[dependabot]

Bumps the frontend-minor-patch group with 16 updates in the / directory:

Package	From	To
@azure/msal-browser	5.6.3	5.25.1
@mui/x-tree-view	9.1.0	9.15.0
allotment	1.20.5	1.20.6
canvas	3.2.2	3.2.3
dompurify	3.4.5	3.4.17
echarts	6.0.0	6.1.0
i18next	26.0.1	26.4.7
katex	0.16.42	0.19.0
react-animate-height	3.2.3	3.2.4
react-virtuoso	4.18.3	4.18.19
validator	13.15.26	13.15.35
vega	6.2.0	6.4.0
vega-lite	6.4.1	6.5.0
@testing-library/dom	10.4.1	10.4.2
@testing-library/react	16.3.2	16.3.3
@types/lodash	4.17.24	4.17.26

Updates @azure/msal-browser from 5.6.3 to 5.25.1

Release notes

Sourced from @​azure/msal-browser's releases.

@​azure/msal-browser v5.25.1

5.25.1

Tue, 13 Oct 2026 19:04:35 GMT

Patches

• Bump @​azure/msal-browser to match @​azure/msal-browser-1p (msaljsbuilds@microsoft.com)

@​azure/msal-browser v5.25.0

5.25.0

Tue, 06 Oct 2026 20:48:41 GMT

Minor changes

• Coalesce concurrent platform-broker acquireTokenSilent requests #8886 (kshabelko@microsoft.com)

@​azure/msal-browser v5.24.0

5.24.0

Fri, 02 Oct 2026 19:03:42 GMT

Minor changes

• Bump @​azure/msal-browser to match @​azure/msal-browser-1p (msaljsbuilds@microsoft.com)
• Bump @​azure/msal-common to v16.14.2 (beachball)

Patches

• Validate cache broadcast context and reload values from persistent storage #8869 (spingale@microsoft.com)
• Add observability across extension and DOM platform broker flows #8824 (lalimasharda@microsoft.com)
• Allow platform broker token requests with empty scopes #8863 (lalima.sharda@gmail.com)

@​azure/msal-browser v5.23.0

5.23.0

Wed, 23 Sep 2026 15:49:43 GMT

Minor changes

• Add Native Auth V2 password reset, sign-in, sign-up, and SMS MFA flows. #8830 (yongdiwang@microsoft.com)
• Add platform broker DPoP request and response contract support #8772 (hectormmg@microsoft.com)
• Export shared web broker bridge performance event names. #8832 (shylasummers@microsoft.com)

Patches

• Treat bfcache restoration during redirects as user cancellation #8839 (thomas.norling@microsoft.com)
• Preserve the requested resource when caching platform broker access tokens #8848 (nugetaad@microsoft.com)

... (truncated)

Commits

• 13cf925 chore: CVE fix for angular/router (#8906)
• 3439ee0 build(deps): bump ip-address from 10.5.0 to 10.7.4 (#8873)
• ff91893 build(deps): bump compression from 1.8.1 to 1.8.2 (#8891)
• a68a306 build(deps): bump source-map-js from 1.2.1 to 1.2.2 (#8890)
• 431d54a build(deps): bump undici from 7.29.0 to 7.30.0 (#8905)
• d54871c build(deps): bump postcss-selector-parser from 7.1.4 to 7.1.6 (#8894)
• f550958 Sanitize confidential client authorization response payload (#8901)
• dc786aa test: temporarily skip failing B2C user-flow suites (#8902)
• 3b6450f build(deps): bump sharp from 0.35.4 to 0.35.5 (#8895)
• 6debc5e build(deps): bump shell-quote from 1.10.0 to 1.12.0 (#8889)
• Additional commits viewable in compare view

Updates @mui/x-tree-view from 9.1.0 to 9.15.0

Release notes

Sourced from @​mui/x-tree-view's releases.

v9.15.0

We'd like to extend a big thank you to the 17 contributors who made this release possible. Here are some highlights ✨:

• 🌍 Add Russian (ru-RU) locale to the Scheduler
• 📐 New height prop to size the Data Grid without a wrapper
• 📅 New onCancel callback prop on the Date and Time Pickers
• ⌨️ Home/End, Ctrl+Home/End, and PageUp/PageDown keyboard navigation in the Charts
• 🔒 Data Grid and Charts exports work under a Content Security Policy
• 🐞 Bugfixes
• 📚 Documentation improvements

Special thanks go out to these community members for their valuable contributions: @​Anexus5919, @​davidjb, @​kwy404, @​mixelburg, @​Sazuru

The following team members contributed to this release: @​arminmeh, @​brijeshb42, @​flaviendelangle, @​Janpot, @​JCQuintas, @​LukasTy, @​mapache-salvaje, @​michelengelen, @​noraleonte, @​rita-codes, @​romgrk, @​siriwatknp

Data Grid

@mui/x-data-grid@9.15.0

• [DataGrid] Add height prop for sizing without a wrapper (#23628) @​michelengelen
• [DataGrid] Cap the pagination toolbar so the footer height is stable on mount (#23547) @​JCQuintas
• [DataGrid] Document rowsSet, filteredRowsSet & sortedRowsSet events (#23631) @​michelengelen
• [DataGrid] Extract the data source polling into a shared hook (#23714) @​LukasTy
• [DataGrid] Fix autosizeColumns with wrapped header text (#23241) @​siriwatknp
• [DataGrid] Fix flex column jump when a detail panel expands (#23576) @​michelengelen
• [DataGrid] Fix stale columns and stalled loading in the demo data generator (#23727) @​LukasTy
• [DataGrid] Fix stale rows and lost edits in useMockServer (#23751) @​LukasTy
• [DataGrid] Fix the height prop overflowing a narrow flex row parent (#23745) @​LukasTy
• [DataGrid] Fix the inputRef prop type warning in select-based filter inputs (#23728) @​LukasTy
• [DataGrid] Keep empty first and last cells when copying rows (#23753) @​Anexus5919
• [DataGrid] Keep pinned cells opaque without color-mix() support (#23563) @​michelengelen
• [DataGrid] Let the theme disable the row checkbox ripple (#23703) @​siriwatknp
• [DataGrid] Stop the data source polling after the grid unmounts (#23709) @​LukasTy
• [DataGrid] Stop the lazy loading polling when lazyLoading turns off (#23717) @​LukasTy
• [DataGrid] Support href on GridActionsCellItem (#23630) @​michelengelen

@mui/x-data-grid-pro@9.15.0

Same changes as in @mui/x-data-grid@9.15.0.

@mui/x-data-grid-premium@9.15.0

Same changes as in @mui/x-data-grid-pro@9.15.0, plus:

• [DataGridPremium] Clear the aggregation from the column menu (#23641) @​Anexus5919
• [DataGridPremium] Fix exports failing or hanging under a Content Security Policy (#23521) @​JCQuintas

Date and Time Pickers

... (truncated)

Changelog

Sourced from @​mui/x-tree-view's changelog.

9.15.0

Oct 6, 2026

We'd like to extend a big thank you to the 17 contributors who made this release possible. Here are some highlights ✨:

• 🌍 Add Russian (ru-RU) locale to the Scheduler
• 📐 New height prop to size the Data Grid without a wrapper
• 📅 New onCancel callback prop on the Date and Time Pickers
• ⌨️ Home/End, Ctrl+Home/End, and PageUp/PageDown keyboard navigation in the Charts
• 🔒 Data Grid and Charts exports work under a Content Security Policy
• 🐞 Bugfixes
• 📚 Documentation improvements

Special thanks go out to these community members for their valuable contributions: @​Anexus5919, @​davidjb, @​kwy404, @​mixelburg, @​Sazuru

The following team members contributed to this release: @​arminmeh, @​brijeshb42, @​flaviendelangle, @​Janpot, @​JCQuintas, @​LukasTy, @​mapache-salvaje, @​michelengelen, @​noraleonte, @​rita-codes, @​romgrk, @​siriwatknp

Data Grid

@mui/x-data-grid@9.15.0

• [DataGrid] Add height prop for sizing without a wrapper (#23628) @​michelengelen
• [DataGrid] Cap the pagination toolbar so the footer height is stable on mount (#23547) @​JCQuintas
• [DataGrid] Document rowsSet, filteredRowsSet & sortedRowsSet events (#23631) @​michelengelen
• [DataGrid] Extract the data source polling into a shared hook (#23714) @​LukasTy
• [DataGrid] Fix autosizeColumns with wrapped header text (#23241) @​siriwatknp
• [DataGrid] Fix flex column jump when a detail panel expands (#23576) @​michelengelen
• [DataGrid] Fix stale columns and stalled loading in the demo data generator (#23727) @​LukasTy
• [DataGrid] Fix stale rows and lost edits in useMockServer (#23751) @​LukasTy
• [DataGrid] Fix the height prop overflowing a narrow flex row parent (#23745) @​LukasTy
• [DataGrid] Fix the inputRef prop type warning in select-based filter inputs (#23728) @​LukasTy
• [DataGrid] Keep empty first and last cells when copying rows (#23753) @​Anexus5919
• [DataGrid] Keep pinned cells opaque without color-mix() support (#23563) @​michelengelen
• [DataGrid] Let the theme disable the row checkbox ripple (#23703) @​siriwatknp
• [DataGrid] Stop the data source polling after the grid unmounts (#23709) @​LukasTy
• [DataGrid] Stop the lazy loading polling when lazyLoading turns off (#23717) @​LukasTy
• [DataGrid] Support href on GridActionsCellItem (#23630) @​michelengelen

@mui/x-data-grid-pro@9.15.0

Same changes as in @mui/x-data-grid@9.15.0.

@mui/x-data-grid-premium@9.15.0

Same changes as in @mui/x-data-grid-pro@9.15.0, plus:

• [DataGridPremium] Clear the aggregation from the column menu (#23641) @​Anexus5919

... (truncated)

Commits

• dd81f1a [release] v9.15.0 (#23777)
• 03d2f6d [code-infra] Widen @​babel/runtime range and stop emitting empty class fields ...
• ba99ac8 [tree view] Use aria-selected instead of aria-checked when `checkboxSelec...
• 9b7842c [x-internals] Import Base UI utils directly instead of re-exporting them (#23...
• cf17872 [x-internals] Import the store from @​base-ui/utils directly (#23335)
• c83b3dd [release] v9.14.0 (#23608)
• b3f1639 [tree view] Prune stale children when replacing an item's children (#23598)
• 721668f [tree view] Optimize lazy loading store writes for nested children (#23489)
• c2809ca [release] v9.13.0 (#23497)
• b5c78e1 [tree view] Remove dead UI from community component (#23487)
• Additional commits viewable in compare view

Updates allotment from 1.20.5 to 1.20.6

Release notes

Sourced from allotment's releases.

v1.20.6

1.20.6 (2026-10-12)

Bug Fixes

• call the latest onReset when double-clicking a sash (#904) (b4d9fca), closes #901
• sash: end in-progress drags cleanly on dispose and view changes (#898) (b307433)
• split-view: resize() no longer crashes when given extra sizes (#914) (2b547d3)

Changelog

Sourced from allotment's changelog.

1.20.6 (2026-10-12)

Bug Fixes

• call the latest onReset when double-clicking a sash (#904) (b4d9fca), closes #901
• sash: end in-progress drags cleanly on dispose and view changes (#898) (b307433)
• split-view: resize() no longer crashes when given extra sizes (#914) (2b547d3)

Commits

• fddd29d chore(main): release 1.20.6 (#895)
• 1737285 chore(deps): update dependency @​rollup/plugin-babel to v7.1.0 (#896)
• 2ac7dca docs: explain drag vs layout changes, what visible remembers, and known limit...
• bf2554d chore(deps): update actions/setup-node action to v7 (#927)
• 82ff665 docs: reorganise guides, complete the API overview and trim the FAQ (#928)
• 3c3fdb4 chore(deps): update actions/checkout action to v7 (#924)
• d67bd89 docs: add live styling and container resize examples (#926)
• 3902bf5 docs: tidy up the getting started guide and Pane API page (#925)
• daf6430 chore(deps): update docusaurus monorepo to v3.10.2 (#922)
• 55eb86a chore(website): use clsx instead of classnames in the hero demo (#923)
• Additional commits viewable in compare view

Updates canvas from 3.2.2 to 3.2.3

Release notes

Sourced from canvas's releases.

v3.2.3

Fixed

• Fix building with gcc (#2559)

Changelog

Sourced from canvas's changelog.

3.2.3

Fixed

• Fix building with gcc (#2559)

Commits

• f91598e v3.2.3
• 1541544 PAGE_SIZE shouldn't be unsigned
• See full diff in compare view

Updates dompurify from 3.4.5 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

• Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
• Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
• Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
• Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
• Added a purify-edge test runner as a compatibility check, thanks @​anzal1
• Clarified the IN_PLACE documentation in the README about possible risks
• Updated several dependencies

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

... (truncated)

Commits

• a77a3e7 release: 3.4.17 (#1672)
• b9b9d80 release: 3.4.16 (#1636)
• 1d7460c release: 3.4.15 (#1609)
• 4e6fe24 release: 3.4.14 (#1587)
• 3067f77 release: 3.4.13 (#1562)
• a9ca1e5 release: 3.4.12 (#1537)
• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• Additional commits viewable in compare view

Updates echarts from 6.0.0 to 6.1.0

Release notes

Sourced from echarts's releases.

6.1.0

• [Feature] [axis] Support dataMin and dataMax option for calculating a nice axis extent. #20838 (Justin-ZS, Ovilia)
• [Feature] [axis] Comprehensively enable all types of axis (i.e., "value"/"time"/"category"/"log") to render series (typically "bar"/"pictorialBar"/"candlestick"/"boxplot") without overflow (including the case "category" axis with boundaryGap: false); provide containShape option; provide some corresponding clip option. dbfaf6a73 fe932a2aa 3973b21ee (100pah) #21511 (Akash Sonune)
• [Feature] [axis] Automatically exclude non-positive series data values on "log" axis. dedc5dc18 (100pah)
• [Feature] [axis] Enable axisLabel.formatter to receive its index for working with customValues. #21220 #21432 (Szymon Pachucki, Ovilia, plainheart)
• [Feature] [line] Add triggerEvent option for more control over mouse event. #21001 (Steven Cobb, plainheart)
• [Feature] [pie] Add tangential-noflip rotation mode to keep labels tangential without flipping. #21258 (春秋半夏, Ovilia)
• [Feature] [gauge] progress.color supports 'auto'. #21224 (StNimmerlein, Ovilia)
• [Feature] [radar] Add clockwise option. #21143 (Dai Xuezhou, Ovilia)
• [Feature] [candlestick] [dataZoom] Add cursor option for candlestick series and add cursorGrab option & cursorGrabbing for 'inside' dataZoom. #21558 (zuming, Ovilia, 100pah)
• [Feature] [scatter] [effectScatter] [geo] Enable clip option on "scatter"/"effectScatter" on geo. 417592289 (100pah)
• [Feature] [visualMap] Add seriesTargets option for multiple series-dimension mappings. #20703 (Justin-ZS, plainheart)
• [Feature] [matrix] Support matrix.x/y.length for conveniently creating a headless matrix without composing an array. #21191 (100pah, plainheart)
• [Feature] [matrix] Add triggerEvent option to support triggering event on matrix cells. #21390 (Natsuo Kawai, 100pah)
• [Feature] [i18n] add Latvian(LV) translation. #21546 (EPoikans)
• [Fix] [axis] Change and clarify the rounding error and auto-precision utils and solutions. 479dcd454 (100pah)
• [Fix] [axis] Fix chart does not work when using customValues with formatter in time axis (axis.type: 'time') label. #21352 (Srajan Sanjay Saxena, plainheart)
• [Fix] [axis] Fix and clarify alignTick strategy, and fix LogScale precision. a6ab2458f ffcc636fb (100pah)
• [Fix] [axis] Fix duplicate ticks when using time axis (axis.type: 'time') or customValues, which causes jitter of splitArea; fix the showMin/MaxLabel handling of a category axis (axis.type: 'category'); enable a uniform bandWidth calculation in numeric axis (axis.type: 'value' | 'time' | 'log'). 8de2b64fa 15af0db02 8ddaa5c69 (100pah)
• [Fix] [axis] Fix time axis (axis.type: 'time') bug when value scale is in millisecond. 40b77b464 (100pah)
• [Fix] [bar] Fix wrong label position when bar series has a 0 width/height. #21218 (Justin-ZS, Ovilia)
• [Fix] [scatter] Fix jitter layout does not support progressive rendering and cause chart to be frozen and potential NPE. #21436 (plainheart)
• [Fix] [lines] Fix effect symbol flip on unidirectional loop end when roundTrip is not enabled. #21320 (Mayank Mehta, plainheart)
• [Fix] [candlestick] Fix candlestick render error with series.encode on horizontal layout. #21325 (Purbayan Pramanik, 100pah)
• [Fix] [parallel] Fix incorrect axis extent when any subsequent series has a larger value than the first. #21387 (jackhickson, 100pah)
• [Fix] [pie] Support axes extent union pie center automatically when pie is laid out on Cartesian (grid component). 18a23a875 (100pah)
• [Fix] [treemap] Fix treemap can not be zoomed out after a zoom-in when scaleLimit is specified #21427 (TateLiu, 100pah)
• [Fix] [lines] Fix potential tooltip XSS vulnerability in lines series (series.type: 'lines'). #21608 (plainheart)
• [Fix] [map] [geo] Fix the failed synchronization and visual artifacts on geo roaming and animation. 417592289 (100pah)
• [Fix] [tooltip] Fix tooltip content does not refresh when changing tooltip trigger from 'axis' to 'item'. #20710 (Justin-ZS, plainheart)
• [Fix] [tooltip] valueFormatter callback param dataIndex should be rawDataIndex rather than dataZoom filtered dataIndex. #21479 (100pah, plainheart)
• [Fix] [axisPointer] Fix axisPointer shadow and enable clipping - it is previously only applicable to "category" axis, but is buggy in numeric axis with "bar" series. 8de2b64fa (100pah)
• [Fix] [axisPointer] Fix visual artifacts caused by failed axisPointer restoration. 56a32c0bb (100pah)
• [Fix] [hoverLayer] Fix visual artifacts arisen on hover layer. zrender#1151 933585126 (100pah)
• [Fix] [marker] Fix marker fails to render with dataset and encode. #21439 (plainheart, 100pah).
• [Fix] [dataZoom] Fix wrong position of the dataZoom when the series has only one data point. #21196 (alesmit, Ovilia)
• [Fix] [dataZoom] Fix dataZoom bug that data info disappears when dragging released; fix dataZoom dragging cursor style. 64305a4b8 (100pah)
• [Fix] [dataZoom] Apply a better auto-precision method; fix unexpected behaviors when dataZoom controls axes with alignTicks: true. d168bf237 (100pah)
• [Fix] [dataZoom] Fix AxisProxy can not be cleared when dataZoom option changed; fix related onZero behaviors. 52ceb924a 2e82d33c3 (100pah)
• [Fix] [areaStyle] Fix areaStyle render error when dimension name is empty string. #21219 (Justin-ZS, Ovilia)
• [Fix] [sunburst] Fix root node label may not be centered. #21306 (Akash Sonune, Ovilia)
• [Fix] [matrix] Fix matrix label formatter does not work. #21410 (Justin-ZS, Ovilia)
• [Fix] [toolbox] Fix emphasis color is the same as the default color. #21384 (Ovilia) b094f987d (100pah)
• [Fix] [toolbox] Fix the dataView component does not fit the dark mode. #21176 (notthistrain, Ovilia)
• [Fix] [progressive] Fix progressive rendering issues. 91a60fc76 (100pah)
• [Fix] [labelLine] Fix labelLine.smooth can not be reset. #21425 (fanwww, plainheart)
• [Fix] [graphic] Fix stroke corner gap due to not closing path in roundRect helper. zrender#1155 (plainheart)
• [Fix] [svg] Enhance SVG encodeBase64 compatibility to make it available in more environments like Web Worker/NodeJS/Bun. zrender#1145 (plainheart)
• [Fix] [core] Mark echarts instance object as raw in Vue. #21293 (plainheart)
• [Fix] [chord] Add the missing export entry for chord chart. #21197 (plainheart, Ovilia)

... (truncated)

Commits

• c5a48f5 Merge pull request #21612 from apache/release-dev
• 77e5222 release 6.1.0-rc.2
• 21f17be fixRegression(map,geo): Resolve circular dependencies introduced by this vers...
• 830e8b6 chore: Supplement package.json (for module cjs declaration) to source release.
• ed0e210 chore: Fix addHeader tool and add missing license headers.
• cc78ada Merge pull request #21611 from apache/release-dev
• 3f6e012 release: Build release.
• d69405f chore: Add missing headers.
• 6998ed0 release: Upgrade npm version.
• 8cb374b fix(build): Fix build commands.
• Additional commits viewable in compare view

Updates i18next from 26.0.1 to 26.4.7

Release notes

Sourced from i18next's releases.

v26.4.7

• perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

v26.4.6

• fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).

v26.4.5

• fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

v26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
• fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

• perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.