chore(deps): bump i18next from 25.10.1 to 26.0.8

[dependabot]

Bumps i18next from 25.10.1 to 26.0.8.

Release notes

Sourced from i18next's releases.

v26.0.8

• fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

v26.0.7

• fix: when a plural lookup misses, the missingKey debug log now shows the actual plural-resolved key (e.g. foo.bar_many for Polish count: 14) instead of the base key — making it obvious which plural category was expected and missing 2423
• chore: drop @babel/runtime runtime dependency. The build no longer generates any @babel/runtime imports, so the package is unused by consumers. Rollup now uses babelHelpers: 'bundled' so any helpers that are ever needed in the future will be inlined rather than imported externally 2424
• chore: stop emitting dist/esm/i18next.bundled.js. It was byte-identical to dist/esm/i18next.js because no helpers were being imported 2424

v26.0.6

Security release — all issues found via an internal audit. GHSA advisory filed after release.

• security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security docs for mitigation guidance (GHSA-TBD)
• security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .
• security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)
• chore: ignore .env* and *.pem/*.key files in .gitignore

v26.0.5

• fix: cloneInstance().changeLanguage() no longer fails to update language state when the target language is not yet loaded — a race between init()'s deferred load() and the user's changeLanguage() could overwrite isLanguageChangingTo, causing setLngProps to be skipped 2422

v26.0.4

• fix(types): inline formatting options like {{price, currency(EUR)}} are now correctly resolved to their base format type (e.g. number for currency) instead of falling back to string 2378

v26.0.3

• fix(types): addResourceBundle now accepts an optional 6th options parameter ({ silent?: boolean; skipCopy?: boolean }) matching the runtime API 2419

v26.0.2

• fix(types): t("key", {} as TOptions) no longer produces a type error — the context constraint now bypasses strict checking when context is unknown (e.g. from TOptions) 2418

v26.0.1

• fix: Formatter no longer crashes when alwaysFormat is true and no format specifier is present (format is undefined)
• fix: Formatter now returns undefined/null values as-is instead of producing NaN when the value is missing

v26.0.0

This is a major breaking release:

Breaking Changes

• Remove deprecated initImmediate option — the backward-compatibility mapping from initImmediate to initAsync (introduced in v24) has been removed. Use initAsync instead.
• Remove legacy interpolation.format function — the old monolithic format function (interpolation: { format: (value, format, lng) => ... }) is no longer supported. The built-in Formatter (or a custom Formatter module via .use()) is now always used. Migrate to the new formatting approach using i18next.services.formatter.add() or .addCached() for custom formatters.
• Remove console support notice — the console support notice introduced in v25.8.0 has been removed, along with the showSupportNotice option and all related internal suppression logic (globalThis.__i18next_supportNoticeShown, I18NEXT_NO_SUPPORT_NOTICE env var). See our blog post for the full story.
• Remove simplifyPluralSuffix option — this option was unused by the core PluralResolver (which relies entirely on Intl.PluralRules). It only had an effect in the old v1/v2/v3 compatibility layer. The v4 test compatibility layer now defaults to true internally.
• Remove deprecated @babel/polyfill from devDependencies.

Improvements

• Code modernization across all source files:
  • Replace indexOf() > -1 / indexOf() < 0 with .includes() (~40+ occurrences)
  • Replace indexOf() === 0 with .startsWith() where appropriate
  • Replace var with const, '' + object with String(object), .substring() with .slice()
  • Replace .apply(observer, [event, ...args]) with direct call observer(event, ...args)

... (truncated)

Changelog

Sourced from i18next's changelog.

26.0.8

• fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

26.0.7

• fix: when a plural lookup misses, the missingKey debug log now shows the actual plural-resolved key (e.g. foo.bar_many for Polish count: 14) instead of the base key — making it obvious which plural category was expected and missing 2423
• chore: drop @babel/runtime runtime dependency. The build no longer generates any @babel/runtime imports, so the package is unused by consumers. Rollup now uses babelHelpers: 'bundled' so any helpers that are ever needed in the future will be inlined rather than imported externally 2424
• chore: stop emitting dist/esm/i18next.bundled.js. It was byte-identical to dist/esm/i18next.js because no helpers were being imported 2424

26.0.6

Security release — all issues found via an internal audit.

• security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security note in the Nesting docs for the full pattern and mitigations
• security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .
• security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)
• chore: ignore .env* and *.pem/*.key files in .gitignore

26.0.5

• fix: cloneInstance().changeLanguage() no longer fails to update language state when the target language is not yet loaded — a race between init()'s deferred load() and the user's changeLanguage() could overwrite isLanguageChangingTo, causing setLngProps to be skipped 2422

26.0.4

• fix(types): inline formatting options like {{price, currency(EUR)}} are now correctly resolved to their base format type (e.g. number for currency) instead of falling back to string 2378

26.0.3

• fix(types): addResourceBundle now accepts an optional 6th options parameter ({ silent?: boolean; skipCopy?: boolean }) matching the runtime API 2419

26.0.2

• fix(types): t("key", {} as TOptions) no longer produces a type error — the context constraint now bypasses strict checking when context is unknown (e.g. from TOptions) 2418

26.0.1

• fix: Formatter no longer crashes when alwaysFormat is true and no format specifier is present (format is undefined)
• fix: Formatter now returns undefined/null values as-is instead of producing NaN when the value is missing

26.0.0

This is a major breaking release:

Breaking Changes

• Remove deprecated initImmediate option — the backward-compatibility mapping from initImmediate to initAsync (introduced in v24) has been removed. Use initAsync instead.
• Remove legacy interpolation.format function — the old monolithic format function (interpolation: { format: (value, format, lng) => ... }) is no longer supported. The built-in Formatter (or a custom Formatter module via .use()) is now always used. Migrate to the new formatting approach using i18next.services.formatter.add() or .addCached() for custom formatters.
• Remove console support notice — the console support notice introduced in v25.8.0 has been removed, along with the showSupportNotice option and all related internal suppression logic (globalThis.__i18next_supportNoticeShown, I18NEXT_NO_SUPPORT_NOTICE env var). See our blog post for the full story.
• Remove simplifyPluralSuffix option — this option was unused by the core PluralResolver (which relies entirely on Intl.PluralRules). It only had an effect in the old v1/v2/v3 compatibility layer. The v4 test compatibility layer now defaults to true internally.

... (truncated)

Commits

• 3ea438f 26.0.8
• 5176bbd retry version bump
• 10b48c6 26.0.8
• 9fdd99a retry version bump
• 9ee7da1 changelog
• 8ce5e26 26.0.8
• e802567 fix(types): restore ExistsFunction shape to keep arrow-function wrappers as...
• ce06fba 26.0.7
• ca33377 chore: drop unused @​babel/runtime dep and redundant bundled ESM output
• 8abe4e6 fix: show resolved plural key in missingKey debug log
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Findings

• [Minor] Major i18next bump has no regression coverage for active count-based translation paths.

Summary

Review mode: initial. One minor issue found: this PR upgrades the runtime translation engine to i18next 26, but there is still no src/tests/ coverage for language switching or the active count-based translation paths that go through it. I did not find a direct API break in the modified lines. Residual risk: pluralization and language-switching behavior remains unverified.

Testing

• Not run (automation)

Open Cowork Bot

[github-actions]

[MINOR] This moves the app onto i18next 26, but the repo still has no regression coverage for the runtime paths that depend on count-based translation resolution. Those paths are active in the renderer (src/renderer/components/settings/SettingsConnectors.tsx:399, src/renderer/components/SandboxSyncToast.tsx:95, src/renderer/components/settings/SettingsSchedule.tsx:682), and the locale resources mix singular/plural key shapes (src/renderer/i18n/locales/en.json:416, src/renderer/i18n/locales/zh.json:416). With a major i18n engine bump, that leaves language-switching/pluralization regressions easy to miss.

Suggested fix:

// src/tests/renderer/i18n/config.test.ts
import { createInstance } from 'i18next';
import en from '../../../renderer/i18n/locales/en.json';
import zh from '../../../renderer/i18n/locales/zh.json';

it('keeps count-based translations working after the i18next bump', async () => {
  const i18n = createInstance();
  await i18n.init({
    resources: {
      en: { translation: en },
      zh: { translation: zh },
    },
    lng: 'en',
    fallbackLng: 'en',
    pluralSeparator: '_',
    contextSeparator: '_',
  });

  expect(i18n.t('mcp.toolsAvailable', { count: 2 })).toBe('2 tools available');
  await i18n.changeLanguage('zh');
  expect(i18n.t('sandbox.syncFiles', { count: 2 })).toBe('2 个文件');
});

[github-actions]

Review mode: follow-up after new commits

Findings

• [Minor] The i18next 25→26 major bump remains without regression coverage for active count-based translation paths. The previous review (commit a8230ab) flagged this, and the new commits (adding DeepSeek CI scripts) do not address it. Pluralization and language-switching behavior are exercised in the renderer (src/renderer/components/settings/SettingsConnectors.tsx, src/renderer/components/SandboxSyncToast.tsx, src/renderer/components/settings/SettingsSchedule.tsx) and locale resources (src/renderer/i18n/locales/en.json, zh.json). Without a focused i18next 26 validation test, regressions can slip through unnoticed.
  Suggested fix: Add a test like the one proposed in the previous review, confirming that t('mcp.toolsAvailable', { count: 2 }) and t('sandbox.syncFiles', { count: 2 }) return the expected strings in both English and Chinese after the upgrade.

Summary

Review mode: follow-up after new commits. The i18next major version bump is still missing regression test coverage. No other issues were introduced by the new commits (DeepSeek CI infrastructure).

Testing

• Not run (automation)

Open Cowork Bot