chore(deps): bump the minor-and-patch group across 1 directory with 19 updates

[dependabot]

Bumps the minor-and-patch group with 19 updates in the / directory:

Package	From	To
@privy-io/react-auth	3.26.0	3.38.0
@privy-io/wagmi	4.0.7	4.0.16
@rainbow-me/rainbowkit	2.2.10	2.2.11
@tailwindcss/postcss	4.3.0	4.3.3
@tanstack/react-query	5.100.10	5.102.8
@vanilla-extract/css	1.20.1	1.21.2
@vanilla-extract/sprinkles	1.6.5	1.7.1
i18next	26.2.0	26.4.0
lucide-react	1.16.0	1.35.0
next	15.5.18	15.5.24
postcss	8.5.14	8.5.26
react	19.2.6	19.2.8
@types/react	19.2.14	19.2.18
react-dom	19.2.6	19.2.8
react-i18next	17.0.8	17.0.12
react-unity-webgl	10.1.6	10.2.0
tailwindcss	4.3.0	4.3.3
viem	2.49.3	2.56.0
eslint-config-next	15.5.18	15.5.24

Updates @privy-io/react-auth from 3.26.0 to 3.38.0

Commits

• See full diff in compare view

Updates @privy-io/wagmi from 4.0.7 to 4.0.16

Commits

• See full diff in compare view

Updates @rainbow-me/rainbowkit from 2.2.10 to 2.2.11

Release notes

Sourced from @​rainbow-me/rainbowkit's releases.

@​rainbow-me/rainbowkit@​2.2.11

Patch Changes

• a40b1f4: Migrate the Base connector to canonical base naming, while preserving backwards-compatible aliases baseAccount and coinbaseWallet.

• 3672dc6: Added Anchorage Digital wallet support with the anchorageDigitalWallet wallet connector.

• 1043d88: Added MeCo Wallet support with mecoWallet wallet connector.

• f52657f: Exposed RainbowKitProviderProps and WalletButtonRendererProps as public type exports to support Custom Wallet Button scenarios.

• 4f2de17: Fixed a crash that could occur when selecting a wallet while multiple browser wallet extensions were installed and the specific injected wallet was missing. Wallet-specific injected connectors now bind only to their matching provider instead of falling back to available defaults.

• bc4625c: Fix recent transaction tracking so failed transactions no longer prevent an app's own transaction receipt wait from settling.

• 25c4c2b: Improved SSR safety to prevent WalletConnect initialization warnings and mitigate localStorage API availability changes in Node.js v25 and above.

• f52657f: Fixed useWindowSize triggering a state update after unmount, which could surface as a React warning.

• eb4251d: The AuthenticationAdapter.createMessage API can now return a promise, so dApps can fetch or construct a custom SIWE message asynchronously. This enables server-side SIWE message creation before prompting the wallet, while preserving existing synchronous behavior.

  See the server-side message creation docs for guidance.

• b0f6d52: fix: harden useCoolMode against malicious wallet icon URLs

  The cool mode particle animation built image elements via innerHTML, which parses its input as HTML. A malicious EIP-6963 wallet could supply a crafted icon URL containing injected attributes (e.g. onerror) that would execute in the dApp's origin when a user interacts with the wallet button.

  Switched to document.createElement('img') with property assignment so the icon value is always treated as a plain URL rather than markup.

• f2523a9: Updated MetaMask wallet icon

Changelog

Sourced from @​rainbow-me/rainbowkit's changelog.

2.2.11

Patch Changes

• a40b1f4: Migrate the Base connector to canonical base naming, while preserving backwards-compatible aliases baseAccount and coinbaseWallet.

• 3672dc6: Added Anchorage Digital wallet support with the anchorageDigitalWallet wallet connector.

• 1043d88: Added MeCo Wallet support with mecoWallet wallet connector.

• f52657f: Exposed RainbowKitProviderProps and WalletButtonRendererProps as public type exports to support Custom Wallet Button scenarios.

• 4f2de17: Fixed a crash that could occur when selecting a wallet while multiple browser wallet extensions were installed and the specific injected wallet was missing. Wallet-specific injected connectors now bind only to their matching provider instead of falling back to available defaults.

• bc4625c: Fix recent transaction tracking so failed transactions no longer prevent an app's own transaction receipt wait from settling.

• 25c4c2b: Improved SSR safety to prevent WalletConnect initialization warnings and mitigate localStorage API availability changes in Node.js v25 and above.

• f52657f: Fixed useWindowSize triggering a state update after unmount, which could surface as a React warning.

• eb4251d: The AuthenticationAdapter.createMessage API can now return a promise, so dApps can fetch or construct a custom SIWE message asynchronously. This enables server-side SIWE message creation before prompting the wallet, while preserving existing synchronous behavior.

  See the server-side message creation docs for guidance.

• b0f6d52: fix: harden useCoolMode against malicious wallet icon URLs

  The cool mode particle animation built image elements via innerHTML, which parses its input as HTML. A malicious EIP-6963 wallet could supply a crafted icon URL containing injected attributes (e.g. onerror) that would execute in the dApp's origin when a user interacts with the wallet button.

  Switched to document.createElement('img') with property assignment so the icon value is always treated as a plain URL rather than markup.

• f2523a9: Updated MetaMask wallet icon

Commits

• 03360ee chore: version packages (#2659)
• f6f00a8 chore(tooling): upgrade biome, typescript (#2669)
• e90c2dd feat: next-auth v5 (#2606)
• bc4625c fix: isolate recent transaction receipt waits (#2670)
• eb4251d feat: support async createMessage in AuthenticationAdapter (#2633)
• 5349f6a feat: internal component exports (#2589)
• a40b1f4 fix: migrate baseAccount connector to base with aliases (#2634)
• 33f2a10 fix: cuer QRCode prop type errors (#2663)
• 4f2de17 fix: avoid binding missing injected wallets (#2661)
• b473b08 fix: guard localStorage access during SSR (#2660)
• Additional commits viewable in compare view

Updates @tailwindcss/postcss from 4.3.0 to 4.3.3

Release notes

Sourced from @​tailwindcss/postcss's releases.

v4.3.3

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
• Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
• Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
• Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
• Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
• Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
• Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
• Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
• Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

v4.3.2

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

v4.3.1

Added

• Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
• Allow @apply to be used with CSS mixins (#19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)
• Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)
• Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)

... (truncated)

Changelog

Sourced from @​tailwindcss/postcss's changelog.

[4.3.3] - 2026-07-16

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
• Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
• Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
• Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
• Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
• Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
• Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
• Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
• Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

[4.3.2] - 2026-06-26

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

[4.3.1] - 2026-06-12

Added

• Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
• Allow @apply to be used with CSS mixins (#19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#20059)

... (truncated)

Commits

• c2b24dd 4.3.3 (#20334)
• e48c5e8 Fix weird character rendering on Windows with Japanese locale (#20318)
• 9b0e8af Ensure @tailwindcss/postcss rebuilds when the input CSS changes but its mti...
• b53fa09 fix: exclude iframes from focus-visible auto outline in Preflight (#20292)
• 056a155 4.3.2 (#20281)
• 8a14a71 4.3.1 (#20226)
• 522288c Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)
• 8dcdb66 Bump dependencies (#20095)
• See full diff in compare view

Updates @tanstack/react-query from 5.100.10 to 5.102.8

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.102.8
  • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-next-experimental@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.102.8

@​tanstack/react-query-persist-client@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.102.8
  • @​tanstack/react-query@​5.102.8

@​tanstack/react-query@​5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.8

@​tanstack/react-query-devtools@​5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.102.7
  • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-next-experimental@​5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.102.7

@​tanstack/react-query-persist-client@​5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.102.7
  • @​tanstack/react-query@​5.102.7

@​tanstack/react-query@​5.102.7

Patch Changes

• Updated dependencies []:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.102.8

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.8

5.102.7

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.7

5.102.6

Patch Changes

• #11305 ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

• Updated dependencies []:

  • @​tanstack/query-core@​5.102.6

5.102.5

Patch Changes

• Updated dependencies [578e5c2]:
  • @​tanstack/query-core@​5.102.5

5.102.4

Patch Changes

• Updated dependencies [a05df6a]:
  • @​tanstack/query-core@​5.102.4

5.102.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.3

5.102.2

Patch Changes

• Updated dependencies [80fbf73]:
  • @​tanstack/query-core@​5.102.2

... (truncated)

Commits

• See full diff in compare view

Updates @vanilla-extract/css from 1.20.1 to 1.21.2

Release notes

Sourced from @​vanilla-extract/css's releases.

@​vanilla-extract/css@​1.21.2

Patch Changes

• #1742 6d56091 Thanks @​ATOM00blue! - Replace dots with underscores in development mode identifiers

  Replace dots with underscores in debug identifiers

  debug identifiers are derived from the source file path. For file paths with additional dots beyond the .css.ts extension (e.g. foo.vanilla.css.ts), the resulting class names contained a literal ., which is a CSS selector metacharacter that requires escaping and is a source of instability. Dots in debug identifiers are now replaced with _. This only affects debug identifiers and not short identifiers.

@​vanilla-extract/css@​1.21.1

Patch Changes

• #1756 b5ca20a Thanks @​askoufis! - Fixed a style composition bug that caused incorrect selector substitution in some cases

• #1758 46eb58c Thanks @​greymoth-jp! - Add boxOrdinalGroup to the list of unitless properties so numeric values are no longer suffixed with px

@​vanilla-extract/css@​1.21.0

Minor Changes

• #1749 caacf56 Thanks @​bschlenk! - Allow createGlobalVar to accept a name with a leading --

  Similar to createGlobalThemeContract, createGlobalVar now trims a leading -- from the variable name. This can be useful if you want to keep the full variable name searchable in your codebase.

  EXAMPLE USAGE:

  import { createGlobalVar } from '@vanilla-extract/css';
  // Both produce var(--my-global-var)
  const a = createGlobalVar('my-global-var');
  const b = createGlobalVar('--my-global-var');

• #1720 7bbe189 Thanks @​cahnory! - style, globalStyle: Add support for @scope rules

  EXAMPLE USAGE:

  import { style, globalStyle } from '@vanilla-extact/css';
  export const styleWithScopeRule = style({
  '@​scope': {
  '(body)': {
  ':after': { content: '"Scoped to body"' }
  }
  }
  });
  globalStyle('div', {
  '@​scope': {

... (truncated)

Changelog

Sourced from @​vanilla-extract/css's changelog.

1.21.2

Patch Changes

• #1742 6d56091 Thanks @​ATOM00blue! - Replace dots with underscores in development mode identifiers

  Replace dots with underscores in debug identifiers

  debug identifiers are derived from the source file path. For file paths with additional dots beyond the .css.ts extension (e.g. foo.vanilla.css.ts), the resulting class names contained a literal ., which is a CSS selector metacharacter that requires escaping and is a source of instability. Dots in debug identifiers are now replaced with _. This only affects debug identifiers and not short identifiers.

1.21.1

Patch Changes

• #1756 b5ca20a Thanks @​askoufis! - Fixed a style composition bug that caused incorrect selector substitution in some cases

• #1758 46eb58c Thanks @​greymoth-jp! - Add boxOrdinalGroup to the list of unitless properties so numeric values are no longer suffixed with px

1.21.0

Minor Changes

• #1749 caacf56 Thanks @​bschlenk! - Allow createGlobalVar to accept a name with a leading --

  Similar to createGlobalThemeContract, createGlobalVar now trims a leading -- from the variable name. This can be useful if you want to keep the full variable name searchable in your codebase.

  EXAMPLE USAGE:

  import { createGlobalVar } from '@vanilla-extract/css';
  // Both produce var(--my-global-var)
  const a = createGlobalVar('my-global-var');
  const b = createGlobalVar('--my-global-var');

• #1720 7bbe189 Thanks @​cahnory! - style, globalStyle: Add support for @scope rules

  EXAMPLE USAGE:

  import { style, globalStyle } from '@vanilla-extact/css';
  export const styleWithScopeRule = style({
  '@​scope': {
  '(body)': {
  ':after': { content: '"Scoped to body"' }
  }
  }
  });

... (truncated)

Commits

• 235de17 Version Packages (#1777)
• 6d56091 fix: replace dots with underscores in dev mode identifiers (#1742)
• dbae181 Version Packages (#1757)
• 46eb58c fix: treat boxOrdinalGroup as a unitless property (#1758)
• a22cdd7 lint: Ban non-null assertions (#1755)
• b5ca20a style: Fix buggy style composition with empty classname (#1756)
• bc8b51c Version Packages (#1736)
• caacf56 feat: trim leading -- from createGlobalVar names (#1749)
• 7bbe189 add scope at-rule support (#1720)
• a4b120f fallbackVar: Don't discard empty string fallback value (#1740)
• Additional commits viewable in compare view

Updates @vanilla-extract/sprinkles from 1.6.5 to 1.7.1

Release notes

Sourced from @​vanilla-extract/sprinkles's releases.

@​vanilla-extract/sprinkles@​1.7.1

Patch Changes

• #1780 8c25d30 Thanks @​askoufis! - defineProperties: Fixed a type limitation that capped conditions at 8

  The type definition previously enforced an arbitrary maximum, despite the lack of a runtime constraint. This limit is now gone.

@​vanilla-extract/sprinkles@​1.7.0

Minor Changes

• #1720 7bbe189 Thanks @​cahnory! - Add support for @scope to conditions

  EXAMPLE USAGE:

  import { style } from '@vanilla-extract/css';
  import { defineProperties } from '@vanilla-extract/sprinkles';
  const scopeRoot = style();
  const scopedProperties = defineProperties({
  defaultCondition: 'unscoped',
  conditions: {
  unscoped: {},
  document: {
  '@​scope': (${scopeRoot})
  }
  },
  responsiveArray: ['unscoped', 'scoped'],
  properties: {
  flexDirection: ['row', 'column'],
  order: {
  first: '1',
  second: '2'
  }
  }
  });

Changelog

Sourced from @​vanilla-extract/sprinkles's changelog.

1.7.1

Patch Changes

• #1780 8c25d30 Thanks @​askoufis! - defineProperties: Fixed a type limitation that capped conditions at 8

  The type definition previously enforced an arbitrary maximum, despite the lack of a runtime constraint. This limit is now gone.

1.7.0

Minor Changes

• #1720 7bbe189 Thanks @​cahnory! - Add support for @scope to conditions

  EXAMPLE USAGE:

  import { style } from '@vanilla-extract/css';
  import { defineProperties } from '@vanilla-extract/sprinkles';
  const scopeRoot = style();
  const scopedProperties = defineProperties({
  defaultCondition: 'unscoped',
  conditions: {
  unscoped: {},
  document: {
  '@​scope': (${scopeRoot})
  }
  },
  responsiveArray: ['unscoped', 'scoped'],
  properties: {
  flexDirection: ['row', 'column'],
  order: {
  first: '1',
  second: '2'
  }
  }
  });

Commits

• a80cb39 Version Packages (#1781)
• 8c25d30 sprinkles: Remove type limitation on number of conditions (#1780)
• bc8b51c Version Packages (#1736)
• 7bbe189 add scope at-rule support (#1720)
• 02d85ec Update prettier to v3, delete some directories, update remix docs (#1689)
• 66b5ad8 Fix misc. lints, replace and remove some deps (#1668)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vanilla-extract/sprinkles since your current version.

Updates i18next from 26.2.0 to 26.4.0

Release notes

Sourced from i18next's releases.

v26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

v26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

v26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

v26.3.0

• feat(types): introduce ResourceNamespaceMap — a separate mergeable augmentation surface for namespace resource types, designed for monorepos where multiple packages each want to contribute their own namespaces. Previously, every package had to coordinate on a single CustomTypeOptions.resources declaration (or fall back to typing dependency namespaces as any) because resources is a single property of an interface and TypeScript reports TS2717 when two declarations of the same property disagree. The new interface merges naturally across declare module 'i18next' blocks, so each package can ship its own i18next.d.ts independently. Per-property merge handles same-namespace contributions from multiple packages, and same-key/different-literal conflicts are silently dropped to avoid poisoning t() overload resolution. Fully backwards-compatible — existing CustomTypeOptions.resources augmentations continue to work, and both surfaces can coexist. Scalar options (defaultNS, returnNull, enableSelector, etc.) still belong on CustomTypeOptions. Thanks @​sh3xu (#2434). Fixes #2409.

Changelog

Sourced from i18next's changelog.

26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Functi...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aurayale-web	Ready	Preview	Aug 31, 2026 3:26pm

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 2 packages with OpenSSF Scorecard issues.

View full job summary