install is synchronous: app.use(i18n) now throws the errors in install, which were unhandled rejections, and i18n.install() returns undefined instead of a Promise that never settled in development without the devtools. (#2740)
escapeParameter: The sanitizer now also disables javascript: URLs in xlink:href, and turns <base>, <animate> and <set> in translations into text. SVG animations with <animate> or <set> in HTML messages no longer run while escapeParameter is enabled. (b27a50e4) See GHSA-473g-cvf6-mfxj.
What's Changed
🐛 Bug Fixes
- fix: make install synchronous like other Vue plugins, so that app.use() throws its errors by @kazupon in #2740
🔒 Security Fixes
- fix(shared): neutralize xlink:href, base and SVG animations in sanitizeTranslatedHtml (b27a50e4)
📝️ Documentations
- docs: describe what missingWarn and fallbackWarn turn off, and how to warn only when no locale has the key by @kazupon in #2743
- docs: describe when the warning of the fallback to root is output by @kazupon in #2746
- docs: add Locale Guard to third-party tooling by @Mohamed-Almarag in #2750
New Contributors
- @Mohamed-Almarag made their first contribution in #2750
Full Changelog: v12.0.0-alpha.7...v12.0.0-alpha.8