[dependabot]

Bumps the npm-minor-and-patch group with 13 updates:

Package	From	To
eslint	10.13.0	10.14.0
node-html-parser	9.0.5	9.0.6
semver	7.8.5	7.8.6
@fluentui/react-components	9.75.0	9.75.1
sass	1.106.1	1.107.1
prosemirror-changeset	2.4.4	2.4.6
prosemirror-schema-list	1.5.1	1.6.0
prosemirror-view	1.42.8	1.42.9
react-window	2.5.1	2.5.3
@fluentui/react-icons	2.0.344	2.0.345
@reduxjs/toolkit	2.13.0	2.14.0
i18next	26.5.11	26.7.1
globals	17.13.0	17.14.0

Updates eslint from 10.13.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

• d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
• 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
• 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
• cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
• 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

• 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
• dab466e docs: Update README (GitHub Actions Bot)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
• 7697550 docs: Update README (GitHub Actions Bot)
• 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
• 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
• e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
• a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
• 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
• 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
• 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
• 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

Commits

• 12cbff4 10.14.0
• 6b696e7 Build: changelog update for 10.14.0
• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
• 0f94f47 docs: remove zh-hans from docs language switcher (#21437)
• dab466e docs: Update README
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419)
• Additional commits viewable in compare view

Updates node-html-parser from 9.0.5 to 9.0.6

Changelog

Sourced from node-html-parser's changelog.

9.0.6 (2026-10-30)

Bug Fixes

• decode attribute values with the HTML attribute rules for character references (41b773c)
• don't indent structuredText blocks that follow whitespace-only text (5ce4d8d)
• keep a trailing slash in an unquoted attribute value (b512399)
• serialize elements iteratively so deep nesting does not overflow the stack (75286bc), closes #324

Commits

• 332fb76 chore(release): 9.0.6
• 391d908 Merge pull request #329 from OsamaAnsar/fix/structured-text-whitespace-betwee...
• cc5f4c5 Merge pull request #330 from OsamaAnsar/fix/unquoted-attribute-value-trailing...
• 4ee4b1d Merge pull request #326 from zzoraemon043/fix/iterative-serialize
• 2d0acc9 Merge pull request #328 from lprnmns/fix-attribute-character-references
• b512399 fix: keep a trailing slash in an unquoted attribute value
• 5ce4d8d fix: don't indent structuredText blocks that follow whitespace-only text
• 41b773c fix: decode attribute values with the HTML attribute rules for character refe...
• 75286bc fix: serialize elements iteratively so deep nesting does not overflow the stack
• See full diff in compare view

Updates semver from 7.8.5 to 7.8.6

Release notes

Sourced from semver's releases.

v7.8.6

7.8.6 (2026-11-02)

Bug Fixes

• 69b305d #918 improve range parsing performance (#918) (@​reggi, @​Copilot)

Chores

• 7257c14 #917 cover comparator normalization (#917) (@​reggi, @​Copilot)

Changelog

Sourced from semver's changelog.

7.8.6 (2026-11-02)

Bug Fixes

• 69b305d #918 improve range parsing performance (#918) (@​reggi, @​Copilot)

Chores

• 7257c14 #917 cover comparator normalization (#917) (@​reggi, @​Copilot)

Commits

• b37b033 chore: release 7.8.6 (#940)
• 69b305d fix: improve range parsing performance (#918)
• 7257c14 chore: cover comparator normalization (#917)
• See full diff in compare view

Updates @fluentui/react-components from 9.75.0 to 9.75.1

Commits

• f24871e release: applying package updates - react-components
• 04ed99c chore(deps): bump undici from 7.29.0 to 7.30.1 (#37012)
• bca2e9e chore(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 (#36925)
• 8c58979 chore(deps): bump the security-dependencies group across 1 directory with 8 u...
• be0413a chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.2 (#36923)
• 7ee3278 chore(deps-dev): bump storybook from 9.1.17 to 9.1.21 (#37011)
• 569fcd5 chore(deps): bump fast-uri from 3.1.6 to 3.1.8 (#37016)
• 8fb75b8 chore(deps): bump azure/cli from 2.1.0 to 3.0.0 (#37052)
• b3bbc88 chore(deps): bump actions/github-script from 8.0.0 to 9.0.0 (#37053)
• 2e5b6db chore(deps-dev): bump vite from 6.4.2 to 6.4.4 (#37010)
• Additional commits viewable in compare view

Updates sass from 1.106.1 to 1.107.1

Release notes

Sourced from sass's releases.

Dart Sass 1.107.1

To install Sass 1.107.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Properly report the embedded protocol version as 3.4.0.

See the full changelog for changes in earlier releases.

Dart Sass 1.107.0

To install Sass 1.107.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Command-Line Interface

• The --fatal-deprecation flag can now exclude deprecations that would otherwise be included by passing a version number. To exclude a deprecation, add - before its name. For example, --fatal-deprecation=1.107.0,-import includes all deprecations that were present in Dart Sass 1.107.0 except for the @import deprecation.

• The --fatal-deprecation flag now takes the special value dart-sass-2, which treats as fatal all deprecations that will become fatal in Dart Sass 2.0.0.

JavaScript API

• Options.fatalDeprecations can now take a DeprecationSelectorDifference object of the form {include: ..., except: ...}, where the include field lists deprecations to mark fatal (which can be version numbers) and the except field lists deprecations not to mark fatal. The except field takes precedence over include.

• Add a (non-enumerable) sass.deprecations.dartSass2 property which can be passed to Options.fatalDeprecations to mark as fatal exactly the deprecations that will become fatal in Dart Sass 2.0.0. This can be combined with other deprecations or used in a DeprecationSelectorDifference to modify exactly which deprecations it covers.

• Passing a version number beyond the current Dart Sass version to Options.fatalDeprecations is now deprecated. See the Sass website for details.

Dart API

• Add a Deprecation.dartSass2 property which returns exactly the set of deprecations that will become fatal in Dart Sass 2.0.0.

• Passing a version number beyond the current Dart Sass version to Deprecation.forVersion is now deprecated.

Embedded Protocol

• Add a CompileRequest.fatal_deprecation_except field which excludes deprecations from being considered fatal if they would have been enabled by CompileRequest.fatal_deprecation.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.107.1

• Properly report the embedded protocol version as 3.4.0.

1.107.0

Command-Line Interface

• The --fatal-deprecation flag can now exclude deprecations that would otherwise be included by passing a version number. To exclude a deprecation, add - before its name. For example, --fatal-deprecation=1.107.0,-import includes all deprecations that were present in Dart Sass 1.107.0 except for the @import deprecation.

• The --fatal-deprecation flag now takes the special value dart-sass-2, which treats as fatal all deprecations that will become fatal in Dart Sass 2.0.0.

JavaScript API

• Options.fatalDeprecations can now take a DeprecationSelectorDifference object of the form {include: ..., except: ...}, where the include field lists deprecations to mark fatal (which can be version numbers) and the except field lists deprecations not to mark fatal. The except field takes precedence over include.

• Add a (non-enumerable) sass.deprecations.dartSass2 property which can be passed to Options.fatalDeprecations to mark as fatal exactly the deprecations that will become fatal in Dart Sass 2.0.0. This can be combined with other deprecations or used in a DeprecationSelectorDifference to modify exactly which deprecations it covers.

• Passing a version number beyond the current Dart Sass version to Options.fatalDeprecations is now deprecated. See the Sass website for details.

Dart API

• Add a Deprecation.dartSass2 property which returns exactly the set of deprecations that will become fatal in Dart Sass 2.0.0.

• Passing a version number beyond the current Dart Sass version to Deprecation.forVersion is now deprecated.

Embedded Protocol

• Add a CompileRequest.fatal_deprecation_except field which excludes deprecations from being considered fatal if they would have been enabled by CompileRequest.fatal_deprecation.

Commits

• 059beb7 Release sass/sass#4266 (#2904)
• 2726cf0 Expose toCssIdentifier() through sass_api (#2903)
• 4e4a042 Merge pull request #2902 from sass/zizmor
• 9156ddf Fix zizmor findings
• 5f2c136 Use full version numbers for all GitHub actions
• 8de571b Fail CI if Zizmor has findings
• 1f895ca Add a message explaining why dependabot auto-merge may not happen (#2900)
• 455cbc0 [Deprecations Except] Implement the change (#2895)
• 0cc2fa2 Bump postcss from 8.5.30 to 8.5.31 in /pkg/sass-parser (#2899)
• See full diff in compare view

Updates prosemirror-changeset from 2.4.4 to 2.4.6

Commits

• See full diff in compare view

Updates prosemirror-schema-list from 1.5.1 to 1.6.0

Commits

• See full diff in compare view

Updates prosemirror-view from 1.42.8 to 1.42.9

Commits

• See full diff in compare view

Updates react-window from 2.5.1 to 2.5.3

Release notes

Sourced from react-window's releases.

2.5.3

• List identifies rows by ariaAttributes (specifically aria-posinset) so that additional children (e.g. sticky rows or overlays) aren't measured as rows, and rows that render nothing don't shift the indices of the rows after them. Rows that don't spread ariaAttributes, or that override aria-posinset or aria-setsize, are still matched by their position. If only some rows spread ariaAttributes (e.g. loaded rows but not loading placeholders), the rows that don't are not measured; spread ariaAttributes onto every row (or none). - #930, #931

2.5.2

• Add displayName to List and Grid (e.g. for React DevTools and error messages in minified builds). The names are set in a way that does not prevent bundlers from tree shaking unused components.

Changelog

Sourced from react-window's changelog.

2.5.3

• List identifies rows by ariaAttributes (specifically aria-posinset) so that additional children (e.g. sticky rows or overlays) aren't measured as rows, and rows that render nothing don't shift the indices of the rows after them. Rows that don't spread ariaAttributes, or that override aria-posinset or aria-setsize, are still matched by their position. If only some rows spread ariaAttributes (e.g. loaded rows but not loading placeholders), the rows that don't are not measured; spread ariaAttributes onto every row (or none). - #930, #931

2.5.2

• Add displayName to List and Grid (e.g. for React DevTools and error messages in minified builds). The names are set in a way that does not prevent bundlers from tree shaking unused components.

Commits

• a6b77b3 2.5.2 -> 2.5.3
• b775322 Identify List rows by aria-posinset instead of position (#931)
• 4bea19a Don't measure List children as rows while hydrated rows are in flow layout (#...
• ec92685 Update react-lib-tools to 0.0.74
• 20b156b Update react-lib-tools dev dependency
• 92f0f9b Declare package as side effect free ("sideEffects": false)
• 0204c12 2.5.1 -> 2.5.2
• 1c0a258 Add displayName to components (#929)
• 18f1892 Declare @​types/react as an optional peer dependency (#927)
• See full diff in compare view

Updates @fluentui/react-icons from 2.0.344 to 2.0.345

Commits

• See full diff in compare view

Updates @reduxjs/toolkit from 2.13.0 to 2.14.0

Release notes

Sourced from @​reduxjs/toolkit's releases.

v2.14.0

This feature release speeds up the dispatch path and RTK Query's Api type checking, shrinks createSlice in esbuild bundles, adds RTK-owned Draft and Patch types so emitted declarations no longer reference Immer, adds removeMany({ where }) and selectByIds to the entity adapter, adds RTK Query cache entry selectors and a DevTools action sanitizer, and fixes a very long list of RTK Query lifecycle, polling, upsert, timer, hook and fetchBaseQuery bugs.

Note that we just announced our roadmap to Redux Toolkit 3.0, which includes both a large set of planned 2.x features and improvements, and planned 3.0 breaking changes. The fixes and updates in this release help pave the way for all of those efforts. We'd also appreciate feedback on the linked RTK Query usage patterns and 3.0 planned breaking changes discussion threads.

Changelog

Dispatch Performance

Every dispatched action runs through every reducer and middleware, so small costs on that path add up. We added a benchmark harness for the dispatch path and used it to find several places where RTK did work for actions it didn't care about.

createAction(...).match now compares action.type before calling isAction, so a non-matching action costs a property read. createReducer no longer allocates arrays on every dispatch to collect case and matcher reducers. Since createSlice builds its reducer with createReducer, every slice reducer gets this improvement.

The listener middleware used to copy its listener list and call every predicate for every action. It now keeps a snapshot that is rebuilt only when listeners are added or removed, and that snapshot knows which action types have type or actionCreator listeners. If an action's type isn't in that set and there are no matcher or predicate listeners, the middleware skips the loop entirely.

The RTK Query root reducer now returns the existing state for actions that none of its slices handle, instead of running all five slice reducers. It also skips rewriting a query's provided tags when the new tags are the same as the stored ones, so re-fetching a query that returns the same tags no longer creates new provided state.

Some numbers from the PR benchmarks (Node 26, ops/sec unless noted):

Scenario	Before	After
Listener middleware, 200 listeners, unrelated action	108K	5.34M
Listener middleware, 200 actionCreator listeners, matching action	100K	612K
createSlice, 20 slices, unrelated action	320K	394K
RTKQ store, unrelated action	352K	468K
RTKQ re-dispatch of a fulfilled query with unchanged tags, 1000 entries (ms per dispatch)	2.50	0.55

The listener middleware numbers are the biggest change, because the old cost grew with the number of listeners. Apps with a handful of listeners will see much smaller gains.

The RTK Query middleware also does less work keeping the store's subscriptions state in sync (#5499). It used to JSON-copy the whole subscriptions object and diff it with Immer every 500ms while subscriptions were changing. It now records which cache keys changed and writes one patch per key. Keys that didn't change keep their object references, so the Redux DevTools no longer receive a full copy of subscriptions on every sync. Polls, refetch() calls and tag invalidation refetches don't add subscribers, so they no longer schedule a sync at all. The visible difference: a cache key that only ever had subscribe: false requests no longer shows up as an empty {} in subscriptions.

Smaller createSlice Bundles With esbuild

createSlice references asyncThunkCreator so that create.asyncThunk works in the reducers callback. esbuild couldn't tell that the asyncThunkCreator object was free of side effects, so it always bundled createAsyncThunk along with createSlice. webpack already dropped it. We've marked it as pure, and an esbuild bundle that imports only createSlice is now about 1 kB smaller (brotli).

Faster RTK Query Api Type Checking

The Api type combines every registered module (core, React hooks, and any third-party modules) by running UnionToIntersection over the module names. TanStack Table hit the same cost with the same design, and found that writing out the known intersection and adding variance annotations helped a lot.

We've done the same thing here: Api uses the core module type directly, and ApiModules has in out variance annotations. On a test app with one ~50-endpoint createApi, type instantiations dropped 22% and check time dropped about 25% on TS 6, and about 18% on the TS 7 native preview. Third-party modules like ngrx-rtk-query saw 7-8% fewer instantiations. There are no runtime changes.

RTK-Owned Draft and Patch Types

RTK used to re-export Immer's Draft type, and used Immer's types in signatures like CaseReducer and PatchCollection. That meant the .d.ts files TypeScript generated for your slices referenced immer. With a package manager layout where immer isn't hoisted, those declarations failed to build with TS2883 (#5516). Re-exporting doesn't fix that, so RTK now declares its own Draft, WritableDraft and Patch types with the same shapes as Immer's. Emitted declarations now point at @reduxjs/toolkit instead. Our type tests check that RTK's Draft and Immer's Draft stay interchangeable, so code that mixes castDraft or current with RTK's types keeps working. We also bumped the immer dependency to ^11.2.9.

There are a few other type additions in this release:

• ApiRootState replaces RTK Query's RootState type, which is now deprecated. RootState will be removed in 3.0.
• TypedAddListenerAction and TypedRemoveListenerAction describe the actions that addListener and removeListener actually dispatch. The default payload type of TypedAddListener and TypedRemoveListener is now the listener options object, so addListener.match(action) no longer claims action.payload has fields like id and unsubscribe that don't exist at runtime.
• dispatch(removeListener(...)) is typed as returning boolean and dispatch(clearAllListeners()) as returning void, matching the runtime.

... (truncated)

Commits

• ec4a1a1 Release 2.14.0
• 705e349 fix(toolkit): respect skipToken in infinite query triggers (#5464)
• 6d845b7 Add simpler Basic Usage example for createListener Middleware (#4836)
• 4bbdb3d Fix isLoading staying false when refetching after an error with no data (...
• 3abefe7 docs(codegen): document the remaining config options (#5367)
• 7bd07e7 docs: fix LazyInfiniteQueryTrigger docs (#5261)
• cc1e048 docs(codegen): document the config option types in src/types.ts (#5373)
• 9b3cb8c docs(codegen): fix malformed config options block (#5366)
• 193bfaa docs: selectInvalidedBy for multiple cache updates across queries (#5226)
• 687819b docs: clarify useLazyQuery data is undefined until trigger (#5348)
• Additional commits viewable in compare view

Updates i18next from 26.5.11 to 26.7.1

Release notes

Sourced from i18next's releases.

v26.7.1

• fix: reloadResources() retries the bundles that failed to load. The load queue skipped them also when reloading, so a language whose first load failed (a backend or network outage at startup) stayed missing. i18next-http-backend 4.0.8, i18next-chained-backend 5.0.7 and i18next-locize-backend 10.0.5 reload through reloadResources() with i18next 26.7, so their reloadInterval no longer recovered from such a failure, as their own reload did before.
• fix: reloadResources() without languages reloads the current languages and every language the backend loaded or tried to load, for the instance and its clones, as the API docs describe ("pass languages and namespaces if you don't want to reload all"). It reloaded only the current languages, so on a server (one clone per request with i18next-http-middleware) a backend's reloadInterval never refreshed the languages loaded for requests. It never requests cimode. With languages given, nothing changes.

v26.7.0

The last 26.x minor before v27, which follows in about a week. It adds the APIs v27 builds on, and with debug: true it warns wherever a setup relies on something v27 changes. Most of the v27 defaults are existing options, so you can try them now:

i18next.init({
  debug: true, // prints the warnings below
  fallbackLng: 'en', // v27: fallbackLng defaults to false, set your source language (no implicit 'dev')
  returnEmptyString: false, // v27 default: an empty string falls back like a missing key
  cleanCode: true, // close to v27, which canonicalizes codes without a region ('EN' becomes 'en')
});

declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: true; // v27 default
    returnEmptyString: false; // v27 default
  }
}

The other v27 changes (/ no longer escaped in values, a logger and post-processors per instance, the key instead of a sentence for an object hit, the dotted-language store calls and *Escaped options removed) have no switch; the debug warnings below show where they apply.

• feat: with the default skipOnVariables: true, a missing interpolation variable is now logged in debug mode, once per string and variable: missed to pass in variable name for interpolating Hello {{name}}. The raw {{name}} reached the UI without any log line, even with debug: true, because the warning only ran with skipOnVariables: false. A variable passed as undefined and a missingInterpolationHandler still log nothing.
• feat: i18next.hydrate(resources, lng) puts resources rendered on the server into the store and changes to the server's language, each only the first time. It does what react-i18next's useSSR did by writing resourceStore.data, options.ns, isInitialized, initializedStoreOnce and initializedLanguageOnce directly, and sets the same flags, so integrations can switch to it and stay compatible with code that still reads or writes them. On a clone it does nothing, as useSSR does: a clone shares its parent's store (one clone per request with i18next-http-middleware). Called before init(), it logs a warning and changes nothing.
• feat: services.utils.reloadResources() lets a backend reload its bundles through i18next (as i18next.reloadResources(), with retries and the loaded event), instead of calling backendConnector.read() and loaded() itself as the reloadInterval of i18next-http-backend and i18next-chained-backend does. Without languages (no lng, no detector, the default fallbackLng), reloadResources() reloads nothing instead of throwing Cannot read properties of undefined (reading 'forEach'); a backend that also reloads preload passes its languages.
• feat: backends and async language detectors can declare their calling convention with callbackApi (an instance or static property). true: read(language, namespace, callback), create(languages, namespace, key, fallbackValue, callback, options) and detect(callback); false: they return a promise or a value, and create gets the options as its fifth argument. Without it, i18next keeps guessing from the number of parameters (Function.length), which default and rest parameters change: i18next-chained-backend's create(..., clb = () => {}, opts = {}) has length 4 and never got its options (isUpdate), and i18next-http-backend's callback form of create has length 5, the length reserved for the callback-less form. Guessing is deprecated: in debug mode an unmarked backend or async detector logs a deprecation warning, once per init().
• feat: isSafeLanguageCode(code) is exported for plugins that take a language from a request, a URL or storage: letters, digits, -, _, @ and . (no ..), at most 128 characters, not a prototype key. It is not a BCP 47 check, so en_US, zh_Hant_TW, sr@latin and de_DE.UTF-8 pass; markup, slashes and spaces do not. The language detector, i18next-http-middleware and i18next-http-backend each have their own rule today.
• feat: use() logs a warning in debug mode when a second backend, language detector, i18nFormat or formatter replaces the first one; only one of each is used per instance, and losing an ICU setup this way was silent. As use() usually runs before init(), the warning is printed once init() has set up the logger.
• feat(types): ParseKeysWithoutVariables<Ns, KPrefix>, the keys t() takes without options: their string has no variables, and a plural key is left out when its forms take count. A wrapper typed with it, like (key: ParseKeysWithoutVariables<'common'>) => t(key), compiles with strictInterpolationChecks without a cast.
• feat(types): defaultVariables in CustomTypeOptions declares the variables interpolation.defaultVariables fills in at runtime (defaultVariables: { appName: string }). They become optional in the t() options, also with strictInterpolationChecks; passed, they keep their type.
• feat(types): interpolationFormatSeparator in CustomTypeOptions for a custom interpolation.formatSeparator: the types split {{price, currency}} at a hard-coded ,, so with formatSeparator: ';' the format was not recognized. The per-call skipInterpolation option is typed, and returnedObjectHandler may return a value (what it returns is what t() returns; it was typed as returning void).
• feat(types): SelectorFn, ApplyTarget, ConstrainTarget and GetSource are exported on purpose, under their current names. react-i18next imports them for Trans; they were importable only because every declaration in the type files counts as exported.
• fix(types): with nsSeparator: false in CustomTypeOptions, the key union no longer contains nsfalsekey-style keys for the other namespaces, and a key that contains the text false (isfalsey) is no longer split at it, which typed its t() result as never.
• fix: with clones (i18next-http-middleware makes one per request), saveMissing now checks that the namespace is loaded for the instance that misses the key. Each cloneInstance() pointed the parent's services.utils.hasLoadedNamespace at the new clone, and the backend connector, which all clones share, used that one: a key missing in one request was not saved (did not save key ... as the namespace ... was not yet loaded) while a newer request was still loading its language, and the parent's services.utils answered for the newest clone. A clone's services.utils is now bound to the clone, and the parent keeps its own. A direct services.backendConnector.saveMissing() call, like the missing keys route of i18next-http-middleware, still checks the newest clone (follow-up to #1413).
• fix: dir() without a language (before init(), or with no language resolved) returns 'ltr' instead of 'rtl' ([discussion #2135](Why 'rtl' is default direction in case of language not found? i18next/i18next#2135)).
• fix: t() before init() returns an empty string, as typed (with a warning when debug logging is already on); it returned undefined.
• fix: off('a b', listener) removes the listener from both events, as on('a b', listener) adds it to both. It looked for an event named 'a b', so once('a b', listener) never removed its listener and ran it on every event.
• deprecate: dotted languages in the resource store calls (getResource('en.translation.key'), addResource('en.translation.key', value), addResourceBundle('en.translation', resources)) log a deprecation warning in debug mode; they are removed in v27. Pass language, namespace and key as separate arguments.
• deprecate: interpolation.prefixEscaped, suffixEscaped, nestingPrefixEscaped and nestingSuffixEscaped (inserted into the RegExp unescaped) log a deprecation warning in debug mode and are marked @deprecated; they are removed in v27. Pass the literal delimiters as prefix, suffix, nestingPrefix and nestingSuffix.
• deprecate: compatibilityJSON is marked @deprecated (it has no effect since v24) and removed from the types in v27.
• deprecate: a language code without a region that v27 canonicalizes differently logs a deprecation warning in debug mode: 'EN' stays 'EN' today and becomes 'en' in v27, 'iw' becomes 'he'. cleanCode: true already lower-cases them.
• deprecate: when fallbackLng is not set, the first request for the default fallback language dev (loading it, or saving missing keys to it) logs a notice in debug mode: v27 defaults to fallbackLng: false and no longer requests dev. Set fallbackLng to your source language, or to 'dev' to keep the current behavior.
• deprecate: in debug mode, a language code that comes from lng, changeLanguage() or the language detector, is not configured (supportedLngs, fallbackLng, preload or the resources) and fails isSafeLanguageCode logs a deprecation warning, once per code: without supportedLngs, a detector that returns "><img src=x onerror=alert(1)> makes that string i18next.language, and apps put it into <html lang>. Nothing changes in 26.7; v27 is planned to refuse such codes and continue as with an unsupported code. Language codes are still not bound to a format.
• deprecate: the logger and post-processors are shared by all instances in v26 and per instance from v27 (clones keep their parent's). In debug mode, an instance that runs a post-processor only another instance registered with use() logs a deprecation warning (call use() on this instance too), and a non-clone init() that replaces the logger another instance set with use() logs one through that logger.
• deprecate: in debug mode, a value with a / under the default escape logs that v27 no longer escapes / ($10/month renders as $10/month today; not with escapeValue: false, where react-i18next's Trans escapes one call itself and decodes the entities afterwards), and an object or array hit without returnObjects logs that v27 returns the key instead of the sentence key '... (en)' returned an object instead of string..

... (truncated)

Changelog

Sourced from i18next's changelog.

26.7.1

• fix: reloadResources() retries the bundles that failed to load. The load queue skipped them also when reloading, so a language whose first load failed (a backend or network outage at startup) stayed missing. i18next-http-backend 4.0.8, i18next-chained-backend 5.0.7 and i18next-locize-backend 10.0.5 reload through reloadResources() with i18next 26.7, so their reloadInterval no longer recovered from such a failure, as their own reload did before.
• fix: reloadResources() without languages reloads the current languages and every language the backend loaded or tried to load, for the instance and its clones, as the API docs describe ("pass languages and namespaces if you don't want to reload all"). It reloaded only the current languages, so on a server (one clone per request with i18next-http-middleware) a backend's reloadInterval never refreshed the languages loaded for requests. It never requests cimode. With languages given, nothing changes.

26.7.0

The last 26.x minor before v27, which follows in about a week. It adds the APIs v27 builds on, and with debug: true it warns wherever a setup relies on something v27 changes. Most of the v27 defaults are existing options, so you can try them now:

i18next.init({
  debug: true, // prints the warnings below
  fallbackLng: 'en', // v27: fallbackLng defaults to false, set your source language (no implicit 'dev')
  returnEmptyString: false, // v27 default: an empty string falls back like a missing key
  cleanCode: true, // close to v27, which canonicalizes codes without a region ('EN' becomes 'en')
});

declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: true; // v27 default
    returnEmptyString: false; // v27 default
  }
}

The other v27 changes (/ no longer escaped in values, a logger and post-processors per instance, the key instead of a sentence for an object hit, the dotted-language store calls and *Escaped options removed) have no switch; the debug warnings below show where they apply.

• feat: with the default skipOnVariables: true, a missing interpolation variable is now logged in debug mode, once per string and variable: missed to pass in variable name for interpolating Hello {{name}}. The raw {{name}} reached the UI without any log line, even with debug: true, because the warning only ran with skipOnVariables: false. A variable passed as undefined and a missingInterpolationHandler still log nothing.
• feat: i18next.hydrate(resources, lng) puts resources rendered on the server into the store and changes to the server's language, each only the first time. It does what react-i18next's useSSR did by writing resourceStore.data, options.ns, isInitialized, initializedStoreOnce and initializedLanguageOnce directly, and sets the same flags, so integrations can switch to it and stay compatible with code that still reads or writes them. On a clone it does nothing, as useSSR does: a clone shares its parent's store (one clone per request with i18next-http-middleware). Called before init(), it logs a warning and changes nothing.
• feat: services.utils.reloadResources() lets a backend reload its bundles through i18next (as i18next.reloadResources(), with retries and the loaded event), instead of calling backendConnector.read() and loaded() itself as the reloadInterval of i18next-http-backend and i18next-chained-backend does. Without languages (no lng, no detector, the default fallbackLng), reloadResources() reloads nothing instead of throwing Cannot read properties of undefined (reading 'forEach'); a backend that also reloads preload passes its languages.
• feat: backends and async language detectors can declare their calling convention with callbackApi (an instance or static property). true: read(language, namespace, callback), create(languages, namespace, key, fallbackValue, callback, options) and detect(callback); false: they return a promise or a value, and create gets the options as its fifth argument. Without it, i18next keeps guessing from the number of parameters (Function.length), which default and rest parameters change: i18next-chained-backend's create(..., clb = () => {}, opts = {}) has length 4 and never got its options (isUpdate), and i18next-http-backend's callback form of create has length 5, the length reserved for the callback-less form. Guessing is deprecated: in debug mode an unmarked backend or async detector logs a deprecation warning, once per init().
• feat: isSafeLanguageCode(code) is exported for plugins that take a language from a request, a URL or storage: letters, digits, -, _, @ and . (no ..), at most 128 characters, not a prototype key. It is not a BCP 47 check, so en_US, zh_Hant_TW, sr@latin and de_DE.UTF-8 pass; markup, slashes and spaces do not. The language detector, i18next-http-middleware and i18next-http-backend each have their own rule today.
• feat: use() logs a warning in debug mode when a second backend, language detector, i18nFormat or formatter replaces the first one; only one of each is used per instance, and losing an ICU setup this way was silent. As use() usually runs before init(), the warning is printed once init() has set up the logger.
• feat(types): ParseKeysWithoutVariables<Ns, KPrefix>, the keys t() takes without options: their string has no variables, and a plural key is left out when its forms take count. A wrapper typed with it, like (key: ParseKeysWithoutVariables<'common'>) => t(key), compiles with strictInterpolationChecks without a cast.
• feat(types): defaultVariables in CustomTypeOptions declares the variables interpolation.defaultVariables fills in at runtime (defaultVariables: { appName: string }). They become optional in the t() options, also with strictInterpolationChecks; passed, they keep their type....

  Description has been truncated

[juliasilge]

I tested out the functionality that these bumps impact and everything looks good: