incorrect type narrowing when combining returnObjects: true with context 2398

v25.9.0

Compare Source

• feat(types): selector API now enforces { count: number } when a key resolves to plural forms 2373
• fix(types): string unions with invalid members are now correctly detected as type errors when used as context option 2172

v25.8.20

Compare Source

• • fix: getFixedT() selector now resolves namespaces against the effective ns rather than the global init options #​2406

v25.8.19

Compare Source

• fix: selector API namespace resolution regression for single-string ns and primary namespace in array #​2405. Reverts the broad namespace-prefix rewrite from v25.8.15 and replaces it with a targeted fix that only rewrites paths starting with a secondary namespace in a multi-namespace array, matching the type-level contract of GetSource

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 12pm on Sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud