Sourced from @​clerk/clerk-js's releases.

@​clerk/clerk-js@​6.40.0

Minor Changes

• Support passkeys as a second factor during sign-in and session reverification. (#9127) by @​dmoerner

  When a user has a passkey, the prebuilt <SignIn/> and <UserVerification/> components preselect it as the second factor, as they already do for the first factor. Other methods stay available under "Use another method".

  To use it, your instance must allow passkeys to satisfy the second factor. This is on by default for instances created after 2026-07-08, and can be turned on in the Dashboard for older ones. Web apps also need to opt in to the passkey second factor update in the Dashboard.

  If you build a custom flow, supportedSecondFactors can now include passkey. Call signIn.authenticateWithPasskey() to complete it.

  Passkeys are no longer preselected, for either factor, where the SDK reports that WebAuthn is unavailable (for example, Electron apps without passkey support enabled).

Patch Changes

• Updated dependencies [e5cfdff]:
  • @​clerk/shared@​4.41.0

@​clerk/clerk-js@​6.39.1

Patch Changes

• Fix oidcPrompt being ignored for OAuth strategies in signIn.sso() and signIn.authenticateWithRedirect(). The value is now sent when the sign-in is created, so a prompt such as select_account reaches the OAuth provider. (#10125) by @​wobsoriano

• session.getToken() no longer skips the network request when navigator.onLine reports false. Some environments, such as Chrome behind certain VPN clients, can report offline while the network works, which caused every token refresh to fail with clerk_offline. HTTP errors from the Frontend API, including ones with non-JSON bodies such as a proxy's HTML 502, are now surfaced as-is instead of being relabeled as ClerkOfflineError. When a resource cache is configured (e.g. Expo), a 5xx response during startup now falls back to the cached resources, and non-JSON 5xx responses no longer clear the Chrome extension's stored development browser token. (#10264) by @​paulogdm

Sourced from @​clerk/clerk-js's changelog.

6.40.0

Minor Changes

• Support passkeys as a second factor during sign-in and session reverification. (#9127) by @​dmoerner

  When a user has a passkey, the prebuilt <SignIn/> and <UserVerification/> components preselect it as the second factor, as they already do for the first factor. Other methods stay available under "Use another method".

  To use it, your instance must allow passkeys to satisfy the second factor. This is on by default for instances created after 2026-07-08, and can be turned on in the Dashboard for older ones. Web apps also need to opt in to the passkey second factor update in the Dashboard.

  If you build a custom flow, supportedSecondFactors can now include passkey. Call signIn.authenticateWithPasskey() to complete it.

  Passkeys are no longer preselected, for either factor, where the SDK reports that WebAuthn is unavailable (for example, Electron apps without passkey support enabled).

Patch Changes

• Updated dependencies [e5cfdff]:
  • @​clerk/shared@​4.41.0

6.39.1

Patch Changes

• Fix oidcPrompt being ignored for OAuth strategies in signIn.sso() and signIn.authenticateWithRedirect(). The value is now sent when the sign-in is created, so a prompt such as select_account reaches the OAuth provider. (#10125) by @​wobsoriano

• session.getToken() no longer skips the network request when navigator.onLine reports false. Some environments, such as Chrome behind certain VPN clients, can report offline while the network works, which caused every token refresh to fail with clerk_offline. HTTP errors from the Frontend API, including ones with non-JSON bodies such as a proxy's HTML 502, are now surfaced as-is instead of being relabeled as ClerkOfflineError. When a resource cache is configured (e.g. Expo), a 5xx response during startup now falls back to the cached resources, and non-JSON 5xx responses no longer clear the Chrome extension's stored development browser token. (#10264) by @​paulogdm

6.39.0

Minor Changes

• Add a role mapping step to the self-serve Directory Sync setup in <OrganizationProfile />. Organization admins can now assign an organization role to each directory group their identity provider pushes, set which group wins when a member belongs to several, and turn role syncing on or off. Members in no mapped group keep the organization's default role. The step is read-only for members without the org:sys_memberships:manage permission and while the organization's role set is being migrated. (#10081) by @​kalafut

Patch Changes

• Add an enterpriseConnectionsUrl option to handleRedirectCallback() and <AuthenticateWithRedirectCallback />. When the Clerk API asks an OAuth sign-up to choose between several enterprise connections for the same email domain, the callback navigates to this URL, which defaults to the enterprise-connections route of your sign-up page. (#9947) by @​NicolasLopes7

• Updated dependencies [dcb03d3, 31c1930]:

  • @​clerk/shared@​4.40.0

6.38.1

... (truncated)

• ec91b9b ci(repo): Version packages (#10283)
• e5cfdff feat(clerk-js,ui,shared,localizations): Support passkey as a second factor (#...
• 0c7e63b ci(repo): Version packages (#10274)
• 560ff50 fix(clerk-js): don't trust navigator.onLine to skip token fetches (#10264)
• c0ba3bc fix(clerk-js): send oidcPrompt when creating an OAuth sign-in (#10125)
• f9aa91e fix(ui): sign in a returning user after a sign-up verification challenge (#10...
• a0ea270 ci(repo): Version packages (#10155)
• dcb03d3 feat(ui,clerk-js,shared): add a role mapping step to the Directory Sync wizar...
• 31c1930 feat(clerk-js): route OAuth callbacks to the enterprise connection chooser (#...
• ff81d5a ci(repo): Version packages (#10074)
• Additional commits viewable in compare view

• See full diff in compare view

Sourced from cropperjs's releases.

v2.3.1

See CHANGELOG.md for details.

v2.3.0

See CHANGELOG.md for details.

Sourced from cropperjs's changelog.

2.3.1 (2026-10-16)

• fix(cropper-image): fix <cropper-image> staying 0×0 when src is set after connect (#1306) (6b53510), closes #1306
• docs(examples): update Cropper instantiation to use createCropper method (9c8828d)

2.3.0 (2026-10-07)

• build: release v2.3.0 (0344ca3)
• refactor(cropper-image): implement fit checking logic in $exceedsFit method (6a72df9)
• refactor(element-viewer): change properties order (30cf335)
• feat(cropper-image): add zoomAroundCenter property (fea6cac)
• feat(cropper-image): add the maxInset and minInset properties (58664a8)
• feat(cropper-selection): add resizeAroundCenter property (01e5c1a), closes #1299
• feat(cropper-selection): add zoomAroundCenter property (9d3c874)
• feat(cropper-selection): add the maxInset and minInset properties (51c984f)
• feat(cropper-selection): enhance resize handling with initial dimensions tracking (f8e5208), closes #1298
• feat(cropper-selection): enhance selection handling for non-resizable elements (6926e84), closes #1302
• feat(cropper-selection): improve selection coverage and boundary handling (32112a8), closes #1285
• feat(cropper-selection/shade): add border radius support for selection and shade elements (75b1cfe), closes #1238
• feat(cropperjs): add the createCropper function for creating a new Cropper instance (0a3cf33)
• Preserve explicit selection dimensions on initial coverage (#1304) (2aba2f4), closes #1304
• docs: add gzip size badge (8a77f71)
• docs: add module example (26cd677)
• docs: improve limit boundaries examples (31e624e), closes #1255
• docs: standardize section headings in API documentation (7af9124)
• docs: update descriptions and links in API documentation for clarity (a6bbf08)
• docs: update examples to include module and script usage (fb4b379)
• docs(cropper-selection): add example for fixed selection while moving or scaling the image (31ef548)
• docs(examples): add example for adding a watermark (741892b)
• docs(examples): add example for applying an image filter (6a47507)
• docs(examples): add example for cropping an image drawn on a canvas (b2ce7cc)
• docs(examples): add example for multiple selections and viewers (36470ad)
• docs(examples): add example for redacting part of an image (f46bf1c)
• docs(examples): add example for uploading a cropped image to a server (9ca08e6)
• docs(examples): enhance code highlighting in HTML examples (d42436b)
• docs(guide): update npm package link for cropperjs version badge (ae47ba0)
• fix: handle image load event for complete images (91bbb5d), closes #1303
• test: enhance tests with keyboard interactions and lifecycle events (d19b3a6)
• ci: add codecov action to CI workflow for test coverage reporting (1dabc83)
• ci(deploy): add --no-verify flag to git commit command (9ca2a3e)

• d671590 build: release v2.3.1
• 0344ca3 build: release v2.3.0
• 0a3cf33 feat(cropperjs): add the createCropper function for creating a new `Cropper...
• See full diff in compare view

Sourced from i18next's releases.

v26.5.6

• fix: cloneInstance({ forkResourceStore: true }) now copies the resources at every level. It copied them only down to the namespace objects, so nested keys and arrays stayed shared with the original instance: addResource() with a nested key (fork.addResource('en', 'translation', 'greeting.hello', 'Hi')) or a deep addResourceBundle() on the fork also changed the original instance and every other fork. Flat keys were already isolated. Forking a large store takes a bit longer: with 300k keys in nested groups, about 11 ms instead of 3 ms per fork. Clones without forkResourceStore still share the store as before. Thanks @​nk-batman21 (#2456, follow-up to #2270).

v26.5.5

• fix: with the default skipOnVariables: true, a {{placeholder}} inside a value inserted with an unescaped {{- var}} now stays literal, as it already did for {{var}}. The escape pass ran after the unescaped values were written and scanned them again, so t('{{- a}}', { a: '{{b}}', b: 'c' }) returned 'c' instead of '{{b}}'. With pre-built HTML that carries user text, like t('You may contact {{name}} at {{- emailHTML}}.', { name, emailHTML }), that text could pull another variable of the same t() call into the output. Results with skipOnVariables: false, and values without placeholders, are unchanged. Compatibility note: a {{- var}} value whose placeholders were meant to be filled from the same t() call now keeps them literally; skipOnVariables: false restores the old behavior. Thanks @​nk-batman21 (#2455, reported in #1595).

v26.5.4

• fix: with the default skipOnVariables: true, a {{placeholder}} inside an interpolated value now stays literal also when the same placeholder appears later in the translation. Each value was written with String.replace, which replaces the first copy of the placeholder text, and that could be the copy inside an earlier value: t('{{name}} has {{count}} items', { name: '{{count}}', count: 5 }) returned '5 has {{count}} items' instead of '{{count}} has 5 items'. The value is now written at the position of the matched placeholder. Results with skipOnVariables: false are unchanged. Thanks @​nk-batman21 (#2454, reported in #1595).
• fix: with useRawValueToEscape: true, a non-string value in an unescaped {{- var}} placeholder or with escapeValue: false no longer throws val.replace is not a function; it is converted to a string like any other value.

v26.5.3

• fix(types): with the selector API, a plural key now requires count also when the call passes an explicit ns. t(($) => $.item) already failed without count, but t(($) => $.item, { ns: 'items' }) compiled, although at runtime it looks up item instead of item_one / item_other and returns the key. It now fails the same way, also with ordinal: true, defaultValue, an ns array, a key prefix and i18n.t. Calls with count, context, returnObjects: true and arrays of selectors, as well as return types, are unchanged. Thanks @​nyarthan (#2452).

v26.5.2

• fix(types): on TypeScript 7, a t() call with a missing, misspelled or wrongly typed option now reports that option again (Property 'album' is missing, Type 'string' is not assignable to type 'number'), as TypeScript 5 and 6 do. TypeScript 7 elaborated the error against the default-value signature instead and ended in '{ count: 3; albm: "Summer"; }' is not assignable to type 'string': on a failed call TypeScript explains the last of the equally matching signatures, and TypeScript 7 sorts the 3-element [key, defaultValue, options?] last. It is now written as two signatures, [key, defaultValue] and [key, defaultValue, options]. This affects the default key checks with i18next {{name}} messages as well as parseInterpolation: 'icu' and 'mf2'. Which calls compile, their return types and the error positions are unchanged on TypeScript 5.9, 6 and 7.

v26.5.1

• perf(types): type-checking t() calls against a large namespace is no longer quadratic in the number of keys. TypeScript does not cache keyof of an object type, and the types rebuilt the union of all keys of a namespace once per key while building the key union, and again in every t() call to look up the return type. Both now use a cached key union, and a literal key is looked up directly instead of being intersected with every key. With 5,000 keys in one namespace and one call per key, the check time went from 14.8s to 1.1s (TypeScript 6); with 1,000 keys from 0.75s to 0.27s. Keys, return types and errors are unchanged.
• perf(types): the selector API (enableSelector: true / 'strict') with context is no longer quadratic in the size of an object. To decide which keys a context keeps, the types scanned all keys of the object once for every key, also when TypeScript checks the selector with context widened to string. With 1,000 keys plus one context variant each, a namespace took 18.7s and failed with "Type instantiation is excessively deep and possibly infinite" (TS2589); 2,500 and more ran out of memory. The context variants of an object are now collected once, in one pass over its keys: 1,000 keys check in 0.69s, 5,000 in 3.1s. Long keys (whole sentences with keySeparator: false) work as before. Selected values and errors are unchanged.

v26.5.0

• feat(types): parseInterpolation: 'icu' and parseInterpolation: 'mf2' type t() options from the message's ICU MessageFormat arguments (i18next-icu) or MessageFormat 2 variables (i18next-mf2), so ICU and MF2 users no longer need parseInterpolation: false and lose argument checking. Missing, misspelled and wrongly typed arguments fail, and so does leaving out the options for a message with arguments (t('greeting')); that error names the missing arguments. Opt-in, default true is unchanged.
  • ICU: {name} takes string | number, {n, number}, plural and selectordinal take number, {d, date} and {t, time} take Date, select takes its case keys or any string (for other), and arguments nested in cases are required too. # and tags are not arguments, apostrophe quoting is read like intl-messageformat does.
  • MF2: {$name} takes string | number, a variable annotated with :number, :integer, :currency, :percent or :unit (inline or through .input / .local) takes number, :datetime, :date and :time take Date, :string takes string, option and markup variables (minimumFractionDigits=$digits, {#link href=$url}) are required too, .local variables are not arguments, and |quoted literals| and \{ escapes are skipped.
  • interpolationFormatTypeMap overrides a type by ICU format or MF2 function name, e.g. date: Date | number or a custom uppercase: string.
  • Applies to t(), getFixedT(), i18n.t, key prefixes, namespaces, the selector API and react-i18next's Trans values. Messages need literal types, as the resources file from i18next-cli's types command has them.
  • Type-check cost with 1,000 messages and one call each: 1.35s instead of 0.86s with false (TypeScript 6), 0.5s instead of 0.26s with TypeScript 7. Messages that no call uses cost nothing.
• fix(types): with the default (non-strict) key checks, an options object with a missing or misspelled interpolation variable now reports the missing variable (Property 'name' is missing) instead of '{ nmae: string }' is not assignable to type 'string' from the default-value overload.

v26.4.7

• perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

v26.4.6

• fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).

v26.4.5

• fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

v26.4.4

• fix(security): the nesting regexp no longer backtracks exponentially (ReDoS) on an unclosed $t(. Its repeated group had overlapping alternatives ([^()"']+ inside (?:...)*?, and inside parentheses [^()] also matched quotes), so a string containing $t( without a closing ) made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hung t() for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch $, t or (, and the skipOnVariables check runs the regexp on the interpolated result, so nest: false did not help either. Every alternative now starts with a different character (plain char, ", ' or (), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone " or ' inside unquoted parentheses within $t(...) is no longer matched. Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.
• fix(security): nest() now resolves $t(...) in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a $t(...) inside a variable that the nested lookup deliberately kept literal (default skipOnVariables: true) was resolved anyway by the outer loop: with outer: 'A $t(inner) B' and inner: 'Hi {{name}}', t('outer', { name: '$t(secret)' }) rendered the secret translation. It now stays A Hi $t(secret) B, the same as without the outer nesting; with skipOnVariables: false it is still resolved. Second, the cost was quadratic when an unclosed $t( preceded many nestings, which matters when an app passes untrusted input as the key itself (t(userInput)): 20,000 nestings took ~1.4 s, now ~25 ms. The resolved value is now sliced into the result instead of going through String.replace, so $&, $`, $' and $$ stay literal as before (26.4.2).

v26.4.3

• perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @​dmchoi77 for the detailed report (#2449).

Sourced from i18next's changelog.

26.5.6

• fix: cloneInstance({ forkResourceStore: true }) now copies the resources at every level. It copied them only down to the namespace objects, so nested keys and arrays stayed shared with the original instance: addResource() with a nested key (fork.addResource('en', 'translation', 'greeting.hello', 'Hi')) or a deep addResourceBundle() on the fork also changed the original instance and every other fork. Flat keys were already isolated. Forking a large store takes a bit longer: with 300k keys in nested groups, about 11 ms instead of 3 ms per fork. Clones without forkResourceStore still share the store as before. Thanks @​nk-batman21 (#2456, follow-up to #2270).

26.5.5

• fix: with the default skipOnVariables: true, a {{placeholder}} inside a value inserted with an unescaped {{- var}} now stays literal, as it already did for {{var}}. The escape pass ran after the unescaped values were written and scanned them again, so t('{{- a}}', { a: '{{b}}', b: 'c' }) returned 'c' instead of '{{b}}'. With pre-built HTML that carries user text, like t('You may contact {{name}} at {{- emailHTML}}.', { name, emailHTML }), that text could pull another variable of the same t() call into the output. Results with skipOnVariables: false, and values without placeholders, are unchanged. Compatibility note: a {{- var}} value whose placeholders were meant to be filled from the same t() call now keeps them literally; skipOnVariables: false restores the old behavior. Thanks @​nk-batman21 (#2455, reported in #1595).

26.5.4

• fix: with the default skipOnVariables: true, a {{placeholder}} inside an interpolated value now stays literal also when the same placeholder appears later in the translation. Each value was written with String.replace, which replaces the first copy of the placeholder text, and that could be the copy inside an earlier value: t('{{name}} has {{count}} items', { name: '{{count}}', count: 5 }) returned '5 has {{count}} items' instead of '{{count}} has 5 items'. The value is now written at the position of the matched placeholder. Results with skipOnVariables: false are unchanged. Thanks @​nk-batman21 (#2454, reported in #1595).
• fix: with useRawValueToEscape: true, a non-string value in an unescaped {{- var}} placeholder or with escapeValue: false no longer throws val.replace is not a function; it is converted to a string like any other value.

26.5.3

• fix(types): with the selector API, a plural key now requires count also when the call passes an explicit ns. t(($) => $.item) already failed without count, but t(($) => $.item, { ns: 'items' }) compiled, although at runtime it looks up item instead of item_one / item_other and returns the key. It now fails the same way, also with ordinal: true, defaultValue, an ns array, a key prefix and i18n.t. Calls with count, context, returnObjects: true and arrays of selectors, as well as return types, are unchanged. Thanks @​nyarthan (#2452).

26.5.2

• fix(types): on TypeScript 7, a t() call with a missing, misspelled or wrongly typed option now reports that option again (Property 'album' is missing, Type 'string' is not assignable to type 'number'), as TypeScript 5 and 6 do. TypeScript 7 elaborated the error against the default-value signature instead and ended in '{ count: 3; albm: "Summer"; }' is not assignable to type 'string': on a failed call TypeScript explains the last of the equally matching signatures, and TypeScript 7 sorts the 3-element [key, defaultValue, options?] last. It is now written as two signatures, [key, defaultValue] and [key, defaultValue, options]. This affects the default key checks with i18next {{name}} messages as well as parseInterpolation: 'icu' and 'mf2'. Which calls compile, their return types and the error positions are unchanged on TypeScript 5.9, 6 and 7.

26.5.1

• perf(types): type-checking t() calls against a large namespace is no longer quadratic in the number of keys. TypeScript does not cache keyof of an object type, and the types rebuilt the union of all keys of a namespace once per key while building the key union, and again in every t() call to look up the return type. Both now use a cached key union, and a literal key is looked up directly instead of being intersected with every key. With 5,000 keys in one namespace and one call per key, the check time went from 14.8s to 1.1s (TypeScript 6); with 1,000 keys from 0.75s to 0.27s. Keys, return types and errors are unchanged.
• perf(types): the selector API (enableSelector: true / 'strict') with context is no longer quadratic in the size of an object. To decide which keys a context keeps, the types scanned all keys of the object once for every key, also when TypeScript checks the selector with context widened to string. With 1,000 keys plus one context variant each, a namespace took 18.7s and failed with "Type instantiation is excessively deep and possibly infinite" (TS2589); 2,500 and more ran out of memory. The context variants of an object are now collected once, in one pass over its keys: 1,000 keys check in 0.69s, 5,000 in 3.1s. Long keys (whole sentences with keySeparator: false) work as before. Selected values and errors are unchanged.

26.5.0

• feat(types): parseInterpolation: 'icu' and parseInterpolation: 'mf2' type t() options from the message's ICU MessageFormat arguments (i18next-icu) or MessageFormat 2 variables (i18next-mf2), so ICU and MF2 users no longer need parseInterpolation: false and lose argument checking. Missing, misspelled and wrongly typed arguments fail, and so does leaving out the options for a message with arguments (t('greeting')); that error names the missing arguments. Opt-in, default true is unchanged.
  • ICU: {name} takes string | number, {n, number}, plural and selectordinal take number, {d, date} and {t, time} take Date, select takes its case keys or any string (for other), and arguments nested in cases are required too. # and tags are not arguments, apostrophe quoting is read like intl-messageformat does.
  • MF2: {$name} takes string | number, a variable annotated with :number, :integer, :currency, :percent or :unit (inline or through .input / .local) takes number, :datetime, :date and :time take Date, :string takes string, option and markup variables (minimumFractionDigits=$digits, {#link href=$url}) are required too, .local variables are not arguments, and |quoted literals| and \{ escapes are skipped.
  • interpolationFormatTypeMap overrides a type by ICU format or MF2 function name, e.g. date: Date | number or a custom uppercase: string.
  • Applies to t(), getFixedT(), i18n.t, key prefixes, namespaces, the selector API and react-i18next's Trans values. Messages need literal types, as the resources file from i18next-cli's types command has them.
  • Type-check cost with 1,000 messages and one call each: 1.35s instead of 0.86s with false (TypeScript 6), 0.5s instead of 0.26s with TypeScript 7. Messages that no call uses cost nothing.
• fix(types): with the default (non-strict) key checks, an options object with a missing or misspelled interpolation variable now reports the missing variable (Property 'name' is missing) instead of '{ nmae: string }' is not assignable to type 'string' from the default-value overload.

26.4.7

• perf: cloneInstance() no longer inherits preload. loadResources() adds every preload language to each load, and clones copied preload from the parent, so a clone's init() and every changeLanguage() walked all preloaded languages × all namespaces through queueLoad() / hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone + changeLanguage() per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: its changeLanguage() no longer waits for parent preload languages that are still loading (the parent's own init() still does), and clone.loadNamespaces() loads the new namespace for the clone's language and fallbacks instead of every preloaded language. clone.loadLanguages() works as before, the parent instance is unchanged, and passing preload to cloneInstance() keeps the old behavior. Thanks @​theMostCuriousHomunculus for the detailed report (#2451).

26.4.6

• fix: a fallback language whose formatted code is already in the hierarchy is no longer added a second time. toResolveHierarchy() checked the raw fallbackLng value against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through: lng: 'de-CH' with fallbackLng: 'de-ch' gave languages ['de-CH', 'de', 'de-CH'], and the same happened with fallbackLng: 'EN' + cleanCode, lowerCaseLng, and Intl aliases (iw-IL → he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @​lprnmns (#2450).

26.4.5

• fix: hasLoadedNamespace(ns, { lng }) no longer stays false forever when the passed in lng is loaded under another code, or not at all. It checked the load state of the raw lng, but loadLanguages() stores a language under its resolved code (de-ch → de-CH, de-CH → de with load: 'languageOnly') and skips a lng outside supportedLngs entirely (only the fallback gets loaded), so that state never got set. react-i18next's useTranslation(ns, { lng }) then never became ready: with useSuspense it kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for a lng outside supportedLngs only waits for the fallback, which is also what t() resolves to. Calls without lng and the precheck (react-i18next's bindI18n: 'languageChanging') are unchanged (react-i18next#1934).

26.4.4

... (truncated)

• 82894c1 26.5.6
• 343080d build
• 8e2eebb changelog for 26.5.6
• 822a37b fix: copy nested resources when cloning with forkResourceStore (#2456)
• 744c5cb 26.5.5
• de5960e build
• fbe16f3 changelog for 26.5.5
• 67b4ae1 fix: keep placeholders inside unescaped values literal (#2455)
• aadd75b 26.5.4
• a43c432 build
• Additional commits viewable in compare view

Sourced from i18next-http-backend's changelog.

4.0.4

Security release. See advisory GHSA-3cmx-xjww-583x.

• security: also reject &, = and ; in lng and ns values. With a query-shaped loadPath / addPath template such as /locales/resources.json?lng={{lng}}&ns={{ns}} (the multiload shape the README documents), a value like de&ns=private&admin=true added or overrode query parameters on the request (HTTP parameter pollution). The 3.0.5 fix only rejected ?, which covers the path position. The default /locales/{{lng}}/{{ns}}.json and other path-only templates were not affected. No language code or usable namespace name contains these characters, and +-joined multiload values such as de+en keep working.

4.0.3

Security release. See advisory GHSA-9jhj-wvmw-cfx5.

• security: refuse a request URL that starts with // (or \) when the loadPath / addPath template does not. With a template that puts {{ns}} directly after a leading / (e.g. /{{ns}}/{{lng}}.json), an ns value of /evil.example passed the per-value checks, because a single / is allowed for nested namespaces, but it joined the template's own / into //evil.example/en.json, a protocol-relative URL that browsers send to another origin. The 4.0.2 // check looked at the value only, so it missed this. The interpolated URL is now checked as a whole. The default /locales/{{lng}}/{{ns}}.json, templates with an origin, and protocol-relative CDN templates such as //cdn.example/{{lng}}/{{ns}}.json are not affected and keep working.

• c201e7f 4.0.4
• b0eef9e security: reject &, = and ; in lng/ns to close query-parameter injectio...
• 8eb6646 Bump i18next-http-backend from 3.0.5 to 4.0.2 in /example/fallback (#199)
• 5d3fd6c Bump i18next-http-backend from 3.0.5 to 4.0.2 in /example/node (#198)
• e48caf2 Bump next from 16.3.6 to 16.3.8 in /example/next (#197)
• 772900c Bump i18next-http-backend from 3.0.5 to 4.0.2 in /example/i18next-vue (#196)
• 42e8639 4.0.3
• 042c3d4 security: reject interpolated URLs that turn into //host (GHSA-9jhj-wvmw-cfx5)
• 9b5f1e2 Bump i18next-http-backend from 1.2.6 to 4.0.2 in /example/angular (#194)
• be8b9a4 Bump next from 16.3.3 to 16.3.6 in /example/next (#193)
• Additional commits viewable in compare view

Sourced from jspdf-autotable's releases.

v5.0.9

What's Changed

• Feature/text option pass by @​TimT1919 in simonbengtsson/jsPDF-AutoTable#1114

New Contributors

• @​TimT1919 made their first contribution in simonbengtsson/jsPDF-AutoTable#1114

Full Changelog: https://github.com/simonbengtsson/jsPDF-AutoTable/compare/v5.0.8...v5.0.9

• af6dd38 5.0.9
• bad76df test: add test case that textOptions is passed to jspdf.text
• 443bb0e feat: pass textOptions to autoTableText in printRow
• d66b06b feat: pass textOptions to jspdf.text in autoTableText
• 898e275 feat: add textOptions to Styles
• See full diff in compare view

Sourced from lucide's releases.

Version 1.61.0

What's Changed

• feat(icons): added circle-chevrons-down, circle-chevrons-left, circle-chevrons-right and 1 more icons by @​ypotti in lucide-icons/lucide#5025

New Contributors

• @​ypotti made their first contribution in lucide-icons/lucide#5025

Full Changelog: https://github.com/lucide-icons/lucide/compare/1.60.0...1.61.0

Version 1.60.0

What's Changed

• feat(icons): added tombstone icon by @​ryck in lucide-icons/lucide#4929
• feat(icons): added smartphone-user-round icon by @​hitanshu-machhi in lucide-icons/lucide#4586
• feat(icons): added bacon icon by @​devkamani9313-lab in lucide-icons/lucide#4694
• fix(site): Fix build by @​ericfennis in lucide-icons/lucide#5033
• chore(docs): Update icon count comparison with Feather Icons by @​noahweidig in lucide-icons/lucide#5022
• feat(icons): added letter-spacing icon by @​madebyoz in lucide-icons/lucide#3038
• chore(deps): bump the vue-deps group with 2 updates by @​dependabot[bot] in lucide-icons/lucide#5027
• chore(deps-dev): bump react-native from 0.87.1 to 0.88.0 in the react-native-deps group by @​dependabot[bot] in lucide-icons/lucide#5030
• feat(icons): added line-height icon by @​madebyoz in lucide-icons/lucide#3039
• chore(deps-dev): bump the svelte-deps group across 1 directory with 2 updates by Description has been truncated