Closed renovate[bot] closed 3 months ago
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code
New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
Package | New capabilities | Transitives | Size | Publisher |
---|---|---|---|---|
npm/glob-to-regexp@0.4.1 | None | 0 |
18.1 kB | nickfitzgerald |
npm/watchpack@2.4.0 | environment, filesystem | 0 |
56.9 kB | sokra |
npm/zod@3.21.4 | None | 0 |
604 kB | colinmcd94 |
🚮 Removed packages: npm/@babel/plugin-syntax-jsx@7.14.5, npm/@hapi/accept@5.0.2, npm/@hapi/boom@9.1.1, npm/@hapi/hoek@9.1.1, npm/@napi-rs/triples@1.1.0, npm/@next/polyfill-module@11.1.3, npm/@next/react-dev-overlay@11.1.3, npm/@next/react-refresh-utils@11.1.3, npm/@node-rs/helper@1.2.1, npm/anser@1.4.9, npm/asn1.js@4.10.1, npm/assert@1.5.0, npm/ast-types@0.13.2, npm/base64-js@1.3.1, npm/big.js@5.2.2, npm/bn.js@4.11.8, npm/brorand@1.1.0, npm/browserify-aes@1.2.0, npm/browserify-cipher@1.0.1, npm/browserify-des@1.0.2, npm/browserify-rsa@4.0.1, npm/browserify-sign@4.1.0, npm/browserify-zlib@0.2.0, npm/buffer-xor@1.0.3, npm/buffer@4.9.2, npm/builtin-status-codes@3.0.0, npm/bytes@3.1.0, npm/cipher-base@1.0.4, npm/classnames@2.2.6, npm/commondir@1.0.1, npm/console-browserify@1.2.0, npm/constants-browserify@1.0.0, npm/create-ecdh@4.0.3, npm/create-hash@1.2.0, npm/create-hmac@1.1.7, npm/crypto-browserify@3.12.0, npm/css.escape@1.5.1, npm/cssnano-preset-simple@3.0.2, npm/cssnano-simple@3.0.0, npm/data-uri-to-buffer@3.0.1, npm/depd@1.1.2, npm/des.js@1.0.1, npm/diffie-hellman@5.0.3, npm/domain-browser@1.2.0, npm/elliptic@6.5.2, npm/emojis-list@2.1.0, npm/encoding@0.1.13, npm/es6-object-assign@1.1.0, npm/etag@1.8.1, npm/evp_bytestokey@1.0.3, npm/find-cache-dir@3.3.1, npm/get-orientation@1.1.2, npm/hash-base@3.1.0, npm/hash.js@1.1.7, npm/he@1.2.0, npm/hmac-drbg@1.0.1, npm/http-errors@1.7.3, npm/https-browserify@1.0.0, npm/ieee754@1.1.13, npm/image-size@1.0.0, npm/is-arguments@1.1.1, npm/is-generator-function@1.0.10, npm/is-nan@1.3.2, npm/loader-utils@1.2.3, npm/md5.js@1.3.5, npm/miller-rabin@4.0.1, npm/minimalistic-assert@1.0.1, npm/minimalistic-crypto-utils@1.0.1, npm/native-url@0.3.4, npm/node-fetch@2.6.1, npm/node-html-parser@1.4.9, npm/node-libs-browser@2.2.1, npm/object-is@1.1.5, npm/os-browserify@0.3.0, npm/pako@1.0.11, npm/parse-asn1@5.1.5, npm/path-browserify@0.0.1, npm/pbkdf2@3.0.17, npm/platform@1.3.6, npm/pnp-webpack-plugin@1.6.4, npm/process-nextick-args@2.0.1, npm/process@0.11.10, npm/public-encrypt@4.0.3, npm/querystring-es3@0.2.1, npm/querystring@0.2.0, npm/queue@6.0.2, npm/randomfill@1.0.4, npm/raw-body@2.4.1, npm/react-refresh@0.8.3, npm/readable-stream@2.3.7, npm/ripemd160@2.0.2, npm/setimmediate@1.0.5, npm/setprototypeof@1.1.1, npm/sha.js@2.4.11, npm/shell-quote@1.7.2, npm/stacktrace-parser@0.1.10, npm/statuses@1.5.0, npm/stream-browserify@2.0.2, npm/stream-http@2.8.3, npm/stream-parser@0.3.1, npm/string-hash@1.1.3, npm/string_decoder@1.1.1, npm/stylis-rule-sheet@0.0.10, npm/stylis@3.5.4, npm/timers-browserify@2.0.12, npm/to-arraybuffer@1.0.1, npm/toidentifier@1.0.0, npm/ts-pnp@1.2.0, npm/tty-browserify@0.0.0, npm/unpipe@1.0.0, npm/url@0.11.0, npm/use-subscription@1.5.1, npm/util-deprecate@1.0.2, npm/util@0.10.3, npm/vm-browserify@1.1.2, npm/xtend@4.0.2
This PR contains the following updates:
11.1.3
->13.5.0
GitHub Vulnerability Alerts
CVE-2022-23646
Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the
next.config.js
file must have animages.domains
array assigned and the image host assigned inimages.domains
must allow user-provided SVG. If thenext.config.js
file hasimages.loader
assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, changenext.config.js
to use a differentloader configuration
other than the default.Impact
next.config.js
file has images.domains array assignednext.config.js
file has images.loader assigned to something other than defaultPatches
Next.js 12.1.0
Workarounds
Change
next.config.js
to use a different loader configuration other than the default, for example:Or if you want to use the
loader
prop on the component, you can usecustom
:CVE-2023-46298
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.
Release Notes
vercel/next.js (next)
### [`v13.5.0`](https://togithub.com/vercel/next.js/compare/v13.4.19...v13.5.0) [Compare Source](https://togithub.com/vercel/next.js/compare/v13.4.19...v13.5.0) ### [`v13.4.19`](https://togithub.com/vercel/next.js/releases/tag/v13.4.19) [Compare Source](https://togithub.com/vercel/next.js/compare/v13.4.18...v13.4.19) ##### Core Changes - fix: invalid module transform for `@headlessui/react`: [#54206](https://togithub.com/vercel/next.js/issues/54206) - chore: remove unnecessary type cast in dev-build-watcher: [#54221](https://togithub.com/vercel/next.js/issues/54221) - fix process.env not being available in standalone mode: [#54203](https://togithub.com/vercel/next.js/issues/54203) - Fix missing `devPageFiles` collection: [#54224](https://togithub.com/vercel/next.js/issues/54224) - Add `Route` and `LinkProps` stub generics: [#54226](https://togithub.com/vercel/next.js/issues/54226) - Use `createClientModuleProxy` from Flight Server: [#54232](https://togithub.com/vercel/next.js/issues/54232) - Add default not found to loader tree of group routes root layer: [#54228](https://togithub.com/vercel/next.js/issues/54228) - feat(image): add support for custom `loaderFile` when `loader: default`: [#53417](https://togithub.com/vercel/next.js/issues/53417) - Fix renamed export of Server Actions: [#54241](https://togithub.com/vercel/next.js/issues/54241) - Ensures App Router Link respects scroll-behavior: smooth when only hash is changed.: [#54243](https://togithub.com/vercel/next.js/issues/54243) ##### Misc Changes - Update dd-trace used for internal tools: [#54214](https://togithub.com/vercel/next.js/issues/54214) - (Fix)Broken `upgrading.mdx` link : [#54234](https://togithub.com/vercel/next.js/issues/54234) - chore: skip CI run on forks: [#54219](https://togithub.com/vercel/next.js/issues/54219) - chore(ci): bump `cancel-workflow-action@0.11.0`: [#54246](https://togithub.com/vercel/next.js/issues/54246) ##### Credits Huge thanks to [@opnay](https://togithub.com/opnay), [@styfle](https://togithub.com/styfle), [@timneutkens](https://togithub.com/timneutkens), [@ztanner](https://togithub.com/ztanner), [@shuding](https://togithub.com/shuding), [@huozhi](https://togithub.com/huozhi), [@vinaykulk621](https://togithub.com/vinaykulk621), [@balazsorban44](https://togithub.com/balazsorban44), [@goguda](https://togithub.com/goguda), and [@coreyleelarson](https://togithub.com/coreyleelarson) for helping! ### [`v13.4.18`](https://togithub.com/vercel/next.js/releases/tag/v13.4.18) [Compare Source](https://togithub.com/vercel/next.js/compare/v13.4.17...v13.4.18) ##### Core Changes - refactor: remove edge condition for module proxy path: [#54167](https://togithub.com/vercel/next.js/issues/54167) - Remove unused variables: [#54149](https://togithub.com/vercel/next.js/issues/54149) - chore: improve ts types for `position` in `dev-build-watcher`: [#54124](https://togithub.com/vercel/next.js/issues/54124) - Turbopack: Strip relative path prefix when generating PageLoaderAsset: [#54040](https://togithub.com/vercel/next.js/issues/54040) - Add `size` property to `ReadonlySearchParams`: [#53144](https://togithub.com/vercel/next.js/issues/53144) - Assign default not-found boundary if custom not-found is not present for root layer only: [#54185](https://togithub.com/vercel/next.js/issues/54185) - Allow range version for eslint config: [#53751](https://togithub.com/vercel/next.js/issues/53751) - Automatically modularizeImports for the popular [@headlessui/react](https://togithub.com/headlessui/react) library: [#54188](https://togithub.com/vercel/next.js/issues/54188) - fix bfcache restoration behavior: [#54198](https://togithub.com/vercel/next.js/issues/54198) ##### Misc Changes - Update rust toolchain: [#54130](https://togithub.com/vercel/next.js/issues/54130) ##### Credits Huge thanks to [@huozhi](https://togithub.com/huozhi), [@shuding](https://togithub.com/shuding), [@styfle](https://togithub.com/styfle), [@jridgewell](https://togithub.com/jridgewell), [@bencmbrook](https://togithub.com/bencmbrook), [@cramforce](https://togithub.com/cramforce), and [@ztanner](https://togithub.com/ztanner) for helping! ### [`v13.4.17`](https://togithub.com/vercel/next.js/releases/tag/v13.4.17) [Compare Source](https://togithub.com/vercel/next.js/compare/v13.4.16...v13.4.17) ##### Core Changes - fix(next/image): empty blur image when animated [#54028](https://togithub.com/vercel/next.js/issues/54028) - Do not output pages 404 in tree view if app not-found is used: [#54051](https://togithub.com/vercel/next.js/issues/54051) - Fix scroll bailout logic when targeting fixed/sticky elements: [#53873](https://togithub.com/vercel/next.js/issues/53873) - Debug tracing: add updated modules and page to HMR span: [#53698](https://togithub.com/vercel/next.js/issues/53698) - fix(next-swc): coerce mdxrs default options: [#54068](https://togithub.com/vercel/next.js/issues/54068) - fix: don't add forceConsistentCasingInFileNames to tsconfig when ts version >= 5.0: [#51564](https://togithub.com/vercel/next.js/issues/51564) - fix(47299): allow testing pages with metadata in jsdom test environment: [#53578](https://togithub.com/vercel/next.js/issues/53578) - upgrade edge-runtime dependency: [#54117](https://togithub.com/vercel/next.js/issues/54117) - Fix root not-found page tree loader structure: [#54080](https://togithub.com/vercel/next.js/issues/54080) - chore: remove `as any` type cast: [#54074](https://togithub.com/vercel/next.js/issues/54074) - chore: refactor to use `fs.promises.rm()`: [#54076](https://togithub.com/vercel/next.js/issues/54076) - Refactor layout router creation in app-render: [#54126](https://togithub.com/vercel/next.js/issues/54126) - chore(image): remove apple silicon workaround for versions older than `node@16.5.0`: [#54125](https://togithub.com/vercel/next.js/issues/54125) - fix routing bug when bfcache is hit following an mpa navigation: [#54081](https://togithub.com/vercel/next.js/issues/54081) - Tracing: add opt-in flag to send a subset of development traces to url: [#53880](https://togithub.com/vercel/next.js/issues/53880) - fix(edge): override init when cloning with `NextRequest`: [#54108](https://togithub.com/vercel/next.js/issues/54108) - OpenTel: remove the internal (ipc) fetched from traces in a non-verbose mode: [#54083](https://togithub.com/vercel/next.js/issues/54083) - cleanup: remove unnecessary effect dep: [#54134](https://togithub.com/vercel/next.js/issues/54134) - Next build: use exported `handle_issues` from turbopack: [#52972](https://togithub.com/vercel/next.js/issues/52972) - node-web-streams: remove tee shim, use ReadableStream.tee: [#54079](https://togithub.com/vercel/next.js/issues/54079) - fix: `cookies().has()` breaks in app-route: [#54112](https://togithub.com/vercel/next.js/issues/54112) - Revert "fix(47299): allow testing pages with metadata in jsdom test environment": [#54160](https://togithub.com/vercel/next.js/issues/54160) ##### Documentation Changes - fix missing `'` in data-fetching/fetching-caching-and-revalidating: [#54058](https://togithub.com/vercel/next.js/issues/54058) ##### Example Changes - Update Docker example to remove HOSTNAME: [#54102](https://togithub.com/vercel/next.js/issues/54102) ##### Misc Changes - chore: hide "same on new version" without link: [#54048](https://togithub.com/vercel/next.js/issues/54048) - chore(ci): small notes for the build steps: [#54073](https://togithub.com/vercel/next.js/issues/54073) - chore: update lock bot wording: [#54099](https://togithub.com/vercel/next.js/issues/54099) - Update `swc_core` to `v0.79.59`: [#54082](https://togithub.com/vercel/next.js/issues/54082) - install-native.mjs: include `packageManager` field: [#54132](https://togithub.com/vercel/next.js/issues/54132) ##### Credits Huge thanks to [@balazsorban44](https://togithub.com/balazsorban44), [@huozhi](https://togithub.com/huozhi), [@ztanner](https://togithub.com/ztanner), [@williamli](https://togithub.com/williamli), [@wbinnssmith](https://togithub.com/wbinnssmith), [@kwonoj](https://togithub.com/kwonoj), [@stefanprobst](https://togithub.com/stefanprobst), [@feugy](https://togithub.com/feugy), [@timneutkens](https://togithub.com/timneutkens), [@kdy1](https://togithub.com/kdy1), [@Kikobeats](https://togithub.com/Kikobeats), [@styfle](https://togithub.com/styfle), [@dvoytenko](https://togithub.com/dvoytenko), [@MaxLeiter](https://togithub.com/MaxLeiter), and [@devjiwonchoi](https://togithub.com/devjiwonchoi) for helping! ### [`v13.4.16`](https://togithub.com/vercel/next.js/releases/tag/v13.4.16) [Compare Source](https://togithub.com/vercel/next.js/compare/v13.4.15...v13.4.16) ##### Core Changes - Concept: test mode for Playwright and similar integration tools: [#52520](https://togithub.com/vercel/next.js/issues/52520) - Turbopack: fix hiding node_modules warnings in error overlay.: [#54022](https://togithub.com/vercel/next.js/issues/54022) - ci(next-swc): print glibc version when build: [#54026](https://togithub.com/vercel/next.js/issues/54026) - Adjust internal action proxy export: [#54004](https://togithub.com/vercel/next.js/issues/54004) ##### Documentation Changes - Update 05-client-side-rendering.mdx with latest tanstack query version: [#54009](https://togithub.com/vercel/next.js/issues/54009) - Open Graph Image font declaration moved to correct place: [#53998](https://togithub.com/vercel/next.js/issues/53998) - Update opengraph-image.mdx: Fix typo: [#54020](https://togithub.com/vercel/next.js/issues/54020) ##### Misc Changes - Remove extra label from runner: [#54002](https://togithub.com/vercel/next.js/issues/54002) - add standalone testcase for ipv6 hostnames: [#53999](https://togithub.com/vercel/next.js/issues/53999) - release: add release log generation script: [#54006](https://togithub.com/vercel/next.js/issues/54006) - test(ci): refine test suite name unique: [#54013](https://togithub.com/vercel/next.js/issues/54013) - Leverage previous swc build images: [#54027](https://togithub.com/vercel/next.js/issues/54027) - chore: mark build folder indexable: [#54029](https://togithub.com/vercel/next.js/issues/54029) - Move turbo outside of build for docker swc builds: [#54035](https://togithub.com/vercel/next.js/issues/54035) ##### Credits Huge thanks to [@ijjk](https://togithub.com/ijjk), [@ztanner](https://togithub.com/ztanner), [@huozhi](https://togithub.com/huozhi), [@lacymorrow](https://togithub.com/lacymorrow), [@dvoytenko](https://togithub.com/dvoytenko), [@kylemcd](https://togithub.com/kylemcd), [@kwonoj](https://togithub.com/kwonoj), [@tibi1220](https://togithub.com/tibi1220), [@wbinnssmith](https://togithub.com/wbinnssmith), and [@shuding](https://togithub.com/shuding) for helping! ### [`v13.4.15`](https://togithub.com/vercel/next.js/releases/tag/v13.4.15) [Compare Source](https://togithub.com/vercel/next.js/compare/v13.4.13...v13.4.15) ##### Core Changes - Fix action failures due to state tree encoding: [#53655](https://togithub.com/vercel/next.js/issues/53655) - Initial HMR Nexturbo API implementation: [#52950](https://togithub.com/vercel/next.js/issues/52950) - Turbopack: add edge app routes : [#53387](https://togithub.com/vercel/next.js/issues/53387) - Turbopack: Hide Turbo Engine internals: [#53007](https://togithub.com/vercel/next.js/issues/53007) - add unit test case for next.rs api: [#53679](https://togithub.com/vercel/next.js/issues/53679) - Fix not-found rendering in production with edge: [#53687](https://togithub.com/vercel/next.js/issues/53687) - fix(next/image): don't call ReactDOM.preload if missing, such as jest: [#53443](https://togithub.com/vercel/next.js/issues/53443) - Add docs page for uncaught DynamicServerErrors: [#53402](https://togithub.com/vercel/next.js/issues/53402) - Consolidate Server and Routing process into one process: [#53523](https://togithub.com/vercel/next.js/issues/53523) - fix: Update outdated transform imports lucide-react: [#53697](https://togithub.com/vercel/next.js/issues/53697) - Update font data: [#53759](https://togithub.com/vercel/next.js/issues/53759) - Add warnings for static generation bail outs: [#53761](https://togithub.com/vercel/next.js/issues/53761) - Sort root entries per pageExtensions config for consistency: [#53769](https://togithub.com/vercel/next.js/issues/53769) - improve error message for conflicting parallel segments: [#53803](https://togithub.com/vercel/next.js/issues/53803) - Add `changeFrequency` and `priority` attributes to sitemaps: [#48484](https://togithub.com/vercel/next.js/issues/48484) - Ensure we set cache-control: no-cache for actions: [#53824](https://togithub.com/vercel/next.js/issues/53824) - Reuse RenderWorker type: [#53782](https://togithub.com/vercel/next.js/issues/53782) - fix: normalize backslash in `getStaticPaths()` for windows: [#53876](https://togithub.com/vercel/next.js/issues/53876) - Delete errorneous empty content length header: [#53843](https://togithub.com/vercel/next.js/issues/53843) - Turbopack: more tests and bugfixes for next.rs api: [#53809](https://togithub.com/vercel/next.js/issues/53809) - Add `@heroicons/react` to `modularizeImports`: [#53902](https://togithub.com/vercel/next.js/issues/53902) - Turbopack: Fix debugging in napi for next-api: [#53889](https://togithub.com/vercel/next.js/issues/53889) - Fix/match resource: [#53796](https://togithub.com/vercel/next.js/issues/53796) - Use summary_large_image as twitter card if images present by default: [#53919](https://togithub.com/vercel/next.js/issues/53919) - Turbopack: Emit whether server or client assets changed: [#53879](https://togithub.com/vercel/next.js/issues/53879) - Limit sharp's concurrency: [#53385](https://togithub.com/vercel/next.js/issues/53385) - enable [@vercel/og](https://togithub.com/vercel/og) support for turbopack: [#53917](https://togithub.com/vercel/next.js/issues/53917) - feat(image): DataURL placeholder support forConfiguration
📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.