fix(deps): update dependency next-intl to ^4.9.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
next-intl (source)	^4.8.3 → ^4.9.1

---

next-intl has an open redirect vulnerability

CVE-2026-40299 / GHSA-8f24-v5vv-gm5j

More information

Details

Impact

Applications using the next-intl middleware with localePrefix: 'as-needed' could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative // or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL.

Patches

The problem has been patched, please update to next-intl@4.9.1.

Credits

Many thanks to Joni Liljeblad from Oura for responsibly disclosing the vulnerability and for suggesting the fix.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/amannn/next-intl/security/advisories/GHSA-8f24-v5vv-gm5j
• https://github.com/amannn/next-intl/pull/2304
• https://github.com/amannn/next-intl/commit/1c80b668aa6d853f470319eec10a3f61e78a70e6
• https://github.com/amannn/next-intl/releases/tag/v4.9.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-40299
• https://github.com/advisories/GHSA-8f24-v5vv-gm5j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

amannn/next-intl (next-intl)

v4.9.1

Compare Source

Bug Fixes

• Improve middleware pathname validation (#​2304) (1c80b66) – by @​amannn

v4.9.0

Compare Source

Features

• Support transitionTypes on Link (#​2302) (02811f5) – by @​amannn

v4.8.4

Compare Source

Bug Fixes

• Remove TypeScript peer dependency and update examples to TypeScript v6 (#​2293) (5e7bcd7) – by @​wojtekmaj

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Coverage Report for packages/configs/vitest-config

Status	Category	Percentage	Covered / Total
🔵	Lines	78.27%	1740 / 2223
🔵	Statements	77.15%	1830 / 2372
🔵	Functions	74.89%	519 / 693
🔵	Branches	65.68%	1148 / 1748

File Coverage

No changed files found.

Generated in workflow #701 for commit 1bfc82d by the Vitest Coverage Report Action