chore(deps): Bump i18next from 26.4.3 to 26.4.4 (#2239)

Bumps [i18next](https://github.com/i18next/i18next) from 26.4.3 to
26.4.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.4.4</h2>
<ul>
<li>fix(security): the nesting regexp no longer backtracks exponentially
(ReDoS) on an unclosed <code>$t(</code>. Its repeated group had
overlapping alternatives (<code>[^()&quot;']+</code> inside
<code>(?:...)*?</code>, and inside parentheses <code>[^()]</code> also
matched quotes), so a string containing <code>$t(</code> without a
closing <code>)</code> made the engine try every way to split the text:
about 2x the runtime per extra character, and a ~25 character value hung
<code>t()</code> for minutes. With the default config this was reachable
through any interpolated value (<code>t('greet', { name:
'$t(aaaaaaaaaaaaaaaaaaaaaaaa' })</code>): escaping does not touch
<code>$</code>, <code>t</code> or <code>(</code>, and the
<code>skipOnVariables</code> check runs the regexp on the interpolated
result, so <code>nest: false</code> did not help either. Every
alternative now starts with a different character (plain char,
<code>&quot;</code>, <code>'</code> or <code>(</code>), so there is only
one way to match and the cost is linear. Quoted strings and one level of
parentheses in nesting options keep working (<a
href="https://redirect.github.com/i18next/i18next/issues/2336">#2336</a>).
The only difference: a lone <code>&quot;</code> or <code>'</code> inside
unquoted parentheses within <code>$t(...)</code> is no longer matched.
Affects 25.3.3 to 26.4.3. Thanks to Anisetti Chaitanya Eshwar Prasad for
the responsible disclosure.</li>
<li>fix(security): <code>nest()</code> now resolves <code>$t(...)</code>
in a single pass and no longer nests text that came out of a resolved
value. Every nested lookup reset the shared nesting regexp, so the loop
started over from the beginning of the string after each match. That had
two effects. First, a <code>$t(...)</code> inside a variable that the
nested lookup deliberately kept literal (default <code>skipOnVariables:
true</code>) was resolved anyway by the outer loop: with <code>outer: 'A
$t(inner) B'</code> and <code>inner: 'Hi {{name}}'</code>,
<code>t('outer', { name: '$t(secret)' })</code> rendered the
<code>secret</code> translation. It now stays <code>A Hi $t(secret)
B</code>, the same as without the outer nesting; with
<code>skipOnVariables: false</code> it is still resolved. Second, the
cost was quadratic when an unclosed <code>$t(</code> preceded many
nestings, which matters when an app passes untrusted input as the key
itself (<code>t(userInput)</code>): 20,000 nestings took ~1.4 s, now ~25
ms. The resolved value is now sliced into the result instead of going
through <code>String.replace</code>, so <code>$&amp;</code>,
<code>$`</code>, <code>$'</code> and <code>$$</code> stay literal as
before (26.4.2).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.4.4</h2>
<ul>
<li>fix(security): the nesting regexp no longer backtracks exponentially
(ReDoS) on an unclosed <code>$t(</code>. Its repeated group had
overlapping alternatives (<code>[^()&quot;']+</code> inside
<code>(?:...)*?</code>, and inside parentheses <code>[^()]</code> also
matched quotes), so a string containing <code>$t(</code> without a
closing <code>)</code> made the engine try every way to split the text:
about 2x the runtime per extra character, and a ~25 character value hung
<code>t()</code> for minutes. With the default config this was reachable
through any interpolated value (<code>t('greet', { name:
'$t(aaaaaaaaaaaaaaaaaaaaaaaa' })</code>): escaping does not touch
<code>$</code>, <code>t</code> or <code>(</code>, and the
<code>skipOnVariables</code> check runs the regexp on the interpolated
result, so <code>nest: false</code> did not help either. Every
alternative now starts with a different character (plain char,
<code>&quot;</code>, <code>'</code> or <code>(</code>), so there is only
one way to match and the cost is linear. Quoted strings and one level of
parentheses in nesting options keep working (<a
href="https://redirect.github.com/i18next/i18next/issues/2336">#2336</a>).
The only difference: a lone <code>&quot;</code> or <code>'</code> inside
unquoted parentheses within <code>$t(...)</code> is no longer matched.
Affects 25.3.3 to 26.4.3. See advisory <a
href="https://github.com/i18next/i18next/security/advisories/GHSA-5jr9-983r-c8x4">GHSA-5jr9-983r-c8x4</a>,
CVSS 7.5 (<code>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</code>).
Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible
disclosure.</li>
<li>fix(security): <code>nest()</code> now resolves <code>$t(...)</code>
in a single pass and no longer nests text that came out of a resolved
value. Every nested lookup reset the shared nesting regexp, so the loop
started over from the beginning of the string after each match. That had
two effects. First, a <code>$t(...)</code> inside a variable that the
nested lookup deliberately kept literal (default <code>skipOnVariables:
true</code>) was resolved anyway by the outer loop: with <code>outer: 'A
$t(inner) B'</code> and <code>inner: 'Hi {{name}}'</code>,
<code>t('outer', { name: '$t(secret)' })</code> rendered the
<code>secret</code> translation. It now stays <code>A Hi $t(secret)
B</code>, the same as without the outer nesting; with
<code>skipOnVariables: false</code> it is still resolved. Second, the
cost was quadratic when an unclosed <code>$t(</code> preceded many
nestings, which matters when an app passes untrusted input as the key
itself (<code>t(userInput)</code>): 20,000 nestings took ~1.4 s, now ~25
ms. The resolved value is now sliced into the result instead of going
through <code>String.replace</code>, so <code>$&amp;</code>,
<code>$`</code>, <code>$'</code> and <code>$$</code> stay literal as
before (26.4.2).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next/commit/f6a7746d119790f07bc03ba86b130b090af8e443"><code>f6a7746</code></a>
26.4.4</li>
<li><a
href="https://github.com/i18next/i18next/commit/25988d5405e8e57415b2550af179f512c33ca2be"><code>25988d5</code></a>
build</li>
<li><a
href="https://github.com/i18next/i18next/commit/c9f8ebab17b456b5837e61a2e542ee27d190e151"><code>c9f8eba</code></a>
fix(security): nesting regexp ReDoS on unclosed $t( and single-pass
nest(), c...</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next/compare/v26.4.3...v26.4.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next&package-manager=npm_and_yarn&previous-version=26.4.3&new-version=26.4.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

package-lock.json

@@ -30,7 +30,7 @@
         "downshift": "^9.4.0",
         "events": "^3.3.0",
         "file-saver": "^2.0.5",
-        "i18next": "^26.4.3",
+        "i18next": "^26.4.4",
         "i18next-browser-languagedetector": "^8.2.1",
         "i18next-resources-to-backend": "^1.2.3",
         "json-stringify-pretty-compact": "^4.0.0",
@@ -6628,9 +6628,9 @@
       }
     },
     "node_modules/i18next": {
-      "version": "26.4.3",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.3.tgz",
-      "integrity": "sha512-QIIueUYS2giFVIY3hu/X5Dz7/qTzwcXE06H29m1DKVhUGVPCyT0wnsh14wEn/cTy9nZ/B6VhbDItdXotOKSO8A==",
+      "version": "26.4.4",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.4.tgz",
+      "integrity": "sha512-O+rqmQUi54OwAgnZ4SAwO6aRrbXZt36VZXWt6zvq0FpC3vJbH46oQRs6u4Uwm1vf8ZI7UqOXQiJhQVTor7vRiQ==",
       "funding": [
         {
           "type": "individual",

package.json

@@ -48,7 +48,7 @@
     "downshift": "^9.4.0",
     "events": "^3.3.0",
     "file-saver": "^2.0.5",
-    "i18next": "^26.4.3",
+    "i18next": "^26.4.4",
     "i18next-browser-languagedetector": "^8.2.1",
     "i18next-resources-to-backend": "^1.2.3",
     "json-stringify-pretty-compact": "^4.0.0",