Repository navigation
Upgrade the version of i18next to address some CVEs and add translations tests - #101
Merged
Merged
Conversation
Nkemjiks
approved these changes
May 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replace the
@prebsch-exo/i18next@19.9.2-patch.1fork with the upstreami18next@^26.0.6in@execonline-inc/translations, and add real tests for the package (it previously had only a broken placeholder).@prebsch-exo/i18next→i18next(skipping ~7 major versions of upstream changes; the v19 fork was a long-stale patch release)@execonline-inc/translations11.5.0 → 12.0.0 (breaking dep change for consumers)translationstate machine, thealreadyTranslatedTextdecoder, andlanguageTag; removed the prior placeholder that wasn't even a valid test.Why now
The
@prebsch-exo/i18nextfork hasn't moved in years and pinned us to v19-era APIs. Upstreami18nextis at v26 with active maintenance, CLDR-based plural rules viaIntl, and current TypeScript definitions. The initAPI surface this adapter relies on (
init(options, callback)returning aPromise) is unchanged across the gap, so the swap is mechanical.Changes
packages/translations/package.jsonVersion bumped to
12.0.0.packages/translations/src/adapters/i18next/index.tspackages/translations/__tests__/translations.test.ts(new)Replaces the broken
translations.test.jsplaceholder. Covers:defaultSettingsshape — guardsns/defaultNS/fallbackLng/keySeparator/nsSeparator/interpolation.escapeValueinitTask— end-to-end check that v26 init resolves aLoadedstate with the right language and a working translator (including{{name}}interpolation)translation— uninitialized → empty string; loaded → translator lookup; not-translatable keys → returned unchanged without invoking the translator; loaded-from-fallback → still uses the translatoralreadyTranslatedText— decodes strings; rejects non-stringslanguageTag— strips region/script (en-US→en,zh-Hant-TW→zh); passes through when no hyphenTests run via
bun testand import from../srcdirectly so they don't depend on a prior build.Compatibility notes for downstream consumers
The
initTask/defaultSettingsAPI is unchanged, but consumers' translation content may be affected by upstream i18next changes between v19 and v26:compatibilityJSON: 'v3'to Intl/CLDR-based plurals. JSON keys likekey_pluralno longer match — usekey_one/key_otheretc., or passcompatibilityJSON: 'v3'in yoursettings override.
init(options, (err, t) => …)works as before; no changes required in consumer init code.Known pre-existing quirk (out of scope here)
While writing the init test I noticed
adapters/i18next/index.tslines 25 & 27 readi18next.language(the global default instance) instead ofinitializer.language(the argument). Consumers who pass a custom instancevia
i18next.createInstance()will seeLoaded.languageasundefined. Not introduced by this PR; happy to file a follow-up.