feat(deps): bump i18next-http-middleware from 3.9.2 to 3.9.3

[dependabot]

Bumps i18next-http-middleware from 3.9.2 to 3.9.3.

Changelog

Sourced from i18next-http-middleware's changelog.

v3.9.3

Security release — all issues found via an internal audit. See published GHSA advisories GHSA-5fgg-jcpf-8jjw and GHSA-c3h8-g69v-pjrg.

• security: guard utils.setPath against prototype pollution via crafted lng/ns in getResourcesHandler (GHSA-5fgg-jcpf-8jjw)
• security: sanitise Content-Language response header to prevent CRLF injection / unhandled ERR_INVALID_CHAR crash via unsanitised language codes (GHSA-c3h8-g69v-pjrg)
• security: skip inherited/prototype-polluting keys (__proto__, constructor, prototype) in missingKeyHandler request body (GHSA-5fgg-jcpf-8jjw)
• security: filter unsafe lng/ns values in getResourcesHandler (reject path-traversal, path separators, control characters, prototype keys, over-long inputs) to prevent path traversal / SSRF via the backend connector and unbounded growth of the shared i18next.options.ns array. Any legitimate language code shape is still accepted — i18next permits arbitrary codes (FAQ) (GHSA-5fgg-jcpf-8jjw)
• security: hasXSS regex now catches event handlers in any attribute position (previously only matched when the handler was the first attribute; e.g. <input autofocus onfocus=…> bypassed the filter)
• security: automatically set the Secure flag on the language cookie when cookieSameSite: 'none' — browsers reject SameSite=None without Secure
• chore: ignore .env* and *.pem/*.key files in .gitignore

Commits

• c662434 3.9.3
• 65301c1 security: harden setPath, CRLF, missingKeyHandler, getResourcesHandler, hasXS...
• a1d92a8 Bump koa from 2.16.1 to 3.1.2 in /example/koa (#113)
• b79725b Bump fastify from 3.21.6 to 5.8.5 in /example/fastify (#112)
• daa5578 Bump fastify from 5.3.2 to 5.8.5 (#111)
• d872c86 Bump preact from 10.27.2 to 10.27.3 (#101)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	i18next-http-middleware@​3.9.2 ⏵ 3.9.3				+5

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud