vue-i18n 11.4.13 → 11.4.14

package/dist/vue-i18n.cjs

@@ -1,5 +1,5 @@
 /*!
-  * vue-i18n v11.4.13
+  * vue-i18n v11.4.14
   * (c) 2026 kazuya kawaguchi
   * Released under the MIT License.
   */
@@ -30,7 +30,7 @@ var Vue__namespace = /*#__PURE__*/_interopNamespaceDefault(Vue);
  *
  * @VueI18nGeneral
  */
-const VERSION = '11.4.13';
+const VERSION = '11.4.14';
 
 const I18nErrorCodes = {
     // composer module errors
@@ -64,6 +64,17 @@ const InejctWithOptionSymbol =
 const DisposeSymbol = /* #__PURE__*/ shared.makeSymbol('__dispose');
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
+/**
+ * Whether `locale` can't be a key of the locale messages and formats.
+ * A property name of `Object.prototype`, such as `__proto__` or `constructor`,
+ * would read or replace a built-in object, so it is ignored with a warning.
+ */
+function isUnsafeLocale(locale) {
+    if (shared.isObjectPrototypeKey(locale)) {
+        return true;
+    }
+    return false;
+}
 /**
  * Transform flat json in obj to normal json in obj
  */
@@ -148,7 +159,10 @@ function getLocaleMessages(locale, options) {
             if ('locale' in custom && 'resource' in custom) {
                 const { locale, resource } = custom;
                 if (locale) {
-                    ret[locale] = ret[locale] || shared.create();
+                    if (isUnsafeLocale(locale)) {
+                        return;
+                    }
+                    ret[locale] = shared.getOwn(ret, locale) || shared.create();
                     shared.deepCopy(resource, ret[locale]);
                 }
                 else {
@@ -335,7 +349,6 @@ function createComposer(options = {}) {
     // pluralRules
     let _pluralRules = options.pluralRules || (__root && __root.pluralRules);
     // runtime context
-    // eslint-disable-next-line prefer-const
     let _context;
     const getCoreContext = () => {
         _isGlobal && coreBase.setFallbackContext(null);
@@ -361,17 +374,12 @@ function createComposer(options = {}) {
         {
             ctxOptions.datetimeFormats = _datetimeFormats.value;
             ctxOptions.numberFormats = _numberFormats.value;
-            ctxOptions.__datetimeFormatters = shared.isPlainObject(_context)
-                ? _context.__datetimeFormatters
-                : undefined;
-            ctxOptions.__numberFormatters = shared.isPlainObject(_context)
-                ? _context.__numberFormatters
-                : undefined;
         }
         const ctx = coreBase.createCoreContext(ctxOptions);
         _isGlobal && coreBase.setFallbackContext(ctx);
         return ctx;
     };
+    // eslint-disable-next-line prefer-const
     _context = getCoreContext();
     coreBase.updateFallbackLocale(_context, _locale.value, _fallbackLocale.value);
     // track reactivity
@@ -393,17 +401,12 @@ function createComposer(options = {}) {
             _locale.value = val;
         }
     });
-    // NOTE: `_context.fallbackContext` points at the root context only while a
-    // translation runs (see `wrapWithDeps`). Point it there while invalidating too,
-    // so that the chain the root cached for this composer's fallbackLocale is dropped.
-    function updateFallbackLocaleWithRoot(fallback) {
+    function withRootFallbackContext(fn) {
         if (!_isGlobal) {
-            _context.fallbackContext = __root
-                ? coreBase.getFallbackContext()
-                : undefined;
+            _context.fallbackContext = coreBase.getFallbackContext();
         }
         try {
-            coreBase.updateFallbackLocale(_context, _locale.value, fallback);
+            return fn();
         }
         finally {
             if (!_isGlobal) {
@@ -411,6 +414,12 @@ function createComposer(options = {}) {
             }
         }
     }
+    // NOTE: `_context.fallbackContext` points at the root context only while a
+    // translation runs (see `wrapWithDeps`). Point it there while invalidating too,
+    // so that the chain the root cached for this composer's fallbackLocale is dropped.
+    function updateFallbackLocaleWithRoot(fallback) {
+        withRootFallbackContext(() => coreBase.updateFallbackLocale(_context, _locale.value, fallback));
+    }
     // fallbackLocale
     const fallbackLocale = Vue.computed({
         get: () => _fallbackLocale.value,
@@ -455,17 +464,9 @@ function createComposer(options = {}) {
         let ret;
         try {
             if (false || false) ;
-            if (!_isGlobal) {
-                _context.fallbackContext = __root
-                    ? coreBase.getFallbackContext()
-                    : undefined;
-            }
-            ret = fn(_context);
+            ret = withRootFallbackContext(() => fn(_context));
         }
         finally {
-            if (!_isGlobal) {
-                _context.fallbackContext = undefined;
-            }
         }
         if ((warnType !== 'translate exists' && // for not `te` (e.g `t`)
             shared.isNumber(ret) &&
@@ -563,9 +564,7 @@ function createComposer(options = {}) {
                 if (resolved === null) {
                     resolved = message[key];
                 }
-                if (coreBase.isMessageAST(resolved) ||
-                    coreBase.isMessageFunction(resolved) ||
-                    shared.isString(resolved)) {
+                if (coreBase.isMessageFormat(resolved)) {
                     return true;
                 }
             }
@@ -578,7 +577,7 @@ function createComposer(options = {}) {
         let messages = null;
         const locales = coreBase.fallbackWithLocaleChain(_context, _fallbackLocale.value, _locale.value);
         for (let i = 0; i < locales.length; i++) {
-            const targetLocaleMessages = _messages.value[locales[i]] || {};
+            const targetLocaleMessages = shared.getOwn(_messages.value, locales[i]) || {};
             const messageValue = _context.messageResolver(targetLocaleMessages, key);
             if (messageValue != null) {
                 messages = messageValue;
@@ -599,66 +598,72 @@ function createComposer(options = {}) {
     }
     // getLocaleMessage
     function getLocaleMessage(locale) {
-        return (_messages.value[locale] || {});
+        return (shared.getOwn(_messages.value, locale) || {});
     }
     // setLocaleMessage
     function setLocaleMessage(locale, message) {
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
         if (flatJson) {
-            const _message = { [locale]: message };
-            for (const key in _message) {
-                if (shared.hasOwn(_message, key)) {
-                    handleFlatJson(_message[key]);
-                }
-            }
-            message = _message[locale];
+            handleFlatJson(message);
         }
         _messages.value[locale] = message;
         _context.messages = _messages.value;
     }
     // mergeLocaleMessage
     function mergeLocaleMessage(locale, message) {
-        _messages.value[locale] = _messages.value[locale] || {};
-        const _message = { [locale]: message };
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
+        _messages.value[locale] = shared.getOwn(_messages.value, locale) || {};
         if (flatJson) {
-            for (const key in _message) {
-                if (shared.hasOwn(_message, key)) {
-                    handleFlatJson(_message[key]);
-                }
-            }
+            handleFlatJson(message);
         }
-        message = _message[locale];
         shared.deepCopy(message, _messages.value[locale]);
         _context.messages = _messages.value;
     }
     // getDateTimeFormat
     function getDateTimeFormat(locale) {
-        return _datetimeFormats.value[locale] || {};
+        return shared.getOwn(_datetimeFormats.value, locale) || {};
     }
     // setDateTimeFormat
     function setDateTimeFormat(locale, format) {
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
         _datetimeFormats.value[locale] = format;
         _context.datetimeFormats = _datetimeFormats.value;
         coreBase.clearDateTimeFormat(_context, locale, format);
     }
     // mergeDateTimeFormat
     function mergeDateTimeFormat(locale, format) {
-        _datetimeFormats.value[locale] = shared.assign(_datetimeFormats.value[locale] || {}, format);
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
+        _datetimeFormats.value[locale] = shared.assign(shared.getOwn(_datetimeFormats.value, locale) || {}, format);
         _context.datetimeFormats = _datetimeFormats.value;
         coreBase.clearDateTimeFormat(_context, locale, format);
     }
     // getNumberFormat
     function getNumberFormat(locale) {
-        return _numberFormats.value[locale] || {};
+        return shared.getOwn(_numberFormats.value, locale) || {};
     }
     // setNumberFormat
     function setNumberFormat(locale, format) {
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
         _numberFormats.value[locale] = format;
         _context.numberFormats = _numberFormats.value;
         coreBase.clearNumberFormat(_context, locale, format);
     }
     // mergeNumberFormat
     function mergeNumberFormat(locale, format) {
-        _numberFormats.value[locale] = shared.assign(_numberFormats.value[locale] || {}, format);
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
+        _numberFormats.value[locale] = shared.assign(shared.getOwn(_numberFormats.value, locale) || {}, format);
         _context.numberFormats = _numberFormats.value;
         coreBase.clearNumberFormat(_context, locale, format);
     }
@@ -829,7 +834,10 @@ function convertComposerOptions(options) {
         const sharedMessages = options.sharedMessages;
         const locales = Object.keys(sharedMessages);
         messages = locales.reduce((messages, locale) => {
-            const message = messages[locale] || (messages[locale] = {});
+            if (isUnsafeLocale(locale)) {
+                return messages;
+            }
+            const message = shared.getOwn(messages, locale) || (messages[locale] = {});
             shared.assign(message, sharedMessages[locale]);
             return messages;
         }, (messages || {}));

package/dist/vue-i18n.esm-browser.js

@@ -1,5 +1,5 @@
 /*!
-  * vue-i18n v11.4.13
+  * vue-i18n v11.4.14
   * (c) 2026 kazuya kawaguchi
   * Released under the MIT License.
   */
@@ -80,6 +80,27 @@ function hasOwn(obj, key) {
     return hasOwnProperty.call(obj, key);
 }
 /* eslint-enable */
+/**
+ * Get `obj[key]` only when `key` is an own property of `obj`, so that a key
+ * such as `constructor` does not read a property inherited from
+ * `Object.prototype`.
+ * The property is read before the check, so that a reactive `obj` tracks
+ * `key` even when it is missing.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function getOwn(obj, key) {
+    const value = obj[key];
+    return hasOwn(obj, key) ? value : undefined;
+}
+/**
+ * Whether `key` is a property name of `Object.prototype`, such as `__proto__`,
+ * `constructor` or `toString`.
+ * On a plain object, such a key reads a built-in, and assigning to `__proto__`
+ * replaces the prototype.
+ */
+function isObjectPrototypeKey(key) {
+    return hasOwn(Object.prototype, key);
+}
 /**
  * Useful Utilities By Evan you
  * Modified by kazuya kawaguchi
@@ -189,6 +210,10 @@ const colonCharacterReferencePattern = /:?/gi;
 const controlOrWhitespacePattern = /[\u0000-\u0020\u007f-\u009f]/g;
 const eventHandlerPattern = /(?:^|[\s"'<>/])on\w+\s*=\s*["']?[^"'>]+["']?/i;
 const eventHandlerAttributePattern = /(^|[\s"'<>/])on(\w+\s*=)/gi;
+// `srcdoc` holds a whole HTML document: its value is entity-decoded and then parsed again,
+// so neither escaping the value nor neutralizing `on*` inside it makes it inert
+const srcdocPattern = /(?:^|[\s"'<>/])srcdoc\s*=/i;
+const srcdocAttributePattern = /(^|[\s"'<>/])s(rcdoc\s*=)/gi;
 const unquotedUrlAttributePattern = /(^|[\s"'<>/])((?:href|src|action|formaction)\s*=\s*)([^\s"'=<>`]+)/gi;
 function decodeNumericCharacterReference(match, hex, decimal) {
     const digits = hex || decimal;
@@ -276,6 +301,15 @@ function sanitizeTranslatedHtml(html) {
         // Neutralize event handler attributes by escaping 'on'
         html = html.replace(eventHandlerAttributePattern, '$1&#111;n$2');
     }
+    // Detect and neutralize `srcdoc` attributes
+    if (srcdocPattern.test(html)) {
+        {
+            warn('Potentially dangerous srcdoc attribute detected in translation. ' +
+                'Consider removing srcdoc from your translation messages.');
+        }
+        // Neutralize `srcdoc` by escaping 's': character references are not decoded in attribute names
+        html = html.replace(srcdocAttributePattern, '$1&#115;$2');
+    }
     // Disable javascript: URLs in unquoted attributes
     html = html.replace(unquotedUrlAttributePattern, (match, boundary, prefix, attrValue) => hasJavascriptScheme(attrValue) ? `${boundary}${prefix}about:blank` : match);
     return html;
@@ -325,8 +359,12 @@ function createEmitter() {
 const isNotObjectOrIsArray = (val) => !isObject(val) || isArray(val);
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function deepCopy(src, des) {
-    // src and des should both be objects, and none of them can be a array
-    if (isNotObjectOrIsArray(src) || isNotObjectOrIsArray(des)) {
+    // src and des should both be objects, and none of them can be a array.
+    // des can't be `Object.prototype` either: copying into it would pollute
+    // every object
+    if (isNotObjectOrIsArray(src) ||
+        isNotObjectOrIsArray(des) ||
+        des === Object.prototype) {
         throw new Error('Invalid value');
     }
     const stack = [{ src, des }];
@@ -2089,9 +2127,7 @@ function compile(message, context) {
         // compose message function from AST
         const msg = format(ast);
         // if occurred compile error, don't cache
-        return !detectError
-            ? (compileCache[cacheKey] = msg)
-            : msg;
+        return !detectError ? (compileCache[cacheKey] = msg) : msg;
     }
     else {
         if (!isMessageAST(message)) {
@@ -2106,8 +2142,7 @@ function compile(message, context) {
                 return cached;
             }
             // compose message function from message (AST)
-            return (compileCache[cacheKey] =
-                format(message));
+            return (compileCache[cacheKey] = format(message));
         }
         else {
             return format(message);
@@ -2650,7 +2685,7 @@ function getWarnMessage$1(code, ...args) {
  * Intlify core-base version
  * @internal
  */
-const VERSION$1 = '11.4.13';
+const VERSION$1 = '11.4.14';
 const NOT_REOSLVED = -1;
 const DEFAULT_LOCALE = 'en-US';
 const MISSING_RESOLVE_VALUE = '';
@@ -3317,6 +3352,8 @@ function createMessageContext(options = {}) {
 
 const NOOP_MESSAGE_FUNCTION = () => '';
 const isMessageFunction = (val) => isFunction(val);
+/** @internal */
+const isMessageFormat = (val) => isString(val) || isMessageAST(val) || isMessageFunction(val);
 // implementation of `translate` function
 function translate(context, ...args) {
     const { fallbackFormat, postTranslation, unresolving, messageCompiler, fallbackLocale, messages } = context;
@@ -3362,10 +3399,7 @@ function translate(context, ...args) {
     let format = formatScope;
     // if you use default message, set it as message format!
     let cacheBaseKey = key;
-    if (!resolvedMessage &&
-        !(isString(format) ||
-            isMessageAST(format) ||
-            isMessageFunction(format))) {
+    if (!resolvedMessage && !isMessageFormat(format)) {
         if (enableDefaultMsg) {
             format = defaultMsgOrKey;
             cacheBaseKey = format;
@@ -3373,10 +3407,7 @@ function translate(context, ...args) {
     }
     // checking message format and target locale
     if (!resolvedMessage &&
-        (!(isString(format) ||
-            isMessageAST(format) ||
-            isMessageFunction(format)) ||
-            !isString(targetLocale))) {
+        (!isMessageFormat(format) || !isString(targetLocale))) {
         return unresolving ? NOT_REOSLVED : key;
     }
     // TODO: refactor
@@ -3438,15 +3469,19 @@ function translate(context, ...args) {
     return ret;
 }
 function escapeParams(options) {
+    // a call can pass both list and named values, so escape each of them
     if (isArray(options.list)) {
         options.list = options.list.map(item => isString(item) ? escapeHtml(item) : item);
     }
-    else if (isObject(options.named)) {
-        Object.keys(options.named).forEach(key => {
-            if (isString(options.named[key])) {
-                options.named[key] = escapeHtml(options.named[key]);
-            }
-        });
+    if (isObject(options.named)) {
+        // escape into a new object, so that the values of the caller are not rewritten
+        const source = options.named;
+        const named = create();
+        for (const key of Object.keys(source)) {
+            const value = source[key];
+            named[key] = isString(value) ? escapeHtml(value) : value;
+        }
+        options.named = named;
     }
 }
 function resolveMessageFormat(context, key, locale, fallbackLocale, fallbackWarn, missingWarn) {
@@ -3515,7 +3550,7 @@ function resolveMessageFormat(context, key, locale, fallbackLocale, fallbackWarn
                 measure('intlify message resolve', startTag, endTag);
             }
         }
-        if (isString(format) || isMessageAST(format) || isMessageFunction(format)) {
+        if (isMessageFormat(format)) {
             break;
         }
         if (!isImplicitFallback(targetLocale, locales)) {
@@ -3744,7 +3779,7 @@ function getMessageContextOptions(context, locale, message, options) {
  *
  * @VueI18nGeneral
  */
-const VERSION = '11.4.13';
+const VERSION = '11.4.14';
 /**
  * This is only called development env
  * istanbul-ignore-next
@@ -3821,7 +3856,8 @@ const I18nWarnCodes = {
     DEPRECATE_TRANSLATE_CUSTOME_DIRECTIVE: (CORE_WARN_CODES_EXTEND_POINT +
         4),
     // duplicate `useI18n` calling
-    DUPLICATE_USE_I18N_CALLING: (CORE_WARN_CODES_EXTEND_POINT + 5)
+    DUPLICATE_USE_I18N_CALLING: (CORE_WARN_CODES_EXTEND_POINT + 5),
+    IGNORE_UNSAFE_LOCALE: (CORE_WARN_CODES_EXTEND_POINT + 6)
 };
 const warnMessages = {
     [I18nWarnCodes.FALLBACK_TO_ROOT]: `Fall back to {type} '{key}' with root locale.`,
@@ -3835,13 +3871,26 @@ const warnMessages = {
      * @deprecated will be removed at vue-i18n v12
      */
     [I18nWarnCodes.DEPRECATE_TRANSLATE_CUSTOME_DIRECTIVE]: `'v-t' has been deprecated in v11. Use translate APIs ('t' or '$t') instead.`,
-    [I18nWarnCodes.DUPLICATE_USE_I18N_CALLING]: "Duplicate `useI18n` calling by local scope. Please don't call it on local scope, due to it does not work properly in component."
+    [I18nWarnCodes.DUPLICATE_USE_I18N_CALLING]: "Duplicate `useI18n` calling by local scope. Please don't call it on local scope, due to it does not work properly in component.",
+    [I18nWarnCodes.IGNORE_UNSAFE_LOCALE]: `Ignore '{locale}' locale: it is a property name of Object.prototype`
 };
 function getWarnMessage(code, ...args) {
     return format$1(warnMessages[code], ...args);
 }
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
+/**
+ * Whether `locale` can't be a key of the locale messages and formats.
+ * A property name of `Object.prototype`, such as `__proto__` or `constructor`,
+ * would read or replace a built-in object, so it is ignored with a warning.
+ */
+function isUnsafeLocale(locale) {
+    if (isObjectPrototypeKey(locale)) {
+        warn(getWarnMessage(I18nWarnCodes.IGNORE_UNSAFE_LOCALE, { locale }));
+        return true;
+    }
+    return false;
+}
 /**
  * Transform flat json in obj to normal json in obj
  */
@@ -3929,7 +3978,10 @@ function getLocaleMessages(locale, options) {
             if ('locale' in custom && 'resource' in custom) {
                 const { locale, resource } = custom;
                 if (locale) {
-                    ret[locale] = ret[locale] || create();
+                    if (isUnsafeLocale(locale)) {
+                        return;
+                    }
+                    ret[locale] = getOwn(ret, locale) || create();
                     deepCopy(resource, ret[locale]);
                 }
                 else {
@@ -4116,7 +4168,6 @@ function createComposer(options = {}) {
     // pluralRules
     let _pluralRules = options.pluralRules || (__root && __root.pluralRules);
     // runtime context
-    // eslint-disable-next-line prefer-const
     let _context;
     const getCoreContext = () => {
         _isGlobal && setFallbackContext(null);
@@ -4142,22 +4193,12 @@ function createComposer(options = {}) {
         {
             ctxOptions.datetimeFormats = _datetimeFormats.value;
             ctxOptions.numberFormats = _numberFormats.value;
-            ctxOptions.__datetimeFormatters = isPlainObject(_context)
-                ? _context.__datetimeFormatters
-                : undefined;
-            ctxOptions.__numberFormatters = isPlainObject(_context)
-                ? _context.__numberFormatters
-                : undefined;
-        }
-        {
-            ctxOptions.__v_emitter = isPlainObject(_context)
-                ? _context.__v_emitter
-                : undefined;
         }
         const ctx = createCoreContext(ctxOptions);
         _isGlobal && setFallbackContext(ctx);
         return ctx;
     };
+    // eslint-disable-next-line prefer-const
     _context = getCoreContext();
     updateFallbackLocale(_context, _locale.value, _fallbackLocale.value);
     // track reactivity
@@ -4179,17 +4220,12 @@ function createComposer(options = {}) {
             _locale.value = val;
         }
     });
-    // NOTE: `_context.fallbackContext` points at the root context only while a
-    // translation runs (see `wrapWithDeps`). Point it there while invalidating too,
-    // so that the chain the root cached for this composer's fallbackLocale is dropped.
-    function updateFallbackLocaleWithRoot(fallback) {
+    function withRootFallbackContext(fn) {
         if (!_isGlobal) {
-            _context.fallbackContext = __root
-                ? getFallbackContext()
-                : undefined;
+            _context.fallbackContext = getFallbackContext();
         }
         try {
-            updateFallbackLocale(_context, _locale.value, fallback);
+            return fn();
         }
         finally {
             if (!_isGlobal) {
@@ -4197,6 +4233,12 @@ function createComposer(options = {}) {
             }
         }
     }
+    // NOTE: `_context.fallbackContext` points at the root context only while a
+    // translation runs (see `wrapWithDeps`). Point it there while invalidating too,
+    // so that the chain the root cached for this composer's fallbackLocale is dropped.
+    function updateFallbackLocaleWithRoot(fallback) {
+        withRootFallbackContext(() => updateFallbackLocale(_context, _locale.value, fallback));
+    }
     // fallbackLocale
     const fallbackLocale = computed({
         get: () => _fallbackLocale.value,
@@ -4246,17 +4288,9 @@ function createComposer(options = {}) {
             if (true || false) {
                 setAdditionalMeta(getMetaInfo());
             }
-            if (!_isGlobal) {
-                _context.fallbackContext = __root
-                    ? getFallbackContext()
-                    : undefined;
-            }
-            ret = fn(_context);
+            ret = withRootFallbackContext(() => fn(_context));
         }
         finally {
-            if (!_isGlobal) {
-                _context.fallbackContext = undefined;
-            }
         }
         if ((warnType !== 'translate exists' && // for not `te` (e.g `t`)
             isNumber(ret) &&
@@ -4378,9 +4412,7 @@ function createComposer(options = {}) {
                 if (resolved === null) {
                     resolved = message[key];
                 }
-                if (isMessageAST(resolved) ||
-                    isMessageFunction(resolved) ||
-                    isString(resolved)) {
+                if (isMessageFormat(resolved)) {
                     return true;
                 }
             }
@@ -4393,7 +4425,7 @@ function createComposer(options = {}) {
         let messages = null;
         const locales = fallbackWithLocaleChain(_context, _fallbackLocale.value, _locale.value);
         for (let i = 0; i < locales.length; i++) {
-            const targetLocaleMessages = _messages.value[locales[i]] || {};
+            const targetLocaleMessages = getOwn(_messages.value, locales[i]) || {};
             const messageValue = _context.messageResolver(targetLocaleMessages, key);
             if (messageValue != null) {
                 messages = messageValue;
@@ -4414,66 +4446,72 @@ function createComposer(options = {}) {
     }
     // getLocaleMessage
     function getLocaleMessage(locale) {
-        return (_messages.value[locale] || {});
+        return (getOwn(_messages.value, locale) || {});
     }
     // setLocaleMessage
     function setLocaleMessage(locale, message) {
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
         if (flatJson) {
-            const _message = { [locale]: message };
-            for (const key in _message) {
-                if (hasOwn(_message, key)) {
-                    handleFlatJson(_message[key]);
-                }
-            }
-            message = _message[locale];
+            handleFlatJson(message);
         }
         _messages.value[locale] = message;
         _context.messages = _messages.value;
     }
     // mergeLocaleMessage
     function mergeLocaleMessage(locale, message) {
-        _messages.value[locale] = _messages.value[locale] || {};
-        const _message = { [locale]: message };
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
+        _messages.value[locale] = getOwn(_messages.value, locale) || {};
         if (flatJson) {
-            for (const key in _message) {
-                if (hasOwn(_message, key)) {
-                    handleFlatJson(_message[key]);
-                }
-            }
+            handleFlatJson(message);
         }
-        message = _message[locale];
         deepCopy(message, _messages.value[locale]);
         _context.messages = _messages.value;
     }
     // getDateTimeFormat
     function getDateTimeFormat(locale) {
-        return _datetimeFormats.value[locale] || {};
+        return getOwn(_datetimeFormats.value, locale) || {};
     }
     // setDateTimeFormat
     function setDateTimeFormat(locale, format) {
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
         _datetimeFormats.value[locale] = format;
         _context.datetimeFormats = _datetimeFormats.value;
         clearDateTimeFormat(_context, locale, format);
     }
     // mergeDateTimeFormat
     function mergeDateTimeFormat(locale, format) {
-        _datetimeFormats.value[locale] = assign(_datetimeFormats.value[locale] || {}, format);
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
+        _datetimeFormats.value[locale] = assign(getOwn(_datetimeFormats.value, locale) || {}, format);
         _context.datetimeFormats = _datetimeFormats.value;
         clearDateTimeFormat(_context, locale, format);
     }
     // getNumberFormat
     function getNumberFormat(locale) {
-        return _numberFormats.value[locale] || {};
+        return getOwn(_numberFormats.value, locale) || {};
     }
     // setNumberFormat
     function setNumberFormat(locale, format) {
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
         _numberFormats.value[locale] = format;
         _context.numberFormats = _numberFormats.value;
         clearNumberFormat(_context, locale, format);
     }
     // mergeNumberFormat
     function mergeNumberFormat(locale, format) {
-        _numberFormats.value[locale] = assign(_numberFormats.value[locale] || {}, format);
+        if (isUnsafeLocale(locale)) {
+            return;
+        }
+        _numberFormats.value[locale] = assign(getOwn(_numberFormats.value, locale) || {}, format);
         _context.numberFormats = _numberFormats.value;
         clearNumberFormat(_context, locale, format);
     }
@@ -5204,7 +5242,10 @@ function convertComposerOptions(options) {
         const sharedMessages = options.sharedMessages;
         const locales = Object.keys(sharedMessages);
         messages = locales.reduce((messages, locale) => {
-            const message = messages[locale] || (messages[locale] = {});
+            if (isUnsafeLocale(locale)) {
+                return messages;
+            }
+            const message = getOwn(messages, locale) || (messages[locale] = {});
             assign(message, sharedMessages[locale]);
             return messages;
         }, (messages || {}));