chore: bump the npm-patch-minor group with 5 updates

[dependabot]

Bumps the npm-patch-minor group with 5 updates:

Package	From	To
i18next	26.3.6	26.4.2
@putdotio/sdk	11.4.2	11.5.0
@types/node	26.1.2	26.6.3
esbuild	0.28.1	0.28.2
knip	6.31.0	6.38.0

Updates i18next from 26.3.6 to 26.4.2

Release notes

Sourced from i18next's releases.

v26.4.2

• fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

v26.4.1

• fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).

v26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

Changelog

Sourced from i18next's changelog.

26.4.2

• fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

26.4.1

• fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).

26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

Commits

• 4dba50f 26.4.2
• e436b62 build
• d955fb0 fix: stringify formatter results in nested values, changelog v26.4.2
• dfafa3c fix: keep replacement patterns literal in nested values (#2447)
• 3c9981e chore: keep dev-only and local files out of the npm package
• c057ee0 26.4.1
• 02e3e16 changelog v26.4.1
• 6f198f2 fix(types): allow selector keyPrefix in getFixedT under enableSelector 'stric...
• 652847e 26.4.0
• 6c6025f prettier fix
• Additional commits viewable in compare view

Updates @putdotio/sdk from 11.4.2 to 11.5.0

Release notes

Sourced from @​putdotio/sdk's releases.

v11.5.0

11.5.0 (2026-09-07)

Features

• account: add the cross-client privacy control settings (#185) (fba5ef6)

v11.4.4

11.4.4 (2026-09-05)

Bug Fixes

• files: accept null stream codec names (f407187)

v11.4.3

11.4.3 (2026-09-05)

Bug Fixes

• files: accept the unknown codec level sentinel (aef9b45)

Commits

• 04273b9 chore(sdk): release 11.5.0 [skip ci]
• fba5ef6 feat(account): add the cross-client privacy control settings (#185)
• 616c898 chore(sdk): release 11.4.4 [skip ci]
• f407187 fix(files): accept null stream codec names
• cf0c8ff chore(sdk): release 11.4.3 [skip ci]
• aef9b45 fix(files): accept the unknown codec level sentinel
• ff68135 docs: route Effect guide, drop putio-js migration phrasing, add done criteria
• See full diff in compare view

Updates @types/node from 26.1.2 to 26.6.3

Commits

• See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates knip from 6.31.0 to 6.38.0

Release notes

Sourced from knip's releases.

Release 6.38.0

• Include co-authors in docs contributor list (0c334100df59d89a512ad598ec50e7f62f6da0c3)
• Filter bots and agents from docs contributors (617f70d8179c6b8668ca41fe5df77ced5e2b37c0)
• Update Eve plugin conventions (#2049) (260dbb91a85f3a3bc2727e8f255d73df3737552c) - thanks @​matchai!
• Add args example to that doc page (50b271b98fc930a05a3b045a2f691486f9f06528)
• Add Turborepo plugin (#2055) (e49d3db05f1d69ce7db3efcb8467a4af63c27379) - thanks @​changbaebang!
• Support import-x/* settings in ESLint plugin (#2050) (1a34cf82a3d6a1202717ef910bedba55838e9dd9) - thanks @​bytedoe!
• Resolve file option in Mocha configuration files (#2051) (9b5c5f60468c8a92a3e74adca5c0931f008677af) - thanks @​giaBaoJS!
• Support oxlint extends (#2054) (a149a98219bb14b15f446fc5f8c4f815e28b2183) - thanks @​matthewnitschke-wk!
• Fix import.meta handling in built-in compilers (#2059) (8b0c85076bf3dce15ef5f3c0c4e58bfefdf59ded) - thanks @​vdavid!
• Fix tag hints for enum and namespace members (#2061) (8a8805e48945863248429d18b7f6c4e4b7dc9ebd) - thanks @​devYRPauli!
• Flag unused member tags in tagged enums and namespaces (584e53ff3e0846fbfe04fa5b5bfefe2420576a34)
• feat: resolve MDX content mapper remarkPlugins (#2060) (34dbccf25359f9e9fefe9d0be6ef2ec0252223cc) - thanks @​gioboa!
• Refactor and separate concerns w/ new typescript-content-mapper plugin (11e94509bd0f350d747facf4003fc5b248d1b02d)
• Resolve mdx content mapper providerImportSource (7b5825117f97f2f87b7141509a254f88d0957cf7)
• Fix config → entry in plop plugin (25a380c9e1165b76583d69b48b5fa7cdf5db0ae2)

Release 6.37.0

• fix(graphql-codegen): mark near-operation-file outputs as entries, not the documents directory (#2048) (06a68fcf99a90e559daeb0b8fb2d24e173124774) - thanks @​RobHannay!
• fix: enable JSX in the config loader (#1959) (5b21dc9192f773613d1c5db8edf35f0a68820268) - thanks @​addielaruee!
• Match binaries only to their actual dependency providers (c5bdb69ccbcb7e1056233f346d0ada3495d1013d)
• Preserve executable references across package manager commands (54af171638db22f5d903faae05c37c2ea6adc869)
• Correct binary provider metadata in Relay fixtures (e67dfcb96d055c27be9c8601e077656855bb632b)
• Separate shell binary expectations from reporting exemptions (resolve #2022) (c1d7d75a3529d9faff7f4c0df11dd0ca1bdfb149)
• Respect npx no-install flags before the executable (4237010c9a834eb8b04f4a528c76d10a5c38ee98)
• Update dependencies (038ea179f7d6bf7ca43bc5daf553a68b13a9067c)
• Remove npm auth check now that's in release-it (4aaf77c58004ac64063a1982b98e53107c2ebe93)
• Fix --format name resolution in the ESLint plugin (#2046) (1269e98bb700384811fadc124d69ea720832037e) - thanks @​bytedoe!

Release 6.36.0

• Add @​tailwindcss/webpack as Tailwind plugin enabler (#2027) (b5ac0cf734dda3c6c6c51c817981dfc558b7c582) - thanks @​igas!
• Fix Next.js Turbopack loader dependencies (23419b4edfd48796dd484fa880e1bad49a043d2e)
• Explain ambiguous star exports in traces (#2025) (3c2c1a53f9c2b7ff3057a4e46761791979e0b09c) - thanks @​gioboa!
• Fix eslintrc parserOptions.parser handling in ESLint plugin (#2028) (c79463cec81d09518eda325ec00e6f12327dea8d) - thanks @​bytedoe!
• fix(compilers): require word boundary around import keyword (#2029) (68bbe51c39b564022b63942bc83cb570778cca00) - thanks @​thanadolps!
• fix: recover from corrupt cache file (#2034) (30ff7568c84e0a6731ca634a52314228d23d1a2b) - thanks @​gioboa!
• fix: fix trailing comma on dependency removal (#2033) (adfaf4f78878b6d55b0939a92d70a1fbb0ae1240) - thanks @​gioboa!
• Document built-in compiler scope (a05e155276dad4ead16992580d17572cebf045e7)
• Add babel, khan and oxc to projects and optimize svgs (1c26560b98bc3109e93d15761d02f089213bfb6c)
• Add section to test preview packages & extension (d911c18385f0aa41f53653a2a15cc90a1e0251b8)
• Fix shared info/exclude handling in linked Git worktrees (#2037) (c1f18d5a7d25fc5a614747bbcbd62d043457eb48) - thanks @​kenfdev!
• Shard Node specs on Windows and enable Bun test parallelism (66e966b6edec4460b40b05847fefa9f90ee69068)
• Add Varlock plugin support (#2000) (e4fbf46acff08e78370e72b142e795bd81f28561) - thanks @​Joehoel!
• Apply NODE_OPTIONS inputs to package manager binaries (#2038) (c8df8a28e9a19484efe7097f984abc0c6556aff5) - thanks @​giaBaoJS!
• Handle array form of import/resolver setting in ESLint plugin (#2041) (a80d386a80fdafc89c610d4887ec82184ac178db) - thanks @​bytedoe!
• fix(node): add valueless Node CLI flags to boolean options (#2042) (4c6768501f7115a894d7ece9e5c32090b684cc6f) - thanks @​shoutoutuoadi325!
• fix(typedoc): accept string form of plugin and theme options (#2043) (ce387b05c8f136546e860ec73e29557563c63afa) - thanks @​giaBaoJS!
• Add textlint plugin (#2039) (532dab595fc9a910e320418dc0390222fb2d7478) - thanks @​anandghegde!
• fix: Correctly resolve Vitest setupFiles from nested configs (#2040) (84a494334e125d229dc865893b21d69d0d201e85) - thanks @​CruseCtrl!
• Add n8n to projects (3f756a7e70c4164d57a7dbbd58f3604afe4043e2)

... (truncated)

Commits

• c0e42f8 Release knip@6.38.0
• 25a380c Fix config → entry in plop plugin
• 7b58251 Resolve mdx content mapper providerImportSource
• 11e9450 Refactor and separate concerns w/ new typescript-content-mapper plugin
• 34dbccf feat: resolve MDX content mapper remarkPlugins (#2060)
• 584e53f Flag unused member tags in tagged enums and namespaces
• 8a8805e Fix tag hints for enum and namespace members (#2061)
• 8b0c850 Fix import.meta handling in built-in compilers (#2059)
• a149a98 Support oxlint extends (#2054)
• 9b5c5f6 Resolve file option in Mocha configuration files (#2051)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions