From 2879c57ef3196e907a1cb56e7bf1bcae4939d896 Mon Sep 17 00:00:00 2001
From: Karl Bauer <kb@de.bauer-group.com>
Date: Sun, 11 Oct 2026 01:23:48 +0200
Subject: [PATCH] fix(deps): updated i18next-http-backend to 4.0.2

Resolved Dependabot alert GHSA-xvq9-wjp8-hwqf (incomplete URL
validation permits SSRF, low). The fix only exists in 4.0.2; the 3.x
line ends at 3.0.6, so the previous ^3.0.6 range could never resolve
to a patched release and a direct major update was required.

Breaking changes in 4.0 checked against this app:
* cross-fetch dropped, host fetch required - the backend only runs in
  the browser (Vite SPA/PWA), where native fetch is always present
* Node >= 18 required - CI and Docker build use Node 24 (.nvmrc)
* package exports map and default export unchanged, so the existing
  `import ... from 'i18next-http-backend'` and loadPath config stay
  as they are; no source changes needed

Lockfile now drops cross-fetch and the node-fetch subtree (node-fetch,
whatwg-url, tr46, webidl-conversions) that only 3.x pulled in. No
npm overrides were added.
---
 package-lock.json | 63 +++++------------------------------------------
 package.json      |  2 +-
 2 files changed, 7 insertions(+), 58 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index ba1ae44..b4e4f59 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -23,7 +23,7 @@
         "html5-qrcode": "^2.3.8",
         "i18next": "^25.8.0",
         "i18next-browser-languagedetector": "^8.0.4",
-        "i18next-http-backend": "^3.0.6",
+        "i18next-http-backend": "^4.0.2",
         "lucide-react": "^0.563.0",
         "protobufjs": "^8.8.0",
         "react": "^19.2.4",
@@ -4388,15 +4388,6 @@
         "url": "https://opencollective.com/core-js"
       }
     },
-    "node_modules/cross-fetch": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/cross-fetch/-/cross-fetch-4.1.0.tgz",
-      "integrity": "sha512-uKm5PU+MHTootlWEY+mZ4vvXoCn4fLQxT9dSc1sXVMSFkINTJVN8cAQROpwcKm8bJ/c7rgZVIBWzH5T78sNZZw==",
-      "license": "MIT",
-      "dependencies": {
-        "node-fetch": "^2.7.0"
-      }
-    },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
       "dev": true,
@@ -5311,12 +5302,12 @@
       }
     },
     "node_modules/i18next-http-backend": {
-      "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/i18next-http-backend/-/i18next-http-backend-3.0.6.tgz",
-      "integrity": "sha512-mBOqy8993jtqAoj6XaI1XeC/8/9v6EPS+681ziegrPvTB0DoaCY7PpTS0SpY56qLMoS4OI1TZEM2Zf59zNh05w==",
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/i18next-http-backend/-/i18next-http-backend-4.0.2.tgz",
+      "integrity": "sha512-oay62dIB2kL7+WHzoUXBjWfL3+mwijD3pQkQkIEaRLhy6kjXxUhrRenV0gInwlCASAaJaDy94+XvYizK+cAGdA==",
       "license": "MIT",
-      "dependencies": {
-        "cross-fetch": "4.1.0"
+      "engines": {
+        "node": ">=18"
       }
     },
     "node_modules/idb": {
@@ -6249,26 +6240,6 @@
         "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
-    "node_modules/node-fetch": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
-      "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
-      "license": "MIT",
-      "dependencies": {
-        "whatwg-url": "^5.0.0"
-      },
-      "engines": {
-        "node": "4.x || >=6.0.0"
-      },
-      "peerDependencies": {
-        "encoding": "^0.1.0"
-      },
-      "peerDependenciesMeta": {
-        "encoding": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/node-releases": {
       "version": "2.0.57",
       "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.57.tgz",
@@ -7444,12 +7415,6 @@
         "node": ">=14.0.0"
       }
     },
-    "node_modules/tr46": {
-      "version": "0.0.3",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
-      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
-      "license": "MIT"
-    },
     "node_modules/tslib": {
       "version": "2.8.1",
       "license": "0BSD"
@@ -7917,22 +7882,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/webidl-conversions": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
-      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
-      "license": "BSD-2-Clause"
-    },
-    "node_modules/whatwg-url": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
-      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
-      "license": "MIT",
-      "dependencies": {
-        "tr46": "~0.0.3",
-        "webidl-conversions": "^3.0.0"
-      }
-    },
     "node_modules/which": {
       "version": "2.0.2",
       "dev": true,
diff --git a/package.json b/package.json
index 8727f53..4e1dc32 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "html5-qrcode": "^2.3.8",
     "i18next": "^25.8.0",
     "i18next-browser-languagedetector": "^8.0.4",
-    "i18next-http-backend": "^3.0.6",
+    "i18next-http-backend": "^4.0.2",
     "lucide-react": "^0.563.0",
     "protobufjs": "^8.8.0",
     "react": "^19.2.4",