[dependabot]

Bumps i18next-http-backend from 4.0.4 to 4.0.10.

Changelog

Sourced from i18next-http-backend's changelog.

4.0.10

Security release. See advisory GHSA-qh2f-jh77-hfwf.

• security: refuse a request URL whose scheme or authority (host, port, userinfo) differs from what the loadPath / addPath template gives when the lng and ns values are plain data. With a template that puts {{ns}} in the host, e.g. https://{{ns}}.cdn.example.com/{{lng}}.json, an ns value of @evil.example/x (@ ends the userinfo, since 4.0.1) or evil.example/x (/ ends the host, since 3.0.6) sent the request, with its customHeaders, to evil.example. / and @ stay allowed in ns for nested and scoped namespaces such as @org/pkg, and they keep working in the path. The check runs for read and create, and for loadPath / addPath functions that return a template. It includes the 4.0.3 check for a leading //, which it replaces. The default /locales/{{lng}}/{{ns}}.json and other templates with the placeholders in the path were not affected. A value in the host may now only contain letters, digits and -._~!*'().

4.0.9

• fix: with i18next 26.7.1 or later, reloadInterval reloads everything i18next loaded or tried to load through the backend: the current languages and the languages loaded for clones (one per request on a server), and it retries the bundles that failed. 4.0.8 passed the fallback and preload languages to i18next's reloadResources(), which skipped a bundle that had failed to load, so a language missing after an outage at startup stayed missing (the backend's own reload before 4.0.8 read it again). With older i18next nothing changes.

4.0.8

• fix: with i18next 26.7.0 or later, create gets its callback. i18next 26.7.0 deprecates guessing the calling convention of a backend from the number of parameters of its methods; the backend now declares it with callbackApi, so i18next calls read and create with a callback (and passes create its options), and debug mode no longer logs the deprecation notice. Older i18next versions ignore it. create(languages, namespace, key, fallbackValue, callback) has five parameters, the number i18next reserved for the form without a callback, so i18next passed its options object as callback, and with a refused lng or ns value create called that object (a TypeError that i18next swallowed).
• reloadInterval reloads through services.utils.reloadResources with i18next 26.7.0 or later (with i18next's retries and the loaded event) instead of calling i18next's internal backend connector. It reloads the same languages as before: the fallback and preload languages. With older i18next nothing changes.

4.0.7

• fix: queryStringParams are now added before a #fragment in loadPath / addPath. They were appended after it, and as the fragment is never sent, the server did not get them: with queryStringParams: { v: '1.2.3' }, /locales/en/ns.json?a=1#x now requests /locales/en/ns.json?a=1&v=1.2.3 instead of /locales/en/ns.json?a=1. URLs without a fragment are unchanged. Thanks @​lprnmns (#204)

4.0.6

• fix: when XMLHttpRequest throws synchronously (open() with an invalid URL, setRequestHeader() with an invalid customHeaders name, send()), the error is now passed to the callback. It was only logged with console.log, so the load never finished and i18next init() did not resolve. Now i18next takes its usual failed-load path. The XHR path is used when no fetch is available and for file: URLs. An XHR that completes inside send() (some polyfills and fake XHRs) is not called back a second time when its callback throws. Thanks @​lprnmns (#203)

4.0.5

• fix: a loadPath function whose promise rejects now reports the error to i18next. The read callback was never called, so init() / loadNamespaces() never settled (a react-i18next Suspense fallback stayed up for good) and in Node the unhandled rejection ended the process. i18next now takes its usual failed-load path (failedLoading event, "loading namespace ... failed" log) and init() resolves. The error is passed on without retry, like the other non-network errors. Thanks @​nk-batman21 (#201)

Commits

• 69b683a 4.0.10
• cf0fc90 security: refuse URLs whose scheme or host a lng/ns value changes (GHSA-qh2f-...
• 645ad0c 4.0.9
• a6085ce build
• f615d3e changelog for 4.0.9
• 8784f12 fix: hand the reload to i18next 26.7.1 or later, which retries bundles that f...
• b674794 4.0.8
• 03366f9 build
• 31d62d8 changelog for 4.0.8
• 334dc53 fix: declare callbackApi, so i18next 26.7 calls create with its callback; rel...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.