Bump the minor-and-patch group across 1 directory with 21 updates

[dependabot]

Bumps the minor-and-patch group with 21 updates in the / directory:

Package	From	To
@mui/material	9.0.1	9.1.2
@reduxjs/toolkit	2.11.2	2.12.0
axios	1.15.1	1.18.1
date-fns	4.1.0	4.4.0
dompurify	3.4.0	3.4.11
focus-trap-react	12.0.0	12.0.3
i18next	26.0.7	26.3.4
react	19.2.5	19.2.7
react-dom	19.2.5	19.2.7
react-hotkeys-hook	5.2.4	5.3.3
react-i18next	17.0.4	17.0.8
react-icons	5.6.0	5.7.0
react-redux	9.2.0	9.3.0
react-tooltip	6.0.0	6.0.8
reselect	5.1.1	5.2.0
@vitejs/plugin-react	6.0.1	6.0.3
sass	1.99.0	1.101.0
typescript-eslint	8.58.2	8.62.1
uuid	14.0.0	14.0.1
vite	8.0.9	8.1.2
vitest	4.1.4	4.1.9

Updates @mui/material from 9.0.1 to 9.1.2

Release notes

Sourced from @​mui/material's releases.

v9.1.2

A big thanks to the 5 contributors who made this release possible.

@mui/material@9.1.2

• [autocomplete] Don't submit forms when committing freeSolo value with Enter key (#48679) @​mj12albert
• [transitions] Fix RTG import in ESM (#48645) @​mj12albert

@mui/system@9.1.2

• [InitColorSchemeScript] Fix script tag warning in Next.js 16 dev mode (#48671) @​siriwatknp

Docs

• Fix typos in release instructions (#48687) @​brijeshb42
• Update @​mui/x-* packages to latest (#48661) @​Janpot

Core

• [code-infra] Convert leaf @​mui/system .js+.d.ts pairs to TypeScript (part 1) (#48578) @​Janpot
• [code-infra] Bump to latest code-infra packages (#48672) @​brijeshb42
• [code-infra] Resolve remaining minimatch advisory (#48662) @​Janpot
• [code-infra] Bump nx to resolve minimatch advisory (#48658) @​Janpot
• [core] Drop @babel/* pnpm overrides (#48710) @​Janpot
• [docs-infra] Revert "Pin StackBlitz demo vite to v7 and plugin-react to v5" (#48709) @​Janpot
• [docs-infra] Fix code-block copy button broken on direct page load (#48653) @​brijeshb42
• [test] Stabilize Data Grid demo data in Argos screenshots (#48654) @​LukasTy

All contributors of this release in alphabetical order: @​brijeshb42, @​Janpot, @​LukasTy, @​mj12albert, @​siriwatknp

v9.1.1

A big thanks to the 9 contributors who made this release possible.

@mui/material@9.1.1

• [Autocomplete] Update fullWidth prop documentation (#48626) @​vipin8797
• [ButtonBase] Fix focus ripple lingering after blur (#48650) @​siriwatknp
• [InitColorSchemeScript] Server-render in tests for React 19.3 (#48604) @​Janpot
• [Transition] Mount child in same commit when opening from unmounted (#48649) @​siriwatknp

@mui/styled-engine@9.1.1

• [styled-engine] Prevent enableCssLayer styles from being overridden by unlayered styles (#48603) @​Janpot

Docs

• Send SOURCE to Brevo on newsletter subscribe (#48633) @​aemartos
• fix TypeScript heading capitalization (#48619) @​ifer47
• Remove outdated security section (#48628) @​oliviertassinari

... (truncated)

Changelog

Sourced from @​mui/material's changelog.

9.1.2

Jun 23, 2026

A big thanks to the 5 contributors who made this release possible.

@mui/material@9.1.2

• [autocomplete] Don't submit forms when committing freeSolo value with Enter key (#48679) @​mj12albert
• [transitions] Fix RTG import in ESM (#48645) @​mj12albert

@mui/system@9.1.2

• [InitColorSchemeScript] Fix script tag warning in Next.js 16 dev mode (#48671) @​siriwatknp

Docs

• Fix typos in release instructions (#48687) @​brijeshb42
• Update @​mui/x-* packages to latest (#48661) @​Janpot

Core

• [code-infra] Convert leaf @​mui/system .js+.d.ts pairs to TypeScript (part 1) (#48578) @​Janpot
• [code-infra] Bump to latest code-infra packages (#48672) @​brijeshb42
• [code-infra] Resolve remaining minimatch advisory (#48662) @​Janpot
• [code-infra] Bump nx to resolve minimatch advisory (#48658) @​Janpot
• [core] Drop @babel/* pnpm overrides (#48710) @​Janpot
• [docs-infra] Revert "Pin StackBlitz demo vite to v7 and plugin-react to v5" (#48709) @​Janpot
• [docs-infra] Fix code-block copy button broken on direct page load (#48653) @​brijeshb42
• [test] Stabilize Data Grid demo data in Argos screenshots (#48654) @​LukasTy

All contributors of this release in alphabetical order: @​brijeshb42, @​Janpot, @​LukasTy, @​mj12albert, @​siriwatknp

9.1.1

Jun 11, 2026

A big thanks to the 9 contributors who made this release possible.

@mui/material@9.1.1

• [Autocomplete] Update fullWidth prop documentation (#48626) @​vipin8797
• [ButtonBase] Fix focus ripple lingering after blur (#48650) @​siriwatknp
• [InitColorSchemeScript] Server-render in tests for React 19.3 (#48604) @​Janpot
• [Transition] Mount child in same commit when opening from unmounted (#48649) @​siriwatknp

... (truncated)

Commits

• a1ea5d8 [release] v9.1.2 (#48713)
• e6a054d [autocomplete] Don't submit forms when committing freeSolo value with Enter...
• 8d0216f [transitions] Fix RTG import in ESM (#48645)
• 8f8e4dd [code-infra] Bump to latest code-infra packages (#48672)
• 0f9b43f [release] v9.1.1 (#48656)
• bfd57b6 [ButtonBase] Fix focus ripple lingering after blur (#48650)
• aa5e12d [Transition] Mount child in same commit when opening from unmounted (#48649)
• 7c749df [Autocomplete] Update fullWidth prop documentation (#48626)
• 0798f38 Update dependencies to resolve Dependabot security alerts (#48641)
• ef607d7 [code-infra] Port codebase to use tsgo (#48616)
• Additional commits viewable in compare view

Updates @reduxjs/toolkit from 2.11.2 to 2.12.0

Release notes

Sourced from @​reduxjs/toolkit's releases.

v2.12.0

This feature release adds RTK usage skills files (via TanStack Intent) exports the RTK Query hook options types for reusability, fixes issues with infinite query status flags and batching handling, and makes some small TS improvements.

Changelog

Skills Files

We've generated agent skill files that are now included in the RTK package itself in a skills folder. They cover using and migrating to modern RTK, client and server state management, and handling side effects. You can point your agent at these skills yourself, or use TanStack Intent to pick them up.

TypeScript Improvements

The types for our RTK Query hook options are now exported, which lets you stop using Parameters to extract those types for use in your own code.

The types for listener middleware matchers were tweaked to allow interface-based type guards, not just type-based definitions.

The internal IgnorePaths type was renamed to IgnoredPaths for consistency.

We now use the built-in NoInfer util that comes with TS 5.4+.

Fixes

We fixed handling of the isSuccess status flag when switching infinite query cache entries. This should prevent accidental UI flashes that were occurring due to this flag accidentally flipping.

We've added a 100ms timeout fallback to the autoBatch enhancer's requestAnimationFrame timer. We had several reports that rAF didn't work correctly when used in background tabs / opened windows, and that RTK never updated the UI. This should ensure that the updates flush correctly.

What's Changed

• Export hook options types for RTK Query hooks by @​veeceey in reduxjs/redux-toolkit#5218
• Add TanStack Intent skills for Redux Toolkit by @​phryneas in reduxjs/redux-toolkit#5249
• Keep isSuccess: true when switching infinite query cache entries by @​riqts in reduxjs/redux-toolkit#5268
• fix: allow interface-based type guards as listener matcher by @​riqts in reduxjs/redux-toolkit#5269
• fix: add setTimeout fallback to raf autoBatch strategy for background tabs by @​riqts in reduxjs/redux-toolkit#5273
• chore(toolkit): rename IgnorePaths type to IgnoredPaths by @​Ri5ha6h in reduxjs/redux-toolkit#5284
• feat(toolkit)!: switch to native NoInfer utility type by @​aryaemami59 in reduxjs/redux-toolkit#5289

Full Changelog: reduxjs/redux-toolkit@v2.11.2...v2.12.0

Commits

• 576a02f Release 2.12.0
• de2d55e Merge pull request #5237 from aryaemami59/fix/codegen/generateEndpoints-retur...
• ac807c3 fix(codegen): narrow generateEndpoints return type
• 01ed3ba Merge pull request #5289 from aryaemami59/feat/toolkit/switch-to-native-NoInfer
• 1f16db1 Merge pull request #5290 from aryaemami59/build/toolkit/exclude-test-files-fr...
• 23783c1 build(toolkit): exclude test files from final bundle
• 91b8b0a feat(toolkit)!: switch to native NoInfer utility type
• 0b37f1a Merge pull request #5286 from aryaemami59/docs/toolkit/fix-typos
• 3cd62c8 fix unforwardedActions
• 64853cc chore: fix various typos
• Additional commits viewable in compare view

Updates axios from 1.15.1 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

• AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
• Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
• Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
• AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

• Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

• Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​webdevelopersrinu (#10913)
• @​sijie-Z (#10993)
• @​bartlomieju (#11023)
• @​JSap0914 (#11019)

Full Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

• Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

• Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

• Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

• Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

• Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

• Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​drori12 (#10984)
• @​eyupcanakman (#10899)
• @​Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

• Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
• Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

• HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

• Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

... (truncated)

Commits

• a209bfb chore(release): prepare release 1.18.1 (#11027)
• fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
• 40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
• a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
• cf1306a docs: add Deno to install instructions (#11023)
• b32880a fix: incorrect use of error (#11021)
• 1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
• 30499d6 fix: various runtime crashes and type definition mismatches (#10959)
• 20ce9c4 fix(http): defer env proxy handling to Node (#10942)
• e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
• Additional commits viewable in compare view

Updates date-fns from 4.1.0 to 4.4.0

Release notes

Sourced from date-fns's releases.

v4.4.0

This release revisits the approach to CDN usage and introduces a new package, @date-fns/cdn and deprecates the date-fns CDN scripts. It allowed reducing the zipped package size from 5.83 MB down to 3.96 MB without introducing any breaking changes.

In v5.0.0-alpha.0 where CDN scripts are completely removed from date-fns the change is more significant and brings the zipped package size down to 2.89 MB.

It is just the first step in optimizing the package size. Expect further size reduction in the future v4 and v5 versions.

Changed

• DEPRECATED: The date-fns CDN scripts are now deprecated and will be removed in the next major release. Please switch to the new @date-fns/cdn package for CDN usage.

• Removed CDN source maps to reduce the package size. If you rely on them, please switch to the new @date-fns/cdn package that still includes them.

v4.3.0

Kudos to @​ImRodry and @​puneetdixit200 for their contributions.

Fixed

• Fixed missing modularized optimization fallback (for Next.js and others). See #4193.

• Fixed pt locale first day of week to be Sunday. See #4195 by @​ImRodry.

• Fixed zh-CN, zh-HK, and zh-TW locale month parsing for October, November, and December. See #4194 by @​puneetdixit200.

v4.2.1

Fixed

• Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

• Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.

Commits

• cd53d25 Promote to v4.4.0
• d948ec1 Preserve but deprecate CDN versions for v4, set up v5 with polyfills
• ee65753 Add root mise :format task
• 9f5bdf5 Add positional argument to test/smoke.sh script
• 651ead6 Split CDN bundles into separate @​date-fns/cdn package
• 224c1a2 Deprecate type tests as attw hangs on date-fns package
• 7bb2842 Switch PACKAGE_OUTPUT_PATH to --dist flag in the package build script
• b6ad5ac Add flags to control package build script
• 424a783 Fix docs release after moving to monorepo setup
• f95bcf1 (docs): Add missing tsx dependency
• Additional commits viewable in compare view

Updates dompurify from 3.4.0 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
• Documented the bench and test:happydom scripts in the README
• Completed the Attack Classes & Bypass History wiki page
• Bumped several dependencies where possible

DOMPurify 3.4.9

• Further improved the handling of Trusted Types config options, thanks @​offset
• Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
• Added more test coverage for IN_PLACE and Trusted Types related usage
• Bumped several dependencies where possible
• Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

• Cleaned up the repository root, renamed some and removed unneeded files
• Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
• Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
• Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
• Bumped several dependencies where possible

DOMPurify 3.4.7

• Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
• Removed a problem leading to permanent hook pollution, thanks @​offset
• Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

• Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
• Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde
• Added more test coverage for IN_PLACE and general DOM Clobbering attacks
• Bumped several dependencies where possible

DOMPurify 3.4.5

• Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @​KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

... (truncated)

Commits

• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• ca30f07 release: 3.4.7 (#1414)
• bb7739e release: 3.4.6 (#1394)
• 011b0c7 release: 3.4.5 (#1382)
• 5817ad9 release: 3.4.4 (#1374)
• 520edb0 release: 3.4.3 (#1352)
• 6f67fd3 Sync/3.4.2 (#1322)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates focus-trap-react from 12.0.0 to 12.0.3

Release notes

Sourced from focus-trap-react's releases.

v12.0.3

Patch Changes

• 26c3dea: Update to tabbable@6.5.0 and focus-trap@8.2.2 for visibility bug fix and support for image areas

v12.0.2

Patch Changes

• 161ec0d: Update focus-trap dependency to v8.2.1 for bug fixes and a new delayReturnFocus option

v12.0.1

Patch Changes

• 93c93e9: Update focus-trap dependency to 8.1.0 for new lifecycle hook improvements (onActivate, etc).

Changelog

Sourced from focus-trap-react's changelog.

12.0.3

Patch Changes

• 26c3dea: Update to tabbable@6.5.0 and focus-trap@8.2.2 for visibility bug fix and support for image areas

12.0.2

Patch Changes

• 161ec0d: Update focus-trap dependency to v8.2.1 for bug fixes and a new delayReturnFocus option

12.0.1

Patch Changes

• 93c93e9: Update focus-trap dependency to 8.1.0 for new lifecycle hook improvements (onActivate, etc).

Commits

• 62c64f4 Version Packages (#1953)
• 26c3dea Update tabbable and focus-trap (#1952)
• b8ec7b8 [DEPENDABOT]: Bump form-data from 4.0.5 to 4.0.6 (#1951)
• fa97f40 [DEPENDABOT]: Bump @​typescript-eslint/eslint-plugin from 8.61.0 to 8.61.1 (#1...
• ba154c0 [DEPENDABOT]: Bump start-server-and-test from 3.0.9 to 3.0.11 (#1947)
• 3adf505 [DEPENDABOT]: Bump @​typescript-eslint/parser from 8.61.0 to 8.61.1 (#1950)
• 9b412b8 [DEPENDABOT]: Bump @​types/jquery from 4.0.0 to 4.0.1 (#1935)
• e916e5b [DEPENDABOT]: Bump @​typescript-eslint/eslint-plugin from 8.60.1 to 8.61.0 (#1...
• 4792c9c [DEPENDABOT]: Bump start-server-and-test from 3.0.6 to 3.0.9 (#1937)
• 0872a26 [DEPENDABOT]: Bump prettier from 3.8.3 to 3.8.4 (#1938)
• Additional commits viewable in compare view

Updates i18next from 26.0.7 to 26.3.4

Release notes

Sourced from i18next's releases.

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

v26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

v26.3.0

• feat(types): introduce ResourceNamespaceMap — a separate mergeable augmentation surface for namespace resource types, designed for monorepos where multiple packages each want to contribute their own namespaces. Previously, every package had to coordinate on a single CustomTypeOptions.resources declaration (or fall back to typing dependency namespaces as any) because resources is a single property of an interface and TypeScript reports TS2717 when two declarations of the same property disagree. The new interface merges naturally across declare module 'i18next' blocks, so each package can ship its own i18next.d.ts independently. Per-property merge handles same-namespace contributions from multiple packages, and same-key/different-literal conflicts are silently dropped to avoid poisoning t() overload resolution. Fully backwards-compatible — existing CustomTypeOptions.resources augmentations continue to work, and both surfaces can coexist. Scalar options (defaultNS, returnNull, enableSelector, etc.) still belong on CustomTypeOptions. Thanks @​sh3xu (#2434). Fixes #2409.

v26.2.0

• feat(types): new parseInterpolation TypeOption (default true). When set to false in CustomTypeOptions, the type-level extractor stops parsing translation strings for {{variable}} patterns. Required by i18next-icu users — the default extractor mistakes ICU MessageFormat nested-brace plurals like {count, plural, one {{count} row} other {{count} rows}} for an interpolation block and demands a phantom variable name. The flag is type-only; runtime interpolation is governed by InterpolationOptions and is unaffected. Fixes i18next-icu#85.
• fix(types): expose enableSelector on InitOptions so i18next.init({ enableSelector: 'strict' }) typechecks without a module augmentation. The runtime already reads opts?.enableSelector from init options; this lands the matching type declaration next to the other selector-resolution knobs. Accepts false | true | 'optimize' | 'strict'. Thanks @​Faithfinder (#2431)

v26.1.0

• feat: enableSelector: 'strict' (TypeOptions + runtime option). Opt-in mode that drops the flattened-primary form from NsResource at the type level — every namespace (primary included) is exposed only under its own key on $, uniformly across single- and multi-ns hooks. At runtime, a leading selector path segment matching the scope's namespace list is always rewritten as a namespace prefix, including the primary. Eliminates the silent-miss surface area where t($ => $.primary.foo) typechecks but doesn't resolve under the default mode (see #2429). Backward-compatible: default enableSelector: false | true | 'optimize' behavior is unchanged. Note: strict mode is incompatible with the #2405 pattern (keys whose names match sibling namespaces) — those users should stay on default mode.

v26.0.10

• feat: getFixedT accepts a fourth optional fixedOpts argument carrying scopeNs — the full namespace list the bound t was created for. The selector API uses scopeNs to detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the bound ns (a single primary string in the typical react-i18next setup), so plain t('key') lookups stay isolated to the primary namespace exactly as before — only t($ => $.secondaryNs.foo) selectors now route correctly under useTranslation([nsA, nsB]). Fixes the runtime side of #2429 for the react-i18next default-nsMode case. The 4th argument is opt-in: existing 3-arg getFixedT(lng, ns, keyPrefix) callers see no behavior change.

v26.0.9

• fix(types): unformatted interpolation values are now typed as string | number (was string). i18next stringifies values at runtime, so requiring callers to wrap numbers in String(...) for plain {{var}} placeholders was unnecessary friction — and could mask the real problem when a non-string value was passed alongside multiple interpolation slots (the t() overload resolution would fall through to the 3-arg form and report a confusing "not assignable to string" error against the options object). Typed format specifiers like {{x, number}}, {{x, currency}}, {{x, datetime}}, etc. keep their precise types; this only relaxes the no-format default....

  Description has been truncated