Update dependency next to v9.3.3 - autoclosed #5
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/nextjs-monorepo
branch
from
949e1d1
to
47c4466
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/nextjs-monorepo
branch
from
47c4466
to
ba4acf5
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/nextjs-monorepo
branch
from
ba4acf5
to
2706bd1
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/nextjs-monorepo
branch
from
2706bd1
to
c662b2b
Compare
renovate
bot
changed the title
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
9.2.1->9.3.3Release Notes
zeit/next.js
v9.3.3Compare Source
Patches
e7ea276Credits
Huge thanks to @bgoerdt, @herrstucki, @MichelleLucero, @liulanz, @sdhani, @JazibJafri, @ElForastero, @moeyashi, @Andarist, @comxd, @chislee0708, and @PullJosh for helping!
v9.3.2Compare Source
This upgrade is completely backwards compatible and recommended for all users on versions below 9.3.2. For future security related communications of our OSS projects, please join this mailing list.
Next.js has just been audited by one of the top security firms in the world.
They found that attackers could craft special requests to access files in the dist directory (
.next).This does not affect files outside of the dist directory (
.next).In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory.
We recommend upgrading to the latest version of Next.js to improve the overall security of your application.
How to Upgrade
npm install next@latest --saveImpact
serverlesstargetnext exportnext startWe recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
How to Assess Impact
If you think sensitive code or data could have been exposed, you can filter logs of affected sites by
../with a 200 response.What is Being Done
As Next.js has grown in popularity, it has received the attention of security researchers and auditors. We are thankful to Luca Carettoni from Doyensec for their investigation and discovery of the original bug and subsequent responsible disclosure.
We've landed a patch that ensures only known filesystem paths of
.next/staticare made available under/_next/static.Regression tests for this attack were added to the security integration test suite.
Patches
5274535remarklink in blog-starter's README: #11177isStaginginwith-envexample: #11305074c60eCredits
Huge thanks to @chibicode, @ijjk, @timneutkens, @sebastianbenz, @zhe, @shaswatsaxena, @prateekbh, @vvo, @lfades, @bbortt, @aviaryan, @mgranados, @julianbenegas, @gregrickaby, @dulmandakh, @yosuke-furukawa, @tinymachine, @bgoerdt, @nicolasrouanne, @filipesmedeiros, @rishabhsaxena, and @queq1890 for helping!
v9.3.1Compare Source
Patches
39ed664c135830a231315Credits
Huge thanks to @ijjk, @chibicode, @5alidz, @watanabeyu, @messa, @timneutkens, @followbl, @herrstucki, @danlutz, @Spy-Seth, @asotoglez, @josiahwiebe, @ragingwind, @ruisaraiva19, @SarKurd, @bobaaaaa, @akhila-ariyachandra, @lfades, @matamatanot, @JazibJafri, @tomdohnal, @carlospavanetti, @giuseppeg, @lifeiscontent, @7ma7X, @PaulHale, @john015, and @petamoriken for helping!
v9.3.0Compare Source
Minor Changes
Patches
80bdf73b331338cedd6fafc9f18dc0f4283663f5c4unstable_prefix from new methods: #10723dangerousAsPathfromRenderOpts: #10773next-server: #10776getStaticProps,getServerSideProps: #10800getServerSidePropsRequests: #10826a61dfb269ba793getServerSidePropsTest Case: #1086283b4fd1Credits
Huge thanks to @arcanis, @lgordey, @ijjk, @martpie, @jaywink, @fabianishere, @dijs, @TheRusskiy, @quinnturner, @timneutkens, @lfades, @vvo, @adithwip, @rafaelalmeidatk, @bmathews, @Spy-Seth, @EvgeniyKumachev, @chibicode, @piglovesyou, @HaNdTriX, @Timer, @janicklas-ralph, @devknoll, @prateekbh, @ethanryan, @MoOx, @rifaidev, @msweeneydev, @motiko, and @balazsorban44 for helping!
v9.2.2Compare Source
Patches
c71694ec71694ewith-next-seosample issues: #10335buildsfrom examples: #10417native-url: #10419native-urlAgain: #10526isFallbackRouter Property: #10539Credits
Huge thanks to @borisowsky, @piglovesyou, @dannytatom, @msweeneydev, @bartdeslagmulder, @stigkj, @jamesmosier, @chibicode, @lfades, @Timer, @RobinCsl, @apollonian, @alejalapeno, @dmitrika, @micahalcorn, @ijjk, @pacocoursey, @zhe, @ivan-kleshnin, @stryder03, @38elements, @msnider, @TheDSCPL, @vasco3, @lachlanjc, @AndyBitz, @atcastle, @pex, @Janpot, @HaNdTriX, @afsanefda, @Nainterceptor, @areai51, @thorsten-stripe, @vvo, @markhaslam, @devknoll, and @sebastianbenz for helping!
Renovate configuration
📅 Schedule: At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by WhiteSource Renovate. View repository job log here.