Skip to content

chore(deps): update dependency i18next-fs-backend to v2.6.8 - #221

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/i18next-fs-backend-2.x-lockfile
Sep 21, 2026
Merged

renovate[bot] merged 1 commit into
mainfrom
renovate/i18next-fs-backend-2.x-lockfile

Conversation

@renovate

@renovate renovate Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
i18next-fs-backend 2.6.7 → 2.6.8 age adoption passing confidence

Release Notes

i18next/i18next-fs-backend (i18next-fs-backend)

v2.6.8

Compare Source

Security release. Coordinated disclosure from @​adamyordan. See published advisory GHSA-cchx-rhgv-92hj.

  • security: utils.getLastOfPath now descends only into own properties, closing an unauthenticated denial of service that the 2.6.6 prototype-pollution fix did not cover. 2.6.6 denylists __proto__, constructor and prototype, but the walk it guards still stepped into inherited members: the autovivify test (!object[key]) is true for every inherited Object.prototype method, so a queued missing-key string such as hasOwnProperty.call (split to ['hasOwnProperty','call'] in writeFile()) walked into Object.prototype.hasOwnProperty and overwrote its .call with the attacker's fallback value, breaking the own-property check i18next itself runs and returning 500 for every request in the process until restart. The same held for valueOf, toString, isPrototypeOf and the other inherited members the denylist never covered, so extending the denylist would not have closed it. The traversal now gates each descent on Object.prototype.hasOwnProperty.call(object, key), covering setPath, pushPath and getPath, and matching the fix i18next core already carries. Reachable in practice via i18next-http-middleware's missingKeyHandler with saveMissing enabled; see also the matching fix in i18next-http-middleware 3.9.9. Credit: @​adamyordan (GHSA-cchx-rhgv-92hj).

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

Copy link
Copy Markdown

Automatic builds from https://github.com/NethServer/nethlink/actions/runs/35547584172.
Commit: 26c1606

Name Platform Link
win-app.exe Windows (x64) Link
macos-app-x64.dmg MacOS (x64) Link
macos-app-arm64.dmg MacOS (arm64) Link
linux-app.AppImage Linux (x64) Link

@renovate
renovate Bot merged commit 7d5bc7b into main Sep 21, 2026
4 checks passed
@renovate
renovate Bot deleted the renovate/i18next-fs-backend-2.x-lockfile branch September 21, 2026 04:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants