fix(deps): update dependency next-intl to v4.9.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next-intl (source)	4.8.3 → 4.9.1

---

next-intl has an open redirect vulnerability

CVE-2026-40299 / GHSA-8f24-v5vv-gm5j

More information

Details

Impact

Applications using the next-intl middleware with localePrefix: 'as-needed' could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative // or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL.

Patches

The problem has been patched, please update to [email protected].

Credits

Many thanks to Joni Liljeblad from Oura for responsibly disclosing the vulnerability and for suggesting the fix.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/amannn/next-intl/security/advisories/GHSA-8f24-v5vv-gm5j
• https://github.com/amannn/next-intl/pull/2304
• https://github.com/amannn/next-intl/commit/1c80b668aa6d853f470319eec10a3f61e78a70e6
• https://github.com/amannn/next-intl/releases/tag/v4.9.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-40299
• https://github.com/advisories/GHSA-8f24-v5vv-gm5j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

amannn/next-intl (next-intl)

v4.9.1

Compare Source

Bug Fixes

• Improve middleware pathname validation (#​2304) (1c80b66) – by @​amannn

v4.9.0

Compare Source

Features

• Support transitionTypes on Link (#​2302) (02811f5) – by @​amannn

v4.8.4

Compare Source

Bug Fixes

• Remove TypeScript peer dependency and update examples to TypeScript v6 (#​2293) (5e7bcd7) – by @​wojtekmaj

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
shiro	Error		Apr 11, 2026 0:37am

[safedep]

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
@emnapi/core @ 1.9.2 pnpm-lock.yaml				🔗
@emnapi/runtime @ 1.9.2 pnpm-lock.yaml				🔗
@emnapi/wasi-threads @ 1.2.1 pnpm-lock.yaml				🔗
@formatjs/bigdecimal @ 0.2.0 pnpm-lock.yaml				🔗
@formatjs/ecma402-abstract @ 3.2.0 pnpm-lock.yaml				🔗
@formatjs/fast-memoize @ 3.1.1 pnpm-lock.yaml				🔗
@formatjs/icu-messageformat-parser @ 3.5.3 pnpm-lock.yaml				🔗
@formatjs/icu-skeleton-parser @ 2.1.3 pnpm-lock.yaml				🔗
@formatjs/intl-localematcher @ 0.8.2 pnpm-lock.yaml				🔗
@napi-rs/wasm-runtime @ 1.1.3 pnpm-lock.yaml				🔗
@oxc-project/types @ 0.124.0 pnpm-lock.yaml				🔗
@rolldown/binding-android-arm64 @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-darwin-arm64 @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-darwin-x64 @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-freebsd-x64 @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-linux-arm-gnueabihf @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-linux-arm64-gnu @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-linux-arm64-musl @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-linux-ppc64-gnu @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-linux-s390x-gnu @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-linux-x64-gnu @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-linux-x64-musl @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-openharmony-arm64 @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-wasm32-wasi @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-win32-arm64-msvc @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/binding-win32-x64-msvc @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@rolldown/pluginutils @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
@swc/core @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-darwin-arm64 @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-darwin-x64 @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-linux-arm-gnueabihf @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-linux-arm64-gnu @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-linux-arm64-musl @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-linux-ppc64-gnu @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-linux-s390x-gnu @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-linux-x64-gnu @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-linux-x64-musl @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-win32-arm64-msvc @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-win32-ia32-msvc @ 1.15.24 pnpm-lock.yaml				🔗
@swc/core-win32-x64-msvc @ 1.15.24 pnpm-lock.yaml				🔗
@swc/types @ 0.1.26 pnpm-lock.yaml				🔗
icu-minify @ 4.9.1 pnpm-lock.yaml				🔗
intl-messageformat @ 11.2.0 pnpm-lock.yaml				🔗
next-intl @ 4.9.1 pnpm-lock.yaml				🔗
next-intl-swc-plugin-extractor @ 4.9.1 pnpm-lock.yaml				🔗
picomatch @ 4.0.4 pnpm-lock.yaml				🔗
postcss @ 8.5.9 pnpm-lock.yaml				🔗
rolldown @ 1.0.0-rc.15 pnpm-lock.yaml				🔗
tinyglobby @ 0.2.16 pnpm-lock.yaml				🔗
use-intl @ 4.9.1 pnpm-lock.yaml				🔗

View complete scan results →

_{This report is generated by SafeDep Github App}