@depup/i18n 0.15.3-depup.0 → 0.15.4-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/i18n
 
 | Field | Value |
 |-------|-------|
-| Original | [i18n](https://www.npmjs.com/package/i18n) @ 0.15.3 |
-| Processed | 2026-03-09 |
+| Original | [i18n](https://www.npmjs.com/package/i18n) @ 0.15.4 |
+| Processed | 2026-09-03 |
 | Smoke test | passed |
 | Deps updated | 1 |
 

package/SECURITY.md

@@ -5,10 +5,10 @@
 Use this section to tell people about which versions of your project are
 currently being supported with security updates.
 
-| Version | Supported          |
-| ------- | ------------------ |
-| 0.8.x   | :white_check_mark: |
-| < 0.8.0   | :x:                |
+| Version  | Supported          |
+| -------- | ------------------ |
+| 0.15.x   | :white_check_mark: |
+| < 0.15.0 | :x:                |
 
 ## Reporting a Vulnerability
 

package/changes.json

@@ -0,0 +1,10 @@
+{
+  "bumped": {
+    "make-plural": {
+      "from": "^7.4.0",
+      "to": "^8.1.0"
+    }
+  },
+  "timestamp": "2026-09-03T00:34:23.800Z",
+  "totalUpdated": 1
+}

package/i18n.js

@@ -1332,12 +1332,27 @@ const i18n = function I18n(_OPTS = false) {
    * basic normalization of filepath
    */
   const getStorageFilePath = (locale) => {
+    // only accept plain locale names before building any path.
+    if (!/^[A-Za-z0-9_-]+$/.test(String(locale))) {
+      throw new Error(`i18n: invalid locale "${locale}".`)
+    }
+
     // changed API to use .json as default, #16
     const ext = extension || '.json'
     const filepath = path.normalize(directory + pathsep + prefix + locale + ext)
     const filepathJS = path.normalize(
       directory + pathsep + prefix + locale + '.js'
     )
+
+    // ensure the resolved file stays inside the locales dir
+    const base = path.resolve(directory) + path.sep
+    if (
+      !path.resolve(filepath).startsWith(base) ||
+      !path.resolve(filepathJS).startsWith(base)
+    ) {
+      throw new Error(`i18n: locale "${locale}" escapes the locales directory.`)
+    }
+
     // use .js as fallback if already existing
     try {
       if (fs.statSync(filepathJS)) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@depup/i18n",
-  "description": "[DepUp] lightweight translation module with dynamic json storage",
-  "version": "0.15.3-depup.0",
+  "description": "lightweight translation module with dynamic json storage (with updated dependencies)",
+  "version": "0.15.4-depup.0",
   "homepage": "http://github.com/mashpie/i18n-node",
   "repository": {
     "type": "git",
@@ -15,13 +15,17 @@
   "files": [
     "i18n.js",
     "index.js",
-    "SECURITY.md"
+    "SECURITY.md",
+    "changes.json",
+    "README.md"
   ],
   "keywords": [
-    "depup",
-    "dependency-bumped",
-    "updated-deps",
     "i18n",
+    "depup",
+    "updated-dependencies",
+    "security",
+    "latest",
+    "patched",
     "template",
     "l10n"
   ],
@@ -84,8 +88,8 @@
     },
     "depsUpdated": 1,
     "originalPackage": "i18n",
-    "originalVersion": "0.15.3",
-    "processedAt": "2026-03-09T05:08:11.002Z",
+    "originalVersion": "0.15.4",
+    "processedAt": "2026-09-03T00:34:33.836Z",
     "smokeTest": "passed"
   }
 }