chore(deps): bump the prod-dependencies group with 3 updates

[dependabot]

Bumps the prod-dependencies group with 3 updates: fastify, i18next and react-i18next.

Updates fastify from 5.12.1 to 5.12.3

Release notes

Sourced from fastify's releases.

v5.12.2

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in fastify/fastify#6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

Commits

• See full diff in compare view

Updates i18next from 26.4.0 to 26.4.2

Release notes

Sourced from i18next's releases.

v26.4.2

• fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

v26.4.1

• fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).

Changelog

Sourced from i18next's changelog.

26.4.2

• fix: $&, $`, $' and $$ inside a nested value ($t(key)) now stay literal. nest() handed the resolved value straight to String.replace as the replacement argument, so those sequences were read as replacement patterns: $& re-inserted the $t(...) match, $` / $' inserted the text before / after it, and $$ collapsed to $. Through t() the $& case was worse than a wrong string: the nested lookup resets the shared nesting regexp, so the re-inserted $t(...) was matched again on every pass and t() never returned — also under the default escapeValue: true when the value arrives via a variable forwarded through nesting options ($t(key, { "name": "{{name}}" }) with a name containing $&). The value is now $-escaped at the String.replace call, the same guard interpolate() already has, and a non-string value returned by a formatter in the nesting chain ($t(key, myFormat)) is stringified before that. Nested values are still not HTML-escaped (#854). Thanks @​mahirhir (#2447).

26.4.1

• fix(types): the selector-form keyPrefix overload of getFixedT() is now available under enableSelector: 'strict'. Its constraint was gated on true | 'optimize' only, so under 'strict' it collapsed to never, the overload dropped out, and the returned t silently lost its keyPrefix scope (t(($) => $.deep) failed with Property 'deep' does not exist on type '{}'). The same call already typechecked under true and 'optimize'. Thanks @​hovelopin (#2446).

Commits

• 4dba50f 26.4.2
• e436b62 build
• d955fb0 fix: stringify formatter results in nested values, changelog v26.4.2
• dfafa3c fix: keep replacement patterns literal in nested values (#2447)
• 3c9981e chore: keep dev-only and local files out of the npm package
• c057ee0 26.4.1
• 02e3e16 changelog v26.4.1
• 6f198f2 fix(types): allow selector keyPrefix in getFixedT under enableSelector 'stric...
• See full diff in compare view

Updates react-i18next from 17.0.12 to 17.0.13

Changelog

Sourced from react-i18next's changelog.

17.0.13

• fix(types): the selector-form keyPrefix overload of useTranslation() is now available under enableSelector: 'strict'. useTranslation was gated on true | 'optimize' only, so under 'strict' it resolved to the legacy signature and the selector overload disappeared entirely (keyPrefix: ($) => $.ns.foo failed with Type '($: any) => any' is not assignable to type 'undefined'). Trans already handled all three modes. Companion to the same fix for getFixedT in i18next#2446. Thanks @​hovelopin (#1930).

Commits

• addf646 17.0.13
• 7c634ee changelog v17.0.13
• 5ceefb0 fix(types): allow selector keyPrefix in useTranslation under enableSelector '...
• aa7ba52 chore(examples): require activesupport >= 7.2.3.1 in the RN Gemfiles
• ec0bb4e chore(examples): drop react_native_windows and the RN Gemfile.locks
• aa5fc43 build
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[steilerDev]

Security review

CLEAR — Tier 2 review (runtime dependencies with linked advisories), performed by security-engineer.

Alert closure. The four linked open alerts (#113/#114 GHSA-w2qp-rph6-63g4, #108/#109 GHSA-3m5p-2c4r-xxw2) both list first_patched_version: 5.12.1, which beta already carries — they show as open only because Dependabot scores against main, still on fastify@5.11.0. This PR does not close them; a prior beta PR already did. GHSA-3m5p-2c4r-xxw2 is additionally moot here: TRUST_PROXY is parsed boolean-only (server/src/plugins/config.ts:146-151, app.ts:75), never the vulnerable numeric hop-count form.

Not in the alert feed but genuinely fixed by this bump — fastify 5.12.2 was a security release for four HIGH-severity advisories not yet synced to the public Advisory API. Each was checked against this codebase and none is currently exploitable: GHSA-9q9j-q6p8-xq58 (no headers: schema uses a dependencies keyword), GHSA-hwr6-493r-vm6h (no schema set to boolean false), GHSA-p68q-wchp-6fh7 (single non-prefixed setNotFoundHandler on the root instance), GHSA-667r-xxjv-c9mm (no $async schema usage). Upgrading closes the class defensively.

Lockfile. No new or changed transitives beyond the three named packages; find-my-way and all @fastify/* versions unchanged. fast-uri already resolves to patched 3.1.7 / 4.1.3.

Changelog review

• Breaking: none.
• Bugfix-relevant: fastify 5.12.2's four advisory fixes (above); i18next 26.4.2's nest() $-escape fix.
• Adoption opportunities: none.
• Neutral: i18next 26.4.1 getFixedT() selector typing (we don't use enableSelector: 'strict'); react-i18next 17.0.13 is a types-only release — the tarball diff versus 17.0.12 shows zero runtime .js changes.

CI note — the test failures were not caused by this bump

This PR was red on Jest shards 5/6 with 60s timeouts. Investigation showed the bump is not responsible:

• PR #2072 — which contains no i18next/react-i18next/fastify change at all — fails the identical tests.
• The regression entered beta in 038a9431 (PR #2070: @testing-library/user-event 14.6.1→14.6.7, jest 30.4.2→30.5.1), which masked it by raising testTimeout to 60000.
• SearchPicker.test.tsx already took 1466s while passing on #2070; it is inherently a 24-40 minute file, so runner variance alone decides which tests cross the ceiling. The failing set differed on every run (10 → 2 → 3, different tests each time).

Three commits on this branch harden the affected suites onto fake timers (81666cd3, 072f4f88, a9f8acad), taking shard 6 from 4 failures to green and shard 5 from 10 failures to 3. No assertion was weakened and testTimeout was not raised. The residual repo-wide exposure — 587 bare userEvent.setup() calls across client tests — is tracked in #2078.

Approved by the /dependabot skill.

[github-actions]

🎉 This PR is included in version 2.15.0-beta.7 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version 2.15.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀