Stop writing defaultLocale to localStorage without consent

[Gutts-n]

What changed

Data Explorer sets a browser locale in localStorage (key defaultLocale) every time it loads, on any dataset/resource page, before the visitor has agreed to any cookie or storage consent. This got flagged in a compliance review (Support-Services#1005) because storing anything on a visitor's device without consent is not allowed under PECR, even if it is not a cookie.

Think of it like this: the app was quietly writing itself a sticky note in the visitor's browser saying "this person prefers English" the moment the page opened, without asking first. The fix removes that sticky note entirely — the app still figures out what language to show, it just stops writing it down in the visitor's browser.

Where

ckanext/dataexplorer/fanstatic/js/main.6dcb79ac.chunk.js — this is a built/minified bundle (the repo does not carry the pre-build React source), so the change is a targeted patch of the i18next-browser-languagedetector config baked into that file:

• Removed "cookie" and "localStorage" from the detector order list.
• Added caches: [] so the library is explicitly told never to persist the detected locale anywhere.
• Detection still works via querystring, navigator (browser language header), htmlTag, path, subdomain — none of those touch device storage.

Verified

• node --check on the patched bundle: syntax OK.
• Confirmed the exact same defaultLocale localStorage write on the live York Open Data site (data.yorkopendata.org) before this fix, matching the reporter's description.

Not verified

• Did not run the full Data Explorer UI against this patched bundle locally (no dev/build environment set up in this session) — recommend a quick manual smoke test (load a dataset page, confirm Table/Chart/Map tabs still render and language still switches via URL ?lng=) before merging.
• Did not check whether any other bundle/plugin in this repo (map/chart/table view bundles) has its own separate i18next init with the same detector config — only main.6dcb79ac.chunk.js was searched and patched.

Deployment

This repo is pulled by client Dockerfiles via pip install -e git+https://github.com/datopian/ckanext-dataexplorer-react.git. Merging this alone does not deploy anything — each client image (e.g. dx-helm-york-prod) needs a rebuild/redeploy to pick up the fix.

Fixes datopian/Support-Services#1005

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: da7d816b-abdc-443f-befb-1a43534600c4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}