[dependabot]

Bumps i18next-browser-languagedetector from 8.2.1 to 8.3.0.

Changelog

Sourced from i18next-browser-languagedetector's changelog.

8.3.0

• security: a detected language must now have the shape i18next 26.7 accepts for a language code from outside (its isSafeLanguageCode): letters, digits, -, _, @ and . (no ..), at most 128 characters. It replaces the list of XSS patterns, which missed values like <b>x</b> or " onmouseover="x() from the query string, a cookie or storage, which then became the language; apps put it into <html lang="...">. Compatibility note: a value with other characters (spaces, slashes, quotes) is now skipped and the next detector is used; codes like en_US, zh_Hant_TW or sr@latin still pass, and i18next 27 refuses such codes from outside as well.

8.2.4

• fix: lookupFromSubdomainIndex counts hostname labels again, so with 1, dev.en.example.com is detected as en. Since 6.1.5 the index picked a regex group instead, and any index other than 0 returned a part of the domain (en.exampl, example.com). Index 0 (the default) works as before. Thanks @​lprnmns 329

8.2.3

• fix: the subdomain detector now detects language tags with script and region subtags, so pt-BR.site.com, zh-Hans-CN.site.com, es-419.site.com and sr-Latn.site.com are detected as pt-BR, zh-Hans-CN, es-419 and sr-Latn. The pattern only accepted 2 to 5 word characters, without hyphens. Other subdomains like staging or preview deployment labels (myapp-git-branch-team.vercel.app) are still not taken for a language, and everything detected before is still detected. Thanks @​lprnmns 328

8.2.2

• fix: the path and hash detectors keep digits in a language segment, so /es-419/ and #/es-419 are detected as es-419 instead of es- (which i18next resolved to es). Segments that start with a digit (/2024/) still yield no language, and lookupFromPathIndex / lookupFromHashIndex point at the same segments as before. Thanks @​nk-batman21 327

Commits

• 8c4b09e 8.3.0
• 3fbc313 release
• b85511f changelog for 8.3.0
• 979dcc3 security: check the shape of a detected language instead of a list of XSS pat...
• 4c6a50d 8.2.4
• e79235c release
• 5c5f032 chore: update dev dependencies to clear the Dependabot alerts
• 797ecfe changelog for unreleased #329
• 9303da4 fix: honor subdomain lookup index (#329)
• fa81be3 8.2.3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.