Left a message about it on the Commons gadget talk page (message, permalink).

At a glance, wikis which have their own copy of HotCat instead of hotloading from Commons include azbwiki, cebwiki, fawiki, idwikimedia, labswiki, mkwiki, mkwiktionary, nowiktionary, pswiki, ruwiktionary, urwikiquote, fdcwiki.

Its a really common pattern to do <msg>/langcode. Its even supported by us if the msg is not content language msg (which would be insane for a js msg).

Given that, i think maybe we should have mw consider anything where the base page name ends in .js in NS_MEDIAWIKI to be a js msg

Enwiki’s version uses regex literals and even functions, which are not allowed in JSON (they could be evaluated strings, of course, but code evaluation should be avoided, otherwise JSON’s protection is lost), meaning the possibility to use JavaScript has to be kept. So the following order might be good (if a page higher on the list is present, the script should not go any further):

1. MediaWiki:Gadget-HotCat.js/local_defaults.json evaluated as JSON
2. MediaWiki:Gadget-HotCat.js/local_defaults.js evaluated as JavaScript
3. MediaWiki:Gadget-HotCat.js/local_defaults evaluated as JavaScript, restricted (possibly based on MediaWiki version: enabled the current stable release as of the implementation of this change, disabled in any later wmf or stable version)

Small comment: this can be mitigated without changing HotCat’s code ASAP by changing content model of such pages in every project to JavaScript (as it should be made, since it vastly improves their editing).

How about visiting all affected wikis and changing the content model? https://global-search.toolforge.org/?q=HotCat&namespaces=8&title=.*%5C%2Flocal+defaults