chore(deps): update dependency vue-i18n to v11 by renovate[bot] · Pull Request #2166 · empathyco/x

renovate · 2026-08-31T03:43:24Z

This PR contains the following updates:

Package	Change	Age	Confidence
vue-i18n (source)	`^9.14.5` → `^11.4.18`
vue-i18n (source)	`~9.14.5` → `~11.4.18`

Release Notes

intlify/vue-i18n (vue-i18n)

`v11.4.18`

Compare Source

escapeParameter: The sanitizer now also turns <script> in translations into text. A <script> does not run with v-html in the browser, but it runs when the translation is rendered on the server (SSR). (#2757) See GHSA-jrxq-gc2q-9357.

What's Changed

🔒 Security Fixes

fix(shared): neutralize script elements in sanitizeTranslatedHtml by @kazupon in #2757

Full Changelog: intlify/vue-i18n@v11.4.17...v11.4.18

`v11.4.17`

Compare Source

install is synchronous: app.use(i18n) now throws the errors in install. They were unhandled rejections, which left the app half-installed (and ended Node.js processes without a handler for them), so if app.use(i18n) throws after you update, the install was failing before, too. i18n.install() returns undefined instead of a Promise that never settled in development without the devtools. (#2741)

Legacy API: A regular expression in silentTranslationWarn or silentFallbackWarn now suppresses the warnings for the keys that match it. As an option of createI18n, it suppressed all the warnings, and set to the property, it suppressed the warnings for the keys that did not match it. (#2744)

escapeParameter: The sanitizer now also disables javascript: URLs in xlink:href, and turns <base>, <animate> and <set> in translations into text. SVG animations with <animate> or <set> in HTML messages no longer run while escapeParameter (escapeParameterHtml in the Legacy API) is enabled. (#2756) See GHSA-473g-cvf6-mfxj.

What's Changed

🐛 Bug Fixes

fix: make install synchronous like other Vue plugins, so that app.use() throws its errors by @kazupon in #2741
fix: make a regular expression in silentTranslationWarn and silentFallbackWarn suppress the warnings for the keys that match it by @kazupon in #2744

🔒 Security Fixes

fix(shared): neutralize xlink:href, base and SVG animations in sanitizeTranslatedHtml by @kazupon in #2756

📝️ Documentations

docs: describe what missingWarn and fallbackWarn turn off, and how to warn only when no locale has the key by @kazupon in #2745

Full Changelog: intlify/vue-i18n@v11.4.16...v11.4.17

`v11.4.16`

Compare Source

What's Changed

🐛 Bug Fixes

fix: read VUE_PROD_DEVTOOLS only when it is defined in the bundler builds, so that Node.js can run them in production by @kazupon in #2735

Full Changelog: intlify/vue-i18n@v11.4.15...v11.4.16

`v11.4.15`

Compare Source

What's Changed

🐛 Bug Fixes

fix: read only own properties in locale, key and plural rule lookups by @kazupon in #2687
fix: return a message that cannot be compiled as is, in development and production by @kazupon in #2698
fix: copy the i18n option of components instead of writing internal values into it by @kazupon in #2700
fix: name datetime and number formats in the warning when a format is not found by @kazupon in #2703
fix: make te() and tm() look up messages in the same way as t() by @kazupon in #2705
fix: read only own properties in the key-value message resolver by @kazupon in #2707
fix: do not read Object.prototype properties as named values, and ignore unknown linked modifiers by @kazupon in #2711
fix: do not write count and n into the named values of a plural call by @kazupon in #2713
fix: do not drop a flat key under a message AST with flatJson by @kazupon in #2719
fix: keep a flat key that ends with cacheKey under a message AST by @kazupon in #2721
fix: let Node.js ESM load the Node.js builds, so that SSR works in production by @kazupon in #2729
fix: keep a flat key that goes through a prop key or cacheKey of a message AST by @kazupon in #2731

📝️ Documentations

docs: explain that locales should be BCP 47 language tags by @kazupon in #2696
docs: describe the fallback of te(), and list te and $te as not included in petite-vue-i18n by @kazupon in #2709

Full Changelog: intlify/vue-i18n@v11.4.14...v11.4.15

`v11.4.14`

Compare Source

What's Changed

🔒 Security Fixes

fix(shared): neutralize srcdoc attribute in sanitizeTranslatedHtml by @kazupon in #2679
fix(core-base): escape both list and named values with escapeParameter by @kazupon in #2680
fix: ignore locales named after Object.prototype properties by @kazupon in #2681

👕 Refactoring

refactor(core-base): extract the resolved message format check by @kazupon in #2674
refactor(vue-i18n-core): remove dead branches in getCoreContext() by @kazupon in #2675
refactor(vue-i18n-core): share the fallbackContext handling in the composer by @kazupon in #2676
refactor(vue-i18n-core): simplify flat JSON handling in setLocaleMessage / mergeLocaleMessage by @kazupon in #2677
refactor(core-base): give the compile cache a proper type by @kazupon in #2678

Full Changelog: intlify/vue-i18n@v11.4.13...v11.4.14

`v11.4.13`

Compare Source

What's Changed

⚡ Improvement Features

fix(core-base): map locale unions without the UnionToTuple round-trip by @kazupon in #2651

Full Changelog: intlify/vue-i18n@v11.4.12...v11.4.13

`v11.4.12`

Compare Source

What's Changed

🐛 Bug Fixes

fix(core-base): cache locale chains by fallback identity by @kazupon in #2635
fix(vue-i18n-core): sync the core context when inheritLocale is enabled by @kazupon in #2636

Full Changelog: intlify/vue-i18n@v11.4.10...v11.4.12

`v11.4.10`

Compare Source

What's Changed

🐛 Bug Fixes

fix(core-base): avoid throwing on AST keys in devtools groupId by @kazupon in #2603

Full Changelog: intlify/vue-i18n@v11.4.9...v11.4.10

`v11.4.9`

Compare Source

What's Changed

🐛 Bug Fixes

fix(core-base): invalidate locale chain cache when fallback changes by @kazupon in #2577
fix(core-base): fallbackWithSimple uses map keys and skips default by @kazupon in #2580

⚡ Improvement Features

fix(vue-i18n-core): preserve tree-shaking with Vapor by @kazupon in #2578
fix(shared): avoid retaining array message references by @Togetic in #2571

👕 Refactoring

chore(release): generate changelog in the tagged commit by @kazupon in #2590

Full Changelog: intlify/vue-i18n@v11.4.8...v11.4.9

`v11.4.8`

Compare Source

What's Changed

👕 Refactoring

refactor: extract security sanitizer module by @kazupon in #2555
refactor: unify intl formatting pipeline by @kazupon in #2556

Full Changelog: intlify/vue-i18n@v11.4.7...v11.4.8

What's Changed

⚡ Improvement Features

fix(core-base): respect part option when format key is omitted in number/datetime by @kazupon in #2522

Full Changelog: intlify/vue-i18n@v11.4.4...v11.4.5

`v11.4.4`

Compare Source

What's Changed

⚡ Improvement Features

fix(security): harden javascript URL sanitization by @kazupon in #2503

Full Changelog: intlify/vue-i18n@v11.4.3...v11.4.4

`v11.4.3`

Compare Source

What's Changed

💥 Breaking Changes

chore!: drop Node.js 20 support by @kazupon in #2478

🔒 Security Fixes

security(ci): harden workflows and add zizmor audit by @kazupon in #2490

Full Changelog: intlify/vue-i18n@v11.4.2...v11.4.3

`v11.4.2`

Compare Source

What's Changed

⚡ Improvement Features

fix(formatter): pass component children as slots by @kazupon in #2474

Full Changelog: intlify/vue-i18n@v11.4.1...v11.4.2

`v11.4.1`

Compare Source

What's Changed

⚡ Improvement Features

fix(i18n-t): pass component children as slots by @kazupon in #2473

Full Changelog: intlify/vue-i18n@v11.4.0...v11.4.1

`v11.4.0`

Compare Source

What's Changed

🌟 Features

feat: support isolated scope by @kazupon in #2468

Full Changelog: intlify/vue-i18n@v11.3.2...v11.4.0

`v11.3.2`

Compare Source

What's Changed

🐛 Bug Fixes

fix(core): avoid register* functions tree-shaking for intlify/core by @kazupon in #2464

⚡ Improvement Features

perf(core-base): avoid translation timeline measurement without devtools by @kazupon in #2465

Full Changelog: intlify/vue-i18n@v11.3.1...v11.3.2

`v11.3.1`

Compare Source

What's Changed

🐛 Bug Fixes

fix: linked messages fail to resolve keys containing dots by @kazupon in #2460
fix: $n overloads use DefineNumberFormat instead of DefineDateTimeFormat by @kazupon in #2461

Full Changelog: intlify/vue-i18n@v11.3.0...v11.3.1

`v11.3.0`

Compare Source

What's Changed

🌟 Features

feat: support escape sequence by @kazupon in #2437

🐛 Bug Fixes

fix: wrong @intlify/devtools-types dependencies by @kazupon in #2411
fix: v-t directive does not rerender when locale switches by @kazupon in #2415
fix: te returns false if the key contains a do by @kazupon in #2430
fix: modifiers skip missing translation keys by @kazupon in #2432
fix: wrong $d type by @kazupon in #2435
fix: resolve correctly key path by @kazupon in #2436

⚡ Improvement Features

fix: Usage of n() and $n() with undefined should not throw errors by @kazupon in #2429
fix: display message commpiler error strictly by @kazupon in #2431
fix: Suppressing automatic locale fallback with ! breaks n/$n and d/$d formatting by @kazupon in #2434

📈 Performance Fixes

perf: use shallowRef server-side for datetimeFormats by @kazupon in #2428

📝️ Documentations

docs: fix wrong plural usage by @kazupon in #2438
docs: improve petite-vue-i18n resource key handling by @kazupon in #2439

👕 Refactoring

refactor: reduce variable assignments and function calls by @kazupon in #2426

Full Changelog: intlify/vue-i18n@v11.2.8...v11.3.0

`v11.1.12`

Compare Source

What's Changed

⚡ Improvement Features

fix: Emit INVALID_TOKEN_IN_PLACEHOLDER instead of UNTERMINATED_CLOSING_BRACE when invalid token is in placeholder and update docs by @kazupon in #2255

Full Changelog: intlify/vue-i18n@v11.1.11...v11.1.12

`v11.1.11`

Compare Source

What's Changed

⚡ Improvement Features

fix: change warning from error for mutiple useI18n local scope calling by @kazupon in #2235

Full Changelog: intlify/vue-i18n@v11.1.10...v11.1.11

`v11.1.10`

Compare Source

🔒 Security Fixes

fix: DOM-based XSS via tag attributes for escape parameter, about details see GHSA-x8qp-wqqm-57ph

Full Changelog: intlify/vue-i18n@v11.1.9...v11.1.10

🌟 Features

feat: Part options support $n by @mauryapari in #2175
feat: Part options support $d by @mauryapari in #2180

⚡ Improvement Features

fix: support vue core internal slot key changing by @kazupon in #2190

Full Changelog: intlify/vue-i18n@v11.1.3...v11.1.4

`v11.1.3`

Compare Source

What's Changed

🐛 Bug Fixes

fix: cannot resolve the ast messages which has json path for v11 by @kazupon in #2159

⚡ Improvement Features

fix: duplicate generated type config naming by @BobbieGoede in #2158

Full Changelog: intlify/vue-i18n@v11.1.2...v11.1.3

`v11.1.2`

Compare Source

What's Changed

🔒 Security Fixes

fix: prototype pollution in handleFlatJson, about details see GHSA-p2ph-7g93-hw3m

Full Changelog: intlify/vue-i18n@v11.1.1...v11.1.2

`v11.1.1`

Compare Source

Full Changelog: intlify/vue-i18n@v11.1.0...v11.1.1

`v11.1.0`

Compare Source

What's Changed

🌟 Features

feat: configurable ComponentCustomProperties['$i18n'] type by @BobbieGoede in #2094

📝️ Documentations

fix: vue-i18n v8 EOL by @kazupon in #2060

Full Changelog: intlify/vue-i18n@v11.0.1...v11.1.0

`v11.0.1`

Compare Source

This changelog is generated by GitHub Releases

What's Changed

⚡ Improvement Features

fix: v-t custom directive warning when it will run by @kazupon in #2057

Full Changelog: intlify/vue-i18n@v11.0.0...v11.0.1

`v11.0.0`

Compare Source

This changelog is generated by GitHub Releases

What's Changed

Deprecate Legacy API mode

The Legacy API mode was the API mode compatible with v8 for Vue 2. When v9 was released, the Legacy API was provided to smooth the migration from v8 to v9.

Legacy API mode will be deprecated in v11, as previous vue-i18n releases have already provided the following to support migration to Composition API mode

Migration from Legacy API mode to Composition API mode, see the docs
Composition API usage, see the docs

For compatibility, Legacy API mode still works in v11, but will be removed entirely in v12, so Legacy API mode will not work after that version.

Deprecate Custom Directive `v-t`

The advantage of v-t was that it could optimize performance using the vue compiler transform and the pre-translation of vue-i18n-extension.

This feature was supported from Vue 2.
About details see the blog article

In Vue 3, due to the Composition API, the pre-translation of vue-i18n-extension is now limited only for global scope.

In addition, Vue 3 Virtual DOM optimization has been introduced, and the optimization provided by vue-i18n-extension is no longer very effective. We need to require settings for SSR, the benefits of using v-t have disappeared. And DX of templates using v-t is not good. Custom directives do not work with key completion in editors (e.g. vscode).

For compatibility, v-t mode still works in v11, but will be removed entirely in v12, so v-t will not work after that version.

Drop `tc` and `$tc` for Legacy API mode

These APIs had already deprecated in warning about being dropped in v11. docs says

Vue I18n maintenance Status

Vue I18n v8 is no longer supported after 2025. Vue I18n v9 and Vue I18n v10 is in maintenance mode after 2025 July.

With the release of Vue I18n v11, that version will become mainstream.

The maintenance detail status of Vue I18n v9 and Vue I18n v10 is as follows:

You can check the maintenance status on the docs

❗ Breaking Changes

feat!: deprecate Legacy API mode by @kazupon in #2016
breaking: drop $tc and tc by @kazupon in #2017
feat!: deprecate v-t custom directive by @kazupon in #2045

⚡ Improvement Features

fix: tm function should accept DefineLocaleMessage key type by @BobbieGoede in #2014

🔒 Security Fixes

fix: security vulnerability fix porting by @kazupon in #2034

📝️ Documentations

Change config prop for quasar flags by @chrissyast in #2003
docs: Pluralization Page by @Sammuel09 in #1998
docs: fix composition section by @Sammuel09 in #2008
fix(docs): correct output in composition api example by @pejeio in #2012
docs: not use deprecated api by @kazupon in #2013
docs: fix wrong plural example by @kazupon in #2033
docx(pluralization.md): Correct spelling from 'gloal' to 'global' by @PuppyOne in #2038
Fix typo by @shaedrich in #2040
Fix another typo by @shaedrich in #2041
docs: add maintenance status by @kazupon in #2044

👋 New Contributors

@chrissyast made their first contribution in #2003
@Sammuel09 made their first contribution in #1998
@pejeio made their first contribution in #2012
@PuppyOne made their first contribution in #2038
@shaedrich made their first contribution in #2040

Full Changelog: intlify/vue-i18n@v10.0.4...v11.0.0

`v10.0.8`

Compare Source

What's Changed

🔒 Security Fixes

fix: DOM-based XSS via tag attributes for escape parameter by @kazupon in #2229

Full Changelog: intlify/vue-i18n@v10.0.7...v10.0.8

`v10.0.7`

Compare Source

What's Changed

🐛 Bug Fixes

fix: cannot resolve the ast messages which has json path for v10 by @kazupon in #2160

Full Changelog: intlify/vue-i18n@v10.0.6...v10.0.7

`v10.0.6`

Compare Source

What's Changed

🔒 Security Fixes

fix: prototype pollution in handleFlatJson, about details see GHSA-p2ph-7g93-hw3m

Full Changelog: intlify/vue-i18n@v10.0.5...v10.0.6

`v10.0.5`

Compare Source

What's Changed

🔒 Security Fixes

fix: XSS vulnerability with prototype pollution on AST: GHSA-9r9m-ffp6-9x4v
fix: prototype pollusion on deepCopy: GHSA-hjwq-mjwj-4x6c

Full Changelog: intlify/vue-i18n@v10.0.4...v10.0.5

`v10.0.4`

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

fix: cannot resolve empty string on plural by @kazupon in #1985

📝️ Documentations

Add petite-vue-i18n package to README by @vikingair in #1971

New Contributors

@vikingair made their first contribution in #1971

Full Changelog: intlify/vue-i18n@v10.0.3...v10.0.4

`v10.0.3`

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

fix(petite-vue-i18n): cannot register correctly message resolver and locale fallbacker by @kazupon in #1967

📝️ Documentations

docs: add unplugin-vue-i18n setting for petite-vue-i18n by @kazupon in #1968

Full Changelog: intlify/vue-i18n@v10.0.2...v10.0.3

`v10.0.2`

Compare Source

This changelog is generated by GitHub Releases

What's Changed

⚡ Improvement Features

fix: revert #1379 by @BobbieGoede in #1953
fix: messages deepCopy mutates src arguments by @BobbieGoede in #1947

📝️ Documentations

docs: add team members by @kazupon in #1951
docs: add how to use shared locale messages on composition api by @kazupon in #1964

Full Changelog: intlify/vue-i18n@v10.0.1...v10.0.2

`v10.0.1`

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

fix: petite-vue-i18n type errors by @TPORL in #1945

New Contributors

@TPORL made their first contribution in #1945

Full Changelog: intlify/vue-i18n@v10.0.0...v10.0.1

`v10.0.0`

Compare Source

We are excited to announce the release of Vue I18n v10.
We had many contributors.

Thanks for your contributing ❤️

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot requested a review from a team as a code owner August 31, 2026 03:43

renovate Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026

renovate Bot force-pushed the renovate/vue-i18n-11.x branch 2 times, most recently from 73ed1e1 to 3b93c33 Compare September 7, 2026 20:47

renovate Bot force-pushed the renovate/vue-i18n-11.x branch 2 times, most recently from 9f9389d to bc2cf14 Compare September 19, 2026 19:39

renovate Bot force-pushed the renovate/vue-i18n-11.x branch 2 times, most recently from 3abed83 to 33056cb Compare October 1, 2026 15:35

renovate Bot force-pushed the renovate/vue-i18n-11.x branch from 33056cb to 87e2326 Compare October 5, 2026 12:15

renovate Bot force-pushed the renovate/vue-i18n-11.x branch 2 times, most recently from 2c730cf to f3be16c Compare October 13, 2026 19:38

renovate Bot force-pushed the renovate/vue-i18n-11.x branch 3 times, most recently from 6099b4a to 9104cfc Compare October 21, 2026 12:22

renovate Bot force-pushed the renovate/vue-i18n-11.x branch 7 times, most recently from 7f783a7 to 8b24eec Compare November 9, 2026 15:45

renovate Bot force-pushed the renovate/vue-i18n-11.x branch from 8b24eec to 7607139 Compare November 10, 2026 09:11

chore(deps): update dependency vue-i18n to v11

c404db6

renovate Bot force-pushed the renovate/vue-i18n-11.x branch from 7607139 to c404db6 Compare November 12, 2026 16:40

Navigation Menu

Repository navigation

chore(deps): update dependency vue-i18n to v11 - #2166

chore(deps): update dependency vue-i18n to v11#2166
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/vue-i18n-11.x

renovate Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

🔒 Security Fixes

What's Changed

🐛 Bug Fixes

🔒 Security Fixes

📝️ Documentations

What's Changed

🐛 Bug Fixes

What's Changed

🐛 Bug Fixes

📝️ Documentations

What's Changed

🔒 Security Fixes

👕 Refactoring

What's Changed

⚡ Improvement Features

What's Changed

🐛 Bug Fixes

What's Changed

🐛 Bug Fixes

What's Changed

🐛 Bug Fixes

⚡ Improvement Features

👕 Refactoring

What's Changed

👕 Refactoring

What's Changed

⚡ Improvement Features

What's Changed

⚡ Improvement Features

What's Changed

💥 Breaking Changes

🔒 Security Fixes

What's Changed

⚡ Improvement Features

What's Changed

⚡ Improvement Features

What's Changed

🌟 Features

What's Changed

🐛 Bug Fixes

⚡ Improvement Features

What's Changed

🐛 Bug Fixes

What's Changed

🌟 Features

🐛 Bug Fixes

⚡ Improvement Features

📈 Performance Fixes

📝️ Documentations

👕 Refactoring

What's Changed

🐛 Bug Fixes

What's Changed

⚡ Improvement Features

What's Changed

⚡ Improvement Features

🔒 Security Fixes

What's Changed

⚡ Improvement Features

What's Changed

🐛 Bug Fixes

What's Changed

⚡ Improvement Features

What's Changed

🐛 Bug Fixes

What's Changed

🌟 Features

⚡ Improvement Features

What's Changed

🐛 Bug Fixes

⚡ Improvement Features

What's Changed

🔒 Security Fixes

What's Changed

🌟 Features

renovate Bot commented Aug 31, 2026 •

edited

Loading

Deprecate Custom Directive `v-t`

Drop `tc` and `$tc` for Legacy API mode