unstale

npm / i18next-fs-backend

i18next-fs-backend

What changed in i18next-fs-backend 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-27.

2 breaking4 security1 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

i18next-fs-backend 27 changes

Breaking changes 2

  • Refuses paths whose root differs from the template's root, preventing lng or ns values from changing the resulting path type.

    2.6.9release notes

  • Filesystem paths are no longer built when ns contains traversal sequences, separators, control characters, prototype keys, or exceeds 128 characters, preventing arbitrary filesystem reads and writes.

    2.6.4release notes

Security 4

  • Path traversal now descends only into own properties, closing an unauthenticated denial of service that could overwrite inherited Object.prototype members.

    2.6.8release notes

  • write() now iterates only own enumerable keys of queuedWrites, preventing prototype pollution from causing writeFile() calls.

    2.6.7release notes

  • Missing-key writes now refuse to traverse __proto__, constructor, or prototype segments, preventing prototype pollution from crafted keys.

    2.6.6release notessecurity advisory

  • i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite

    2.6.4security advisoryrelease notes

Fixes and other changes 1

  • Namespace values may contain forward slashes again, allowing nested namespace names to load from subfolder locale files.

    2.6.5release notes