Bump i18next-http-backend from 1.4.0 to 4.0.4 - #4357

Sourced from i18next-http-backend's changelog.

4.0.4

Security release. See advisory GHSA-3cmx-xjww-583x.

• security: also reject &, = and ; in lng and ns values. With a query-shaped loadPath / addPath template such as /locales/resources.json?lng={{lng}}&ns={{ns}} (the multiload shape the README documents), a value like de&ns=private&admin=true added or overrode query parameters on the request (HTTP parameter pollution). The 3.0.5 fix only rejected ?, which covers the path position. The default /locales/{{lng}}/{{ns}}.json and other path-only templates were not affected. No language code or usable namespace name contains these characters, and +-joined multiload values such as de+en keep working.

4.0.3

Security release. See advisory GHSA-9jhj-wvmw-cfx5.

• security: refuse a request URL that starts with // (or \) when the loadPath / addPath template does not. With a template that puts {{ns}} directly after a leading / (e.g. /{{ns}}/{{lng}}.json), an ns value of /evil.example passed the per-value checks, because a single / is allowed for nested namespaces, but it joined the template's own / into //evil.example/en.json, a protocol-relative URL that browsers send to another origin. The 4.0.2 // check looked at the value only, so it missed this. The interpolated URL is now checked as a whole. The default /locales/{{lng}}/{{ns}}.json, templates with an origin, and protocol-relative CDN templates such as //cdn.example/{{lng}}/{{ns}}.json are not affected and keep working.

4.0.2

Security release. See advisory GHSA-xvq9-wjp8-hwqf.

• security: also reject : in lng and ns values, and // in ns values. With a loadPath / addPath template that starts with the placeholder (e.g. {{lng}}/{{ns}}.json — no origin and no leading /), a value such as http:127.0.0.1:8080 was interpolated into an absolute URL and the request left the intended origin (SSRF / URL injection). The default /locales/{{lng}}/{{ns}}.json and every template with a leading path or origin were not affected, because a colon inside a path segment has no structural meaning there. No BCP-47 language code contains :, and : is i18next's default nsSeparator, so no usable namespace name does either — the tightened check has no legitimate collateral.

4.0.1

• fix: allow @ in ns values so scoped-package-style namespace names such as @organization/package-name fetch correctly again (#191). 3.0.6 relaxed the ns check for / but left @ in the shared denylist. In the URL path position @ is a plain RFC 3986 pchar with no structural meaning; it stays blocked for lng, where it marks the userinfo/authority boundary. Every other pattern from the 3.0.5 advisory (.., \, %, ?, #, whitespace, control chars, prototype keys, oversized inputs) remains blocked for both keys.

4.0.0

• BREAKING: drop cross-fetch dependency. i18next-http-backend now requires a host-provided fetch. This is available in Node ≥ 18 (stable since Node 21), all modern browsers, Deno, and Bun. For runtimes without native fetch, install a ponyfill yourself and inject it via options.alternateFetch, or stay on v3.x.
• BREAKING: minimum Node version is now 18 (engines.node = ">=18").
• chore: simplified environment detection in lib/request.js — uses globalThis (with global / window fallbacks for legacy embedded runtimes) instead of separate global.* / window.* branches per API. XHR / ActiveXObject are still picked up if the host provides them, but no longer polyfilled.
• chore: declared "sideEffects": false for better tree-shaking by downstream bundlers.
• build: replaced babel + browserify + uglify-js with tsdown (rolldown + oxc). One config produces ESM, CJS, and the IIFE browser bundles. Drops @babel/cli, @babel/core, @babel/preset-env, babel-plugin-add-module-exports, browserify, uglify-js, the fixcjs rewrite hack, and the --ignore cross-fetch browserify flag. Side benefit: minified browser bundle shrinks from ~13 KB to ~6.8 KB (oxc minifier + no babel runtime helpers).
• build: ESM and CJS outputs are now bundled into a single index.js per format (previously one file per lib/*.js module). The package's exports map is unchanged, so this is invisible to consumers using documented entry points.
• lint: replaced eslint-config-standard (+ five plugins) with neostandard and migrated to ESLint 9 flat config (eslint.config.mjs). Removed deprecated tslint and dtslint — test:typescript now runs tsc --noEmit plus tsd.
• chore: tightened .npmignore — published tarball no longer includes the source lib/, the build configs (tsdown.config.ts, eslint.config.mjs, tsconfig.json), or the root index.js re-export shim. Drops from 21.3 KB → ~17 KB packed.
• docs: alternateFetch is now documented in the README options block as the supported escape hatch for fetch ponyfills, test mocking, and request interception. v4 migration note added to "Getting started".

3.0.6

• fix: allow forward slashes in ns values so nested namespace names (mapping to URL layouts such as /locales/en/a/b.json) fetch correctly again. 3.0.5's security fix applied the same strict URL-segment check to both lng and ns, which was correct for lng (no BCP-47 shape contains /) but over-strict for ns — nested namespaces containing / were never officially supported, but the behaviour fell out of the implicit string-substitution semantics of loadPath and is common enough in the wild to be worth accommodating. isSafeUrlSegment is now split into isSafeLangUrlSegment (strict — still rejects /) and isSafeNsUrlSegment (loose — allows / but still rejects .., \, URL-structure characters, control chars, prototype keys, and oversized inputs). isSafeUrlSegment is kept as a backwards-compatible alias for the strict check. The 3.0.5 security fix remains in force for every concrete attack pattern from the original advisory.

3.0.5

Security release — all issues found via an internal audit. See published advisory GHSA-q89c-q3h5-w34g.

• security: refuse to build request URLs when lng or ns values contain path-traversal, URL-structure (?, #, %, @, whitespace), path separators, control characters, prototype keys, or exceed 128 chars. Prevents path traversal / SSRF / URL injection via attacker-controlled language-code values. isSafeUrlSegment is permissive for legitimate i18next language codes (any BCP-47-like shape, underscores, hyphens, dots, +-joined multi-language requests) (GHSA-q89c-q3h5-w34g)
• security: per-instance omitFetchOptions — the fetch-options-stripping fallback is now scoped to a single backend instance via options._omitFetchOptions instead of a module-level boolean. One instance hitting a "not implemented" fetch error no longer permanently strips requestOptions (including credentials, mode, cache) from every other backend instance in the same process
• security: strip CR/LF/NUL and other C0/C1 control characters from lng/ns / URL values before they appear in error-callback strings (CWE-117 log forging)
• security: redact user:password credentials from URLs before including them in error-callback strings — prevents leaking basic-auth credentials embedded in loadPath / addPath
• security: iterate own enumerable keys only (Object.keys + prototype-key guard) in addQueryString and in the customHeaders loop in XHR mode — prevents prototype-pollution amplification into the URL and request headers
• chore: ignore .env* and *.pem/*.key files in .gitignore

3.0.4

... (truncated)

• c201e7f 4.0.4
• b0eef9e security: reject &, = and ; in lng/ns to close query-parameter injectio...
• 8eb6646 Bump i18next-http-backend from 3.0.5 to 4.0.2 in /example/fallback (#199)
• 5d3fd6c Bump i18next-http-backend from 3.0.5 to 4.0.2 in /example/node (#198)
• e48caf2 Bump next from 16.3.6 to 16.3.8 in /example/next (#197)
• 772900c Bump i18next-http-backend from 3.0.5 to 4.0.2 in /example/i18next-vue (#196)
• 42e8639 4.0.3
• 042c3d4 security: reject interpolated URLs that turn into //host (GHSA-9jhj-wvmw-cfx5)
• 9b5f1e2 Bump i18next-http-backend from 1.2.6 to 4.0.2 in /example/angular (#194)
• be8b9a4 Bump next from 16.3.3 to 16.3.6 in /example/next (#193)
• Additional commits viewable in compare view