Changelog
2026-07-27v0.41.3· Safer i18n
Fixed
- Three i18n strings no longer go through
dangerouslySetInnerHTML.EmptyState.tsx(two sites:emptyState.unsupportedBrowserDesc,emptyState.selectFolderDesc) andConflictModal.tsx(conflict.conflictingChanges, which interpolates{{taskId}}) now use the<Trans>component fromreact-i18nextwith a children-template pattern. The English children declare the HTML structure (<code>,<strong>) and the{{var}}placeholders;react-i18nextmaps the matching HTML from each of the 48 locale JSONs onto those tags, and the interpolated task id is React-escaped instead of being injected raw. Severity was low because the strings come from project-controlled locale files, not user content, but a translation contributed through a PR was still a plausible injection path. Closes [[t242]].