# 0.41.3 — 2026-07-27 — "Safer i18n"

## Fixed

- **Three i18n strings no longer go through `dangerouslySetInnerHTML`.** `EmptyState.tsx` (two sites: `emptyState.unsupportedBrowserDesc`, `emptyState.selectFolderDesc`) and `ConflictModal.tsx` (`conflict.conflictingChanges`, which interpolates `{{taskId}}`) now use the `<Trans>` component from `react-i18next` with a children-template pattern. The English children declare the HTML structure (`<code>`, `<strong>`) and the `{{var}}` placeholders; `react-i18next` maps the matching HTML from each of the 48 locale JSONs onto those tags, and the interpolated task id is React-escaped instead of being injected raw. Severity was low because the strings come from project-controlled locale files, not user content, but a translation contributed through a PR was still a plausible injection path. Closes [[t242]].