chore(deps): bump i18next-http-backend from 4.0.1 to 4.0.2

[dependabot]

Bumps i18next-http-backend from 4.0.1 to 4.0.2.

Changelog

Sourced from i18next-http-backend's changelog.

4.0.2

Security release. See advisory GHSA-xvq9-wjp8-hwqf.

• security: also reject : in lng and ns values, and // in ns values. With a loadPath / addPath template that starts with the placeholder (e.g. {{lng}}/{{ns}}.json — no origin and no leading /), a value such as http:127.0.0.1:8080 was interpolated into an absolute URL and the request left the intended origin (SSRF / URL injection). The default /locales/{{lng}}/{{ns}}.json and every template with a leading path or origin were not affected, because a colon inside a path segment has no structural meaning there. No BCP-47 language code contains :, and : is i18next's default nsSeparator, so no usable namespace name does either — the tightened check has no legitimate collateral.

Commits

• 7db2f60 4.0.2
• 07e0288 security: reject : in lng/ns and // in ns to close scheme injection (GHSA...
• 08cb05d ci: install npm 11 before npm install
• ff1da48 docs: fix the documented reloadInterval default
• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
web-test	Error		Oct 8, 2026 2:31am UTC