@depup/next-intl 4.9.0-depup.0 → 4.9.1-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/next-intl
 
 | Field | Value |
 |-------|-------|
-| Original | [next-intl](https://www.npmjs.com/package/next-intl) @ 4.9.0 |
-| Processed | 2026-04-01 |
+| Original | [next-intl](https://www.npmjs.com/package/next-intl) @ 4.9.1 |
+| Processed | 2026-04-10 |
 | Smoke test | passed |
 | Deps updated | 3 |
 
@@ -24,7 +24,7 @@ npm install @depup/next-intl
 |------------|------|-----|
 | @formatjs/intl-localematcher | ^0.8.1 | ^0.8.2 |
 | @parcel/watcher | ^2.4.1 | ^2.5.6 |
-| @swc/core | ^1.15.2 | ^1.15.21 |
+| @swc/core | ^1.15.2 | ^1.15.24 |
 
 ---
 

package/changes.json

@@ -10,9 +10,9 @@
     },
     "@swc/core": {
       "from": "^1.15.2",
-      "to": "^1.15.21"
+      "to": "^1.15.24"
     }
   },
-  "timestamp": "2026-04-01T20:19:00.237Z",
+  "timestamp": "2026-04-10T16:23:34.187Z",
   "totalUpdated": 3
 }

package/dist/esm/development/middleware/utils.js

@@ -186,9 +186,17 @@ function getLocaleAsPrefix(locale) {
 }
 function sanitizePathname(pathname) {
   // Sanitize malicious URIs, e.g.:
-  // '/en/\\example.org → /en/%5C%5Cexample.org'
-  // '/en////example.org → /en/example.org'
-  return pathname.replace(/\\/g, '%5C').replace(/\/+/g, '/');
+  // '/en/\\example.org'  → '/en/%5Cexample.org'     (backslash → %5C)
+  // '/en/\t/example.org' → '/en/example.org'        (WHATWG-stripped TAB)
+  // '/en/\n/example.org' → '/en/example.org'        (WHATWG-stripped LF)
+  // '/en/\r/example.org' → '/en/example.org'        (WHATWG-stripped CR)
+  // '/en////example.org' → '/en/example.org'        (consecutive slashes)
+  //
+  // U+0009/000A/000D are silently stripped by the WHATWG URL parser
+  // (https://url.spec.whatwg.org/#concept-url-parser). Without removing
+  // them here, a decoded TAB in a segment separator position causes
+  // new URL("/\t/host", base) to collapse to "//host" → open redirect.
+  return pathname.replace(/\\/g, '%5C').replace(/[\t\n\r]/g, '').replace(/\/+/g, '/');
 }
 
 export { applyBasePath, formatPathname, formatPathnameTemplate, formatTemplatePathname, getBestMatchingDomain, getHost, getInternalTemplate, getLocaleAsPrefix, getLocalePrefixes, getNormalizedPathname, getPathnameMatch, getRouteParams, isLocaleSupportedOnDomain, sanitizePathname };

package/dist/esm/production/middleware/utils.js

@@ -1 +1 @@
-import{normalizeTrailingSlash as e,getSortedPathnames as t,matchesPathname as n,prefixPathname as r,getLocalePrefix as o,templateToRegex as c,getLocalizedTemplate as i}from"../shared/utils.js";function s(e,r,o){const c=t(Object.keys(e));for(const t of c){const c=e[t];if("string"==typeof c){if(n(c,r))return[void 0,t]}else{const s=Object.entries(c),f=s.findIndex((([e])=>e===o));f>0&&s.unshift(s.splice(f,1)[0]);for(const[o]of s){const c=i(e[t],o,t);if(n(c,r))return[o,t]}}}for(const t of Object.keys(e))if(n(t,r))return[void 0,t];return[void 0,void 0]}function f(t,n,r,o){let c="";return c+=h(r,d(n,t)),c=e(c),c}function l(t,n,r){t.endsWith("/")||(t+="/");const o=u(n,r),c=new RegExp(`^(${o.map((([,e])=>e.replaceAll("/","\\/"))).join("|")})/(.*)`,"i"),i=t.match(c);let s=i?"/"+i[2]:t;return"/"!==s&&(s=e(s)),s}function u(e,t,n=!0){const r=e.map((e=>[e,o(e,t)]));return n&&r.sort(((e,t)=>t[1].length-e[1].length)),r}function a(e,t,n,r){const o=u(t,n);r&&o.sort((([e],[t])=>{if(e===r.defaultLocale)return-1;if(t===r.defaultLocale)return 1;const n=r.locales.includes(e),o=r.locales.includes(t);return n&&!o?-1:!n&&o?1:0}));for(const[t,n]of o){let r,o;if(e===n||e.startsWith(n+"/"))r=o=!0;else{const t=e.toLowerCase(),c=n.toLowerCase();(t===c||t.startsWith(c+"/"))&&(r=!1,o=!0)}if(o)return{locale:t,prefix:n,matchedPrefix:e.slice(0,n.length),exact:r}}}function d(t,n){const r=e(n),o=e(t),i=c(o).exec(r);if(!i)return;const s={},f=o.match(/\[([^\]]+)\]/g)??[];for(let e=1;e<i.length;e++){const t=f[e-1];if(!t)continue;const n=t.replace(/[[\]]/g,""),r=i[e]??"";s[n]=r}return s}function h(e,t){if(!t)return e;let n=e=e.replace(/\[\[/g,"[").replace(/\]\]/g,"]");return Object.entries(t).forEach((([e,t])=>{n=n.replace(`[${e}]`,t)})),n}function p(e,t,n){let o=e;return t&&(o=r(t,o)),n&&(o+=n),o}function g(e){return e.get("x-forwarded-host")??e.get("host")??void 0}function x(e,t){return t.defaultLocale===e||t.locales.includes(e)}function m(e,t,n){let r;return e&&x(t,e)&&(r=e),r||(r=n.find((e=>e.defaultLocale===t))),r||(r=n.find((e=>e.locales.includes(t)))),r}function j(t,n){return e(n+t)}function L(e){return`/${e}`}function v(e){return e.replace(/\\/g,"%5C").replace(/\/+/g,"/")}export{j as applyBasePath,p as formatPathname,h as formatPathnameTemplate,f as formatTemplatePathname,m as getBestMatchingDomain,g as getHost,s as getInternalTemplate,L as getLocaleAsPrefix,u as getLocalePrefixes,l as getNormalizedPathname,a as getPathnameMatch,d as getRouteParams,x as isLocaleSupportedOnDomain,v as sanitizePathname};
+import{normalizeTrailingSlash as e,getSortedPathnames as t,matchesPathname as n,prefixPathname as r,getLocalePrefix as o,templateToRegex as c,getLocalizedTemplate as i}from"../shared/utils.js";function s(e,r,o){const c=t(Object.keys(e));for(const t of c){const c=e[t];if("string"==typeof c){if(n(c,r))return[void 0,t]}else{const s=Object.entries(c),f=s.findIndex((([e])=>e===o));f>0&&s.unshift(s.splice(f,1)[0]);for(const[o]of s){const c=i(e[t],o,t);if(n(c,r))return[o,t]}}}for(const t of Object.keys(e))if(n(t,r))return[void 0,t];return[void 0,void 0]}function f(t,n,r,o){let c="";return c+=p(r,d(n,t)),c=e(c),c}function l(t,n,r){t.endsWith("/")||(t+="/");const o=u(n,r),c=new RegExp(`^(${o.map((([,e])=>e.replaceAll("/","\\/"))).join("|")})/(.*)`,"i"),i=t.match(c);let s=i?"/"+i[2]:t;return"/"!==s&&(s=e(s)),s}function u(e,t,n=!0){const r=e.map((e=>[e,o(e,t)]));return n&&r.sort(((e,t)=>t[1].length-e[1].length)),r}function a(e,t,n,r){const o=u(t,n);r&&o.sort((([e],[t])=>{if(e===r.defaultLocale)return-1;if(t===r.defaultLocale)return 1;const n=r.locales.includes(e),o=r.locales.includes(t);return n&&!o?-1:!n&&o?1:0}));for(const[t,n]of o){let r,o;if(e===n||e.startsWith(n+"/"))r=o=!0;else{const t=e.toLowerCase(),c=n.toLowerCase();(t===c||t.startsWith(c+"/"))&&(r=!1,o=!0)}if(o)return{locale:t,prefix:n,matchedPrefix:e.slice(0,n.length),exact:r}}}function d(t,n){const r=e(n),o=e(t),i=c(o).exec(r);if(!i)return;const s={},f=o.match(/\[([^\]]+)\]/g)??[];for(let e=1;e<i.length;e++){const t=f[e-1];if(!t)continue;const n=t.replace(/[[\]]/g,""),r=i[e]??"";s[n]=r}return s}function p(e,t){if(!t)return e;let n=e=e.replace(/\[\[/g,"[").replace(/\]\]/g,"]");return Object.entries(t).forEach((([e,t])=>{n=n.replace(`[${e}]`,t)})),n}function g(e,t,n){let o=e;return t&&(o=r(t,o)),n&&(o+=n),o}function h(e){return e.get("x-forwarded-host")??e.get("host")??void 0}function x(e,t){return t.defaultLocale===e||t.locales.includes(e)}function m(e,t,n){let r;return e&&x(t,e)&&(r=e),r||(r=n.find((e=>e.defaultLocale===t))),r||(r=n.find((e=>e.locales.includes(t)))),r}function j(t,n){return e(n+t)}function L(e){return`/${e}`}function v(e){return e.replace(/\\/g,"%5C").replace(/[\t\n\r]/g,"").replace(/\/+/g,"/")}export{j as applyBasePath,g as formatPathname,p as formatPathnameTemplate,f as formatTemplatePathname,m as getBestMatchingDomain,h as getHost,s as getInternalTemplate,L as getLocaleAsPrefix,u as getLocalePrefixes,l as getNormalizedPathname,a as getPathnameMatch,d as getRouteParams,x as isLocaleSupportedOnDomain,v as sanitizePathname};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/next-intl",
-  "version": "4.9.0-depup.0",
+  "version": "4.9.1-depup.0",
   "sideEffects": false,
   "author": "Jan Amann <jan@amann.work>",
   "funding": [
@@ -133,12 +133,12 @@
   "dependencies": {
     "@formatjs/intl-localematcher": "^0.8.2",
     "@parcel/watcher": "^2.5.6",
-    "@swc/core": "^1.15.21",
-    "icu-minify": "^4.9.0",
+    "@swc/core": "^1.15.24",
+    "icu-minify": "^4.9.1",
     "negotiator": "^1.0.0",
-    "next-intl-swc-plugin-extractor": "^4.9.0",
+    "next-intl-swc-plugin-extractor": "^4.9.1",
     "po-parser": "^2.1.1",
-    "use-intl": "^4.9.0"
+    "use-intl": "^4.9.1"
   },
   "peerDependencies": {
     "next": "^12.0.0 || ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0",
@@ -149,7 +149,7 @@
       "optional": true
     }
   },
-  "gitHead": "b65f8c4e88ad3f2ac8df3443b6cdd66c08c19e60",
+  "gitHead": "b4aa5380c50ad59a80d1dfdbc229590a4e0133a3",
   "depup": {
     "changes": {
       "@formatjs/intl-localematcher": {
@@ -162,13 +162,13 @@
       },
       "@swc/core": {
         "from": "^1.15.2",
-        "to": "^1.15.21"
+        "to": "^1.15.24"
       }
     },
     "depsUpdated": 3,
     "originalPackage": "next-intl",
-    "originalVersion": "4.9.0",
-    "processedAt": "2026-04-01T20:19:14.108Z",
+    "originalVersion": "4.9.1",
+    "processedAt": "2026-04-10T16:23:46.148Z",
     "smokeTest": "passed"
   }
 }