Sonatype reports vulnerabilities in i18next version used by aurelia-i18n

[adityazagade]

• Library Version: 3.1.4

• Operating System: Windows10

• Node Version: v12.21.0

• NPM Version: 6.14.11

• Browser: all

• Language: (Don't know what to put here) all | TypeScript X.X | ESNext

Current behavior: Sonatype has reported security vulneribilities in i18next v14.1.1 sonatype-2020-0598 8.1 i18next : 14.1.1 sonatype-2020-0577 7.5 i18next : 14.1.1 sonatype-2021-0184 7.5 i18next : 14.1.1

CVSS scores of 8.1, 7.5 are high.

However using 19.8.5 by doing npm forced causes build to fail with the following error: /aurelia-i18n/dist/aurelia-i18n.d.ts(8,49): error TS2503: Cannot find namespace 'i18next'. /aurelia-i18n/dist/aurelia-i18n.d.ts(12,49): error TS2503: Cannot find namespace 'i18next'. /aurelia-i18n/dist/aurelia-i18n.d.ts(29,43): error TS2503: Cannot find namespace 'i18next'. /aurelia-i18n/dist/aurelia-i18n.d.ts(31,37): error TS2503: Cannot find namespace 'i18next'. /aurelia-i18n/dist/aurelia-i18n.d.ts(36,39): error TS2503: Cannot find namespace 'i18next'. /aurelia-i18n/dist/aurelia-i18n.d.ts(173,31): error TS2503: Cannot find namespace 'i18next'. TypeScript: 6 semantic errors

I think that the changes made i18next 19.0.0 have cause these breaking changes. Pls look at their change.md file for more details.

• What is the expected behavior? All these are fixed in i18next version 19.8.5 or higher. Could this dependency be updated?

[adityazagade]

By changing the import statement in aurelia-i18n.d.ts, to

import * as i18next from "i18next";

I was able to build.

[adityazagade]

@zewa666 @Sayan751 @krisha2

[adubois1337]

Is there any plan to roll this package upgrade into a future release?