Bump react-i18next from 15.4.0 to 17.0.10 in /js

[dependabot]

Bumps react-i18next from 15.4.0 to 17.0.10.

Changelog

Sourced from react-i18next's changelog.

17.0.10

• fix(warnings): the useTranslation and Trans "You will need to pass in an i18next instance" warnings now match the useSSR wording, mentioning the props/context alternatives and the most common unexplained cause at scale: duplicate react-i18next copies in monorepo setups. The Trans variant also referenced the internal i18nextReactModule name; it now points to the public initReactI18next API.
• feat(warnings): development-only warning (SUSPENDED_WHILE_LOADING, logged once) right before useTranslation suspends while translations are loading. With the default useSuspense: true and no <Suspense> boundary this previously surfaced as a blank screen or a cryptic React error; the warning now names both fixes (add a <Suspense> boundary or set react.useSuspense: false). No-op in production builds; the process.env.NODE_ENV check is wrapped so runtimes without a process global (raw ESM in the browser, some edge runtimes) stay silent instead of throwing.
• ci: weekly workflow typechecking the test suite against @types/react@next / @types/react-dom@next, so the next React major's type changes (like the React 18 TFunctionResult/children wave) surface before user reports.

17.0.9

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. Fixes #1927, thanks @​andikapradanaarif.
• fix(types): <Trans t={t} ns="ns" …> with a t from useTranslation(['ns']) now typechecks under TypeScript 7. TS7 intersects the Ns inference candidates coming from the t prop (readonly ['ns']) and the ns prop ('ns') into an unsatisfiable 'ns' & readonly ['ns'], where TS6 resolved them. The ns prop on TransProps, TransSelectorProps and IcuTransWithoutContextProps now also accepts a single namespace out of an array-typed Ns (Ns | (Ns extends readonly (infer S extends string)[] ? S : never)) — which matches runtime behavior and is unchanged under TS5/TS6.

17.0.8

• fix(types): <Trans i18nKey={$ => ...}> now typechecks under enableSelector: 'strict'. The Trans component's conditional type was gated on _EnableSelector extends true | 'optimize', excluding 'strict' and falling back to the legacy string-key signature. Runtime was already correct (it calls keyFromSelector(i18nKey) whenever typeof i18nKey === 'function'); this is a type-only fix that widens the conditional to include 'strict'. Thanks @​Faithfinder (#1921)

17.0.7

• feat: useTranslation([nsA, nsB, ...]) now passes its full namespace list to getFixedT via the new scopeNs opt (requires i18next ≥ v26.0.10). This makes selector calls with a secondary-namespace prefix resolve correctly under default nsMode: t($ => $.nsB.foo) previously missed silently because the bound ns was the primary string only and i18next's selector rewrite needed an array. Resolution semantics are unchanged — plain t('key') lookups still stay isolated to the primary namespace by default; use nsMode: 'fallback' to opt into multi-ns fallback resolution as before. Fixes i18next#2429 for useTranslation-based callers.

17.0.6

• fix: restore the v17 nodesToString output format consumed by i18next-cli's extractor while still rendering 1919 correctly
  • 17.0.5 fixed 1919 by changing what nodesToString produced, which inadvertently changed the extracted translation strings for keep-tags wrapping non-keep React elements
  • The fix now lives in the renderer: indexed <N> placeholders nested inside a keep-tag are scoped to that tag's own original React children (matching kept tags by name and positional occurrence at each level), so the translation string format produced by nodesToString is unchanged

17.0.5

• fix: <Trans /> no longer breaks child rendering when a kept HTML node (transKeepBasicHtmlNodesFor) wraps a non-keep React element 1919 — superseded by 17.0.6, which keeps the same runtime fix without changing the nodesToString output

17.0.4

• fix: avoid React does not recognize the 'i18nIsDynamicList' prop on a DOM element warning 1915

17.0.3

• fix: avoid invalid prop on React.Fragment inside <Trans /> 1914

17.0.2

• fix(types): values prop on <Trans /> now only requires interpolation variables for the specific i18nKey, not all variables in the namespace 1913

17.0.1

• chore: bump minimum i18next peer dependency to >= 26.0.1 (forgot to do it in last version)
• fix: migrate test setup from removed legacy interpolation.format to i18n.services.formatter.add() (i18next v26)

17.0.0

Potentially breaking changes

... (truncated)

Commits

• 3b71c27 17.0.10
• 57c3500 build
• c62476f chore: sync package-lock with i18next ^26.2.0 devDependency bump
• 0126bd1 improve instance warnings (monorepo hint) + dev-only suspense warning + weekl...
• 8b4a9ea 17.0.9
• 422bab1 fix: support typescript 7 — widen peer range and fix Trans ns inference under...
• 6e18aa9 README: mention npx i18next-cli localize as the zero-to-localized path
• a46ad23 17.0.8
• f715031 update i18next dep
• a515d5b changelog: 17.0.8 entry for #1921
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: area/dependencies, team/ui. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The review identified critical security vulnerabilities and implementation gaps that prevent merging in its current state:

• Security Vulnerabilities: High-severity flaws were detected, including a Remote Code Execution (RCE) vulnerability in simple-git and Open Redirect vulnerabilities in react-router-dom.
• Missing Requirements: The update for js/libs/ui-shared/package.json is missing from the PR, despite being a core requirement.
• Unaddressed Breaking Changes: Moving from v15 to v17 introduces significant breaking changes, such as a new default for useSuspense and a requirement for i18next core version 26.0.1 or higher. The PR lacks the necessary logic updates and peer dependency bumps to support this major upgrade.

About this PR

• The changelog for react-i18next v17.0.1 indicates a requirement for i18next >= 26.0.1. The project's current i18next version was not updated in this PR, which may lead to runtime errors or peer dependency conflicts.
• The upgrade from react-i18next v15 to v17 involves breaking changes. Manual code adjustments, such as verifying component rendering or explicitly configuring suspense behavior, appear to be missing from this pull request.

2 comments outside of the diff

js/pnpm-lock.yaml

_{line 310 🔴 HIGH RISK}
A high-severity Remote Code Execution (RCE) vulnerability (CVE-2026-6951) was detected in simple-git. This vulnerability allows attackers to execute arbitrary shell commands via incomplete sanitization. It is highly recommended to update this dependency to version 3.36.0 or higher.

_{line 95 🟡 MEDIUM RISK}
i18next-http-backend contains a Path Traversal and URL Injection vulnerability (CVE-2026-41691). As you are currently updating the internationalization stack, please update this dependency to version 3.0.5 or higher.

Test suggestions

• Verify that the i18next core dependency is at version 26.0.1 or higher to satisfy the new peer dependency requirement introduced in v17.0.1.
• Confirm that the application handles the new default useSuspense: true behavior in useTranslation or has explicitly configured it to false to avoid unhandled suspension errors.
• Validate that the Trans component renders correctly when using nested HTML nodes, ensuring the fixes in v17.0.5 and v17.0.6 regarding nodesToString are verified.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the i18next core dependency is at version 26.0.1 or higher to satisfy the new peer dependency requirement introduced in v17.0.1.
2. Confirm that the application handles the new default useSuspense: true behavior in useTranslation or has explicitly configured it to false to avoid unhandled suspension errors.
3. Validate that the Trans component renders correctly when using nested HTML nodes, ensuring the fixes in v17.0.5 and v17.0.6 regarding nodesToString are verified.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Suggestion: The react-router-dom dependency uses a version of react-router containing an Open Redirect vulnerability (CVE-2026-40181). An attacker could redirect users to malicious sites via specially crafted URLs. Consider updating this dependency:

Suggested change

	"react-router-dom": "^6.29.0",
	"react-router-dom": "^6.30.4",

[codacy-production]

_{🔴 HIGH RISK}

Suggestion: The react-router-dom dependency uses a version of react-router containing an Open Redirect vulnerability (CVE-2026-40181). An attacker could redirect users to malicious sites via specially crafted URLs. Consider updating this dependency:

Suggested change

	"react-router-dom": "^6.29.0"
	"react-router-dom": "^6.30.4"