i18ntk 2.3.4 → 2.3.5

package/README.md

@@ -1,4 +1,4 @@
-# i18ntk v2.3.4
+# i18ntk v2.3.5
 
 Zero-dependency internationalization toolkit for setup, scanning, analysis, validation, usage tracking, and translation completion.
 
@@ -9,14 +9,15 @@ Zero-dependency internationalization toolkit for setup, scanning, analysis, vali
 [![node](https://img.shields.io/badge/node-%3E%3D16-339933)](https://nodejs.org)
 [![dependencies](https://img.shields.io/badge/dependencies-0-success)](https://www.npmjs.com/package/i18ntk)
 [![license](https://img.shields.io/badge/license-MIT-yellow.svg)](LICENSE)
-[![socket](https://socket.dev/api/badge/npm/package/i18ntk/2.3.4)](https://socket.dev/npm/package/i18ntk/overview/2.3.4)
+[![socket](https://socket.dev/api/badge/npm/package/i18ntk/2.3.5)](https://socket.dev/npm/package/i18ntk/overview/2.3.5)
 
 ## Upgrade Notice
 
-Versions earlier than `2.3.4` may contain known stability and security issues.
-They are considered unsupported for production use. Upgrade to `2.3.4` or newer.
-The CLI now checks npm registry metadata at startup and warns when your installed version is out of date.
-Set `I18NTK_DISABLE_UPDATE_CHECK=true` to disable this warning in restricted/offline environments.
+Versions earlier than `2.3.5` may contain known stability and security issues.
+They are considered unsupported for production use. Upgrade to `2.3.5` or newer.
+The CLI can check npm registry metadata and warn when your installed version is out of date.
+Set `I18NTK_ENABLE_UPDATE_CHECK=true` to enable this behavior.
+Set `I18NTK_DISABLE_UPDATE_CHECK=true` to force-disable it in restricted/offline environments.
 Set `I18NTK_DISABLE_AUTOSAVE=1` in server/runtime environments to keep config in memory and skip disk writes.
 
 ## What i18ntk Does
@@ -154,7 +155,7 @@ Example `.i18ntk-config`:
 
 ```json
 {
-  "version": "2.3.4",
+  "version": "2.3.5",
   "sourceDir": "./locales",
   "i18nDir": "./locales",
   "outputDir": "./i18ntk-reports",
@@ -177,7 +178,7 @@ See [docs/api/CONFIGURATION.md](docs/api/CONFIGURATION.md) for the full configur
 - [Runtime API Guide](docs/runtime.md)
 - [Scanner Guide](docs/scanner-guide.md)
 - [Environment Variables](docs/environment-variables.md)
-- [Migration Guide v2.3.4](docs/migration-guide-v2.3.4.md)
+- [Migration Guide v2.3.5](docs/migration-guide-v2.3.5.md)
 - [Optimization Prompt](docs/development/package-optimization-prompt.md)
 
 ## License

package/main/i18ntk-backup-class.js

@@ -15,12 +15,20 @@ const SecurityUtils = require('../utils/security');
  *
  * Class-based implementation of backup functionality for use with CommandRouter
  */
-class I18nBackup {
+class I18nBackup {
     constructor(config = {}) {
         this.config = config;
         this.backupDir = path.join(process.cwd(), 'i18ntk-backups');
         this.maxBackups = Math.min(Math.max(parseInt(config.backup?.maxBackups, 10) || 1, 1), 3);
-    }
+    }
+
+    validateInProject(targetPath, label = 'path') {
+        const validated = SecurityUtils.validatePath(targetPath, process.cwd());
+        if (!validated) {
+            throw new Error(`Invalid ${label}: ${targetPath}`);
+        }
+        return validated;
+    }
 
     /**
      * Main run method for the backup command
@@ -79,13 +87,15 @@ Options:
     }
 
     // Command handlers
-    async handleCreate(options = {}) {
-        // Use absolute path for the locales directory
-        const dir = (options._ && options._[1]) || options.dir || path.join(__dirname, '..', 'locales');
-        const outputDir = options.output || this.backupDir;
-        const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
-        const backupName = `backup-${timestamp}.json`;
-        const backupPath = path.join(outputDir, backupName);
+    async handleCreate(options = {}) {
+        // Use absolute path for the locales directory
+        const requestedDir = (options._ && options._[1]) || options.dir || path.join(process.cwd(), 'locales');
+        const requestedOutputDir = options.output || this.backupDir;
+        const dir = this.validateInProject(path.resolve(process.cwd(), requestedDir), 'source directory');
+        const outputDir = this.validateInProject(path.resolve(process.cwd(), requestedOutputDir), 'backup directory');
+        const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+        const backupName = `backup-${timestamp}.json`;
+        const backupPath = this.validateInProject(path.join(outputDir, backupName), 'backup file');
 
         // Log the paths for debugging
         logger.debug(`Source directory: ${dir}`);
@@ -104,7 +114,7 @@ Options:
         }
 
         // Validate directory
-        const sourceDir = path.resolve(dir);
+        const sourceDir = dir;
         try {
             const stats = await fsp.stat(sourceDir);
             if (!stats.isDirectory()) {
@@ -163,16 +173,17 @@ Options:
         };
     }
 
-    async handleRestore(options = {}) {
-        const backupFile = options._ && options._[1];
-        if (!backupFile) {
-            throw new Error('Backup file path is required');
-        }
-
-        const backupPath = path.resolve(process.cwd(), backupFile);
-        const outputDir = options.output
-            ? path.resolve(process.cwd(), options.output)
-            : path.join(process.cwd(), 'restored');
+    async handleRestore(options = {}) {
+        const backupFile = options._ && options._[1];
+        if (!backupFile) {
+            throw new Error('Backup file path is required');
+        }
+
+        const backupPath = this.validateInProject(path.resolve(process.cwd(), backupFile), 'backup file');
+        const outputDir = this.validateInProject(
+            options.output ? path.resolve(process.cwd(), options.output) : path.join(process.cwd(), 'restored'),
+            'restore output directory'
+        );
 
         // Validate backup file
         if (!SecurityUtils.safeExistsSync(backupPath, process.cwd())) {
@@ -183,21 +194,21 @@ Options:
 
         try {
             // Read the backup file
-            const backupData = await fs.readFile(backupPath, 'utf8');
-            const translations = JSON.parse(backupData);
+            const backupData = await fsp.readFile(backupPath, 'utf8');
+            const translations = JSON.parse(backupData);
 
             // Create output directory if it doesn't exist
             try {
-                await fs.mkdir(outputDir, { recursive: true });
-            } catch (err) {
-                if (err.code !== 'EEXIST') throw err;
-            }
+                await fsp.mkdir(outputDir, { recursive: true });
+            } catch (err) {
+                if (err.code !== 'EEXIST') throw err;
+            }
 
             // Write the restored files
-            for (const [file, content] of Object.entries(translations)) {
-                const filePath = path.join(outputDir, file);
-                await fs.writeFile(filePath, JSON.stringify(content, null, 2));
-            }
+            for (const [file, content] of Object.entries(translations)) {
+                const filePath = this.validateInProject(path.join(outputDir, file), 'restore file');
+                await fsp.writeFile(filePath, JSON.stringify(content, null, 2), 'utf8');
+            }
 
             logger.success('Backup restored successfully');
             logger.info(`  Restored ${Object.keys(translations).length} files to: ${outputDir}`);
@@ -214,12 +225,13 @@ Options:
         }
     }
 
-    async handleList() {
-        try {
-            // Ensure backup directory exists
-            try {
-                await fsp.access(this.backupDir);
-            } catch (err) {
+    async handleList() {
+        const backupDir = this.validateInProject(this.backupDir, 'backup directory');
+        try {
+            // Ensure backup directory exists
+            try {
+                await fsp.access(backupDir);
+            } catch (err) {
                 if (err.code === 'ENOENT') {
                     logger.warn('No backups found. The backup directory does not exist yet.');
                 } else {
@@ -228,13 +240,13 @@ Options:
                 return { success: true, backups: [] };
             }
 
-            const files = await fsp.readdir(this.backupDir);
+            const files = await fsp.readdir(backupDir);
             const backups = [];
 
             for (const file of files) {
                 if (file.startsWith('backup-') && file.endsWith('.json')) {
                     try {
-                        const filePath = path.join(this.backupDir, file);
+                        const filePath = this.validateInProject(path.join(backupDir, file), 'backup file');
                         const stats = await fsp.stat(filePath);
                         backups.push({
                             name: file,
@@ -288,7 +300,7 @@ Options:
             throw new Error('Backup file path is required');
         }
 
-        const backupPath = path.resolve(process.cwd(), backupFile);
+        const backupPath = this.validateInProject(path.resolve(process.cwd(), backupFile), 'backup file');
 
         // Validate backup file
         if (!SecurityUtils.safeExistsSync(backupPath, process.cwd())) {
@@ -328,21 +340,22 @@ Options:
         }
     }
 
-    async handleCleanup(options = {}) {
-        const keep = options.keep ? parseInt(options.keep, 10) : this.maxBackups;
+    async handleCleanup(options = {}) {
+        const keep = options.keep ? parseInt(options.keep, 10) : this.maxBackups;
+        const backupDir = this.validateInProject(this.backupDir, 'backup directory');
 
         logger.info('\nCleaning up old backups...');
 
         try {
-            const files = await fsp.readdir(this.backupDir);
-            const backupFiles = files
-                .filter(file => file.startsWith('backup-') && file.endsWith('.json'))
-                .map(file => ({
-                    name: file,
-                    path: path.join(this.backupDir, file),
-                    time: fs.statSync(path.join(this.backupDir, file)).mtime.getTime()
+            const files = await fsp.readdir(backupDir);
+            const backupFiles = files
+                .filter(file => file.startsWith('backup-') && file.endsWith('.json'))
+                .map(file => ({
+                    name: file,
+                    path: this.validateInProject(path.join(backupDir, file), 'backup file'),
+                    time: (SecurityUtils.safeStatSync(path.join(backupDir, file), process.cwd()) || { mtime: new Date(0) }).mtime.getTime()
                 }))
-                .sort((a, b) => b.time - a.time);
+                .sort((a, b) => b.time - a.time);
 
             // Keep only the most recent 'keep' files
             const toDelete = backupFiles.slice(keep);
@@ -379,27 +392,28 @@ Options:
         }
     }
 
-    async cleanupOldBackups(outputDir) {
-        try {
-            const files = await fs.readdir(outputDir);
-            const backupFiles = files
-                .filter(file => file.startsWith('backup-') && file.endsWith('.json'))
-                .map(file => ({
-                    name: file,
-                    path: path.join(outputDir, file),
-                    time: fs.statSync(path.join(outputDir, file)).mtime.getTime()
-                }))
-                .sort((a, b) => b.time - a.time);
+    async cleanupOldBackups(outputDir) {
+        try {
+            const safeOutputDir = this.validateInProject(outputDir, 'backup output directory');
+            const files = await fsp.readdir(safeOutputDir);
+            const backupFiles = files
+                .filter(file => file.startsWith('backup-') && file.endsWith('.json'))
+                .map(file => ({
+                    name: file,
+                    path: this.validateInProject(path.join(safeOutputDir, file), 'backup file'),
+                    time: (SecurityUtils.safeStatSync(path.join(safeOutputDir, file), process.cwd()) || { mtime: new Date(0) }).mtime.getTime()
+                }))
+                .sort((a, b) => b.time - a.time);
 
             // Keep only the most recent files
             const toDelete = backupFiles.slice(this.maxBackups);
 
-            for (const file of toDelete) {
-                try {
-                    await fs.unlink(file.path);
-                } catch (err) {
-                    // Ignore cleanup errors
-                }
+            for (const file of toDelete) {
+                try {
+                    await fsp.unlink(file.path);
+                } catch (err) {
+                    // Ignore cleanup errors
+                }
             }
         } catch (error) {
             // Ignore cleanup errors

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18ntk",
-  "version": "2.3.4",
+  "version": "2.3.5",
   "description": "🚀 The fastest internationalization toolkit with 97% performance boost! Zero-dependency, enterprise-grade internationalization for React, Vue, Angular, Python, Java, PHP & more. Features PIN protection, auto framework detection, 7+ UI languages, and comprehensive translation management. Perfect for startups to enterprises.",
   "keywords": [
     "i18n",
@@ -227,7 +227,7 @@
   },
   "preferGlobal": true,
   "versionInfo": {
-    "version": "2.3.4",
+    "version": "2.3.5",
     "releaseDate": "12/04/2026",
     "lastUpdated": "12/04/2026",
     "maintainer": "Vlad Noskov",
@@ -238,9 +238,10 @@
       "HOTFIX: Removed deprecated package-path fallback that caused production build warnings for non-exported subpaths.",
       "CRITICAL FIX: Resolved sizing and usage-analysis regressions in v2 command flow.",
       "PACKAGING: Reduced publish footprint by removing internal development scripts and legacy fixed-file artifacts.",
-      "SECURITY: Hardened release checks and added explicit support guidance to update from pre-2.3.4 versions.",
+      "SECURITY: Hardened release checks and added explicit support guidance to update from pre-2.3.5 versions.",
       "CONFIG: Added cross-process file locking for .i18ntk-config writes to prevent production rename races.",
       "CONFIG: Made autosave runtime-safe with non-throwing save failures and I18NTK_DISABLE_AUTOSAVE support.",
+      "SECURITY: Hardened reset/backup path handling and made npm update checks explicit opt-in.",
       "CLI: Added npm registry version check with upgrade warning for out-of-date installs.",
       "I18N: Completed internal UI locale parity and actionable untranslated-key cleanup across supported languages."
     ],
@@ -267,7 +268,7 @@
       "spring-boot": ">=2.5.0",
       "laravel": ">=8.0.0"
     },
-    "supportPolicy": "Versions earlier than 2.3.4 may be unstable or insecure. Upgrade to 2.3.4 or newer."
+    "supportPolicy": "Versions earlier than 2.3.5 may be unstable or insecure. Upgrade to 2.3.5 or newer."
   },
   "_comment": "This package is zero-dependency and uses only native Node.js modules"
 }

package/settings/settings-manager.js

@@ -312,6 +312,18 @@ class SettingsManager {
         this.settings = this.loadSettings();
     }
 
+    resolveSafePath(targetPath, basePath = process.cwd()) {
+        return SecurityUtils.validatePath(path.resolve(targetPath), basePath);
+    }
+
+    safeDeleteFile(targetPath, basePath = process.cwd()) {
+        const validated = this.resolveSafePath(targetPath, basePath);
+        if (!validated) return false;
+        if (!SecurityUtils.safeExistsSync(validated, basePath)) return false;
+        fs.unlinkSync(validated);
+        return true;
+    }
+
     /**
      * Load settings from file or return default settings
      * @returns {object} Settings object
@@ -432,12 +444,18 @@ class SettingsManager {
      */
     _saveImmediately() {
         try {
-            if (!SecurityUtils.safeExistsSync(this.configDir)) {
-                fs.mkdirSync(this.configDir, { recursive: true });
+            const configDir = path.dirname(this.configFile);
+            const validatedConfigDir = this.resolveSafePath(configDir, process.cwd());
+            if (!validatedConfigDir) {
+                throw new Error('Invalid configuration directory');
+            }
+
+            if (!SecurityUtils.safeExistsSync(validatedConfigDir, process.cwd())) {
+                SecurityUtils.safeMkdirSync(validatedConfigDir, process.cwd(), { recursive: true });
             }
             
             const content = JSON.stringify(this.settings, null, 4);
-            SecurityUtils.safeWriteFileSync(this.configFile, content, path.dirname(this.configFile), 'utf8');
+            SecurityUtils.safeWriteFileSync(this.configFile, content, validatedConfigDir, 'utf8');
             
             // Create backup if enabled
             if (this.settings.backup?.enabled) {
@@ -466,13 +484,19 @@ class SettingsManager {
             }
 
             if (!SecurityUtils.safeExistsSync(validatedBackupDir, process.cwd())) {
-                fs.mkdirSync(validatedBackupDir, { recursive: true });
+                SecurityUtils.safeMkdirSync(validatedBackupDir, process.cwd(), { recursive: true });
             }
             
             const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
             const backupFile = path.join(validatedBackupDir, `config-${timestamp}.json`);
+            const validatedConfigFile = this.resolveSafePath(this.configFile, process.cwd());
+            const validatedBackupFile = this.resolveSafePath(backupFile, process.cwd());
+            if (!validatedConfigFile || !validatedBackupFile) {
+                console.error('Error creating backup: Invalid source or destination path');
+                return;
+            }
             
-            fs.copyFileSync(this.configFile, backupFile);
+            fs.copyFileSync(validatedConfigFile, validatedBackupFile);
             
             // Clean old backups
             this.cleanupOldBackups(validatedBackupDir);
@@ -486,17 +510,20 @@ class SettingsManager {
      */
     cleanupOldBackups(backupDirectory = null) {
         try {
-            const activeBackupDir = backupDirectory || this.backupDir;
+            const activeBackupDir = this.resolveSafePath(backupDirectory || this.backupDir, process.cwd());
+            if (!activeBackupDir) {
+                return;
+            }
             if (!SecurityUtils.safeExistsSync(activeBackupDir, process.cwd())) {
                 return;
             }
 
-            const files = fs.readdirSync(activeBackupDir)
+            const files = (SecurityUtils.safeReaddirSync(activeBackupDir, process.cwd()) || [])
                 .filter(file => file.startsWith('config-') && file.endsWith('.json'))
                 .map(file => ({
                     name: file,
                     path: path.join(activeBackupDir, file),
-                    mtime: fs.statSync(path.join(activeBackupDir, file)).mtime
+                    mtime: (SecurityUtils.safeStatSync(path.join(activeBackupDir, file), process.cwd()) || { mtime: new Date(0) }).mtime
                 }))
                 .sort((a, b) => b.mtime - a.mtime);
             
@@ -506,7 +533,7 @@ class SettingsManager {
                 : 1;
             if (files.length > maxBackups) {
                 files.slice(maxBackups).forEach(file => {
-                    fs.unlinkSync(file.path);
+                    this.safeDeleteFile(file.path, process.cwd());
                 });
             }
         } catch (error) {
@@ -546,52 +573,49 @@ class SettingsManager {
             
             // 2. Remove actual configuration files used by the system
             const packageDir = path.resolve(__dirname, '..');
+            const projectRoot = process.cwd();
             const settingsDir = path.join(packageDir, 'settings');
             
             // Main configuration file
             const mainConfigPath = path.join(settingsDir, 'i18ntk-config.json');
-            if (SecurityUtils.safeExistsSync(mainConfigPath)) {
-                fs.unlinkSync(mainConfigPath);
+            if (this.safeDeleteFile(mainConfigPath, packageDir)) {
                 console.log('✅ Main configuration file removed');
             }
             
             // Project configuration file
             const projectConfigPath = path.join(settingsDir, 'project-config.json');
-            if (SecurityUtils.safeExistsSync(projectConfigPath)) {
-                fs.unlinkSync(projectConfigPath);
+            if (this.safeDeleteFile(projectConfigPath, packageDir)) {
                 console.log('✅ Project configuration removed');
             }
             
             // Setup tracking file
             const setupFile = path.join(settingsDir, 'setup.json');
-            if (SecurityUtils.safeExistsSync(setupFile)) {
-                fs.unlinkSync(setupFile);
+            if (this.safeDeleteFile(setupFile, packageDir)) {
                 console.log('✅ Setup tracking cleared');
             }
             
             // 3. Clear all backup files from backups directory
             const backupsDir = path.join(packageDir, 'backups');
-            if (SecurityUtils.safeExistsSync(backupsDir)) {
-                const backupFiles = fs.readdirSync(backupsDir);
+            if (SecurityUtils.safeExistsSync(backupsDir, packageDir)) {
+                const backupFiles = SecurityUtils.safeReaddirSync(backupsDir, packageDir) || [];
                 for (const file of backupFiles) {
                     if (file.endsWith('.json') || file.endsWith('.bak')) {
-                        fs.unlinkSync(path.join(backupsDir, file));
+                        this.safeDeleteFile(path.join(backupsDir, file), packageDir);
                     }
                 }
                 console.log('✅ All backup files cleared');
             }
             
-            // 4. Clear admin PIN configuration (multiple possible locations including root)
+            // 4. Clear admin PIN configuration (package/project scope only)
             const adminConfigPaths = [
                 path.join(packageDir, '.i18n-admin-config.json'),
                 path.join(settingsDir, '.i18n-admin-config.json'),
                 path.join(settingsDir, 'admin-config.json'),
-                path.join(packageDir, '..', '.i18n-admin-config.json') // Root level
+                path.join(projectRoot, '.i18n-admin-config.json')
             ];
             
             for (const adminConfigPath of adminConfigPaths) {
-                if (SecurityUtils.safeExistsSync(adminConfigPath)) {
-                    fs.unlinkSync(adminConfigPath);
+                if (this.safeDeleteFile(adminConfigPath, projectRoot)) {
                     console.log('✅ Admin PIN configuration cleared');
                 }
             }
@@ -603,8 +627,7 @@ class SettingsManager {
             ];
             
             for (const initFile of initFiles) {
-                if (SecurityUtils.safeExistsSync(initFile)) {
-                    fs.unlinkSync(initFile);
+                if (this.safeDeleteFile(initFile, packageDir)) {
                     console.log('✅ Initialization tracking cleared');
                 }
             }
@@ -616,10 +639,10 @@ class SettingsManager {
             ];
             
             for (const cacheDir of cacheDirs) {
-                if (SecurityUtils.safeExistsSync(cacheDir)) {
-                    const cacheFiles = fs.readdirSync(cacheDir);
+                if (SecurityUtils.safeExistsSync(cacheDir, packageDir)) {
+                    const cacheFiles = SecurityUtils.safeReaddirSync(cacheDir, packageDir) || [];
                     for (const file of cacheFiles) {
-                        fs.unlinkSync(path.join(cacheDir, file));
+                        this.safeDeleteFile(path.join(cacheDir, file), packageDir);
                     }
                     console.log('✅ Cache cleared');
                 }
@@ -639,9 +662,7 @@ class SettingsManager {
             ];
             
             for (const tempFile of tempFiles) {
-                if (SecurityUtils.safeExistsSync(tempFile)) {
-                    fs.unlinkSync(tempFile);
-                }
+                this.safeDeleteFile(tempFile, packageDir);
             }
             console.log('✅ Temporary files cleared');
             
@@ -656,8 +677,7 @@ class SettingsManager {
             ];
             
             for (const file of additionalFiles) {
-                if (SecurityUtils.safeExistsSync(file)) {
-                    fs.unlinkSync(file);
+                if (this.safeDeleteFile(file, packageDir)) {
                     console.log(`✅ Removed ${path.basename(file)}`);
                 }
             }

package/utils/npm-version-warning.js

@@ -108,6 +108,11 @@ async function printUpgradeWarningIfOutdated({
   currentVersion,
   timeoutMs = DEFAULT_TIMEOUT_MS
 }) {
+  const enabled = String(process.env.I18NTK_ENABLE_UPDATE_CHECK || '').toLowerCase();
+  if (!(enabled === '1' || enabled === 'true' || enabled === 'yes')) {
+    return;
+  }
+
   if (process.env.I18NTK_DISABLE_UPDATE_CHECK === 'true') {
     return;
   }