From 636cdc6cc5ea2c51b0377dd373a74176ca72cbd6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 7 Sep 2026 13:54:47 +0000
Subject: [PATCH] chore(deps): Bump i18next from 26.4.1 to 26.4.2 (#2143)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [i18next](https://github.com/i18next/i18next) from 26.4.1 to
26.4.2.
Release notes
Sourced from i18next's
releases.
v26.4.2
- fix:
$&, $`, $' and
$$ inside a nested value ($t(key)) now stay
literal. nest() handed the resolved value straight to
String.replace as the replacement argument, so those
sequences were read as replacement patterns: $&
re-inserted the $t(...) match, $` /
$' inserted the text before / after it, and $$
collapsed to $. Through t() the
$& case was worse than a wrong string: the nested
lookup resets the shared nesting regexp, so the re-inserted
$t(...) was matched again on every pass and
t() never returned — also under the default
escapeValue: true when the value arrives via a variable
forwarded through nesting options ($t(key, { "name":
"{{name}}" }) with a name containing
$&). The value is now $-escaped at the
String.replace call, the same guard
interpolate() already has, and a non-string value returned
by a formatter in the nesting chain ($t(key, myFormat)) is
stringified before that. Nested values are still not HTML-escaped (#854).
Thanks @mahirhir
(#2447).
Changelog
Sourced from i18next's
changelog.
26.4.2
- fix:
$&, $`, $' and
$$ inside a nested value ($t(key)) now stay
literal. nest() handed the resolved value straight to
String.replace as the replacement argument, so those
sequences were read as replacement patterns: $&
re-inserted the $t(...) match, $` /
$' inserted the text before / after it, and $$
collapsed to $. Through t() the
$& case was worse than a wrong string: the nested
lookup resets the shared nesting regexp, so the re-inserted
$t(...) was matched again on every pass and
t() never returned — also under the default
escapeValue: true when the value arrives via a variable
forwarded through nesting options ($t(key, { "name":
"{{name}}" }) with a name containing
$&). The value is now $-escaped at the
String.replace call, the same guard
interpolate() already has, and a non-string value returned
by a formatter in the nesting chain ($t(key, myFormat)) is
stringified before that. Nested values are still not HTML-escaped (#854).
Thanks @mahirhir
(#2447).
Commits
4dba50f
26.4.2e436b62
buildd955fb0
fix: stringify formatter results in nested values, changelog
v26.4.2dfafa3c
fix: keep replacement patterns literal in nested values (#2447)3c9981e
chore: keep dev-only and local files out of the npm package- See full diff in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
package-lock.json | 8 ++++----
package.json | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index 6ae840d9..7777b156 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -30,7 +30,7 @@
"downshift": "^9.4.0",
"events": "^3.3.0",
"file-saver": "^2.0.5",
- "i18next": "^26.4.1",
+ "i18next": "^26.4.2",
"i18next-browser-languagedetector": "^8.2.1",
"i18next-resources-to-backend": "^1.2.3",
"json-stringify-pretty-compact": "^4.0.0",
@@ -6716,9 +6716,9 @@
}
},
"node_modules/i18next": {
- "version": "26.4.1",
- "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.1.tgz",
- "integrity": "sha512-9YbX5E6gd1H+yaOSX3izCsPj5iWXyH7X4oC+iuHHJJw8AeHglzOK5SJf+1CHxaYKYigcea+8jvzSxqYx46YvyA==",
+ "version": "26.4.2",
+ "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.2.tgz",
+ "integrity": "sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==",
"funding": [
{
"type": "individual",
diff --git a/package.json b/package.json
index ff01dcb4..97cd62e0 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
"downshift": "^9.4.0",
"events": "^3.3.0",
"file-saver": "^2.0.5",
- "i18next": "^26.4.1",
+ "i18next": "^26.4.2",
"i18next-browser-languagedetector": "^8.2.1",
"i18next-resources-to-backend": "^1.2.3",
"json-stringify-pretty-compact": "^4.0.0",