next-intl 4.9.1 → 4.9.2

package/dist/cjs/development/{JSONCodec-rhejs716.cjs → JSONCodec-XU-elSg6.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var plugin = require('./plugin-YzBhQjAo.cjs');
+var plugin = require('./plugin-Har7Ebj3.cjs');
 var ExtractorCodec = require('./ExtractorCodec-D9Tw618d.cjs');
 require('fs/promises');
 require('path');
@@ -35,6 +35,9 @@ var JSONCodec = ExtractorCodec.defineCodec(() => ({
 function traverseMessages(obj, callback, path = '') {
   const NAMESPACE_SEPARATOR = '.';
   for (const key of Object.keys(obj)) {
+    if (plugin.isForbiddenObjectKey(key)) {
+      throw new Error(`Invalid message catalog key: \`${key}\`.`);
+    }
     const newPath = path ? path + NAMESPACE_SEPARATOR + key : key;
     const value = obj[key];
     if (typeof value === 'string') {

package/dist/cjs/development/{POCodec-Cv3VdXQG.cjs → POCodec-cA1pxFGQ.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
 var POParser = require('po-parser');
-var plugin = require('./plugin-YzBhQjAo.cjs');
+var plugin = require('./plugin-Har7Ebj3.cjs');
 var ExtractorCodec = require('./ExtractorCodec-D9Tw618d.cjs');
 require('fs/promises');
 require('path');

package/dist/cjs/development/{plugin-YzBhQjAo.cjs → plugin-Har7Ebj3.cjs}

@@ -122,11 +122,11 @@ export default messages;`;
 
 const formats = {
   json: {
-    codec: () => Promise.resolve().then(function () { return require('./JSONCodec-rhejs716.cjs'); }),
+    codec: () => Promise.resolve().then(function () { return require('./JSONCodec-XU-elSg6.cjs'); }),
     extension: '.json'
   },
   po: {
-    codec: () => Promise.resolve().then(function () { return require('./POCodec-Cv3VdXQG.cjs'); }),
+    codec: () => Promise.resolve().then(function () { return require('./POCodec-cA1pxFGQ.cjs'); }),
     extension: '.po'
   }
 };
@@ -342,15 +342,24 @@ function normalizePathToPosix(filePath) {
   // always use POSIX separators, regardless of the OS that ran extraction.
   return path__default.default.posix.normalize(filePath.split(path__default.default.win32.sep).join(path__default.default.posix.sep));
 }
+const FORBIDDEN_OBJECT_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+function isForbiddenObjectKey(key) {
+  return FORBIDDEN_OBJECT_KEYS.has(key);
+}
 
 // Essentialls lodash/set, but we avoid this dependency
 function setNestedProperty(obj, keyPath, value) {
   const keys = keyPath.split('.');
+  for (const key of keys) {
+    if (isForbiddenObjectKey(key)) {
+      throw new Error(`Invalid message id segment: ${key}`);
+    }
+  }
   let current = obj;
   for (let i = 0; i < keys.length - 1; i++) {
     const key = keys[i];
-    if (!(key in current) || typeof current[key] !== 'object' || current[key] === null) {
-      current[key] = {};
+    if (!Object.prototype.hasOwnProperty.call(current, key) || typeof current[key] !== 'object' || current[key] === null) {
+      current[key] = Object.create(null);
     }
     current = current[key];
   }
@@ -990,7 +999,7 @@ class LRUCache {
   }
 }
 
-const require$2 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('plugin-YzBhQjAo.cjs', document.baseURI).href)));
+const require$2 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('plugin-Har7Ebj3.cjs', document.baseURI).href)));
 class MessageExtractor {
   compileCache = new LRUCache(750);
   constructor(opts) {
@@ -1148,7 +1157,7 @@ function initExtractionCompiler(pluginConfig) {
 
 function getCurrentVersion() {
   try {
-    const require$1 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('plugin-YzBhQjAo.cjs', document.baseURI).href)));
+    const require$1 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('plugin-Har7Ebj3.cjs', document.baseURI).href)));
     const pkg = require$1('next/package.json');
     return pkg.version;
   } catch (error) {
@@ -1175,7 +1184,7 @@ function isNextJs16OrHigher() {
   return compareVersions(getCurrentVersion(), '16.0.0') >= 0;
 }
 
-const require$1 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('plugin-YzBhQjAo.cjs', document.baseURI).href)));
+const require$1 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('plugin-Har7Ebj3.cjs', document.baseURI).href)));
 function withExtensions(localPath) {
   return [`${localPath}.ts`, `${localPath}.tsx`, `${localPath}.js`, `${localPath}.jsx`];
 }
@@ -1454,4 +1463,5 @@ function createNextIntlPlugin(i18nPathOrConfig = {}) {
 
 exports.createNextIntlPlugin = createNextIntlPlugin;
 exports.getSortedMessages = getSortedMessages;
+exports.isForbiddenObjectKey = isForbiddenObjectKey;
 exports.setNestedProperty = setNestedProperty;

package/dist/cjs/development/plugin.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var plugin = require('./plugin-YzBhQjAo.cjs');
+var plugin = require('./plugin-Har7Ebj3.cjs');
 require('fs/promises');
 require('path');
 require('@parcel/watcher');

package/dist/esm/development/extractor/catalogLoader.js

@@ -60,7 +60,7 @@ function catalogLoader(source) {
  * using icu-minify/compile for smaller runtime bundles.
  */
 function precompileMessages(messages, cache) {
-  const result = {};
+  const result = Object.create(null);
   const cacheKeysToEvict = new Set(cache.keys());
   for (const message of messages) {
     cacheKeysToEvict.delete(message.id);

package/dist/esm/development/extractor/format/codecs/JSONCodec.js

@@ -1,4 +1,4 @@
-import { getSortedMessages, setNestedProperty } from '../../utils.js';
+import { getSortedMessages, setNestedProperty, isForbiddenObjectKey } from '../../utils.js';
 import { defineCodec } from '../ExtractorCodec.js';
 
 var JSONCodec = defineCodec(() => ({
@@ -27,6 +27,9 @@ var JSONCodec = defineCodec(() => ({
 function traverseMessages(obj, callback, path = '') {
   const NAMESPACE_SEPARATOR = '.';
   for (const key of Object.keys(obj)) {
+    if (isForbiddenObjectKey(key)) {
+      throw new Error(`Invalid message catalog key: \`${key}\`.`);
+    }
     const newPath = path ? path + NAMESPACE_SEPARATOR + key : key;
     const value = obj[key];
     if (typeof value === 'string') {

package/dist/esm/development/extractor/utils.js

@@ -5,15 +5,24 @@ function normalizePathToPosix(filePath) {
   // always use POSIX separators, regardless of the OS that ran extraction.
   return path.posix.normalize(filePath.split(path.win32.sep).join(path.posix.sep));
 }
+const FORBIDDEN_OBJECT_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+function isForbiddenObjectKey(key) {
+  return FORBIDDEN_OBJECT_KEYS.has(key);
+}
 
 // Essentialls lodash/set, but we avoid this dependency
 function setNestedProperty(obj, keyPath, value) {
   const keys = keyPath.split('.');
+  for (const key of keys) {
+    if (isForbiddenObjectKey(key)) {
+      throw new Error(`Invalid message id segment: ${key}`);
+    }
+  }
   let current = obj;
   for (let i = 0; i < keys.length - 1; i++) {
     const key = keys[i];
-    if (!(key in current) || typeof current[key] !== 'object' || current[key] === null) {
-      current[key] = {};
+    if (!Object.prototype.hasOwnProperty.call(current, key) || typeof current[key] !== 'object' || current[key] === null) {
+      current[key] = Object.create(null);
     }
     current = current[key];
   }
@@ -43,4 +52,4 @@ function getDefaultProjectRoot() {
   return process.cwd();
 }
 
-export { compareReferences, getDefaultProjectRoot, getSortedMessages, localeCompare, normalizePathToPosix, setNestedProperty };
+export { compareReferences, getDefaultProjectRoot, getSortedMessages, isForbiddenObjectKey, localeCompare, normalizePathToPosix, setNestedProperty };

package/dist/esm/production/extractor/catalogLoader.js

@@ -1 +1 @@
-import e from"path";import t from"icu-minify/compile";import{getFormatExtension as s,resolveCodec as o}from"./format/index.js";import{setNestedProperty as r}from"./utils.js";let a=null;const n=new Map;function i(i){const c=this.getOptions(),l=this.async(),f=s(c.messages.format);(async function(e,t){return a||(a=await o(e.messages.format,t)),a})(c,this.rootContext).then((s=>{const o=e.basename(this.resourcePath,f);let a;if(c.messages.precompile){const e=function(e,s){const o={},a=new Set(s.keys());for(const n of e){a.delete(n.id);const e=n.message;if(Array.isArray(e))throw new Error(`Message at \`${n.id}\` resolved to an array, but only strings are supported. See https://next-intl.dev/docs/usage/translations#arrays-of-messages`);if("object"==typeof e)throw new Error(`Message at \`${n.id}\` resolved to \`${typeof e}\`, but only strings are supported. Use a \`.\` to retrieve nested messages. See https://next-intl.dev/docs/usage/translations#structuring-messages`);const i=s.get(n.id);let c;i?.messageValue===e?c=i.compiledMessage:(c=t(e),s.set(n.id,{compiledMessage:c,messageValue:e})),r(o,n.id,c)}for(const e of a)s.delete(e);return o}(s.decode(i,{locale:o}),function(e){let t=n.get(e);return t||(t=new Map,n.set(e,t)),t}(this.resourcePath));a=JSON.stringify(e)}else a=s.toJSONString(i,{locale:o});const m=`export default JSON.parse(${JSON.stringify(a)});`;l(null,m)})).catch(l)}export{i as default};
+import e from"path";import t from"icu-minify/compile";import{getFormatExtension as s,resolveCodec as o}from"./format/index.js";import{setNestedProperty as r}from"./utils.js";let a=null;const n=new Map;function i(i){const c=this.getOptions(),l=this.async(),f=s(c.messages.format);(async function(e,t){return a||(a=await o(e.messages.format,t)),a})(c,this.rootContext).then((s=>{const o=e.basename(this.resourcePath,f);let a;if(c.messages.precompile){const e=function(e,s){const o=Object.create(null),a=new Set(s.keys());for(const n of e){a.delete(n.id);const e=n.message;if(Array.isArray(e))throw new Error(`Message at \`${n.id}\` resolved to an array, but only strings are supported. See https://next-intl.dev/docs/usage/translations#arrays-of-messages`);if("object"==typeof e)throw new Error(`Message at \`${n.id}\` resolved to \`${typeof e}\`, but only strings are supported. Use a \`.\` to retrieve nested messages. See https://next-intl.dev/docs/usage/translations#structuring-messages`);const i=s.get(n.id);let c;i?.messageValue===e?c=i.compiledMessage:(c=t(e),s.set(n.id,{compiledMessage:c,messageValue:e})),r(o,n.id,c)}for(const e of a)s.delete(e);return o}(s.decode(i,{locale:o}),function(e){let t=n.get(e);return t||(t=new Map,n.set(e,t)),t}(this.resourcePath));a=JSON.stringify(e)}else a=s.toJSONString(i,{locale:o});const m=`export default JSON.parse(${JSON.stringify(a)});`;l(null,m)})).catch(l)}export{i as default};

package/dist/esm/production/extractor/format/codecs/JSONCodec.js

@@ -1 +1 @@
-import{getSortedMessages as e,setNestedProperty as r}from"../../utils.js";import{defineCodec as s}from"../ExtractorCodec.js";var t=s((()=>({decode(e){const r=JSON.parse(e),s=[];return o(r,((e,r)=>{s.push({id:r,message:e})})),s},encode(s){const t={};for(const o of e(s))r(t,o.id,o.message);return JSON.stringify(t,null,2)+"\n"},toJSONString:e=>e})));function o(e,r,s=""){for(const t of Object.keys(e)){const n=s?s+"."+t:t,a=e[t];if("string"==typeof a)r(a,n);else{if(Array.isArray(a))throw new Error(`Message at \`${n}\` resolved to an array, but only strings are supported. See https://next-intl.dev/docs/usage/translations#arrays-of-messages`);"object"==typeof a&&o(a,r,n)}}}export{t as default};
+import{getSortedMessages as e,setNestedProperty as r,isForbiddenObjectKey as s}from"../../utils.js";import{defineCodec as t}from"../ExtractorCodec.js";var o=t((()=>({decode(e){const r=JSON.parse(e),s=[];return a(r,((e,r)=>{s.push({id:r,message:e})})),s},encode(s){const t={};for(const o of e(s))r(t,o.id,o.message);return JSON.stringify(t,null,2)+"\n"},toJSONString:e=>e})));function a(e,r,t=""){for(const o of Object.keys(e)){if(s(o))throw new Error(`Invalid message catalog key: \`${o}\`.`);const n=t?t+"."+o:o,i=e[o];if("string"==typeof i)r(i,n);else{if(Array.isArray(i))throw new Error(`Message at \`${n}\` resolved to an array, but only strings are supported. See https://next-intl.dev/docs/usage/translations#arrays-of-messages`);"object"==typeof i&&a(i,r,n)}}}export{o as default};

package/dist/esm/production/extractor/utils.js

@@ -1 +1 @@
-import n from"path";function e(e){return n.posix.normalize(e.split(n.win32.sep).join(n.posix.sep))}function t(n,e,t){const o=e.split(".");let r=n;for(let n=0;n<o.length-1;n++){const e=o[n];e in r&&"object"==typeof r[e]&&null!==r[e]||(r[e]={}),r=r[e]}r[o[o.length-1]]=t}function o(n){return n.toSorted(((n,e)=>{const t=n.references?.[0],o=e.references?.[0];return t&&o?i(t,o):0}))}function r(n,e){return n.localeCompare(e,"en")}function i(n,e){const t=r(n.path,e.path);return 0!==t?t:(n.line??0)-(e.line??0)}function c(){return process.cwd()}export{i as compareReferences,c as getDefaultProjectRoot,o as getSortedMessages,r as localeCompare,e as normalizePathToPosix,t as setNestedProperty};
+import t from"path";function e(e){return t.posix.normalize(e.split(t.win32.sep).join(t.posix.sep))}const n=new Set(["__proto__","constructor","prototype"]);function o(t){return n.has(t)}function r(t,e,n){const r=e.split(".");for(const t of r)if(o(t))throw new Error(`Invalid message id segment: ${t}`);let c=t;for(let t=0;t<r.length-1;t++){const e=r[t];Object.prototype.hasOwnProperty.call(c,e)&&"object"==typeof c[e]&&null!==c[e]||(c[e]=Object.create(null)),c=c[e]}c[r[r.length-1]]=n}function c(t){return t.toSorted(((t,e)=>{const n=t.references?.[0],o=e.references?.[0];return n&&o?i(n,o):0}))}function s(t,e){return t.localeCompare(e,"en")}function i(t,e){const n=s(t.path,e.path);return 0!==n?n:(t.line??0)-(e.line??0)}function p(){return process.cwd()}export{i as compareReferences,p as getDefaultProjectRoot,c as getSortedMessages,o as isForbiddenObjectKey,s as localeCompare,e as normalizePathToPosix,r as setNestedProperty};

package/dist/types/extractor/utils.d.ts

@@ -1,5 +1,6 @@
 import type { ExtractorMessage, ExtractorMessageReference } from './types.js';
 export declare function normalizePathToPosix(filePath: string): string;
+export declare function isForbiddenObjectKey(key: string): boolean;
 export declare function setNestedProperty(obj: Record<string, any>, keyPath: string, value: any): void;
 export declare function getSortedMessages(messages: Array<ExtractorMessage>): Array<ExtractorMessage>;
 export declare function localeCompare(a: string, b: string): number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-intl",
-  "version": "4.9.1",
+  "version": "4.9.2",
   "sideEffects": false,
   "author": "Jan Amann <jan@amann.work>",
   "funding": [
@@ -127,11 +127,11 @@
     "@formatjs/intl-localematcher": "^0.8.1",
     "@parcel/watcher": "^2.4.1",
     "@swc/core": "^1.15.2",
-    "icu-minify": "^4.9.1",
+    "icu-minify": "^4.9.2",
     "negotiator": "^1.0.0",
-    "next-intl-swc-plugin-extractor": "^4.9.1",
+    "next-intl-swc-plugin-extractor": "^4.9.2",
     "po-parser": "^2.1.1",
-    "use-intl": "^4.9.1"
+    "use-intl": "^4.9.2"
   },
   "peerDependencies": {
     "next": "^12.0.0 || ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0",
@@ -142,5 +142,5 @@
       "optional": true
     }
   },
-  "gitHead": "b4aa5380c50ad59a80d1dfdbc229590a4e0133a3"
+  "gitHead": "e1b18258075017216165735212568c8f795e1660"
 }