this is not worth a security advisory or special announcement because
this is run on verified data (the .po files), but it is still worth fixing in case something escapes our reviews.