fix(deps): update dependency next-intl to ^4.9.2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
next-intl (source)	^4.1.0 → ^4.9.2
next-intl (source)	^4.3.12 → ^4.9.2

---

next-intl has an open redirect vulnerability

CVE-2026-40299 / GHSA-8f24-v5vv-gm5j

More information

Details

Impact

Applications using the next-intl middleware with localePrefix: 'as-needed' could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative // or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL.

Patches

The problem has been patched, please update to next-intl@4.9.1.

Credits

Many thanks to Joni Liljeblad from Oura for responsibly disclosing the vulnerability and for suggesting the fix.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/amannn/next-intl/security/advisories/GHSA-8f24-v5vv-gm5j
• https://github.com/amannn/next-intl/pull/2304
• https://github.com/amannn/next-intl/commit/1c80b668aa6d853f470319eec10a3f61e78a70e6
• https://github.com/amannn/next-intl/releases/tag/v4.9.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-40299
• https://github.com/advisories/GHSA-8f24-v5vv-gm5j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

next-intl has prototype pollution with experimental.messages.precompile via attacker-controlled translation catalog keys

GHSA-4c35-wcg5-mm9h

More information

Details

Summary

setNestedProperty in packages/next-intl/src/extractor/utils.tsx walks a dotted key path and assigns the final value without blocking the reserved keys __proto__, constructor, or prototype. When the next-intl Next.js plugin is configured with experimental.messages and messages.precompile: true, a JSON translation catalog containing a top‑level __proto__ key causes setNestedProperty(result, '__proto__.isAdmin', compiledMessage) to assign onto Object.prototype, polluting every object in the running build process.

Details

Root cause — packages/next-intl/src/extractor/utils.tsx:13-34:

export function setNestedProperty(
  obj: Record<string, any>,
  keyPath: string,
  value: any
): void {
  const keys = keyPath.split('.');
  let current = obj;

  for (let i = 0; i < keys.length - 1; i++) {
    const key = keys[i];
    if (
      !(key in current) ||
      typeof current[key] !== 'object' ||
      current[key] === null
    ) {
      current[key] = {};
    }
    current = current[key];
  }

  current[keys[keys.length - 1]] = value;
}

The existence check !(key in current) uses the in operator, which walks the prototype chain. For key === '__proto__', '__proto__' in {} is true (it's inherited from Object.prototype) and typeof current['__proto__'] === 'object' (it is Object.prototype). The guard therefore never re-initializes current[key], and current = current['__proto__'] redirects all subsequent writes onto Object.prototype. The final assignment current[keys[keys.length-1]] = value sets Object.prototype[<attacker key>] = <attacker value>.

Build-time data flow:

1. packages/next-intl/src/plugin/catalog/catalogLoader.tsx:55-83 — the webpack/turbopack loader receives the catalog file source and, if options.messages.precompile is enabled, calls codec.decode(source, {locale}).
2. packages/next-intl/src/extractor/format/codecs/JSONCodec.tsx:9-18 — decode runs JSON.parse(source). V8 installs __proto__ as an own data property on the result when the JSON key is literally "__proto__" (bypassing the normal Object.prototype.__proto__ setter that would otherwise reassign the prototype).
3. JSONCodec.tsx:33-53 — traverseMessages iterates Object.keys(obj), which for a JSON‑parsed object includes the own __proto__ key. It reads obj.__proto__ (returns the attacker’s nested object, not Object.prototype, because it's an own property), recurses into it, and emits message id __proto__.isAdmin.
4. catalogLoader.tsx:71 — precompileMessages(decoded, cache).
5. catalogLoader.tsx:89-131 — for each message, calls setNestedProperty(result, message.id, compiledMessage). With message.id === '__proto__.isAdmin', setNestedProperty walks into Object.prototype and assigns Object.prototype.isAdmin = compiledMessage.

The same sink is also reachable via JSONCodec.encode (JSONCodec.tsx:20-26) and POCodec (packages/next-intl/src/extractor/format/codecs/POCodec.tsx:87) during extraction, both of which feed attacker-influenced message.id values into setNestedProperty — but those paths require control of source-code identifiers, which is a weaker attack vector than the build-time catalog path above.

After pollution, every subsequent object access during the remainder of the Next.js build pipeline (webpack, turbopack, babel, next-intl’s own logic) inherits the attacker-controlled properties. This is a classic gadget-chain precondition for corrupting build-tool internals and tampering with generated bundles, since many build tools use patterns like if (obj.someFlag) or options[key] ?? default that are sensitive to polluted prototypes.

Trust boundary note: next-intl’s message catalogs are realistically attacker-influenced in practice. Translation files are routinely round-tripped through external TMS systems (Crowdin, Lokalise, Transifex), accepted via community locale PRs, or pulled from third-party translation packages — any of which can carry a crafted __proto__ key unnoticed, since JSON translation diffs are usually merged with minimal scrutiny.

PoC

Prerequisites: a Next.js project using next-intl ≤ 4.9.1 with the Next.js plugin configured:

// next.config.ts
import createNextIntlPlugin from 'next-intl/plugin';

const withNextIntl = createNextIntlPlugin({
  experimental: {
    messages: {
      path: './messages',
      format: 'json',
      locales: 'infer',
      precompile: true
    }
  }
});

export default withNextIntl({});

1. Drop a malicious catalog at messages/en.json:

   {
     "Greeting": "Hello",
     "__proto__": { "isAdmin": "polluted" }
   }

2. Run next build (or next dev). The catalogLoader will invoke JSONCodec.decode → traverseMessages → precompileMessages → setNestedProperty.

3. Minimal reproduction of the sink itself (verified locally against the v4.9.1 source):

   function setNestedProperty(obj, keyPath, value) {
     const keys = keyPath.split('.');
     let current = obj;
     for (let i = 0; i < keys.length - 1; i++) {
       const key = keys[i];
       if (!(key in current) || typeof current[key] !== 'object' || current[key] === null) {
         current[key] = {};
       }
       current = current[key];
     }
     current[keys[keys.length - 1]] = value;
   }
   
   setNestedProperty({}, '__proto__.isAdmin', 'PWNED');
   console.log(({}).isAdmin); // -> "PWNED"

   Output: PWNED.

4. Full chain reproduction (also verified):

   const parsed = JSON.parse('{"Greeting":"Hello","__proto__":{"isAdmin":"polluted"}}');
   // traverseMessages emits: [{id:"Greeting",message:"Hello"},{id:"__proto__.isAdmin",message:"polluted"}]
   // precompileMessages then calls setNestedProperty(result, "__proto__.isAdmin", "polluted")
   console.log(({}).isAdmin); // -> "polluted"

   After the loader runs, ({}).isAdmin === 'polluted' for the remainder of the build Node process.

Impact

• Object.prototype is polluted for the lifetime of the build‑time Node.js process, affecting every object created or inspected thereafter in the Next.js build pipeline (webpack/turbopack loaders, babel plugins, next-intl’s own codecs, user plugins).
• Classic CWE-1321 gadget-chain precondition: downstream tools that branch on obj.someFlag, options[key] ?? default, if (!config.noX), etc. can be coerced into unintended behavior, including emitting tampered bundles.
• Realistic delivery vectors include TMS round-trips (Crowdin/Lokalise/Transifex), community locale PRs, and compromised/transitively-installed translation packages — all situations where a JSON catalog diff is routinely accepted without the scrutiny given to code changes.
• Exploitation requires the user to opt in to the experimental.messages + precompile configuration. Users who do not use the extractor/precompile features are not affected.

Recommended Fix

Reject reserved keys in setNestedProperty and stop using the in operator for the existence check. A minimal patch to packages/next-intl/src/extractor/utils.tsx:

const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);

export function setNestedProperty(
  obj: Record<string, any>,
  keyPath: string,
  value: any
): void {
  const keys = keyPath.split('.');
  for (const key of keys) {
    if (FORBIDDEN_KEYS.has(key)) {
      throw new Error(`Invalid message id segment: ${key}`);
    }
  }

  let current = obj;
  for (let i = 0; i < keys.length - 1; i++) {
    const key = keys[i];
    if (
      !Object.prototype.hasOwnProperty.call(current, key) ||
      typeof current[key] !== 'object' ||
      current[key] === null
    ) {
      current[key] = Object.create(null);
    }
    current = current[key];
  }

  current[keys[keys.length - 1]] = value;
}

Additionally:

• In packages/next-intl/src/extractor/format/codecs/JSONCodec.tsx, make traverseMessages skip reserved keys (or switch to Object.create(null) + Object.hasOwn semantics) so that a malicious catalog is rejected early with a clear error rather than producing __proto__.* message ids.
• In packages/next-intl/src/plugin/catalog/catalogLoader.tsx, initialize precompileMessages’s result with Object.create(null) as defense in depth, so even if a key slipped through it could not redirect through Object.prototype.

Severity

• CVSS Score: 4.2 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

References

• https://github.com/amannn/next-intl/security/advisories/GHSA-4c35-wcg5-mm9h
• https://github.com/advisories/GHSA-4c35-wcg5-mm9h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

next-intl has an open redirect vulnerability

CVE-2026-40299 / GHSA-8f24-v5vv-gm5j

More information

Details

Impact

Applications using the next-intl middleware with localePrefix: 'as-needed' could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative // or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL.

Patches

The problem has been patched, please update to next-intl@4.9.1.

Credits

Many thanks to Joni Liljeblad from Oura for responsibly disclosing the vulnerability and for suggesting the fix.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/amannn/next-intl/security/advisories/GHSA-8f24-v5vv-gm5j
• https://nvd.nist.gov/vuln/detail/CVE-2026-40299
• https://github.com/amannn/next-intl/pull/2304
• https://github.com/amannn/next-intl/commit/1c80b668aa6d853f470319eec10a3f61e78a70e6
• https://github.com/amannn/next-intl
• https://github.com/amannn/next-intl/releases/tag/v4.9.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

next-intl has prototype pollution with experimental.messages.precompile via attacker-controlled translation catalog keys

GHSA-4c35-wcg5-mm9h

More information

Details

Summary

setNestedProperty in packages/next-intl/src/extractor/utils.tsx walks a dotted key path and assigns the final value without blocking the reserved keys __proto__, constructor, or prototype. When the next-intl Next.js plugin is configured with experimental.messages and messages.precompile: true, a JSON translation catalog containing a top‑level __proto__ key causes setNestedProperty(result, '__proto__.isAdmin', compiledMessage) to assign onto Object.prototype, polluting every object in the running build process.

Details

Root cause — packages/next-intl/src/extractor/utils.tsx:13-34:

export function setNestedProperty(
  obj: Record<string, any>,
  keyPath: string,
  value: any
): void {
  const keys = keyPath.split('.');
  let current = obj;

  for (let i = 0; i < keys.length - 1; i++) {
    const key = keys[i];
    if (
      !(key in current) ||
      typeof current[key] !== 'object' ||
      current[key] === null
    ) {
      current[key] = {};
    }
    current = current[key];
  }

  current[keys[keys.length - 1]] = value;
}

The existence check !(key in current) uses the in operator, which walks the prototype chain. For key === '__proto__', '__proto__' in {} is true (it's inherited from Object.prototype) and typeof current['__proto__'] === 'object' (it is Object.prototype). The guard therefore never re-initializes current[key], and current = current['__proto__'] redirects all subsequent writes onto Object.prototype. The final assignment current[keys[keys.length-1]] = value sets Object.prototype[<attacker key>] = <attacker value>.

Build-time data flow:

1. packages/next-intl/src/plugin/catalog/catalogLoader.tsx:55-83 — the webpack/turbopack loader receives the catalog file source and, if options.messages.precompile is enabled, calls codec.decode(source, {locale}).
2. packages/next-intl/src/extractor/format/codecs/JSONCodec.tsx:9-18 — decode runs JSON.parse(source). V8 installs __proto__ as an own data property on the result when the JSON key is literally "__proto__" (bypassing the normal Object.prototype.__proto__ setter that would otherwise reassign the prototype).
3. JSONCodec.tsx:33-53 — traverseMessages iterates Object.keys(obj), which for a JSON‑parsed object includes the own __proto__ key. It reads obj.__proto__ (returns the attacker’s nested object, not Object.prototype, because it's an own property), recurses into it, and emits message id __proto__.isAdmin.
4. catalogLoader.tsx:71 — precompileMessages(decoded, cache).
5. catalogLoader.tsx:89-131 — for each message, calls setNestedProperty(result, message.id, compiledMessage). With message.id === '__proto__.isAdmin', setNestedProperty walks into Object.prototype and assigns Object.prototype.isAdmin = compiledMessage.

The same sink is also reachable via JSONCodec.encode (JSONCodec.tsx:20-26) and POCodec (packages/next-intl/src/extractor/format/codecs/POCodec.tsx:87) during extraction, both of which feed attacker-influenced message.id values into setNestedProperty — but those paths require control of source-code identifiers, which is a weaker attack vector than the build-time catalog path above.

After pollution, every subsequent object access during the remainder of the Next.js build pipeline (webpack, turbopack, babel, next-intl’s own logic) inherits the attacker-controlled properties. This is a classic gadget-chain precondition for corrupting build-tool internals and tampering with generated bundles, since many build tools use patterns like if (obj.someFlag) or options[key] ?? default that are sensitive to polluted prototypes.

Trust boundary note: next-intl’s message catalogs are realistically attacker-influenced in practice. Translation files are routinely round-tripped through external TMS systems (Crowdin, Lokalise, Transifex), accepted via community locale PRs, or pulled from third-party translation packages — any of which can carry a crafted __proto__ key unnoticed, since JSON translation diffs are usually merged with minimal scrutiny.

PoC

Prerequisites: a Next.js project using next-intl ≤ 4.9.1 with the Next.js plugin configured:

// next.config.ts
import createNextIntlPlugin from 'next-intl/plugin';

const withNextIntl = createNextIntlPlugin({
  experimental: {
    messages: {
      path: './messages',
      format: 'json',
      locales: 'infer',
      precompile: true
    }
  }
});

export default withNextIntl({});

1. Drop a malicious catalog at messages/en.json:

   {
     "Greeting": "Hello",
     "__proto__": { "isAdmin": "polluted" }
   }

2. Run next build (or next dev). The catalogLoader will invoke JSONCodec.decode → traverseMessages → precompileMessages → setNestedProperty.

3. Minimal reproduction of the sink itself (verified locally against the v4.9.1 source):

   function setNestedProperty(obj, keyPath, value) {
     const keys = keyPath.split('.');
     let current = obj;
     for (let i = 0; i < keys.length - 1; i++) {
       const key = keys[i];
       if (!(key in current) || typeof current[key] !== 'object' || current[key] === null) {
         current[key] = {};
       }
       current = current[key];
     }
     current[keys[keys.length - 1]] = value;
   }
   
   setNestedProperty({}, '__proto__.isAdmin', 'PWNED');
   console.log(({}).isAdmin); // -> "PWNED"

   Output: PWNED.

4. Full chain reproduction (also verified):

   const parsed = JSON.parse('{"Greeting":"Hello","__proto__":{"isAdmin":"polluted"}}');
   // traverseMessages emits: [{id:"Greeting",message:"Hello"},{id:"__proto__.isAdmin",message:"polluted"}]
   // precompileMessages then calls setNestedProperty(result, "__proto__.isAdmin", "polluted")
   console.log(({}).isAdmin); // -> "polluted"

   After the loader runs, ({}).isAdmin === 'polluted' for the remainder of the build Node process.

Impact

• Object.prototype is polluted for the lifetime of the build‑time Node.js process, affecting every object created or inspected thereafter in the Next.js build pipeline (webpack/turbopack loaders, babel plugins, next-intl’s own codecs, user plugins).
• Classic CWE-1321 gadget-chain precondition: downstream tools that branch on obj.someFlag, options[key] ?? default, if (!config.noX), etc. can be coerced into unintended behavior, including emitting tampered bundles.
• Realistic delivery vectors include TMS round-trips (Crowdin/Lokalise/Transifex), community locale PRs, and compromised/transitively-installed translation packages — all situations where a JSON catalog diff is routinely accepted without the scrutiny given to code changes.
• Exploitation requires the user to opt in to the experimental.messages + precompile configuration. Users who do not use the extractor/precompile features are not affected.

Recommended Fix

Reject reserved keys in setNestedProperty and stop using the in operator for the existence check. A minimal patch to packages/next-intl/src/extractor/utils.tsx:

const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);

export function setNestedProperty(
  obj: Record<string, any>,
  keyPath: string,
  value: any
): void {
  const keys = keyPath.split('.');
  for (const key of keys) {
    if (FORBIDDEN_KEYS.has(key)) {
      throw new Error(`Invalid message id segment: ${key}`);
    }
  }

  let current = obj;
  for (let i = 0; i < keys.length - 1; i++) {
    const key = keys[i];
    if (
      !Object.prototype.hasOwnProperty.call(current, key) ||
      typeof current[key] !== 'object' ||
      current[key] === null
    ) {
      current[key] = Object.create(null);
    }
    current = current[key];
  }

  current[keys[keys.length - 1]] = value;
}

Additionally:

• In packages/next-intl/src/extractor/format/codecs/JSONCodec.tsx, make traverseMessages skip reserved keys (or switch to Object.create(null) + Object.hasOwn semantics) so that a malicious catalog is rejected early with a clear error rather than producing __proto__.* message ids.
• In packages/next-intl/src/plugin/catalog/catalogLoader.tsx, initialize precompileMessages’s result with Object.create(null) as defense in depth, so even if a key slipped through it could not redirect through Object.prototype.

Severity

• CVSS Score: 4.2 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

References

• https://github.com/amannn/next-intl/security/advisories/GHSA-4c35-wcg5-mm9h
• https://github.com/amannn/next-intl

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

amannn/next-intl (next-intl)

v4.9.2

Compare Source

Bug Fixes

• Prototype safety guards for precompile: true (#​2307) (c0bf0ee) – by @​amannn

v4.9.1

Compare Source

Bug Fixes

• Improve middleware pathname validation (#​2304) (1c80b66) – by @​amannn

v4.9.0

Compare Source

Features

• Support transitionTypes on Link (#​2302) (02811f5) – by @​amannn

v4.8.4

Compare Source

Bug Fixes

• Remove TypeScript peer dependency and update examples to TypeScript v6 (#​2293) (5e7bcd7) – by @​wojtekmaj

v4.8.3

Compare Source

Bug Fixes

• Update @formatjs/intl-localematcher (#​2265) (196f1f3) – by @​amannn

v4.8.2

Compare Source

Bug Fixes

• Avoid throwing config errors for non-Next.js consumers of next.config.ts (#​2245) (f57800e) – by @​amannn

v4.8.1

Compare Source

Bug Fixes

• Fix precompile alias on Windows (#​2237) (8e7151a) – by @​amannn

v4.8.0

Compare Source

Features

• Ahead-of-time compilation for messages (#​2220) (02149c1) – by @​amannn

v4.7.0

Compare Source

Features

• Improvements for useExtracted (#​2200) (ebc5e43) – by @​amannn

v4.6.1

Compare Source

Bug Fixes

• Improvements for useExtracted (#​2176) (3937e44) – by @​amannn

v4.6.0

Compare Source

Features

• Custom formats for useExtracted, consistency fixes for file references, pruning of messages and sorting of keys (#​2155) (c02818e) – by @​amannn

v4.5.8

Compare Source

Bug Fixes

• Improvements for useExtracted (#​2152) (9b7c9fe) – by @​amannn

v4.5.7

Compare Source

Bug Fixes

• Skip accept-language parsing when locale cookie is already present (#​2143) (0d1331b), closes #​2116 – by @​lxup

v4.5.6

Compare Source

Bug Fixes

• Improvements for useExtracted (#​2133) (5397c49) – by @​amannn

v4.5.5

Compare Source

Bug Fixes

• Move SWC cache to node_modules (#​2120) (0ba9105) – by @​amannn

v4.5.4

Compare Source

Bug Fixes

• Move AST transformer of useExtracted to SWC plugin & handle source maps (#​2114) (e63fbc5) – by @​amannn

v4.5.3

Compare Source

Bug Fixes

• Fix inconsistent ordering of messages for useExtracted pt. 2 (#​2103) (5cbd5da) – by @​amannn

v4.5.2

Compare Source

Bug Fixes

• Bug fixes for useExtracted (#​2099) (b1ff1fa) – by @​amannn

v4.5.1

Compare Source

Bug Fixes

• Avoid partial matches in overlapping localized pathnames (#​2090) (c276c80), closes #​2089 #​2089 – by @​amannn

v4.5.0

Compare Source

Features

• Add useExtracted (experimental) (#​2080) (7a85644) – by @​amannn

v4.4.0

Compare Source

Features

• Next.js 16 update (#​2054) (c397e92) – by @​amannn

v4.3.12

Compare Source

Bug Fixes

• Use correct return type for getTimeZone (#​2053) (bdc2af4), closes #​2052 – by @​amannn

v4.3.11

Compare Source

Bug Fixes

• Only call NextResponse.rewrite if really necessary (#​2051) (43ed4aa) – by @​amannn

v4.3.10

Compare Source

Bug Fixes

• Bump @types/react version (#​2050) (c1e997e), closes #​2044 #​2044 – by @​amannn

v4.3.9

Compare Source

Bug Fixes

• Prefix pathnames when switching with useRouter to another locale (#​2021) (c82d0af), closes #​2020 – by @​amannn

v4.3.8

Compare Source

Bug Fixes

• Avoid double-encoding of already encoded params (#​2017) (31265b4), closes #​2014 – by @​amannn

v4.3.7

Compare Source

Bug Fixes

• Avoid usePathname inconsistency in Next.js leading to a hydration error with custom prefixes, localePrefix: 'always' and static rendering (#​2012) (bc9cb62), closes #​2011 vercel/next.js#73085 #​1571 – by @​hugotiger

v4.3.6

Compare Source

Bug Fixes

• Ensure messages declaration continues working in next dev for upcoming next@15.5.1 (#​2008) (2bf09ec) – by @​amannn

v4.3.5

Compare Source

Bug Fixes

• Don't create messages declaration file when running next {start,info,telemetry} (#​1992) (fd0722a) – by @​amannn

v4.3.4

Compare Source

Bug Fixes

• Correctly compile messages containing escaped curly braces (e.g. '{name'}) (#​1950) (4d418f4), closes #​1948 – by @​amannn

v4.3.3

Compare Source

Bug Fixes

• Add friendly error message when failing to load current Next.js version (#​1945) (5021773) – by @​cupofjoakim

v4.3.2

Compare Source

Bug Fixes

• Ensure cookie is synced before navigation with useRouter (#​1947) (3ee9c4d) – by @​amannn

v4.3.1

Compare Source

Bug Fixes

• Use correct return type for getTimeZone (#​2053) (bdc2af4), closes #​2052 – by @​amannn

v4.3.0

Compare Source

Features

• Support BigInt for number interpolation with useTranslations (#​1929) (a893330), closes #​1928 – by @​sgleisner

v4.2.0

Compare Source

Features

• Encode non-ASCII characters in pathnames returned from navigation APIs (#​1923) (3d23c61) – by @​amannn

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.