fix(deps): update dependency i18next-http-middleware to ^3.9.8 (main)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
i18next-http-middleware	^3.9.7 → ^3.9.8

---

Release Notes

i18next/i18next-http-middleware (i18next-http-middleware)

v3.9.8

Compare Source

• security: validate lng/ns in missingKeyHandler before forwarding them to backendConnector.saveMissing(). The route params were used unvalidated, while the sibling getResourcesHandler already filtered them since 3.9.3. Because those values become the {{lng}}/{{ns}} segments of the backend's addPath, and route params arrive percent-decoded, a request such as POST /locales/add/..%2f..%2f..%2ftmp%2fpwned/x could write outside the locales directory on i18next-fs-backend; lng=__proto__ additionally reached that backend's queuedWrites path walk. Unsafe values now get a 400 and never reach the backend. The same isSafeLangIdentifier/isSafeNsIdentifier split applies, so legitimate values (including nested namespaces like a/b) are unaffected.
• security: apply utils.isSafeLangIdentifier to detected languages in LanguageDetector.detect(). Detected values come from untrusted request input (querystring, path, cookie, session, header) and were filtered only by utils.hasXSS, which targets markup payloads and does not reject .., /, \, control characters or prototype keys. With the default supportedLngs: false, i18next resolves any string, so a crafted ?lng= could reach the backend's loadPath as a traversal segment (arbitrary file read on i18next-fs-backend, request forgery on i18next-http-backend). The check runs after convertDetectedLanguage, so a custom converter cannot reintroduce an unsafe value. All five built-in detectors converge on this one filter.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 418ca4b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[netlify]

❌ Deploy Preview for modernjs-byted failed. Why did it fail? →

Name	Link
🔨 Latest commit	c465827
🔍 Latest deploy log	https://app.netlify.com/projects/modernjs-byted/deploys/6a76fb8d571d990008f40c41

[netlify]

❌ Deploy Preview for modernjs-byted failed. Why did it fail? →

Name	Link
🔨 Latest commit	418ca4b
🔍 Latest deploy log	https://app.netlify.com/projects/modernjs-byted/deploys/6a8933cdfb4cbc0008302ebb