Skip to content

fix: i18next-fs-backend upgrade to 2.6.6 for prototype pollution vuln - #29657

Merged
bandhan-majumder merged 1 commit into
mainfrom
bandhan/audit-security
Jun 26, 2026
Merged

fix: i18next-fs-backend upgrade to 2.6.6 for prototype pollution vuln#29657
bandhan-majumder merged 1 commit into
mainfrom
bandhan/audit-security

Conversation

@bandhan-majumder

Copy link
Copy Markdown
Member

What does this PR do?

  • Fixes #XXXX (GitHub issue number)

Visual Demo (For contributors especially)

A visual demonstration is strongly recommended, for both the original and new change (video / image - any one).

Video Demo (if applicable):

  • Show screen recordings of the issue or feature.
  • Demonstrate how to reproduce the issue, the behavior before and after the change.

Image Demo (if applicable):

  • Add side-by-side screenshots of the original and updated change.
  • Highlight any significant change(s).

Mandatory Tasks (DO NOT REMOVE)

  • I have self-reviewed the code (A decent size PR without self-review might be rejected).
  • I have updated the developer docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
  • I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

  • Are there environment variables that should be set?
  • What are the minimal test data to have?
  • What is expected (happy path) to have (input and output)?
  • Any other important info that could help to test that PR

Checklist

  • I haven't read the contributing guide
  • My code doesn't follow the style guidelines of this project
  • I haven't commented my code, particularly in hard-to-understand areas
  • I haven't checked if my changes generate no new warnings
  • My PR is too large (>500 lines or >10 files) and should be split into smaller PRs

@bandhan-majumder bandhan-majumder added ready-for-e2e run-ci Approve CI to run for external contributors labels Jun 26, 2026
@bandhan-majumder
bandhan-majumder enabled auto-merge (squash) June 26, 2026 20:09
@bandhan-majumder bandhan-majumder self-assigned this Jun 26, 2026
@coderabbitai

coderabbitai Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 76c8cc28-9869-43ca-b808-743e280169d8

📥 Commits

Reviewing files that changed from the base of the PR and between 62317bd and e75c8a4.

⛔ Files ignored due to path filters (1)
  • yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (1)
  • package.json

📝 Walkthrough

Walkthrough

The resolutions section in package.json is updated to retain the existing brace-expansion@^2.0.2 override and add a new i18next-fs-backend resolution at ^2.6.6. No other scripts or sections are changed.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Description check ❓ Inconclusive The description is mostly template text and placeholder issue text, so it gives little meaningful detail about the change. Replace the template with a brief summary of the dependency update, the vulnerability addressed, and any testing performed.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly states the security-focused i18next-fs-backend upgrade to 2.6.6, matching the changeset.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch bandhan/audit-security

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@bandhan-majumder
bandhan-majumder merged commit b97cd62 into main Jun 26, 2026
56 of 59 checks passed
@bandhan-majumder
bandhan-majumder deleted the bandhan/audit-security branch June 26, 2026 20:31
sebartyr pushed a commit to sebartyr/cal.diy that referenced this pull request Jul 2, 2026
regisstedile pushed a commit to regisstedile/cal.diy that referenced this pull request Jul 19, 2026
(cherry picked from commit b97cd62)
rubennati pushed a commit to rubennati/cal.diy that referenced this pull request Jul 26, 2026
(cherry picked from commit b97cd62)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready-for-e2e run-ci Approve CI to run for external contributors size/S

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants