generated from 8iq/nodejs-hackathon-boilerplate-starter-kit
-
Notifications
You must be signed in to change notification settings - Fork 23
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(deps): update dependency next to v14 [security] #1579
Closed
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
51aac56
to
4e2ff3f
Compare
4e2ff3f
to
b3c3f60
Compare
b3c3f60
to
0eca56e
Compare
0eca56e
to
0168a18
Compare
0168a18
to
1ab73b6
Compare
1ab73b6
to
67294f0
Compare
67294f0
to
e718949
Compare
e718949
to
e4929d2
Compare
e4929d2
to
a06e40f
Compare
a06e40f
to
8fd762d
Compare
8fd762d
to
80a8480
Compare
80a8480
to
f36a21e
Compare
f36a21e
to
b32d328
Compare
b32d328
to
3987b80
Compare
3987b80
to
d40cb58
Compare
f9f244a
to
71c141a
Compare
71c141a
to
434bdf6
Compare
434bdf6
to
b7a5104
Compare
b7a5104
to
2a22f1c
Compare
Kudos, SonarCloud Quality Gate passed!
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^9.5.5
->^14.0.0
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2021-43803
Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. Note that prior version 0.9.9 package
next
hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.CVE-2021-37699
Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when
pages/_error.js
was statically generated, allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although it can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.Impact
10.0.5
and10.2.0
11.0.0
and11.0.1
usingpages/_error.js
withoutgetInitialProps
11.0.0
and11.0.1
usingpages/_error.js
andnext export
pages/404.js
next
npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.We recommend upgrading to the latest version of Next.js to improve the overall security of your application.
Patches
https://github.com/vercel/next.js/releases/tag/v11.1.0
CVE-2023-46298
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.
Release Notes
vercel/next.js (next)
v14.0.2
Compare Source
v14.0.1
Compare Source
Core Changes
8c8ee9e
to0c63487
and types: #57772Documentation Changes
Example Changes
with-youtube-embed
example: #57367with-google-maps-embed
example: #57365Misc Changes
create-next-app
: #57262Credits
Huge thanks to @dijonmusters, @sokra, @philwolstenholme, @IgorKowalczyk, @housseindjirdeh, @Zoe-Bot, @HanCiHu, @JackHowa, @goncy, @hirotomoyamada, @pveyes, @yeskunall, @vinaykulk621, @ChendayUP, @leerob, @dvoytenko, @mknichel, @ijjk, @hmaesta, @ajz003, @its-kunal, @joelhooks, @blurrah, @tariknh, @Vinlock, @Nayeem-XTREME, @aziyatali, @aspehler, @huozhi, @ztanner, @ForsakenHarmony, @moka-ayumu, and @gnoff for helping!
v14.0.0
Compare Source
v13.5.6
Compare Source
Core Changes
Credits
Huge thanks to @ijjk @huozhi @gnoff for helping!
v13.5.5
Compare Source
v13.5.4
Compare Source
Core Changes
beta.nextjs.org
Links: #55924config.experimental.workerThreads
: #55257swc_core
tov0.83.26
: #55780swc_core
tov0.83.26
": #56077permanentRedirect
return 308 in route handlers: #56065boolean
instead offalse
for experimental logging config: #56110postcss
: #56225Documentation Changes
not-found
to file conventions page: #55944extension
option tocreateMDX()
: #55967.bind
method: #56164Response.json
overNextResponse.json
: #56173Example Changes
with-jest
: #56152with-jest
types: #56193with-stripe-typescript
example: #56274Misc Changes
swc_core
tov0.83.28
: #56134Credits
Huge thanks to @balazsorban44, @sdkdeepa, @aayman997, @mayank1513, @timneutkens, @2XG-DEV, @eliot-akira, @hi-matthew, @riobits, @wbinnssmith, @ijjk, @sokra, @dvoytenko, @rishabhpoddar, @manovotny, @A7med3bdulBaset, @huozhi, @jridgewell, @joulev, @SukkaW, @kdy1, @feedthejim, @Fredkiss3, @styfle, @MildTomato, @ForsakenHarmony, @walfly, @bzhn, @shuding, @boylett, @Loki899899, @devrsi0n, @ImBIOS, @vinaykulk621, @ztanner, @sdaigo, @hamirmahal, @blurrah, @omarmciver, and @alexBaizeau for helping!
v13.5.3
Compare Source
v13.5.2
Compare Source
Core Changes
d6dcad6
to2807d78
: #55590@vercel/og
andsatori
: #55654named_import
transform: #55664Documentation Changes
create-next-app
templates: Changebun run dev
commands tobun dev
: #55603Example Changes
Misc Changes
Credits
Huge thanks to @padmaia, @mayank1513, @jakeboone02, @balazsorban44, @kwonoj, @huozhi, @Yovach, @ztanner, @wyattjoh, @GabenGar, @timneutkens, and @shuding for helping!
v13.5.1
Compare Source
Core Changes
output: export
in app router: #54202ua-parser-js
: #54404ssr: false
in App Router: #54411named_import_transform
: #54530optimize_barrel
SWC transform and newoptimizePackageImports
config: #54572permanentRedirect
function in App Router: #54047preload
is not exported fromreact-dom
: #54688@visx/visx
to the import optimization list: #54778/
: #54744/route
suffix: #54851undici
: #55007react-hot-toast
from the optimizePackageImports list: #55029optimizePackageImports
: #55040babel/code-frame
: #55024skipTrailingSlashRedirect
being ignored inpages
: #55067Send
: #55077ImageResponse
extendsResponse
: #55187--experimental-turbo
from supported next-dev args: #55300react-server-dom-webpack
cache invalidation: #55287.ts
files: #552960.0.0.0
: #54445dd480ef
tod6dcad6
.: #55399next/head
on client in App Pages: #55419mui-core
to the defaultoptimizePackageImports
list: #55554ppr
flag: #55560optimize_server_react
transform: #55551Documentation Changes
manifest
metadata file: #54380next-i18n-router
as a resource for internationalized routing: #52344useSelectedLayoutSegment
&useSelectedLayoutSegments
: #53602loaderFile
config: #54529Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.