dependabot/npm_and_yarn/next-intl-4.9.2

safe

a8dc5f2 · fullPR #355reviewed 2026-07-28 18:01 UTC0H · 0M · 2L · 9I

The branch

Purpose

Automated dependency maintenance to keep next-intl current and pull in security patches

Goal

Bump next-intl from 4.6.1 to 4.9.2, closing two security advisories not exploitable with this project's config

Sub-goals

SG-1: Update package.json version constraint to ^4.9.2
SG-2: Resolve updated lockfile

The changes (whole branch)

What: Single line in apps/platform/package.json bumping next-intl constraint; pnpm-lock.yaml resolved with updated transitive deps
Why: Dependabot automated bump — picks up 3 minor versions with 2 security patches and additive features
Areas: apps/platform/package.json+1−1pnpm-lock.yaml+301−267
Blast: 2 files, +302/-268 lines — all in package manifest and lockfile; zero application code changed

➖CI checks· No CI status available at review time➖CodeRabbit· No .coderabbit.yaml in repo

Findings · 9

correctness3

low

4.7.0 changelog truncated — verify upstream CHANGELOG before merging

apps/platform/package.json

The PR body truncates the 4.7.0 entry. All documented 4.8.x–4.9.x changes are additive or bug-fix only. The public API surface in use is stable.

info

New transitive deps (icu-minify, po-parser) added by 4.8.0 AoT — dormant without precompile

pnpm-lock.yaml

Not enabled in this project — no runtime impact.

info

next-intl-swc-plugin-extractor 4.6.1→4.13.4 version gap is expected

pnpm-lock.yaml

Companion package tracks SWC ABI compatibility on a faster independent cadence.

security2

info

CVE-2026-40299 (CVSS 6.9 open redirect) patched — not exploitable with localePrefix: always

apps/platform/package.json

Attack path requires localePrefix: as-needed; this project uses always.

info

GHSA-4c35-wcg5-mm9h (CVSS 4.2 prototype pollution) patched — not applicable without precompile

apps/platform/package.json

Scoped to precompile: true which this project does not use.

tests2

info

Three component tests mock next-intl at module boundary — immune to internal API changes

BulkActionBar, ContractsTable, HelioscopeSourceConfig tests use vi.mock with identity-key pattern.

info

Routing / server components covered only by e2e — confirm before merge

Run pnpm --filter @batu/platform test && pnpm exec playwright test e2e/platform/ on preview branch.

improvement2

low

Consider enabling precompile: true in next.config.ts

apps/platform/next.config.ts

4.8.0 AoT feature shifts runtime parsing of 2,835 keys to build time. Security-hardened in 4.9.2. One config flag change.

info

transitionTypes prop available on next-intl Link for tab-nav UX (4.9.0)

Tab-navigation layouts could use transitionTypes with React 19 View Transitions. Purely additive.