[dependabot]

Bumps i18next-browser-languagedetector from 8.2.3 to 8.3.0.

Changelog

Sourced from i18next-browser-languagedetector's changelog.

8.3.0

• security: a detected language must now have the shape i18next 26.7 accepts for a language code from outside (its isSafeLanguageCode): letters, digits, -, _, @ and . (no ..), at most 128 characters. It replaces the list of XSS patterns, which missed values like <b>x</b> or " onmouseover="x() from the query string, a cookie or storage, which then became the language; apps put it into <html lang="...">. Compatibility note: a value with other characters (spaces, slashes, quotes) is now skipped and the next detector is used; codes like en_US, zh_Hant_TW or sr@latin still pass, and i18next 27 refuses such codes from outside as well.

8.2.4

• fix: lookupFromSubdomainIndex counts hostname labels again, so with 1, dev.en.example.com is detected as en. Since 6.1.5 the index picked a regex group instead, and any index other than 0 returned a part of the domain (en.exampl, example.com). Index 0 (the default) works as before. Thanks @​lprnmns 329

Commits

• 8c4b09e 8.3.0
• 3fbc313 release
• b85511f changelog for 8.3.0
• 979dcc3 security: check the shape of a detected language instead of a list of XSS pat...
• 4c6a50d 8.2.4
• e79235c release
• 5c5f032 chore: update dev dependencies to clear the Dependabot alerts
• 797ecfe changelog for unreleased #329
• 9303da4 fix: honor subdomain lookup index (#329)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-code-quality]

Code coverage overview

Languages: TypeScript, Go

TypeScript / code-coverage-agent

develop b834c8a	dependabot/npm_and_y... 7a28b17	+/-
56%	56%	0%

Go / code-coverage-agent

develop b834c8a	dependabot/npm_and_y... 7a28b17	+/-
26%	26%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated November 02, 2026 18:11 UTC}