New Crowdin updates

[cuberhaus]

No description provided.

[cursor]

Stale comment

Security review — PR #198

Result: No high-confidence vulnerabilities found.

This PR only updates English locale JSON (locales/en/*.json): emoji additions to demo copy and removal of certifications.all from ui.json. No application code, dependencies, auth, secrets, or server-side logic changed.

Checklist

Area	Assessment
Injection (SQL, command, template, path)	N/A — static translation strings only
Authn/authz	N/A — no auth-related changes
Secrets / token leakage	None — no credentials or logging changes
XSS	No new risk — see note below
SSRF / CSRF / deserialization	N/A
Supply chain	None — no dependency changes

Diff-specific notes

1. demos.json lead field (emoji + existing HTML) — The lead string still contains the same <strong> / <a href="https://www.ccma.cat/..."> markup as before; only a leading 🏆 was added. It is rendered via set:html in DemoHeader.astro, which is a pre-existing trust boundary (Crowdin/source-controlled locale content). This PR does not introduce new HTML tags, event handlers, or untrusted URLs.

2. mpids-demo.json / sbc-demo.json (emoji in labels) — These strings are rendered as React text nodes (MPIDSDemo.tsx, SbcDemo.tsx), not as HTML. Unicode emoji/symbols are not an injection vector here.

3. ui.json removal of certifications.all — This is a functional/i18n parity issue (EN pages will miss the “All” filter label while es/ca retain the key; Certifications.astro still calls t('certifications.all')). It is not a security vulnerability.

Pre-existing context (not introduced by this PR)

Locale strings passed to set:html (e.g. demo lead copy) assume trusted translators. If that trust model ever changes, consider HTML sanitization at render time — but that is outside the scope of this Crowdin sync.

---

Automated security review — Cursor Automation

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review — PR #198

Verdict: No high-confidence vulnerabilities found.

Reviewed the full PR diff against main (UI polish + Crowdin locale sync on l10n_main). The latest synchronize push (a62f841…b4b869b) is a no-op at the tree level (identical trees); findings below apply to the cumulative PR state vs main.

Scope reviewed

Area	Result
Injection (SQL/command/template/path)	No new sinks or user-controlled inputs
Authn/authz	N/A — static site; no auth changes
Secrets / token leakage	No credentials or tokens in the diff
XSS / HTML injection	No new set:html / dangerouslySetInnerHTML usage
SSRF / CSRF / deserialization	No new network handlers or parsers
Dependencies / supply chain	Patch-level bumps only (astro, @sentry/astro, lucide-react, dev tooling); actions/checkout@v6 → v7

Change summary (security-relevant)

• Locale JSON (locales/{en,es,ca}/*.json): copy/emoji tweaks and new UI keys (certifications.all, demo.categories.*, work.client). Plain text or pre-existing HTML in demos.json lead fields.
• Components (Demos.astro, Certifications.astro, demo islands): client-side category/issuer filtering via data-* attributes and textContent/classList — no innerHTML with untrusted data.
• Data (src/data/demos.json): adds category labels from maintainer-controlled metadata.
• Tooling (.cursor/skills/**, extract-icons.cjs): dev/CI-only; not served in production.

Pre-existing note (not introduced by this PR)

DemoHeader.astro renders demos.json lead via set:html. That HTML-in-translation pattern predates this PR; Crowdin compromise could theoretically inject markup, but this PR does not expand that surface (it only removes a leading emoji from existing lead strings).

Uncertain / out of scope

• lucide-react and other dependency bumps were not audited for unpublished CVEs beyond routine patch-level expectations.
• .cursor/skills/ui-ux-pro-max/scripts/*.py were not executed or reviewed for runtime safety; they are not part of the deployed static site.

---

Automated security review — Cursor Automation

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review — PR #198

Result: No high-confidence vulnerabilities found

Reviewed the full diff (a62f841…9873780): 4 locale JSON files only (locales/ca|es/{certifications,ui}.json). No application code, config, workflow, or dependency changes.

Checklist summary

Area	Finding
Injection (SQL, command, template, path traversal)	Not applicable — static JSON translation data, no runtime evaluation
Authn / authz	No changes
Secrets / token leakage	None — no credentials or sensitive values in diff
Deserialization / SSRF / CSRF	Not applicable
XSS	No new exposure — changed strings are plain text (UI labels, month names). Existing render paths use Astro/React text interpolation ({c.issued}, {t(...)}), which auto-escape HTML. No innerHTML, dangerouslySetInnerHTML, or URL fields introduced in this diff
Supply chain / dependencies	No dependency changes

Content-quality note (non-security)

The Catalan certifications.json changes appear to permute issued dates across indices, and both ca/es add a "16" entry while locales/en/certifications.json and src/data/certifications.json still have 16 entries (indices 0–15). This is a translation parity / data-integrity concern for CI, not a security vulnerability.

Residual (low-confidence) context

Crowdin-sourced locale PRs inherit the trust model of the translation pipeline: a compromised Crowdin account could theoretically inject HTML/JS into strings consumed by unsafe sinks elsewhere in the app. This diff does not touch such sinks, and the changed values contain no markup or script payloads.

---

Automated security review — no code changes recommended from a security standpoint.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review — PR #198

Result: No high-confidence vulnerabilities found.

Scope reviewed

This PR modifies three locale JSON files only:

• locales/ca/certifications.json — issue-date reordering + new key "16"
• locales/es/certifications.json — issue-date updates + new key "16"
• locales/es/ui.json — two UI label string updates

No application code, dependencies, CI configuration, or secrets were changed.

Checklist

Area	Finding
Injection (SQL, command, template, path traversal)	Not applicable — static translation strings only.
Authn / authz	No changes to authentication, authorization, or permission boundaries.
Secrets / logging	No credentials, tokens, or logging changes in the diff.
XSS	Changed strings are plain text (e.g. "Personaliza las secciones", "Trabajo Profesional", month/year labels). Certification issued values render as Astro text content ({c.issued}), which is auto-escaped. UI strings flow through the existing t() i18n helper without dangerouslySetInnerHTML or set:html. No HTML/script payloads introduced.
Deserialization / SSRF / CSRF	No server-side logic or network call changes.
Supply chain	No new or updated dependencies. Crowdin sync content in this diff is benign.

Uncertain / non-security note

The PR adds locale key "16" in es and ca certifications.json, while src/data/certifications.json and locales/en/certifications.json contain 16 entries (keys 0–15). This is a data-parity / content-integrity concern (likely to fail content-parity tests), not a security vulnerability. No action required from a security standpoint.

---

Automated security review — evidence limited to the PR diff.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security Review — PR #198

Verdict: No high-confidence vulnerabilities found.

Scope reviewed

This synchronize event touches 5 locale JSON files only (locales/{ca,en,es}/certifications.json, locales/{ca,es}/ui.json). No application code, dependencies, CI config, or secrets were changed.

Checklist results

Area	Result
Injection (SQL, command, template, path traversal)	Not applicable — no executable code or dynamic query/path construction
Authn / authz bypass	Not applicable — no auth or permission logic touched
Secrets / token leakage	None — no credentials or sensitive values in the diff
Deserialization / SSRF / CSRF	Not applicable — static translation data only
XSS	No new risk in this diff — changed strings are plain text (month/year dates, nav labels). They are rendered via Astro text interpolation ({c.issued}) and React JSX text nodes (<legend>{labels.sectionsTitle}</legend>), which auto-escape HTML. No dangerouslySetInnerHTML, set:html, or innerHTML usage is introduced by these files.
Supply chain / dependencies	None — no package.json or lockfile changes

Changed content (non-security)

• Certification issued date reordering across locales.
• New locale key "16" for certifications (aligns with a 17th data entry if one was added upstream; otherwise a content-parity concern, not a security issue).
• UI copy updates: cvSectionsTitle, nav.work.

Process note (informational, not a finding)

Crowdin translation PRs are a general trust boundary for user-visible strings. A malicious or compromised translation could theoretically introduce XSS payloads if the app ever rendered locale strings as raw HTML. This diff contains no markup or script-like content, and the existing rendering paths for the touched keys use safe text interpolation. No action required for this PR from a security standpoint.

---

Automated security review — evidence based on diff a62f841…ef5dca3.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review

Verdict: No high-confidence vulnerabilities found

Reviewed diff a62f841..9b5bf31 (5 files, locale JSON only).

Scope

File	Change
locales/{en,es,ca}/certifications.json	Reordered/updated issued date strings; added keys 16 (en) and 16–17 (es/ca)
locales/{es,ca}/ui.json	Copy updates for about.cvSectionsTitle and nav.work

No application code, dependencies, CI/config, secrets, or network-facing logic changed.

Checklist (threat-focused)

Area	Result
Injection (SQL, command, template, path traversal)	N/A — static translation strings, no dynamic query/command construction
Authn / authz bypass	N/A — no auth or permission logic touched
Secrets / token leakage	None — no credentials, tokens, or sensitive values in diff
Unsafe deserialization / SSRF / CSRF	N/A — no request handling or deserialization changes
XSS	No issue in this diff — changed values are plain text (dates, labels). issued is rendered via Astro text interpolation ({c.issued}), which HTML-escapes by default; UI strings use the same t() path as existing copy
Supply chain / dependencies	N/A — no lockfile or package changes

Uncertain / out of scope (not introduced here)

• Crowdin supply chain: Locale files are translator-editable. A malicious Crowdin contributor could theoretically submit HTML/JS in future strings. Mitigation is existing framework escaping plus CI parity tests; this PR’s strings contain no markup or script payloads.
• Locale/data parity: locales/en/certifications.json now has 17 entries (0–16) and locales/es/locales/ca have 18 (0–17), while src/data/certifications.json on main has 16 items (0–15). That is a content-integrity concern for content-parity tests, not a security vulnerability.

Remediation

None required for security. If parity CI fails, align locale key counts with src/data/certifications.json in the companion data PR or Crowdin sync.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review — PR #198

Verdict: No high-confidence vulnerabilities found.

Scope

Reviewed diff a62f841…8f40e3a (5 files, locale JSON only):

• locales/{en,es,ca}/certifications.json — reordered issued date strings; added keys 16 and 17
• locales/{ca,es}/ui.json — copy updates for about.cvSectionsTitle and nav.work

No application code, build/config, dependency, or secret changes.

Checklist

Area	Result
Injection (SQL, command, template, path traversal)	N/A — no queries, shell, templates, or filesystem paths
Authn/authz bypass	N/A — static site; no auth boundaries touched
Secrets / token leakage	None — only human-readable UI/date strings
Deserialization / SSRF / CSRF	N/A — no runtime request handling
XSS	No issue in this diff — changed strings are rendered as plain text ({c.issued} in Certifications.astro; t('about.cvSectionsTitle') / nav.work via useTranslations), not set:html / dangerouslySetInnerHTML
Supply chain	None — no package.json or lockfile changes

Notes (informational, not findings)

• Locale files are a general trust boundary (Crowdin → repo). The changed values are benign date labels and nav/UI copy with no HTML, URLs, or script content.
• Keys 16/17 in certifications.json locales exceed the current 16-entry src/data/certifications.json array; that is a content-parity concern for CI, not a security defect.

Check result: pass — safe to merge from a security perspective.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review — no high-confidence vulnerabilities found

Verdict: Pass (no confirmed vulnerabilities in this diff)

Scope

This PR only modifies Crowdin-sourced locale JSON:

• locales/{en,es,ca}/certifications.json — issued date strings reordered/added
• locales/{ca,es}/ui.json — two plain-text UI label updates (cvSectionsTitle, nav.work)

No application code, dependencies, secrets, auth logic, or build/CI configuration changed.

Checklist results

Area	Result
Injection (SQL, command, template, path traversal)	Not applicable — static JSON strings only
Authn/authz bypass	Not applicable — no auth surface touched
Secrets / token leakage / insecure logging	None — no credentials or sensitive values in diff
Unsafe deserialization / SSRF / CSRF	Not applicable — no runtime request handling changed
XSS	No issue in changed strings — updated values are plain text (month names, UI labels). They render via Astro/React text interpolation ({c.issued}, {t('…')}), not set:html / dangerouslySetInnerHTML
Dependency / supply-chain risk	None introduced — no package.json or lockfile changes

Notes (informational, not findings)

• Crowdin supply chain (pre-existing): Locale files are third-party translated content. If malicious HTML/JS were merged into strings that are later rendered unsafely, XSS could occur — but the keys changed in this PR use safe text rendering paths, and the new content contains no markup or script.
• Locale key drift (data integrity, not security): At PR head, certification locale indices (en: 18, es/ca: 19) exceed src/data/certifications.json length (16). Extra indices are ignored by flattenForLocale and should fail content-parity tests; this is a content-sync concern, not a security boundary issue.

No remediation required from a security standpoint.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Security review — no high-confidence vulnerabilities found

Scope: Crowdin locale sync only (locales/{en,es,ca}/certifications.json, locales/{es,ca}/ui.json). No application code, dependencies, auth, or infrastructure changes.

Checklist

Area	Result
Injection (SQL, command, template, path traversal)	Not applicable — static JSON string updates only
Authn / authz bypass	Not applicable — no auth or permission logic touched
Secrets / token leakage	None — no credentials, tokens, or sensitive values in the diff
XSS	No risk identified — changed strings are plain month labels and UI copy; issued renders via Astro text interpolation ({c.issued}) and UI keys (cvSectionsTitle, nav.work) are passed as text content, not innerHTML
SSRF / CSRF / unsafe deserialization	Not applicable
Dependency / supply-chain	No dependency changes

Changed content (benign)

• Certification issued date strings reordered/extended (e.g. "Jul 2026", "Maig 2026").
• UI copy tweaks: CV section title and nav label ("Treball Professional", "Trabajo Profesional").

Residual process note (informational, not a finding)

Crowdin remains the translation supply chain for locale files. Existing repo controls (content-parity tests, PR review) are the appropriate mitigations; this diff does not introduce executable content or markup.

Verdict: ✅ No actionable security issues in this changeset.

  

_{Sent by Cursor Automation: Find vulnerabilities}