chore(deps): bump the minor-patch group in /frontend with 3 updates

[dependabot]

Bumps the minor-patch group in /frontend with 3 updates: i18next, lucide-react and react-i18next.

Updates i18next from 26.3.4 to 26.3.6

Release notes

Sourced from i18next's releases.

v26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

Changelog

Sourced from i18next's changelog.

26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

Commits

• e1c60d4 26.3.6
• 04da43e fix: allow typescript 7 in optional peerDependencies range (react-i18next#1927)
• 8eed4ac build
• 573ae73 26.3.5
• cc54b05 docs(changelog): 26.3.5 — multiline $t() options, replace mutation, escaped-l...
• 3180d67 fix: skip interpolation of placeholders inside escaped values (#2442)
• d16f5a2 fix: stop mutating the passed replace object when returning details (#2441)
• bed56c1 fix: parse $t() nesting options block that spans multiple lines (#2440)
• c19e458 docs(changelog): link GHSA advisory for deepExtend fix
• 7bb87d0 docs(changelog): reference security advisory for deepExtend fix
• Additional commits viewable in compare view

Updates lucide-react from 1.23.0 to 1.24.0

Release notes

Sourced from lucide-react's releases.

Version 1.24.0

What's Changed

• fix(scripts): fix typo in renameIcon.function.mts by @​karsa-mistmere in lucide-icons/lucide#4514
• chore(icons): remove toBeRemovedInVersion metadata and make it optional in schema by @​ericfennis with @​Copilot in lucide-icons/lucide#4513
• feat(site): Add merch link by @​ericfennis in lucide-icons/lucide#4524
• fix(packages/angular): move child rendering logic to template from effect by @​karsa-mistmere in lucide-icons/lucide#4519
• docs(site): list @​gyeonghokim/lucide-lit as third-party package by @​GyeongHoKim in lucide-icons/lucide#4421
• fix(icons): changed option icon by @​jamiemlaw in lucide-icons/lucide#4326
• fix(lucide-react-native): restore the icons entry point in the JS bundles by @​pvinis in lucide-icons/lucide#4528
• fix(vue): support kebab-case icon-node prop on Icon component by @​Sagargupta16 in lucide-icons/lucide#4512
• fix(lucide-react-native): Add icon exports property to the package.json file by @​ericfennis in lucide-icons/lucide#4522
• fix(icons): centered the dot icon by @​cnlancehu in lucide-icons/lucide#4492
• feat(icons): added circle-euro-sign icon by @​Guido3000 in lucide-icons/lucide#4353
• feat(icons): added server-plus icon by @​Turboman3000 in lucide-icons/lucide#4232

New Contributors

• @​ericfennis with @​Copilot made their first contribution in lucide-icons/lucide#4513
• @​GyeongHoKim made their first contribution in lucide-icons/lucide#4421
• @​pvinis made their first contribution in lucide-icons/lucide#4528
• @​Sagargupta16 made their first contribution in lucide-icons/lucide#4512
• @​Guido3000 made their first contribution in lucide-icons/lucide#4353
• @​Turboman3000 made their first contribution in lucide-icons/lucide#4232

Full Changelog: lucide-icons/lucide@1.23.0...1.24.0

Commits

• See full diff in compare view

Updates react-i18next from 17.0.8 to 17.0.9

Changelog

Sourced from react-i18next's changelog.

17.0.9

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. Fixes #1927, thanks @​andikapradanaarif.
• fix(types): <Trans t={t} ns="ns" …> with a t from useTranslation(['ns']) now typechecks under TypeScript 7. TS7 intersects the Ns inference candidates coming from the t prop (readonly ['ns']) and the ns prop ('ns') into an unsatisfiable 'ns' & readonly ['ns'], where TS6 resolved them. The ns prop on TransProps, TransSelectorProps and IcuTransWithoutContextProps now also accepts a single namespace out of an array-typed Ns (Ns | (Ns extends readonly (infer S extends string)[] ? S : never)) — which matches runtime behavior and is unchanged under TS5/TS6.

Commits

• 8b4a9ea 17.0.9
• 422bab1 fix: support typescript 7 — widen peer range and fix Trans ns inference under...
• 6e18aa9 README: mention npx i18next-cli localize as the zero-to-localized path
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions