renovate[bot]
commented
2 years ago ⚠ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
- any of the package files in this branch needs updating, or
- the branch becomes conflicted, or
- you click the rebase/retry checkbox if found above, or
- you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: yarn.lock
This script must be run as root
This PR contains the following updates:
6.0.3->9.3.2GitHub Vulnerability Alerts
CVE-2020-5284
Impact
serverlesstargetnext exportWe recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
Patches
https://github.com/zeit/next.js/releases/tag/v9.3.2
References
https://github.com/zeit/next.js/releases/tag/v9.3.2
Release Notes
vercel/next.js
### [`v9.3.2`](https://togithub.com/vercel/next.js/releases/tag/v9.3.2) [Compare Source](https://togithub.com/vercel/next.js/compare/v9.3.1...v9.3.2) **This upgrade is *completely backwards compatible and recommended for all users on versions below 9.3.2.* For future security related communications of our OSS projects, please [join this mailing list](https://zeit.co/security).** Next.js has just been audited by one of the top security firms in the world. They found that attackers could craft special requests to access files in the dist directory (`.next`). **This does not affect files outside of the dist directory (`.next`).** In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. We recommend upgrading to the latest version of Next.js to improve the overall security of your application. #### How to Upgrade - We have released patch versions for both the stable and canary channels of Next.js. - To upgrade run `npm install next@latest --save` #### Impact - **Not affected**: Deployments on ZEIT Now v2 ([https://zeit.co](https://zeit.co/)) are not affected - **Not affected**: Deployments using the `serverless` target - **Not affected**: Deployments using `next export` - **Affected**: Users of Next.js below 9.3.2 that use `next start` We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. ##### How to Assess Impact If you think sensitive code or data could have been exposed, you can filter logs of affected sites by `../` with a 200 response. #### What is Being Done As Next.js has grown in popularity, it has received the attention of security researchers and auditors. We are thankful to Luca Carettoni from Doyensec for their investigation and discovery of the original bug and subsequent responsible disclosure. We've landed a patch that ensures only known filesystem paths of `.next/static` are made available under `/_next/static`. Regression tests for this attack were added to the [security](https://togithub.com/zeit/next.js/blob/canary/test/integration/production/test/security.js) integration test suite. - We have notified known Next.js users in advance of this publication. - A public CVE was issued. - If you want to stay on top of our security related news impacting Next.js or other ZEIT projects, please [join this mailing list](https://zeit.co/security). - We encourage responsible disclosure of future issues. Please email us at **