Skip to content
kandown
103 releases

Changelog

2026-07-27

v0.41.3· Safer i18n

Fixed

  • Three i18n strings no longer go through dangerouslySetInnerHTML. EmptyState.tsx (two sites: emptyState.unsupportedBrowserDesc, emptyState.selectFolderDesc) and ConflictModal.tsx (conflict.conflictingChanges, which interpolates {{taskId}}) now use the <Trans> component from react-i18next with a children-template pattern. The English children declare the HTML structure (<code>, <strong>) and the {{var}} placeholders; react-i18next maps the matching HTML from each of the 48 locale JSONs onto those tags, and the interpolated task id is React-escaped instead of being injected raw. Severity was low because the strings come from project-controlled locale files, not user content, but a translation contributed through a PR was still a plausible injection path. Closes [[t242]].