From c2af4536a7567b0ece05eccfcc945f78cb007bdf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 13:50:45 +0000
Subject: [PATCH] chore(deps): Bump i18next-resources-to-backend from 1.2.1 to
 1.2.2 (#2053)

Bumps
[i18next-resources-to-backend](https://github.com/i18next/i18next-resources-to-backend)
from 1.2.1 to 1.2.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next-resources-to-backend/blob/main/CHANGELOG.md">i18next-resources-to-backend's
changelog</a>.</em></p>
<blockquote>
<h3>1.2.2</h3>
<ul>
<li>security: validate <code>language</code> and <code>namespace</code>
in <code>read()</code> before they are passed to the loader. i18next
resolves any string as a language unless <code>supportedLngs</code> is
set, so these values can carry whatever a language detector picked up
from the querystring, path or a cookie. The documented usage pattern is
<code>import(</code>./locales/${language}/${namespace}.json<code>)</code>,
and while a bundler compiles that template to a fixed context map, an
unbundled ESM runtime (Node SSR) resolves the specifier against the
filesystem, where a crafted value escapes the locales directory. Values
containing <code>..</code>, <code>\</code>, control characters,
<code>__proto__</code> / <code>constructor</code> /
<code>prototype</code>, or longer than 128 characters are now rejected
with an error and the loader is never called; <code>/</code> is rejected
for <code>language</code> but allowed for <code>namespace</code>, where
nested layouts such as <code>a/b</code> are legitimate. The same check
keeps the static-resources lookup off
<code>Object.prototype</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/i18next/i18next-resources-to-backend/commit/79926015633ef99a62c3e5b2ab98590bc127aa58"><code>7992601</code></a>
1.2.2</li>
<li><a
href="https://github.com/i18next/i18next-resources-to-backend/commit/8b7240c588ca8b6f3ba711f73066310fa878c183"><code>8b7240c</code></a>
cosmetics</li>
<li><a
href="https://github.com/i18next/i18next-resources-to-backend/commit/1d45d0b9d59c0d93c571904332ff5a2a83694fae"><code>1d45d0b</code></a>
security: validate language/namespace before calling the loader</li>
<li><a
href="https://github.com/i18next/i18next-resources-to-backend/commit/75a31f87a670f78df15da963f3472131e0262863"><code>75a31f8</code></a>
README: mention npx i18next-cli localize as the zero-to-localized
path</li>
<li><a
href="https://github.com/i18next/i18next-resources-to-backend/commit/12858c721895b1f1346c3e164f667e0d7e3d13e9"><code>12858c7</code></a>
Add Locize advice section near the top of README</li>
<li><a
href="https://github.com/i18next/i18next-resources-to-backend/commit/e3f24cd694fe822ae909f901701bf961217b9f5d"><code>e3f24cd</code></a>
Modernize locize.com URLs and refresh UTM tags</li>
<li><a
href="https://github.com/i18next/i18next-resources-to-backend/commit/33a1f29ebac9dae1e2c1535f7dfa1c2972ee9cc1"><code>33a1f29</code></a>
chore: ignore .env*, *.pem, *.key in .gitignore</li>
<li>See full diff in <a
href="https://github.com/i18next/i18next-resources-to-backend/compare/v1.2.1...v1.2.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next-resources-to-backend&package-manager=npm_and_yarn&previous-version=1.2.1&new-version=1.2.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 8 ++++----
 package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 44760cea..d889d61b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -32,7 +32,7 @@
         "file-saver": "^2.0.5",
         "i18next": "^26.3.6",
         "i18next-browser-languagedetector": "^8.2.1",
-        "i18next-resources-to-backend": "^1.2.1",
+        "i18next-resources-to-backend": "^1.2.2",
         "json-stringify-pretty-compact": "^4.0.0",
         "json-to-ast": "^2.1.0",
         "lodash": "^4.18.1",
@@ -7521,9 +7521,9 @@
       }
     },
     "node_modules/i18next-resources-to-backend": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/i18next-resources-to-backend/-/i18next-resources-to-backend-1.2.1.tgz",
-      "integrity": "sha512-okHbVA+HZ7n1/76MsfhPqDou0fptl2dAlhRDu2ideXloRRduzHsqDOznJBef+R3DFZnbvWoBW+KxJ7fnFjd6Yw==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/i18next-resources-to-backend/-/i18next-resources-to-backend-1.2.2.tgz",
+      "integrity": "sha512-1qDy4c67qurkyLKXoFncMBB0XmXJE0GHoPCx7ONbDoq9R3puhjOpfUERbtWcwfulbXvxwdqWRmB4DIud+nLpuw==",
       "license": "MIT",
       "dependencies": {
         "@babel/runtime": "^7.23.2"
diff --git a/package.json b/package.json
index 05f5c7c9..7f86f0ee 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "file-saver": "^2.0.5",
     "i18next": "^26.3.6",
     "i18next-browser-languagedetector": "^8.2.1",
-    "i18next-resources-to-backend": "^1.2.1",
+    "i18next-resources-to-backend": "^1.2.2",
     "json-stringify-pretty-compact": "^4.0.0",
     "json-to-ast": "^2.1.0",
     "lodash": "^4.18.1",