[dependabot]

Bumps the frontend-dependencies group with 24 updates in the /frontend directory:

Package	From	To
@capacitor/android	8.5.2	8.5.3
@capacitor/app	8.1.1	8.1.2
@capacitor/camera	8.2.4	8.2.6
@capacitor/core	8.5.2	8.5.3
@capacitor/geolocation	8.2.2	8.2.4
@capacitor/ios	8.5.2	8.5.3
@capacitor/push-notifications	8.1.2	8.1.3
@capacitor/share	8.0.2	8.0.3
@capacitor/status-bar	8.0.3	8.0.4
@sentry/react	11.2.0	11.8.0
i18next	26.4.2	26.4.7
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
react-i18next	17.0.15	17.0.19
@axe-core/playwright	4.13.0	4.14.0
@capacitor/cli	8.5.2	8.5.3
@playwright/test	1.63.0	1.64.1
@testing-library/user-event	14.6.7	14.6.8
@vitejs/plugin-react	6.1.1	6.1.2
jsdom	30.1.1	30.1.3
vite	8.3.2	8.3.4
vite-plugin-pwa	1.3.0	2.0.0
vitest	5.0.3	5.0.5
firebase	12.19.0	13.0.0

Updates @capacitor/android from 8.5.2 to 8.5.3

Release notes

Sourced from @​capacitor/android's releases.

8.5.3

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Changelog

Sourced from @​capacitor/android's changelog.

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Commits

• 06e3e19 Release 8.5.3
• ba28569 chore: add .build/ folder to gitignore (#8640)
• 145560e fix(cli): change Cordova AppDelegate.h imports for SPM (#8618)
• See full diff in compare view

Updates @capacitor/app from 8.1.1 to 8.1.2

Release notes

Sourced from @​capacitor/app's releases.

@​capacitor/app@​8.1.2

8.1.2 (2026-10-02)

Bug Fixes

• app: silence the String?-to-Any coercion warning in getAppLanguage on iOS (#2598) (0706269)

Commits

• 87c0bb8 chore(release): publish [skip ci]
• 0706269 fix(app): silence the String?-to-Any coercion warning in getAppLanguage on iO...
• 03fca06 docs(screen-orientation): fix iOS orientation snippet for UIScene (#2597)
• bf42d23 fix(status-bar): avoid retain cycle between StatusBar and the bridge (#2569)
• 5608b1c fix(browser): only fire browserFinished when the Custom Tab actually terminat...
• ed6cf8f fix(share): present share sheet from the topmost view controller on iOS (#2574)
• fd606de fix(push-notifications): show foreground notification image on Android (#2572)
• 467dafd chore(release): publish [skip ci]
• fa8ddfb fix(share): Add nonce validation to broadcast receiver on Android (#2592)
• 89070d4 chore: migrate local notifications to new repo (#2584)
• Additional commits viewable in compare view

Updates @capacitor/camera from 8.2.4 to 8.2.6

Release notes

Sourced from @​capacitor/camera's releases.

v8.2.6

8.2.6 (2026-10-16)

Bug Fixes

• android: use bridge.registerForActivityResult for Fragment compatibility (#84) (41ece15)

---

This release is also available on:

• npm package (@​latest dist-tag)

v8.2.6-next.1

8.2.6-next.1 (2026-10-02)

Bug Fixes

• ios: bump ion-ios-camera to 1.0.5 for iOS 27 UIScene compliance (#67) (b110010)

---

This release is also available on:

• npm package (@​next dist-tag)

v8.2.5

8.2.5 (2026-10-02)

Bug Fixes

• android: fix build warnings (#81) (ae77487)

---

This release is also available on:

• npm package (@​latest dist-tag)

Changelog

Sourced from @​capacitor/camera's changelog.

8.2.6 (2026-10-16)

Bug Fixes

• android: use bridge.registerForActivityResult for Fragment compatibility (#84) (41ece15)

8.2.5 (2026-10-02)

Bug Fixes

• android: fix build warnings (#81) (ae77487)

Commits

• 7e001d4 chore(release): 8.2.6 [skip ci]
• 41ece15 fix(android): use bridge.registerForActivityResult for Fragment compatibility...
• f555eec chore(release): 8.2.5 [skip ci]
• ae77487 fix(android): fix build warnings (#81)
• See full diff in compare view

Updates @capacitor/core from 8.5.2 to 8.5.3

Release notes

Sourced from @​capacitor/core's releases.

8.5.3

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Changelog

Sourced from @​capacitor/core's changelog.

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Commits

• 06e3e19 Release 8.5.3
• ba28569 chore: add .build/ folder to gitignore (#8640)
• 145560e fix(cli): change Cordova AppDelegate.h imports for SPM (#8618)
• See full diff in compare view

Updates @capacitor/geolocation from 8.2.2 to 8.2.4

Release notes

Sourced from @​capacitor/geolocation's releases.

v8.2.4

8.2.4 (2026-10-16)

Bug Fixes

• android: use bridge.registerForActivityResult for Fragment compatibility (#104) (6a171fe)

---

This release is also available on:

• npm package (@​latest dist-tag)

v8.2.3

8.2.3 (2026-10-02)

Bug Fixes

• ios: update native lib to latest version (#103) (0638cae)

---

This release is also available on:

• npm package (@​latest dist-tag)

Changelog

Sourced from @​capacitor/geolocation's changelog.

8.2.4 (2026-10-16)

Bug Fixes

• android: use bridge.registerForActivityResult for Fragment compatibility (#104) (6a171fe)

8.2.3 (2026-10-02)

Bug Fixes

• ios: update native lib to latest version (#103) (0638cae)

Commits

• 1f652e0 chore(release): 8.2.4 [skip ci]
• 6a171fe fix(android): use bridge.registerForActivityResult for Fragment compatibility...
• c61adcf chore(release): 8.2.3 [skip ci]
• 0638cae fix(ios): update native lib to latest version (#103)
• See full diff in compare view

Updates @capacitor/ios from 8.5.2 to 8.5.3

Release notes

Sourced from @​capacitor/ios's releases.

8.5.3

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Changelog

Sourced from @​capacitor/ios's changelog.

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Commits

• 06e3e19 Release 8.5.3
• ba28569 chore: add .build/ folder to gitignore (#8640)
• 145560e fix(cli): change Cordova AppDelegate.h imports for SPM (#8618)
• See full diff in compare view

Updates @capacitor/push-notifications from 8.1.2 to 8.1.3

Release notes

Sourced from @​capacitor/push-notifications's releases.

@​capacitor/push-notifications@​8.1.3

8.1.3 (2026-10-02)

Bug Fixes

• push-notifications: show foreground notification image on Android (#2572) (fd606de)

Commits

• 87c0bb8 chore(release): publish [skip ci]
• 0706269 fix(app): silence the String?-to-Any coercion warning in getAppLanguage on iO...
• 03fca06 docs(screen-orientation): fix iOS orientation snippet for UIScene (#2597)
• bf42d23 fix(status-bar): avoid retain cycle between StatusBar and the bridge (#2569)
• 5608b1c fix(browser): only fire browserFinished when the Custom Tab actually terminat...
• ed6cf8f fix(share): present share sheet from the topmost view controller on iOS (#2574)
• fd606de fix(push-notifications): show foreground notification image on Android (#2572)
• 467dafd chore(release): publish [skip ci]
• fa8ddfb fix(share): Add nonce validation to broadcast receiver on Android (#2592)
• 89070d4 chore: migrate local notifications to new repo (#2584)
• Additional commits viewable in compare view

Updates @capacitor/share from 8.0.2 to 8.0.3

Release notes

Sourced from @​capacitor/share's releases.

@​capacitor/share@​8.0.3

8.0.3 (2026-10-02)

Bug Fixes

• share: present share sheet from the topmost view controller on iOS (#2574) (ed6cf8f)

Commits

• 87c0bb8 chore(release): publish [skip ci]
• 0706269 fix(app): silence the String?-to-Any coercion warning in getAppLanguage on iO...
• 03fca06 docs(screen-orientation): fix iOS orientation snippet for UIScene (#2597)
• bf42d23 fix(status-bar): avoid retain cycle between StatusBar and the bridge (#2569)
• 5608b1c fix(browser): only fire browserFinished when the Custom Tab actually terminat...
• ed6cf8f fix(share): present share sheet from the topmost view controller on iOS (#2574)
• fd606de fix(push-notifications): show foreground notification image on Android (#2572)
• See full diff in compare view

Updates @capacitor/status-bar from 8.0.3 to 8.0.4

Release notes

Sourced from @​capacitor/status-bar's releases.

@​capacitor/status-bar@​8.0.4

8.0.4 (2026-10-02)

Bug Fixes

• status-bar: avoid retain cycle between StatusBar and the bridge (#2569) (bf42d23)

Commits

• 87c0bb8 chore(release): publish [skip ci]
• 0706269 fix(app): silence the String?-to-Any coercion warning in getAppLanguage on iO...
• 03fca06 docs(screen-orientation): fix iOS orientation snippet for UIScene (#2597)
• bf42d23 fix(status-bar): avoid retain cycle between StatusBar and the bridge (#2569)
• 5608b1c fix(browser): only fire browserFinished when the Custom Tab actually terminat...
• ed6cf8f fix(share): present share sheet from the topmost view controller on iOS (#2574)
• fd606de fix(push-notifications): show foreground notification image on Android (#2572)
• 467dafd chore(release): publish [skip ci]
• fa8ddfb fix(share): Add nonce validation to broadcast receiver on Android (#2592)
• 89070d4 chore: migrate local notifications to new repo (#2584)
• Additional commits viewable in compare view

Updates @sentry/react from 11.2.0 to 11.8.0

Release notes

Sourced from @​sentry/react's releases.

11.8.0

Important Changes

• feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

  The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

  • Node.js 20.19.0 or higher is required.
  • @sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.
  • The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
  • Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

• feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

  OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

• feat(core): Support SuppressedError in LinkedErrors integration (#25246)
• fix(astro): Delete generated source maps for static output (#25310)
• fix(astro): Upload source maps of Astro 7's prerender build (#25309)
• fix(browser): Apply urlQueryParams to the Referer header (#25324)
• fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
• fix(hono): Expose runtime-specific SDK options (#25290)
• fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)
• fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)
• fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)
• fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)
• fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
• fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)
• fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)

• chore: Add external contributor to CHANGELOG.md (#25375)
• ci: Install the pnpm version that Volta pins (#25287)
• license: Add cli FSL notice to package licenses (#25314)
• ref(core): use shared MCP attribute conventions (#25059)
• ref(tanstackstart-react): Reuse shared component annotation options (#25313)
• test(browser): Keep whitespace text out of the handlers-lcp page (#25280)
• test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)
• test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
• test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)
• test(e2e): Add node-openai-send-to-sentry test app (#24824)
• test(e2e): Add nuxt-5-sourcemaps test (#25268)
• test(e2e): Inherit root Volta config in all e2e test apps (#25369)
• test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)
• test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)
• test(nextjs): Switch DEBUG_BUILD with a getter instead of re-importing the SDK (#25279)

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

11.8.0

Important Changes

• feat(bundler-plugins): Release @sentry/webpack-plugin, @sentry/vite-plugin, @sentry/rollup-plugin and @sentry/esbuild-plugin from the SDK repository (#25095)

  The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching @sentry/bundler-plugins entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:

  • Node.js 20.19.0 or higher is required.
  • @sentry/webpack-plugin requires webpack 5.1 or higher. The @sentry/webpack-plugin/webpack5 entry point still works and exports the same plugin as @sentry/webpack-plugin.
  • The plugins use the sentry CLI SDK instead of @sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
  • Deploys that the plugins create on Vercel use the value of VERCEL_TARGET_ENV (production, preview or a custom name) as their environment, instead of vercel-production or vercel-preview. To keep the old value, set release.deploy.env.

• feat(server-utils): Instrument the OpenAI decisions API as gen_ai.decide spans (#25285)

  OpenAI decisions.create calls now create gen_ai.decide spans.

Other Changes

• feat(core): Support SuppressedError in LinkedErrors integration (#25246)
• fix(astro): Delete generated source maps for static output (#25310)
• fix(astro): Upload source maps of Astro 7's prerender build (#25309)
• fix(browser): Apply urlQueryParams to the Referer header (#25324)
• fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
• fix(hono): Expose runtime-specific SDK options (#25290)
• fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)
• fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)
• fix(server-utils): Read pi-durable 1.2.0 tool results from output (#25312)
• fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)
• fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
• fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)
• fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)

• chore: Add external contributor to CHANGELOG.md (#25375)
• ci: Install the pnpm version that Volta pins (#25287)
• license: Add cli FSL notice to package licenses (#25314)
• ref(core): use shared MCP attribute conventions (#25059)
• ref(tanstackstart-react): Reuse shared component annotation options (#25313)
• test(browser): Keep whitespace text out of the handlers-lcp page (#25280)
• test(bun): Restore @​sentry/core spies after the Bun.serve tests (#25276)
• test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
• test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)
• test(e2e): Add node-openai-send-to-sentry test app (#24824)
• test(e2e): Add nuxt-5-sourcemaps test (#25268)
• test(e2e): Inherit root Volta config in all e2e test apps (#25369)
• test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)
• test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)

... (truncated)

Commits

• c6492ef release: 11.8.0
• e091f7f meta(changelog): Update changelog for 11.8.0 (#25388)
• 30ec754 meta(changelog): Update changelog for 11.8.0
• a309cf8 test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
• 71f1ef9 test(e2e): Inherit root Volta config in all e2e test apps (#25369)
• e54e577 chore: Add external contributor to CHANGELOG.md (#25375)
• 0ed4606 fix(sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25376)
• 9516aeb fix(cloudflare): auto-instrument when wrangler main is a package (#25343)
• 7471347 feat(core): Support SuppressedError in LinkedErrors integration (#25246)
• f4ae6c5 fix(browser): Apply urlQueryParams to the Referer header (#25324)
• Additional commits viewable in compare view

Updates i18next from 26.4.2 to 26.4.7

Release notes

Sourced from i18next's releases.

v26.4.7

• perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

v26.4.6

• fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).

v26.4.5

• fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

v26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
• fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

• perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

Changelog

Sourced from i18next's changelog.

26.4.7

• perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

26.4.6

• fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).

26.4.5

• fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. See advisory GHSA-5jr9-983r-c8x4, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
• fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

26.4.3

• perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

Commits

• 5546d21 26.4.7
• f27c937 build
• 50ecc22 perf: clones no longer inherit preload, so changeLanguage on a clone doesn't ...
• bc951ab 26.4.6
• 45d0aba changelog + build for 26.4.6
• 0458efc fix: don't repeat a fallback language that differs only in casing (#2450)
• ce7b9cf 26.4.5
• 4d4c607 build
• 8f8651e fix: hasLoadedNamespace with a passed in lng checks the code it is actually l...
• 15d0b9d changelog: link GHSA-5jr9-983r-c8x4 in v26.4.4
• Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (...

  Description has been truncated