[dependabot]

Bumps the production-dependencies group with 16 updates in the /apps/ui directory:

Package	From	To
@casl/ability	7.0.1	7.1.1
@hookform/resolvers	5.9.1	7.0.1
@sentry/react	11.2.0	11.10.0
@tanstack/react-query	5.104.0	5.105.1
@tanstack/react-query-devtools	5.104.0	5.105.1
i18next	26.4.2	26.7.1
i18next-browser-languagedetector	8.2.1	8.3.0
lucide-react	1.49.0	1.66.0
radix-ui	1.6.7	1.8.1
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
react-hook-form	7.89.0	7.91.0
react-i18next	17.0.15	17.1.11
react-router-dom	7.18.4	7.18.5
zod	4.6.5	4.6.7
zustand	5.0.15	5.0.16

Updates @casl/ability from 7.0.1 to 7.1.1

Release notes

Sourced from @​casl/ability's releases.

@​casl/ability: v7.1.1

7.1.1 (2026-10-31)

Security Fixes

• adds enforced subject type validation (#1328) (63f0c44)

Compatibility note: Setting __caslSubjectType__ manually now throws an error during authorization. Use the subject() helper to assign subject types. This property name always was an implementation detail and planned to be replaced with a Symbol() in the next major version

@​casl/ability: v7.1.0

7.1.0 (2026-10-28)

Features

• adds support for custom subject type detection types (#1321) (eb4896b)

@​casl/ability: v7.0.3

7.0.3 (2026-10-28)

Bug Fixes

• adds possibility to infer instance of class with abstract/private/protected constructor (#1320) (08978e9), closes #995

@​casl/ability: v7.0.2

7.0.2 (2026-10-15)

Bug Fixes

• prevent rulesToFields to set properties on prototype and non-objects (#1305) (58242cb)

Changelog

Sourced from @​casl/ability's changelog.

7.1.1 (2026-10-31)

Security Fixes

• adds enforced subject type validation (#1328) (63f0c44)

7.1.0 (2026-10-28)

Features

• adds support for custom subject type detection types (#1321) (eb4896b)

7.0.3 (2026-10-28)

Bug Fixes

• adds possibility to infer instance of class with abstract/private/protected constructor (#1320) (08978e9), closes #995

7.0.2 (2026-10-15)

Bug Fixes

• prevent rulesToFields to set properties on prototype and non-objects (#1305) (58242cb)

Commits

• 33f2820 chore: release main (#1329)
• 63f0c44 fix: adds enforced subject type validation (#1328)
• 1652044 chore(deps): update dependency node to v26 (#1326)
• 0c3e3bb chore: release main (#1322)
• eb4896b feat: adds support for custom subject type detection types (#1321)
• 8340c4a chore: release main (#1319)
• 08978e9 fix: adds possibility to infer instance of class with abstract/private/protec...
• cd9293f docs: adds casl/ability size measurement during doc build
• a9bd440 chore: release main (#1306)
• 58242cb fix: prevent rulesToFields to set properties on prototype and non-objects (#1...
• Additional commits viewable in compare view

Updates @hookform/resolvers from 5.9.1 to 7.0.1

Release notes

Sourced from @​hookform/resolvers's releases.

v7.0.1

7.0.1 (2026-11-01)

Bug Fixes

• fluentvalidation-ts: preserve primitive array error messages (#889) (5845b81)

v7.0.0

7.0.0 (2026-10-31)

• feat(typebox)!: migrate to the typebox 1.x package (#888) (0d4a3d2)

BREAKING CHANGES

• the typebox resolver now requires typebox ^1.0.0 as peer dependency instead of @sinclair/typebox. Error type values are now keyword names (e.g. minLength) instead of numeric ValueErrorType codes, messages use TypeBox 1.x wording, and TypeCompiler.Compile is replaced by Compile from typebox/compile.

• fix(typebox): infer validator context in resolver types

v6.0.2

6.0.2 (2026-10-28)

Bug Fixes

• typebox: preserve escaped field names in validation errors (#886) (813d0ea)

v6.0.1

6.0.1 (2026-10-27)

Bug Fixes

• typeschema: drop @​typeschema/main from peerDependencies (#883) (0430340), closes #753 #882

v6.0.0

6.0.0 (2026-10-19)

Features

• effect-ts: support Effect v4 (#880) (a5ab308), closes #878

... (truncated)

Commits

• 5845b81 fix(fluentvalidation-ts): preserve primitive array error messages (#889)
• 0d4a3d2 feat(typebox)!: migrate to the typebox 1.x package (#888)
• 813d0ea fix(typebox): preserve escaped field names in validation errors (#886)
• 511d7f6 ci: bump GitHub Actions to Node 24 compatible versions (#885)
• 0430340 fix(typeschema): drop @​typeschema/main from peerDependencies (#883)
• 3bcf122 update readme
• a5ab308 feat(effect-ts): support Effect v4 (#880)
• 71e6052 fix(ajv): preserve escaped field names in validation errors (#879)
• 8d088d4 chore(deps): bump ata-validator to ^1.23.0 (#877)
• See full diff in compare view

Updates @sentry/react from 11.2.0 to 11.10.0

Release notes

Sourced from @​sentry/react's releases.

11.10.0

Important Changes

• feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

  Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

  To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

  // browser
  Sentry.init({ dsn, tunnel: true });
  // server
  Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

  If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

  app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

  The request option of handleTunnelRequest is deprecated and will be removed in v12.

• feat: Make span origins spec compliant (#25602)

  Some span origins changed their names to follow the trace origin spec:

  • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
  • auto.vercelai.channel is now auto.ai.vercelai.
  • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
  • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
  • auto.aws_lambda is now auto.function.aws_serverless.
  • auto.mcp.notification is now auto.function.mcp_server.notification.
  • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
  • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

  bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

  Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

  ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

• feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

  sentryBunPlugin from @sentry/bun/plugin now accepts the same options as sentryEsbuildPlugin (org, project, authToken, release, sourcemaps, ...). When Bun.build writes source maps to outdir, the plugin injects the debug ID that Bun writes into each bundle, injects the release, and uploads the source maps at the end of the build. You no longer need to run sentry sourcemap inject and sentry sourcemap upload after the build.

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

11.10.0

Important Changes

• feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

  Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

  To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

  // browser
  Sentry.init({ dsn, tunnel: true });
  // server
  Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

  If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

  app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

  The request option of handleTunnelRequest is deprecated and will be removed in v12.

• feat: Make span origins spec compliant (#25602)

  Some span origins changed their names to follow the trace origin spec:

  • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
  • auto.vercelai.channel is now auto.ai.vercelai.
  • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
  • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
  • auto.aws_lambda is now auto.function.aws_serverless.
  • auto.mcp.notification is now auto.function.mcp_server.notification.
  • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
  • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

  bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

  Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

  ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

• feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

... (truncated)

Commits

• 9e33660 release: 11.10.0
• a51d938 Merge pull request #25832 from getsentry/prepare-release/11.10.0
• 612654c meta(changelog): Update changelog for 11.10.0
• 0455361 Merge pull request #25833 from getsentry/ab/merge-master-into-develop
• 0e2b465 chore: Merge master into develop
• 90a71e7 feat(server-utils): Instrument together-ai 1.x (#25823)
• c6ac34c test(cloudflare): Bump agents and MCP SDK in cloudflare-mcp-agent e2e app (#2...
• 6efffd8 test(remix): Cover prefetched navigations in the Remix 3 E2E app (#25829)
• e17a480 fix(remix): Drop Remix 3 release candidates from the peer range (#25808)
• cad66c7 test: Wire the managed tunnel by hand in Node, Cloudflare and Next.js (#25785)
• Additional commits viewable in compare view

Updates @tanstack/react-query from 5.104.0 to 5.105.1

Changelog

Sourced from @​tanstack/react-query's changelog.

5.105.1

Patch Changes

• #11373 7ccba6e - fix({react,preact,angular,solid,vue}-query/infiniteQueryOptions): correct the overload selected for a possibly-undefined 'initialData'

• #12390 18e54bf - Exclude fetchStatus from the filters accepted by QueryClient.isFetching, useIsFetching, and injectIsFetching. These APIs always count queries with fetchStatus: 'fetching'.

• Updated dependencies [6f8a48d, 18e54bf]:

  • @​tanstack/query-core@​5.105.1

5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

5.104.5

Patch Changes

• #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
• Updated dependencies [f608f93]:
  • @​tanstack/query-core@​5.104.5

5.104.4

Patch Changes

• #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [1fee044, fce89dd]:

  • @​tanstack/query-core@​5.104.4

5.104.3

Patch Changes

• Updated dependencies [0f15bc9]:
  • @​tanstack/query-core@​5.104.3

5.104.2

Patch Changes

• Updated dependencies [03e8c39]:
  • @​tanstack/query-core@​5.104.2

5.104.1

... (truncated)

Commits

• a6be1ce ci: Version Packages (#12391)
• 979695d docs({react,preact,angular,solid,svelte,vue}-query): describe when the 'Defin...
• 7ccba6e fix({react,preact,angular,solid,vue}-query/infiniteQueryOptions): correct the...
• 18e54bf fix(query-core): exclude fetchStatus from fetching filters (#12390)
• 5cc606e ci: Version Packages (#12301)
• 14cc330 style(packages): write durations in 'count * unit * 1000' order (#12382)
• d7c0418 chore(react-query/{useQuery,useInfiniteQuery}): remove the unused '@​eslint-re...
• aa3e26b chore(react-query/{HydrationBoundary,utils}): explain why 'react-hooks-js/ref...
• b2801aa test(react-query/useMutation): assert that the mutation settles in the cache ...
• 43636c4 test(react-query/useMutation): wait for the mutation to settle after unmount ...
• Additional commits viewable in compare view

Updates @tanstack/react-query-devtools from 5.104.0 to 5.105.1

Changelog

Sourced from @​tanstack/react-query-devtools's changelog.

5.105.1

Patch Changes

• Updated dependencies [7ccba6e, 18e54bf]:
  • @​tanstack/react-query@​5.105.1
  • @​tanstack/query-devtools@​5.105.1

5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.105.0
  • @​tanstack/react-query@​5.105.0

5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5
  • @​tanstack/query-devtools@​5.104.5

5.104.4

Patch Changes

• #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

  • @​tanstack/query-devtools@​5.104.4
  • @​tanstack/react-query@​5.104.4

5.104.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.104.3
  • @​tanstack/query-devtools@​5.104.3

5.104.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.104.2
  • @​tanstack/react-query@​5.104.2

... (truncated)

Commits

• a6be1ce ci: Version Packages (#12391)
• 5cc606e ci: Version Packages (#12301)
• a5d5e00 docs(*-devtools): describe how the 'theme' prop interacts with the theme sele...
• 4b2c611 test({query-devtools,react-query-devtools,preact-query-devtools,vue-query}): ...
• bb41f83 chore(oxlint.config): add 'eslint-plugin-testing-library' with its DOM rules ...
• 07bdb6b chore(oxlint.config): enable 'vitest/require-mock-type-parameters' and type t...
• c1dc50c chore(oxlint.config): enable 'vitest/prefer-import-in-mock' and type the modu...
• 22d9966 chore(oxlint.config): enable 'vitest/prefer-called-with' and assert the call ...
• a8ecc8d ci: Version Packages (#12128)
• 1219972 ci: Version Packages (#12062)
• Additional commits viewable in compare view

Updates i18next from 26.4.2 to 26.7.1

Release notes

Sourced from i18next's releases.

v26.7.1

• fix: reloadResources() retries the bundles that failed to load. The load queue skipped them also when reloading, so a language whose first load failed (a backend or network outage at startup) stayed missing. i18next-http-backend 4.0.8, i18next-chained-backend 5.0.7 and i18next-locize-backend 10.0.5 reload through reloadResources() with i18next 26.7, so their reloadInterval no longer recovered from such a failure, as their own reload did before.
• fix: reloadResources() without languages reloads the current languages and every language the backend loaded or tried to load, for the instance and its clones, as the API docs describe ("pass languages and namespaces if you don't want to reload all"). It reloaded only the current languages, so on a server (one clone per request with i18next-http-middleware) a backend's reloadInterval never refreshed the languages loaded for requests. It never requests cimode. With languages given, nothing changes.

v26.7.0

The last 26.x minor before v27, which follows in about a week. It adds the APIs v27 builds on, and with debug: true it warns wherever a setup relies on something v27 changes. Most of the v27 defaults are existing options, so you can try them now:

i18next.init({
  debug: true, // prints the warnings below
  fallbackLng: 'en', // v27: fallbackLng defaults to false, set your source language (no implicit 'dev')
  returnEmptyString: false, // v27 default: an empty string falls back like a missing key
  cleanCode: true, // close to v27, which canonicalizes codes without a region ('EN' becomes 'en')
});

declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: true; // v27 default
    returnEmptyString: false; // v27 default
  }
}

The other v27 changes (/ no longer escaped in values, a logger and post-processors per instance, the key instead of a sentence for an object hit, the dotted-language store calls and *Escaped options removed) have no switch; the debug warnings below show where they apply.

• feat: with the default skipOnVariables: true, a missing interpolation variable is now logged in debug mode, once per string and variable: missed to pass in variable name for interpolating Hello {{name}}. The raw {{name}} reached the UI without any log line, even with debug: true, because the warning only ran with skipOnVariables: false. A variable passed as undefined and a missingInterpolationHandler still log nothing.
• feat: i18next.hydrate(resources, lng) puts resources rendered on the server into the store and changes to the server's language, each only the first time. It does what react-i18next's useSSR did by writing resourceStore.data, options.ns, isInitialized, initializedStoreOnce and initializedLanguageOnce directly, and sets the same flags, so integrations can switch to it and stay compatible with code that still reads or writes them. On a clone it does nothing, as useSSR does: a clone shares its parent's store (one clone per request with i18next-http-middleware). Called before init(), it logs a warning and changes nothing.
• feat: services.utils.reloadResources() lets a backend reload its bundles through i18next (as i18next.reloadResources(), with retries and the loaded event), instead of calling backendConnector.read() and loaded() itself as the reloadInterval of i18next-http-backend and i18next-chained-backend does. Without languages (no lng, no detector, the default fallbackLng), reloadResources() reloads nothing instead of throwing Cannot read properties of undefined (reading 'forEach'); a backend that also reloads preload passes its languages.
• feat: backends and async language detectors can declare their calling convention with callbackApi (an instance or static property). true: read(language, namespace, callback), create(languages, namespace, key, fallbackValue, callback, options) and detect(callback); false: they return a promise or a value, and create gets the options as its fifth argument. Without it, i18next keeps guessing from the number of parameters (Function.length), which default and rest parameters change: i18next-chained-backend's create(..., clb = () => {}, opts = {}) has length 4 and never got its options (isUpdate), and i18next-http-backend's callback form of create has length 5, the length reserved for the callback-less form. Guessing is deprecated: in debug mode an unmarked backend or async detector logs a deprecation warning, once per init().
• feat: isSafeLanguageCode(code) is exported for plugins that take a language from a request, a URL or storage: letters, digits, -, _, @ and . (no ..), at most 128 characters, not a prototype key. It is not a BCP 47 check, so en_US, zh_Hant_TW, sr@latin and de_DE.UTF-8 pass; markup, slashes and spaces do not. The language detector, i18next-http-middleware and i18next-http-backend each have their own rule today.
• feat: use() logs a warning in debug mode when a second backend, language detector, i18nFormat or formatter replaces the first one; only one of each is used per instance, and losing an ICU setup this way was silent. As use() usually runs before init(), the warning is printed once init() has set up the logger.
• feat(types): ParseKeysWithoutVariables<Ns, KPrefix>, the keys t() takes without options: their string has no variables, and a plural key is left out when its forms take count. A wrapper typed with it, like (key: ParseKeysWithoutVariables<'common'>) => t(key), compiles with strictInterpolationChecks without a cast.
• feat(types): defaultVariables in CustomTypeOptions declares the variables interpolation.defaultVariables fills in at runtime (defaultVariables: { appName: string }). They become optional in the t() options, also with strictInterpolationChecks; passed, they keep their type.
• feat(types): interpolationFormatSeparator in CustomTypeOptions for a custom interpolation.formatSeparator: the types split {{price, currency}} at a hard-coded ,, so with formatSeparator: ';' the format was not recognized. The per-call skipInterpolation option is typed, and returnedObjectHandler may return a value (what it returns is what t() returns; it was typed as returning void).
• feat(types): SelectorFn, ApplyTarget, ConstrainTarget and GetSource are exported on purpose, under their current names. react-i18next imports them for Trans; they were importable only because every declaration in the type files counts as exported.
• fix(types): with nsSeparator: false in CustomTypeOptions, the key union no longer contains nsfalsekey-style keys for the other namespaces, and a key that contains the text false (isfalsey) is no longer split at it, which typed its t() result as never.
• fix: with clones (i18next-http-middleware makes one per request), saveMissing now checks that the namespace is loaded for the instance that misses the key. Each cloneInstance() pointed the parent's services.utils.hasLoadedNamespace at the new clone, and the backend connector, which all clones share, used that one: a key missing in one request was not saved (did not save key ... as the namespace ... was not yet loaded) while a newer request was still loading its language, and the parent's services.utils answered for the newest clone. A clone's services.utils is now bound to the clone, and the parent keeps its own. A direct services.backendConnector.saveMissing() call, like the missing keys route of i18next-http-middleware, still checks the newest clone (follow-up to #1413).
• fix: dir() without a language (before init(), or with no language resolved) returns 'ltr' instead of 'rtl' ([discussion #2135](Why 'rtl' is default direction in case of language not found? i18next/i18next#2135)).
• fix: t() before init() returns an empty string, as typed (with a warning when debug logging is already on); it returned undefined.
• fix: off('a b', listener) removes the listener from both events, as on('a b', listener) adds it to both. It looked for an event named 'a b', so once('a b', listener) never removed its listener and ran it on every event.
• deprecate: dotted languages in the resource store calls (getResource('en.translation.key'), addResource('en.translation.key', value), addResourceBundle('en.translation', resources)) log a deprecation warning in debug mode; they are removed in v27. Pass language, namespace and key as separate arguments.
• deprecate: interpolation.prefixEscaped, suffixEscaped, nestingPrefixEscaped and nestingSuffixEscaped (inserted into the RegExp unescaped) log a deprecation warning in debug mode and are marked @deprecated; they are removed in v27. Pass the literal delimiters as prefix, suffix, nestingPrefix and nestingSuffix.
• deprecate: compatibilityJSON is marked @deprecated (it has no effect since v24) and removed from the types in v27.
• deprecate: a language code without a region that v27 canonicalizes differently logs a deprecation warning in debug mode: 'EN' stays 'EN' today and becomes 'en' in v27, 'iw' becomes 'he'. cleanCode: true already lower-cases them.
• deprecate: when fallbackLng is not set, the first request for the default fallback language dev (loading it, or saving missing keys to it) logs a notice in debug mode: v27 defaults to fallbackLng: false and no longer requests dev. Set fallbackLng to your source language, or to 'dev' to keep the current behavior.
• deprecate: in debug mode, a language code that comes from lng, changeLanguage() or the language detector, is not configured (supportedLngs, fallbackLng, preload or the resources) and fails isSafeLanguageCode logs a deprecation warning, once per code: without supportedLngs, a detector that returns "><img src=x onerror=alert(1)> makes that string i18next.language, and apps put it into <html lang>. Nothing changes in 26.7; v27 is planned to refuse such codes and continue as with an unsupported code. Language codes are still not bound to a format.
• deprecate: the logger and post-processors are shared by all instances in v26 and per instance from v27 (clones keep their parent's). In debug mode, an instance that runs a post-processor only another instance registered with use() logs a deprecation warning (call use() on this instance too), and a non-clone init() that replaces the logger another instance set with use() logs one through that logger.
• deprecate: in debug mode, a value with a / under the default escape logs that v27 no longer escapes / ($10/month renders as $10/month today; not with escapeValue: false, where react-i18next's Trans escapes one call itself and decodes the entities afterwards), and an object or array hit without returnObjects logs that v27 returns the key instead of the sentence key '... (en)' returned an object instead of string..

... (truncated)

Changelog

Sourced from i18next's changelog.

26.7.1

• fix: reloadResources() retries the bundles that failed to load. The load queue skipped them also when reloading, so a language whose first load failed (a backend or network outage at startup) stayed missing. i18next-http-backend 4.0.8, i18next-chained-backend 5.0.7 and i18next-locize-backend 10.0.5 reload through reloadResources() with i18next 26.7, so their reloadInterval no longer recovered from such a failure, as their own reload did before.
• fix: reloadResources() without languages reloads the current languages and every language the backend loaded or tried to load, for the instance and its clones, as the API docs describe ("pass languages and namespaces if you don't want to reload all"). It reloaded only the current languages, so on a server (one clone per request with i18next-http-middleware) a backend's reloadInterval never refreshed the languages loaded for requests. It never requests cimode. With languages given, nothing changes.

26.7.0

The last 26.x minor before v27, which follows in about a week. It adds the APIs v27 builds on, and with debug: true it warns wherever a setup relies on something v27 changes. Most of the v27 defaults are existing options, so you can try them now:

i18next.init({
  debug: true, // prints the warnings below
  fallbackLng: 'en', // v27: fallbackLng defaults to false, set your source language (no implicit 'dev')
  returnEmptyString: false, // v27 default: an empty string falls back like a missing key
  cleanCode: true, // close to v27, which canonicalizes codes without a region ('EN' becomes 'en')
});

declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: true; // v27 default
    returnEmptyString: false; // v27 default
  }
}

The other v27 changes (/ no longer escaped in values, a logger and post-processors per instance, the key instead of a sentence for an object hit, the dotted-language store calls and *Escaped options removed) have no switch; the debug warnings below show where they apply.

• feat: with the default skipOnVariables: true, a missing interpolation variable is now logged in debug mode, once per string and variable: missed to pass in variable name for interpolating Hello {{name}}. The raw {{name}} reached the UI without any log line, even with debug: true, because the warning only ran with skipOnVariables: false. A variable passed as undefined and a missingInterpolationHandler still log nothing.
• feat: i18next.hydrate(resources, lng) puts resources rendered on the server into the store and changes to the server's language, each only the first time. It does what react-i18next's useSSR did by writing resourceStore.data, options.ns, isInitialized, initializedStoreOnce and initializedLanguageOnce directly, and sets the same flags, so integrations can switch to it and stay compatible with code that still reads or writes them. On a clone it does nothing, as useSSR does: a clone shares its parent's store (one clone per request with i18next-http-middleware). Called before init(), it logs a warning and changes nothing.
• feat: services.utils.reloadResources() lets a backend reload its bundles through i18next (as i18next.reloadResources(), with retries and the loaded event), instead of calling backendConnector.read() and loaded() itself as the reloadInterval of i18next-http-backend and i18next-chained-backend does. Without languages (no lng, no detector, the default fallbackLng), reloadResources() reloads nothing instead of throwing Cannot read properties of undefined (reading 'forEach'); a backend that also reloads preload passes its languages.
• feat: backends and async language detectors can declare their calling convention with callbackApi (an instance or static property). true: read(language, namespace, callback), create(languages, namespace, key, fallbackValue, callback, options) and detect(callback); false: they return a promise or a value, and create gets the options as its fifth argument. Without it, i18next keeps guessing from the number of parameters (Function.length), which default and rest parameters change: i18next-chained-backend's create(..., clb = () => {}, opts = {}) has length 4 and never got its options (isUpdate), and i18next-http-backend's callback form of create has length 5, the length reserved for the callback-less form. Guessing is deprecated: in debug mode an unmarked backend or async detector logs a deprecation warning, once per init().
• feat: isSafeLanguageCode(code) is exported for plugins that take a language from a request, a URL or storage: letters, digits, -, _, @ and . (no ..), at most 128 characters, not a prototype key. It is not a BCP 47 check, so en_US, zh_Hant_TW, sr@latin and de_DE.UTF-8 pass; markup, slashes and spaces do not. The language detector, i18next-http-middleware and i18next-http-backend each have their own rule today.
• feat: use() logs a warning in debug mode when a second backend, language detector, i18nFormat or formatter replaces the first one; only one of each is used per instance, and losing an ICU setup this way was silent. As use() usually runs before init(), the warning is printed once init() has set up the logger.
• feat(types): ParseKeysWithoutVariables<Ns, KPrefix>, the keys t() takes without options: their string has no variables, and a plural key is left out when its forms take count. A wrapper typed with it, like (key: ParseKeysWithoutVariables<'common'>) => t(key), compiles with strictInterpolationChecks without a cast.
• feat(types): defaultVariables in CustomTypeOptions declares the variables interpolation.defaultVariables fills in at runtime (defaultVariables: { appName: string }). They become optional in the t() options, also with strictInterpolationChecks; passed, they keep their type.
• feat(types): interpolationFormatSeparator in CustomTypeOptions for a custom interpolation.formatSeparator: the types split {{price, currency}} at a hard-coded ,, so with formatSeparator: ';' the format was not recognized. The per-call skipInterpolation option is typed, and returnedObjectHandler may return a value (what it returns is what t() returns; it was typed as returning void).
• feat(types): SelectorFn, ApplyTarget, ConstrainTarget and GetSource are exported on purpose, under their current names. react-i18next imports them for Trans; they were importable only because every declaration in the type files counts as exported.
• fix(types): with nsSeparator: false in CustomTypeOptions, the key union no longer contains nsfalsekey-style keys for the other namespaces, and a key that contains the text false (isfalsey) is no longer split at it, which typed its t() result as never.
• fix: with clones (i18next-http-middleware makes one per request), saveMissing now checks that the namespace is loaded for the instance that misses the key. Each cloneInstance() pointed the parent's services.utils.hasLoadedNamespace at the new clone, and the backend connector, which all clones share, used that one: a key missing in one request was not saved (did not save key ... as the namespace ... was not yet loaded) while a newer request was still loading its language, and the parent's services.utils answered for the newest clone. A clone's services.utils is now bound to the clone, and the parent keeps its own. A direct services.backendConnector.saveMissing() call, like the missing keys route of i18next-http-middleware, still checks the newest clone (follow-up to #1413).
• fix: dir() without a language (before init(), or with no language resolved) returns 'ltr' instead of 'rtl' ([discussion #2135](Why 'rtl' is default direction in case of language not found? i18next/i18next#2135)).
• fix: t() before init() returns an empty string, as typed (with a warning when debug logging is already on); it returned undefined.
• fix: off('a b', listener) removes the listener from both events, as on('a b', listener) adds it to both. It looked for an event named 'a b', so once('a b', listener) never removed its listener and ran it on every event.
• deprecate: dotted languages in the resource store calls (getResource('en.translation.key'), addResource('en.translation.key', value), addResourceBundle('en.translation', resources)) log a deprecation warning in debug mode; they are removed in v27. Pass language, namespace and key as separate arguments.
• deprecate: interpolation.prefixEscaped, suffixEscaped, nestingPrefixEscaped and nestingSuffixEscaped (inserted into the RegExp unescaped) log a deprecation warning in debug mode and are marked @deprecated; they are removed in v27. Pass the literal delimiters as prefix, suffix, nestingPrefix and nestingSuffix.
• deprecate: compatibilityJSON is marked @deprecated (it has no effect since v24) and removed from the types in v27.
• deprec...

  Description has been truncated