Skip to content

chore(deps): bump i18next-locize-backend from 7.0.3 to 9.0.2 in /packages/sdk-test-app#7

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/packages/sdk-test-app/i18next-locize-backend-9.0.2
Open

chore(deps): bump i18next-locize-backend from 7.0.3 to 9.0.2 in /packages/sdk-test-app#7
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/packages/sdk-test-app/i18next-locize-backend-9.0.2

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 22, 2026

Bumps i18next-locize-backend from 7.0.3 to 9.0.2.

Changelog

Sourced from i18next-locize-backend's changelog.

9.0.2

Security release — all issues found via an internal audit. See published advisory GHSA-mgcp-mfp8-3q45.

  • security: refuse to build request URLs when lng, ns, projectId, or version values contain path-traversal (..), path separators (/, \), URL-structure characters (?, #, %, @, whitespace), control characters, prototype keys (__proto__, constructor, prototype), or exceed 128 chars. Prevents path traversal / URL injection via attacker-controlled option values (same class of fix as i18next-http-backend@3.0.5) (GHSA-mgcp-mfp8-3q45)
  • security: guard interpolate against prototype-chain lookups — a polluted Object.prototype.__proto__ no longer leaks into URL substitution
  • security: replace for...in iteration over the defaults source with Object.keys() + explicit prototype-key guard
  • chore: remove unused .coveralls.yml
  • chore: ignore .env* and *.pem/*.key files in .gitignore

9.0.1

  • improve handling for inexisting projects

9.0.0

  • changed default cdnType to "standard" instead of "prod"

8.1.2

  • hint in error if using the wrong cdnType

8.1.1

  • fix noCache option

8.1.0

  • Add useCacheLayer option — in-memory Cache-Control-aware cache for runtimes without a native HTTP cache (Node.js, Deno, React Native). Parses Cache-Control: max-age, caches full responses for GET requests until expiry, defaults to enabled in non-browser environments and can be disabled per-instance. Note: process-local and unbounded.

8.0.0

  • log/error is shown if cdnType is not defined, because of changing default to 'standard' instead of 'pro'

7.2.1

  • fix noCache log output when set automatically based on debug: true

7.2.0

  • Added cdnType option: Configures which CDN endpoint to use, depending on your locize project’s CDN type. Defaults to 'pro'.
  • Added noCache option: When set to true, always loads uncached translations (useful during development). If not set, it defaults to true when the i18next debug option is enabled.

7.1.1

  • if locize project does not offer the requested language it logs an error

7.1.0

  • Verify if locize project offers requested language and warn if that's not the case.

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [i18next-locize-backend](https://github.com/locize/i18next-locize-backend) from 7.0.3 to 9.0.2.
- [Changelog](https://github.com/locize/i18next-locize-backend/blob/master/CHANGELOG.md)
- [Commits](locize/i18next-locize-backend@v7.0.3...v9.0.2)

---
updated-dependencies:
- dependency-name: i18next-locize-backend
  dependency-version: 9.0.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants