chore(deps): update dependency next to v14 [security] #3211
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
triple-bot
requested review from
zzolain,
dongoc and
seulgiyoon
and removed request for
a team
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #3211 +/- ##
=======================================
Coverage 14.77% 14.77%
=======================================
Files 721 721
Lines 10097 10097
Branches 3307 3307
=======================================
Hits 1492 1492
Misses 8182 8182
Partials 423 423 ☔ View full report in Codecov by Sentry. |
triple-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
4 times, most recently
from
f52e3e3
to
537fac7
Compare
triple-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
2 times, most recently
from
576d550
to
fd4b9a0
Compare
triple-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
2 times, most recently
from
7af8359
to
ae6c241
Compare
triple-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
6 times, most recently
from
a0e3de2
to
5df320c
Compare
triple-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
from
5df320c
to
1c21eaa
Compare
triple-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
3 times, most recently
from
758859e
to
5cebed3
Compare
triple-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
2 times, most recently
from
5a307c8
to
82e8c45
Compare
triple-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
from
82e8c45
to
eaf342e
Compare
triple-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
2 times, most recently
from
f44e0ce
to
87c02c7
Compare
triple-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
from
87c02c7
to
a27f9d8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^13.4->^13.4 || ^14.0.0^13.5.6->^14.0.013.4.13->14.1.1GitHub Vulnerability Alerts
CVE-2024-34351
Impact
A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the
Hostheader is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.Prerequisites
<14.1.1) is running in a self-hosted* manner./.* Many hosting providers (including Vercel) route requests based on the Host header, so we do not believe that this vulnerability affects any Next.js applications where routing is done in this manner.
Patches
This vulnerability was patched in #62561 and fixed in Next.js
14.1.1.Workarounds
There are no official workarounds for this vulnerability. We recommend upgrading to Next.js
14.1.1.Credit
Vercel and the Next.js team thank Assetnote for responsibly disclosing this issue to us, and for working with us to verify the fix. Thanks to:
Adam Kues - Assetnote
Shubham Shah - Assetnote
CVE-2023-46298
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.
CVE-2024-34350
Impact
Inconsistent interpretation of a crafted HTTP request meant that requests are treated as both a single request, and two separate requests by Next.js, leading to desynchronized responses. This led to a response queue poisoning vulnerability in the affected Next.js versions.
For a request to be exploitable, the affected route also had to be making use of the rewrites feature in Next.js.
Patches
The vulnerability is resolved in Next.js
13.5.1and newer. This includes Next.js14.x.Workarounds
There are no official workarounds for this vulnerability. We recommend that you upgrade to a safe version.
References
https://portswigger.net/web-security/request-smuggling/advanced/response-queue-poisoning
Release Notes
vercel/next.js (next)
v14.2.5Compare Source
Core Changes
Misc
Credits
Huge thanks to @devjiwonchoi, @ijjk, @emmerich, @huozhi, @kdy1, @kwonoj, @styfle, and @sokra for helping!
v14.2.4Compare Source
Core Changes
Credits
Huge thanks to @ztanner, @ijjk, @wbinnssmith, @huozhi, and @lubieowoce for helping!
v14.2.3Compare Source
Core Changes
Credits
Huge thanks to @huozhi, @samcx, @ztanner, @Jeffrey-Zutt, and @ijjk for helping!
v14.2.2Compare Source
Core Changes
Credits
Huge thanks to @shuding, @coltonehrman, @ztanner, @huozhi, @sokra, @Jeffrey-Zutt, @timneutkens, @wbinnssmith, @wiesson, @ijjk, @devjiwonchoi, and @bgw for helping!
v14.2.1Compare Source
Core Changes
Credits
Huge thanks to @sokra for helping!
v14.2.0Compare Source
Learn more: https://nextjs.org/blog/next-14-2
Core Changes
next infooutput: #60376tersertov5.27.0: #61068swc_coretov0.87.28: #60876unoptimizedprop: #61045_app: #60789optimizeServerReactto config-shared: #61106maxDurationto typescript plugin allowed exports: #59193swc_coretov0.89.x: #61086swc_coretov0.89.4: #61285preset-envmode ofstyled-jsxin webpack mode: #61306.tsfiles as.tsx: #61219swc_coretov0.89.6: #61426@vercel/nft@0.26.3: #61538next/fontmanifest: #61424@swc/helperstov0.5.5: #61659MiddlewareConfiginterface: #61576.eslintrc.jsonnot being created bynext linton App Router: #5510460a927dto2bc7d33: #61522ReadonlyURLSearchParamsshould extendURLSearchParams: #61419squooshin favor ofsharpas optional dep: #61696MiddlewareConfigwith documentation: #61718exports.foofromcjs_finder: #61795squooshin favor ofsharpas optional dep": #61810useLightningcssforstyled-jsx: #61359remotePatternswith a dot in the pathname: #604882bc7d33toba5e6a8: #61837useLightningcssforstyled-jsx: #61359remotePatternswith a dot in the pathname: #604882bc7d33toba5e6a8: #61837fillandsizes="100vw": #61949swc_coretov0.90.7and update turbopack: #61662Next-URL: #61235@vercel/nft@0.26.4: #62019swc_coretov0.90.8: #61976x-forwarded-protoheaders: #58824react-dom/serverin rsc context: #61165zeromqto server-external-packages.json: #62105turbopack-240215.5: #62119Object.hasOwn: #60437terser-webpack-pluginpath intaskfile.jsis missing 'src': #62229swc_coretov0.90.10: #62222next info: #62249<unknown>/stringifymethods in<anonymous>file from stack: #62325'use server'directives: #62259next.config.jsmust have default export: #62341configSchema.tswithexperimental#useEarlyImport: #62408nextwithout building: #62404swc_coretov0.90.12: #62518useSelectedLayoutSegment(s)in Pages Router: #62584MergeCssChunksPlugin: #62746output: "export"by default: #61211html/bodyin root layout: [#62815](https://togithub.com/vercel/next.js/issConfiguration
📅 Schedule: Branch creation - "" in timezone Asia/Seoul, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Renovate Bot.