Skip to content

chore(deps): bump react-i18next from 15.4.1 to 17.1.4 - #1351

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/react-i18next-17.0.15
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/react-i18next-17.0.15

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026 •

Copy link
Copy Markdown
Contributor

Bumps react-i18next from 15.4.1 to 17.1.4.

Changelog

Sourced from react-i18next's changelog.

17.1.4

  • fix(types): without allowObjectInHTMLChildren, the children of HTML elements now use React's own type (DOMAttributes<T>['children']) instead of the ReactI18NextChildren | Iterable<ReactI18NextChildren> union. Both accept the same children, so nothing compiles differently. For default installs the global HTMLAttributes augmentation now repeats whatever @types/react declares, so changes in React's types flow through instead of meeting a copy, and type errors on element children no longer list an extra Iterable<...>. With allowObjectInHTMLChildren: true nothing changes. First step of #1928.

17.1.3

  • fix(IcuTrans): numeric HTML entities above U+FFFF, like emoji, now decode to the right character. "Hello &#x1F44B; <0>friend</0> &[#127881](https://github.com/i18next/react-i18next/issues/127881);" rendered U+F44B and U+F389, private-use glyphs that usually show as a box, instead of 👋 and 🎉: the decoder used String.fromCharCode, which keeps only the low 16 bits of the code point. This shows up with translations that a TMS or CMS exports HTML-encoded. Entities above U+10FFFF, which are no valid code points, now stay as written instead of becoming U+0000. Entities below U+10000, including surrogate pairs written as two entities, decode as before. Thanks @​nk-batman21 (#1940).

17.1.2

  • fix(Trans): when the only child is a string, a tag whose index the children don't have now renders its own text. <Trans i18nKey="welcome">Welcome</Trans> with "Welcome <1>friend</1>" rendered Welcome e, and defaults="Hi <1>there</1>" with the child Hi rendered Hi i. The fallback for a single object of components ({{ 1: <strong /> }}) looked the tag up on the string and rendered one of its characters. It now applies only when that child is an object, so {{ 1: <strong /> }} renders as before, and the tag falls back to its inner text, as it already did with several children or with a number or an element as the only child. This also stops a single-entry array child holding null ({[null]}, e.g. from a .map that returned null) from throwing Cannot read properties of null. Thanks @​Cayan (#1939).

17.1.1

  • fix(Trans): with components as an object with index keys, the component for key 0 is now rendered. components={{ 0: <a href={path} /> }} with "You're eligible. <0>Get started here.</0>" rendered the text without the link, a self-closing <0/> rendered nothing, and in <0>a <1>b</1></0> both elements were lost, while keys 1 and up and the array form worked. The object was passed on as the indexed children, so <0> resolved to the object itself. It is now looked up by key, like a named components map. This also fixes an array components next to react.transDefaultProps.components, which the merge turns into such an object ({ Bold, 0, 1 }) and so lost its first entry, and a self-closing named tag in a mixed object ({ 0: <a />, Bold: <b /> } with <Bold/>), which rendered as the text <Bold />. Arrays, named maps and index objects starting at 1 render as before. Thanks @​nk-batman21 (#1938).

17.1.0

  • feat(types): with i18next's new parseInterpolation: 'icu' (or 'mf2') type option (i18next v26.5.0), the values of IcuTrans and IcuTransWithoutContext are typed from the message of i18nKey, like the options of t(): a misspelled argument, a value of the wrong type or a value meant for another key is a type error. values was Record<string, any> before, and still is with any other parseInterpolation setting. values stays optional, as on Trans. useTranslation's t and Trans values get the checks from i18next's types without changes here.
  • fix(types): IcuTrans and IcuTransWithoutContext now infer the literal i18nKey (const type parameter, as Trans does), so props that depend on the key are checked against that key instead of all keys of the namespace.

17.0.21

  • fix(IcuTrans): explicit values now win over interpolation.defaultVariables, as they do in t(). IcuTrans merged them the other way round, so <IcuTrans values={{ user: 'John Doe' }} /> rendered the configured default variable user instead of John Doe. Trans had the same inverted merge and is fixed too. Compatibility note: only names that are set both in values and in defaultVariables render differently.
  • feat: new entry point react-i18next/IcuTransWithoutContext (with types) for React Server Components. Importing IcuTransWithoutContext from react-i18next in a Server Component could fail the build with createContext is not a function, because the main entry creates the React context when it is loaded. Like react-i18next/TransWithoutContext, the new entry point does not.
  • fix(build): the ESM build's dist/es/package.json now declares "sideEffects": false, like the root package.json already did. Bundlers use the nearest package.json, so the ESM build counted as having side effects and unused exports were kept: an app that only uses Trans still bundled IcuTrans with its HTML entity decoder, useTranslation and use-sync-external-store. With esbuild, a Trans-only bundle (React and i18next external) goes from 20.9 KB to 11.6 KB minified, 8.3 KB to 5.0 KB gzipped.
  • docs: the icu.macro Babel macro is now marked as deprecated in favour of using IcuTrans directly. It fails on Babel 8 (t.jSXIdentifier is not a function), <Plural count={count}> renders the raw ICU message, and a React key on <Plural>/<Select> becomes an ICU case. It keeps working on Babel 7 and is not removed. The IcuTrans docs page has a corrected example and props table and covers Server Components.

17.0.20

  • fix: useTranslation no longer suspends when a missing namespace is loaded by a synchronous backend. With useSuspense (the default), a namespace that wasn't in the store yet always made the component throw the loading promise, even when the backend had already delivered the resources while that promise was being created. React then showed the Suspense fallback and rendered again right away, which appears as a fallback flash (a white flash in React Native) and costs performance. The hook now starts the load first, checks the store again and only suspends if the namespace is still missing. This helps every backend that calls back synchronously, for example i18next-resources-to-backend with a static resources object or a loader that returns the data directly. Async backends, and an instance that isn't initialized yet, still suspend as before. Thanks @​oblador (#1937).

17.0.19

  • fix: useTranslation with an inline selector keyPrefix (useTranslation('ns', { keyPrefix: ($) => $.role })) returned a new t on every render, so every effect, useCallback and useMemo depending on t ran again each time. The cached t was compared against the keyPrefix function itself, and an inline arrow is a new function on every render. It is now compared against the key the selector resolves to (with the same options and namespace list getFixedT resolves it with), so t keeps its identity as long as the resolved prefix does, just like a string keyPrefix. A selector that resolves to a different key still gets a new t, and i18next still resolves the selector on each t call as before. Fixes #1936.
  • fix: useTranslation kept returning the previous t when only the namespace (useTranslation('a') → useTranslation('b')) or only the i18n instance (another instance with the same language, via props or I18nextProvider) changed on a mounted component. That t kept resolving against the old namespace or instance until something else (the language, the ready state, a bound i18n event) produced a new one. Both are now part of the check that decides whether the cached t can be reused.

17.0.18

  • fix(Trans): with shouldUnescape, the default unescape now turns &nbsp; and &[#160](https://github.com/i18next/react-i18next/issues/160); into a no-break space (U+00A0) instead of a regular space (U+0020). The regular space dropped what the entity is for: u&nbsp;nás or 10&nbsp;km could wrap across lines, and consecutive &nbsp;s collapsed into one space. This also matches IcuTrans, whose entity decoder already mapped &nbsp; to U+00A0. Compatibility note: only affects shouldUnescape; snapshots or exact textContent comparisons of such text now contain U+00A0 (Testing Library's default normalizer still matches it as a space). A custom react.unescape function can restore the old mapping for text nodes. Thanks @​lprnmns (#1935).

17.0.17

  • perf: useTranslation no longer unsubscribes and resubscribes its i18n listeners on every render. The subscribe callback handed to useSyncExternalStore depended on the merged options object, which is rebuilt whenever props is a new object: with no options (the {} default), with options passed inline (useTranslation('ns', { keyPrefix })), and through withTranslation and <Translation>. A new subscribe makes React resubscribe, so each render of each caller ran i18n.off and i18n.on in an extra effect. It now depends only on the instance and the bindI18n/bindI18nStore event names. No updates were ever missed, because React re-checks the snapshot after resubscribing; this only removes the churn, which adds up with many mounted components that re-render often. Reported via next-i18next#2349.

17.0.16

  • fix(Trans): a selector i18nKey that points into a secondary namespace of useTranslation now resolves the same way t() does. With const { t } = useTranslation(['ns1', 'ns2']), t($ => $.ns2.message) works since 17.0.7, but <Trans t={t} i18nKey={$ => $.ns2.message} /> rendered the raw key (or its children). Trans always passed an ns option to t, filled from t.ns (the primary namespace only), and an explicit ns makes i18next's fixed t skip the hook's full namespace list (scopeNs). When Trans or TransWithoutContext gets a t that carries its own namespace and no ns prop, it now leaves ns out and lets that t apply its own. String keys, keyPrefix, nsMode: 'fallback', an explicit ns prop and Trans without a t prop behave as before. Compatibility note: if the primary namespace has a nested object named like a secondary namespace (ns1 → ns2.message), Trans now resolves $ => $.ns2.message to ns2:message, as t() already does. Fixes #1933.

17.0.15

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 1, 2026

@ripple-code-reviewer ripple-code-reviewer Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Routine Dependabot bump of react-i18next 15.4.1 → 17.0.15 (a two-major-version jump) with corresponding package.json edit. The lockfile diff is consistent and transitive deps (@babel/runtime, html-parse-stringify, use-sync-external-store) update sensibly. One point worth verifying before merge: the new react-i18next peerDependencies entry now requires i18next >= 26.2.0 (up from >= 23.2.3), but neither the lockfile nor package.json diff shows the project's i18next version being bumped alongside it.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/react-i18next-17.0.15 branch from 8946cc6 to e4512f0 Compare October 7, 2026 21:12

@ripple-code-reviewer ripple-code-reviewer Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verify i18next peer dependency compatibility - see inline.

Comment thread package.json Outdated
"react-error-boundary": "^4.0.13",
"react-helmet-async": "^2.0.4",
"react-i18next": "15.4.1",
"react-i18next": "17.0.15",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Peer dependency: react-i18next 17.0.15 requires i18next >= 26.2.0. Verify i18next version in package.json.

@pdp2121 pdp2121 mentioned this pull request Oct 8, 2026
1 of 10 tasks
pdp2121 added a commit that referenced this pull request Oct 8, 2026
## High Level Overview of Change

Quarterly batch dependency upgrade (2026-Q4). This PR consolidates the
open Dependabot dependency PRs **and** applies any further upgrades
needed to resolve the open Semgrep (DGE) supply-chain tickets that a
package upgrade can fix.

- **21** Dependabot PRs applied (Upgraded); **9** skipped
(peer-dependency or Node-engine conflicts — see the table).
- **0** Semgrep tickets needed an upgrade: the 4 new **Critical** axios
tickets (DGE-8416–8419, `axios ≥ 1.20.0`) are already satisfied on
`main` by the Q3 batch (No-op), and none are left open.
- Twelve of the applied PRs are major bumps, eight of them production
dependencies: `express` 5, `dotenv` 18,
`i18next-browser-languagedetector` 8, `i18next-http-backend` 4,
`react-helmet-async` 3, `react-error-boundary` 6, `vite-plugin-svgr` 5,
`tldts` 7.

> **Express 4 → 5 needed a server fix that CI does not catch — please
review it specifically.** Under Express 5 the production server crashed
on startup (`PathError: Missing parameter name at index 1: *`), because
`path-to-regexp` 8 no longer accepts a bare `*` route. No Jest test
loads `server/`, so `lint:ci`, `build`, `build-ts` and `test:ci` all
passed regardless. Two lines in `server/index.js` were changed to the
Express 5 syntax, and the server was started and probed in both
production and development modes (see Test Plan).

### Context of Change

Quarterly batch of the Dependabot PRs opened on 2026-10-01, plus the
Semgrep tickets a package upgrade can fix. Direct dependency versions
were bumped in `package.json`; `package-lock.json` was updated in place
(never regenerated from scratch). No `overrides` or `resolutions` were
added and no parent range was widened.

### Type of Change

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] Refactor (non-breaking change that only restructures code)
- [ ] Tests (You added tests for code that already exists, or your new
feature included in this PR)
- [ ] Documentation Updates
- [ ] Translation Updates
- [ ] Release

"Breaking change" is checked because production dependencies cross major
versions (most notably `express` 5). User-facing behavior is unchanged.

### Codebase Modernization

N/A — no file conversions.

- [ ] Updated files to React Hooks
- [ ] Updated files to TypeScript

## Before / After

**`server/index.js`** — Express 5 route syntax (details in
`code-changes.md`):

```js
// before (Express 4)
app.get('*', (_req, res) => { res.sendFile(path.join(__dirname, '/../build/index.html')) })
app.use('*', (req, res) => { /* 404 */ })

// after (Express 5)
app.get('/{*splat}', (_req, res) => { res.sendFile(path.join(__dirname, '/../build/index.html')) })
app.use((req, res) => { /* 404 */ })
```

`/{*splat}` keeps matching `/` itself, as `*` did; `app.use` with no
path already matches every request.

**Prettier 3.9 reformat** — six files re-wrapped by `npm run lint`
(`--fix`), cosmetic only: `BasicInfoCard.test.tsx`, `AMMPool/utils.ts`,
`ConfBalanceTooltipIcon.tsx`, `Notification/index.tsx`,
`TransactionActionIcon.tsx`, `registerServiceWorker.js`.

**Lockfile** — 86 packages changed version, 44 added, 46 removed; most
of the churn is Express 5's own dependency tree (`router`,
`path-to-regexp` 8, `serve-static` 2, …).

All Semgrep tickets closed in Q3 were re-verified against this lockfile
and remain satisfied (e.g. `path-to-regexp` is now 8.4.2 and
`serve-static` 2.2.1, both outside their advisories' affected ranges).

## Test Plan

Run locally on Node 22.14:

- `npm run lint:ci` — passes
- `npm run build` — passes
- `npm run build-ts` — passes
- `npm run test:ci` — 292/293 suites, 1688/1726 tests pass; coverage
thresholds met. The only failure,
`src/containers/shared/test/amendmentUtils.test.ts` (38 tests), calls
the live VHS dev API (`vhs.dev.ripplex.io/v1/network/amendments/info`),
which was returning **HTTP 503** during the run; it fails identically on
an untouched `main` checkout. It is unrelated to this batch and should
pass once the endpoint recovers (or be mocked in a follow-up).
- **Express 5 server smoke test** (not covered by CI), with `node
server`:
- `NODE_ENV=production`: `/` → 200 `index.html`; `/transactions/ABC123`
→ 200 `index.html` (SPA fallback); `/api/v1/healthz` → 200 `success`.
- `NODE_ENV=development`: `/` → 200 (static); `/transactions/ABC123` →
404 `{"error":"route not found"}`; `/api/v1/does-not-exist` → 404.

## Superseded Dependabot PRs

| PR | Package | From | Asked for | Resolved | Status |
MajorVersionUpgrade |

|----|---------|------|-----------|----------|--------|---------------------|
| #1375 | ts-jest | 29.4.9 | 29.4.14 | 29.4.14 | Upgraded | No |
| #1374 | dotenv | 17.4.2 | 18.0.5 | 18.0.6 | Upgraded | Yes
([v18](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)) |
| #1373 | @testing-library/react | 13.4.0 | 16.3.3 | 16.3.3 | Upgraded |
Yes
([v14](https://github.com/testing-library/react-testing-library/releases/tag/v14.0.0),
[v15](https://github.com/testing-library/react-testing-library/releases/tag/v15.0.0),
[v16](https://github.com/testing-library/react-testing-library/releases/tag/v16.0.0))
|
| #1372 | compression | 1.8.1 | 1.8.2 | 1.8.2 | Upgraded | No |
| #1371 | stylelint-scss | 7.0.0 | 7.3.0 | 7.3.0 | Upgraded | No |
| #1370 | @babel/preset-react | 7.28.5 | 8.0.1 | 7.28.5 | Skipped (peer
dep conflict: requires `@babel/core ^8`; installed 7.29.7) | Yes
([v8](https://github.com/babel/babel/releases/tag/v8.0.0)) |
| #1369 | express | 4.22.3 | 5.2.1 | 5.2.1 | Upgraded (with
`server/index.js` route fix) | Yes
([v5](https://github.com/expressjs/express/releases/tag/v5.0.0),
[migration guide](https://expressjs.com/en/guide/migrating-5.html)) |
| #1368 | lint-staged | 15.5.2 | 17.6.0 | 15.5.2 | Skipped (engine
conflict: requires Node ≥ 22.22.1; repo allows `>=22.0.0` with
`engine-strict=true`) | Yes
([v16](https://github.com/lint-staged/lint-staged/releases/tag/v16.0.0),
[v17](https://github.com/lint-staged/lint-staged/releases/tag/v17.0.0))
|
| #1367 | @types/node | 22.19.17 | 26.6.4 | 22.19.17 | Skipped (runtime
is Node 22; Node 26 types would allow APIs missing at runtime) | Yes
([types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node))
|
| #1366 | jest-environment-jsdom | 30.3.0 | 30.5.2 | 30.5.2 | Upgraded |
No |
| #1365 | i18next-browser-languagedetector | 7.2.2 | 8.2.1 | 8.2.1 |
Upgraded | Yes
([v8](https://github.com/i18next/i18next-browser-languageDetector/blob/master/CHANGELOG.md))
|
| #1364 | eslint-plugin-prettier | 5.5.5 | 5.5.6 | 5.5.6 | Upgraded | No
|
| #1363 | i18next-http-backend | 3.0.6 | 4.0.2 | 4.0.2 | Upgraded | Yes
([v4](https://github.com/i18next/i18next-http-backend/blob/master/CHANGELOG.md))
|
| #1362 | @typescript-eslint/parser | 8.58.2 | 8.71.0 | 8.71.1 |
Upgraded | No |
| #1361 | react / @types/react | 18.3.1 / 18.3.28 | 19.3.0 / 19.3.0 |
18.3.1 / 18.3.28 | Skipped (peer dep conflict: `react-query@3.39.3`, the
last v3, requires `react ≤ 18`) | Yes
([v19](https://github.com/facebook/react/releases/tag/v19.0.0),
[types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react))
|
| #1360 | react-helmet-async | 2.0.5 | 3.0.0 | 3.0.0 | Upgraded | Yes
([v3](https://github.com/staylor/react-helmet-async/releases/tag/v3.0.0))
|
| #1359 | react-error-boundary | 4.1.2 | 6.1.6 | 6.1.6 | Upgraded | Yes
([v5](https://github.com/bvaughn/react-error-boundary/releases/tag/5.0.0),
[v6](https://github.com/bvaughn/react-error-boundary/releases/tag/6.0.0))
|
| #1358 | react-error-overlay | 6.0.11 | 6.1.0 | 6.1.0 | Upgraded | No |
| #1357 | vite-plugin-environment | 1.1.3 | 1.1.4 | 1.1.3 | Skipped
(peer dep conflict: requires `vite >= 8`; installed 7.3.6) | No |
| #1356 | prettier | 3.6.2 | 3.9.9 | 3.9.9 | Upgraded | No |
| #1355 | xrpl | 4.6.0 | 5.3.0 | 5.3.0 | Upgraded | Yes
([v5](https://github.com/XRPLF/xrpl.js/releases/tag/xrpl%405.0.0)) |
| #1354 | react-router | 7.18.4 | 8.4.0 | 7.18.4 | Skipped (peer dep
conflict: requires `react ≥ 19.2.7`, blocked by #1361; also Node ≥
22.22) | Yes
([v8](https://github.com/remix-run/react-router/releases/tag/react-router%408.0.0))
|
| #1353 | vite-plugin-svgr | 4.5.0 | 5.2.0 | 5.2.0 | Upgraded | Yes
([v5](https://github.com/pd4d10/vite-plugin-svgr/releases/tag/v5.0.0)) |
| #1352 | @typescript-eslint/eslint-plugin | 8.58.2 | 8.71.0 | 8.71.1 |
Upgraded | No |
| #1351 | react-i18next | 15.4.1 | 17.0.15 | 15.4.1 | Skipped (peer dep
conflict: requires `i18next ≥ 26.2.0`; installed 23.16.8) | Yes
([CHANGELOG](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md))
|
| #1350 | babel-jest | 29.7.0 | 30.5.2 | 30.5.2 | Upgraded | Yes
([v30](https://jestjs.io/blog/2025/06/04/jest-30)) |
| #1349 | tldts | 6.1.86 | 7.4.16 | 7.4.16 | Upgraded | Yes
([v7](https://github.com/remusao/tldts/releases/tag/v7.0.0)) |
| #1348 | eslint-import-resolver-typescript | 4.4.4 | 4.4.5 | 4.4.5 |
Upgraded | No |
| #1347 | @babel/preset-env | 7.29.2 | 8.0.6 | 7.29.2 | Skipped (peer
dep conflict: requires `@babel/core ^8`; installed 7.29.7) | Yes
([v8](https://github.com/babel/babel/releases/tag/v8.0.0)) |
| #1346 | eslint-plugin-react-hooks | 4.6.2 | 7.1.1 | 4.6.2 | Skipped
(peer dep conflict: `eslint-config-airbnb@19.0.4`, the latest, requires
`^4.3.0`) | Yes
([CHANGELOG](https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md))
|

## Semgrep tickets

Out of scope (not package-upgrade-fixable; not addressed here):
DGE-4837, DGE-4839, DGE-4840, DGE-7803, DGE-7812 (code findings);
DGE-7802, DGE-7804 (config findings); DGE-4831, DGE-4834, DGE-4843,
DGE-7794 (`ripple/explorer-deploy`).

| Ticket | Package | From | Asked for | Resolved | Status |
MajorVersionUpgrade |

|--------|---------|------|-----------|----------|--------|---------------------|
| [DGE-8416](https://ripplelabs.atlassian.net/browse/DGE-8416) | axios |
1.20.0 | ≥ 1.20.0 | 1.20.0 | No-op (already satisfied on main since the
Q3 batch) | No |
| [DGE-8417](https://ripplelabs.atlassian.net/browse/DGE-8417) | axios |
1.20.0 | ≥ 1.20.0 | 1.20.0 | No-op (already satisfied on main since the
Q3 batch) | No |
| [DGE-8418](https://ripplelabs.atlassian.net/browse/DGE-8418) | axios |
1.20.0 | ≥ 1.20.0 | 1.20.0 | No-op (already satisfied on main since the
Q3 batch) | No |
| [DGE-8419](https://ripplelabs.atlassian.net/browse/DGE-8419) | axios |
1.20.0 | ≥ 1.20.0 | 1.20.0 | No-op (already satisfied on main since the
Q3 batch) | No |

No ticket required an upgrade that a Dependabot PR did not already
propose.

## Closing instructions

After merging, run `/batch-deps-upgrade close` to close the superseded
PRs and the resolved Semgrep tickets. It will close these **Upgraded**
Dependabot PRs — #1375, #1374, #1373, #1372, #1371, #1369, #1366, #1365,
#1364, #1363, #1362, #1360, #1359, #1358, #1356, #1355, #1353, #1352,
#1350, #1349, #1348 — and these **No-op** tickets: DGE-8416, DGE-8417,
DGE-8418, DGE-8419.

The following PRs were **Skipped** and should remain open so Dependabot
keeps rebasing them: #1370 (@babel/preset-react), #1368 (lint-staged),
#1367 (@types/node), #1361 (react / @types/react), #1357
(vite-plugin-environment), #1354 (react-router), #1351 (react-i18next),
#1347 (@babel/preset-env), #1346 (eslint-plugin-react-hooks). No Semgrep
tickets stay open.
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/react-i18next-17.0.15 branch from ca89a62 to f1d0876 Compare October 8, 2026 15:52

@ripple-code-reviewer ripple-code-reviewer Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependency-only bump of react-i18next 15.4.1 → 17.0.15 (two major versions) plus its transitive deps (html-parse-stringify 3→4, use-sync-external-store added, void-elements removed, @babel/runtime patch bump). The lockfile and package.json changes are consistent with the stated purpose, but the magnitude of the jump and a tightened peer-dependency range warrant a quick compatibility check before merging.

Bumps [react-i18next](https://github.com/i18next/react-i18next) from 15.4.1 to 17.1.4.
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v15.4.1...v17.1.4)

---
updated-dependencies:
- dependency-name: react-i18next
  dependency-version: 17.0.15
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump react-i18next from 15.4.1 to 17.0.15 chore(deps): bump react-i18next from 15.4.1 to 17.1.4 Oct 26, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/react-i18next-17.0.15 branch from f1d0876 to 438917b Compare October 26, 2026 14:04

@ripple-code-reviewer ripple-code-reviewer Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 1 blocking issue — see inline.

Comment thread package.json
"react-error-boundary": "^6.1.6",
"react-helmet-async": "^3.0.0",
"react-i18next": "15.4.1",
"react-i18next": "17.1.4",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

react-i18next 17.x requires i18next >= 26.2.0. Confirm i18next >= 26.2.0 in package.json or run npm ls i18next.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants