fix(deps): update dependency @intlify/shared to v9.14.2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@intlify/shared (source)	9.4.1 -> 9.14.2

GitHub Vulnerability Alerts

CVE-2024-52810

Vulnerability type: Prototype Pollution

Affected Package:

Product: @​intlify/shared
Version: 10.0.4

Vulnerability Location(s):

node_modules/@​intlify/shared/dist/shared.cjs:232:26

Description:

The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) the minimum consequence.

Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.

PoC:

// install the package with the latest version
~$ npm install @​intlify/[email protected]
// run the script mentioned below 
~$ node poc.js
//The expected output (if the code still vulnerable) is below. 
// Note that the output may slightly differs from function to another.
Before Attack:  {}
After Attack:  {"pollutedKey":123}

(async () => {
const lib = await import('@​intlify/shared');
var someObj = {}
console.log("Before Attack: ", JSON.stringify({}.__proto__));
try {
// for multiple functions, uncomment only one for each execution.
lib.deepCopy (JSON.parse('{"__proto__":{"pollutedKey":123}}'), someObj)
} catch (e) { }
console.log("After Attack: ", JSON.stringify({}.__proto__));
delete Object.prototype.pollutedKey;
})();

References

Prototype Pollution Leading to Remote Code Execution - An example of how prototype pollution can lead to command code injection.

OWASP Prototype Pollution Prevention Cheat Sheet - Best practices for preventing prototype pollution.

PortSwigger Guide on Preventing Prototype Pollution - A detailed guide to securing your applications against prototype pollution.

---

Release Notes

intlify/vue-i18n (@​intlify/shared)

v9.14.2

Compare Source

What's Changed

🔒 Security Fixes

• fix: XSS vulnerability with prototype pollution on AST: GHSA-9r9m-ffp6-9x4v
• fix: prototype pollusion on deepCopy: GHSA-hjwq-mjwj-4x6c

Full Changelog: intlify/vue-i18n@v9.14.1...v9.14.2

v9.14.1

Compare Source

What's Changed

🐛 Bug Fixes

• fix: messages deepCopy mutates src arguments by @​BobbieGoede in https://github.com/intlify/vue-i18n/pull/1975

Full Changelog: intlify/vue-i18n@v9.14.0...v9.14.1

v9.14.0

Compare Source

What's Changed

⚡ Improvement Features

• fix: vue-i18n type definition for vue package by @​BobbieGoede in https://github.com/intlify/vue-i18n/pull/1919

Full Changelog: intlify/vue-i18n@v9.13.1...v9.14.0

v9.13.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix(message-compiler): cannot resolve none-identifier characters at linked key by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1813

Full Changelog: intlify/vue-i18n@v9.13.0...v9.13.1

v9.13.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

⚠️ Deprecated Features

• fix: EOL announcement warning for vue-i18n-bridge by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1800

⚡ Improvement Features

• fix: not throw warnings when using implicit fallback by @​ShinnosukeKomiya in https://github.com/intlify/vue-i18n-next/pull/1798

📝️ Documentations

• fix: spelling by @​DamageESP in https://github.com/intlify/vue-i18n-next/pull/1802
• docs: improve documentation by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1801
• docs: fix dead link on menu by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1804

New Contributors

• @​ShinnosukeKomiya made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1798
• @​DamageESP made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1802

Full Changelog: intlify/vue-i18n@v9.12.1...v9.13.0

v9.12.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix: compile error for key with included hyphen in named interpolation by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1797

👕 Refactoring

• refactor: tokenizer by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1799

Full Changelog: intlify/vue-i18n@v9.12.0...v9.12.1

v9.12.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

• fix: deprecate named interpolation with modulo syntax by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1795

Full Changelog: intlify/vue-i18n@v9.11.1...v9.12.0

v9.11.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix: regression triple slash including in .d.ts by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1794

Full Changelog: intlify/vue-i18n@v9.11.0...v9.11.1

v9.11.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

• fix: number and date format components not using scope prop by @​BobbieGoede in https://github.com/intlify/vue-i18n-next/pull/1786

New Contributors

• @​xuanzhi33 made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1767
• @​YoshiYo made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1781

Full Changelog: intlify/vue-i18n@v9.10.2...v9.11.0

v9.10.2

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix: manually add triple slash directive to message-compiler by @​BobbieGoede in https://github.com/intlify/vue-i18n-next/pull/1766

New Contributors

• @​shinGangan made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1763

Full Changelog: intlify/vue-i18n@v9.10.1...v9.10.2

v9.10.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

⚡ Improvement Features

• chore(fix): #​1630 make the install function synchronous to be aligned… by @​k-paxian in https://github.com/intlify/vue-i18n-next/pull/1631

📝️ Documentations

• docs: wrong te docs by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1753

New Contributors

• @​k-paxian made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1631

Full Changelog: intlify/vue-i18n@v9.10.0...v9.10.1

v9.10.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

• fix: Support for te behavior compatibility before v9.6 by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1751

📝️ Documentations

• docs: update description of Nuxt I18n and its status by @​BobbieGoede in https://github.com/intlify/vue-i18n-next/pull/1739

New Contributors

• @​twolfvb made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1732
• @​ismailarilik made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1722

Full Changelog: intlify/vue-i18n@v9.9.1...v9.10.0

v9.9.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix: key-value style messages broken after merging (#​1717) by @​chojnicki in https://github.com/intlify/vue-i18n-next/pull/1718

📝️ Documentations

• chore(typo): update injection.md by @​quentinmcq in https://github.com/intlify/vue-i18n-next/pull/1716
• Update syntax.md by @​hinogi in https://github.com/intlify/vue-i18n-next/pull/1701

New Contributors

• @​chojnicki made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1718
• @​quentinmcq made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1716
• @​hinogi made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1701

Full Changelog: intlify/vue-i18n@v9.9.0...v9.9.1

v9.9.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

⚡ Improvement Features

• Register vue jsx types in tsx test by @​yyx990803 in https://github.com/intlify/vue-i18n-next/pull/1661
• chore: improve Vue type definition appending by @​NozomuIkuta in https://github.com/intlify/vue-i18n-next/pull/1671

📈 Performance Fixes

• fix: lower memory usage by @​BobbieGoede in https://github.com/intlify/vue-i18n-next/pull/1677

📝️ Documentations

• Update installation.md by @​KumJungMin in https://github.com/intlify/vue-i18n-next/pull/1676

New Contributors

• @​yyx990803 made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1661
• @​KumJungMin made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1676

Full Changelog: intlify/vue-i18n@v9.8.0...v9.9.0

v9.8.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

• feat: more strictly return type locale detector by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1640

Full Changelog: intlify/vue-i18n@v9.7.1...v9.8.0

v9.7.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

⚡ Improvement Features

• fix: tweak @intlify/core conditional exports by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1639

Full Changelog: intlify/vue-i18n@v9.7.0...v9.7.1

v9.7.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

• feat: export message merging utilities to shared module by @​BobbieGoede in https://github.com/intlify/vue-i18n-next/pull/1635

Full Changelog: intlify/vue-i18n@v9.6.5...v9.7.0

v9.6.5

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix: Nuxt I18n type inference by @​BobbieGoede in https://github.com/intlify/vue-i18n-next/pull/1628

New Contributors

• @​BobbieGoede made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1628

Full Changelog: intlify/vue-i18n@v9.6.4...v9.6.5

v9.6.4

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix: wrong source getting by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1624

Full Changelog: intlify/vue-i18n@v9.6.3...v9.6.4

v9.6.3

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix: adjust /* #__PURE__*/ comment timing by @​newives in https://github.com/intlify/vue-i18n-next/pull/1623

New Contributors

• @​newives made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1623

Full Changelog: intlify/vue-i18n@v9.6.2...v9.6.3

v9.6.2

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix: return null for fucntion by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1617

Full Changelog: intlify/vue-i18n@v9.6.1...v9.6.2

v9.6.1

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix: more te logic strictly by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1612
• fix: te fallback to root by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1613

Full Changelog: intlify/vue-i18n@v9.6.0...v9.6.1

v9.6.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

• feat!: support resource schema type definition for @intlfy/core-base (@intlify/core) by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1594

🐛 Bug Fixes

• fix(examples): remove @vite-ignore magic comment by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1590
• fix: cannot resolve flatjson messages when use setLocaleMessage by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1601
• fix: strictly key exsisting with te by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1602

⚡ Improvement Features

• fix: locale detector type definition by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1591

📝️ Documentations

• docs: add example link by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1608

Full Changelog: intlify/vue-i18n@v9.5.0...v9.6.0

v9.5.0

Compare Source

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

• feat(core-base): support locale detector by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1566

🐛 Bug Fixes

• Handle falsy values in i18n.te() by @​BuuBux in https://github.com/intlify/vue-i18n-next/pull/1554
• fix(core-base): wrong list index resolving on jit optimization by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1571
• fix: support runtime module for node.js by @​kazupon in https://github.com/intlify/vue-i18n-next/pull/1573

📝️ Documentations

• docs: fix typo in optimization.md by @​Theiaz in https://github.com/intlify/vue-i18n-next/pull/1565
• Fix typos in breaking.md doc by @​piercemorris in https://github.com/intlify/vue-i18n-next/pull/1572

🍭 Examples

• Update nuxt.config.ts in Nuxt 3 Minimal Starter Example by @​ram-you in https://github.com/intlify/vue-i18n-next/pull/1553

New Contributors

• @​BuuBux made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1554
• @​Theiaz made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1565
• @​piercemorris made their first contribution in https://github.com/intlify/vue-i18n-next/pull/1572

Full Changelog: intlify/vue-i18n@v9.4.1...v9.5.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.