Update dependency next to v11 [SECURITY]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next (source)	`^5.1.0` -> `^11.0.0`

GitHub Vulnerability Alerts

Impact

Not affected: Deployments on ZEIT Now v2 (https://zeit.co) are not affected
Not affected: Deployments using the serverless target
Not affected: Deployments using next export
Affected: Users of Next.js below 9.3.2

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

Patches

https://github.com/zeit/next.js/releases/tag/v9.3.2

References

https://github.com/zeit/next.js/releases/tag/v9.3.2

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. Note that prior version 0.9.9 package next hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

CVE-2021-37699

Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated, allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although it can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.

Impact

Affected: Users of Next.js between 10.0.5 and 10.2.0
Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js without getInitialProps
Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js and next export
Not affected: Deployments on Vercel (vercel.com) are not affected
Not affected: Deployments with pages/404.js
Note that versions prior to 0.9.9 package next npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

We recommend upgrading to the latest version of Next.js to improve the overall security of your application.

Patches

https://github.com/vercel/next.js/releases/tag/v11.1.0

Release Notes

vercel/next.js (next)

### [`v11.1.3`](https://togithub.com/vercel/next.js/releases/tag/v11.1.3) [Compare Source](https://togithub.com/vercel/next.js/compare/v11.1.2...v11.1.3) See https://github.com/vercel/next.js/releases/v12.0.5 for details about this patch. ### [`v11.1.2`](https://togithub.com/vercel/next.js/releases/tag/v11.1.2) [Compare Source](https://togithub.com/vercel/next.js/compare/v11.1.1...v11.1.2) ##### Core Changes - chore: upgrade styled-jsx to 4.0.1: [#28626](https://togithub.com/vercel/next.js/issues/28626) - getServerSideProps should support props value as Promise: [#28607](https://togithub.com/vercel/next.js/issues/28607) - Ensure custom app regex is correct for Windows: [#28631](https://togithub.com/vercel/next.js/issues/28631) ##### Credits Huge thanks to [@huozhi](https://togithub.com/huozhi) and [@kara](https://togithub.com/kara) for helping! ### [`v11.1.1`](https://togithub.com/vercel/next.js/releases/tag/v11.1.1) [Compare Source](https://togithub.com/vercel/next.js/compare/v11.1.0...v11.1.1) ##### Core Changes - Next.js swc publish flow: [#27984](https://togithub.com/vercel/next.js/issues/27984) - Ensure config file message is only shown once: [#28017](https://togithub.com/vercel/next.js/issues/28017) - Add missing fields to `NextConfig` type: [#27974](https://togithub.com/vercel/next.js/issues/27974) - use a shared worker pool for collecting page data and static page generation: [#27924](https://togithub.com/vercel/next.js/issues/27924) - Use [@next](https://togithub.com/next) scope for native packages: [#28046](https://togithub.com/vercel/next.js/issues/28046) - Fix `generateBuildId` type that can be async function: [#28040](https://togithub.com/vercel/next.js/issues/28040) - Fix image optimization encoding url: [#28045](https://togithub.com/vercel/next.js/issues/28045) - Clean up `Document` in preparation for streaming: [#28032](https://togithub.com/vercel/next.js/issues/28032) - Render as a concatenation of streams: [#28082](https://togithub.com/vercel/next.js/issues/28082) - Add support for dynamic HTML: [#28085](https://togithub.com/vercel/next.js/issues/28085) - Support suspense in next dynamic: [#27611](https://togithub.com/vercel/next.js/issues/27611) - Handle blob urls in image component: [#27975](https://togithub.com/vercel/next.js/issues/27975) - Bypass webpack compilation for precompiled [@next/polyfills-nomodule](https://togithub.com/next/polyfills-nomodule): [#27596](https://togithub.com/vercel/next.js/issues/27596) - Update `util` to 0.12.4: [#27939](https://togithub.com/vercel/next.js/issues/27939) - Remove duplicate doctypes: [#28089](https://togithub.com/vercel/next.js/issues/28089) - Fix revalidate for initial notFound: true paths: [#28097](https://togithub.com/vercel/next.js/issues/28097) - Add proper error when failing to load next.config.js: [#28099](https://togithub.com/vercel/next.js/issues/28099) - Fix: wrong link error message: [#28127](https://togithub.com/vercel/next.js/issues/28127) - Add support for Jaeger trace target: [#28129](https://togithub.com/vercel/next.js/issues/28129) - Enable pure client suspense in blocking rendering: [#28165](https://togithub.com/vercel/next.js/issues/28165) - Add entrypoint tracing: [#25538](https://togithub.com/vercel/next.js/issues/25538) - Add module type to build-module trace: [#28128](https://togithub.com/vercel/next.js/issues/28128) - Update to latest babel versions: [#28174](https://togithub.com/vercel/next.js/issues/28174) - Improve jaeger traces: [#28168](https://togithub.com/vercel/next.js/issues/28168) - fix development mode bug with pages with "+" and other special characters: [#28122](https://togithub.com/vercel/next.js/issues/28122) - let loaders automatically infer source map setting: [#28204](https://togithub.com/vercel/next.js/issues/28204) - Avoid fs write `next-env.d.ts` on read-only filesystems: [#28206](https://togithub.com/vercel/next.js/issues/28206) - Document usage of suspense option of next/dynamic: [#28210](https://togithub.com/vercel/next.js/issues/28210) - Add warning when parent styles break `next/image`: [#28221](https://togithub.com/vercel/next.js/issues/28221) - Use `zen-observable` library: [#28214](https://togithub.com/vercel/next.js/issues/28214) - Fix HMR when custom \_app or \_document is removed: [#28227](https://togithub.com/vercel/next.js/issues/28227) - Add relationship between issuer and module to traces: [#28192](https://togithub.com/vercel/next.js/issues/28192) - Update generating next-server dependencies: [#28223](https://togithub.com/vercel/next.js/issues/28223) - Fix `next/image` blur placeholder when JS is disabled: [#28269](https://togithub.com/vercel/next.js/issues/28269) - Ensure adding \_app/\_document HMRs correctly: [#28279](https://togithub.com/vercel/next.js/issues/28279) - upgrade webpack to 5.51.1: [#28291](https://togithub.com/vercel/next.js/issues/28291) - \[ESLint] Adds `process.exit` to `next lint` success output: [#28299](https://togithub.com/vercel/next.js/issues/28299) - Fix next env vars injection in dynamic: [#28309](https://togithub.com/vercel/next.js/issues/28309) - Add layout to data-nimg attribute: [#28312](https://togithub.com/vercel/next.js/issues/28312) - Add data attribute to script component: [#28310](https://togithub.com/vercel/next.js/issues/28310) - Ensure [@babel/core](https://togithub.com/babel/core) is de-duped when nccing: [#28384](https://togithub.com/vercel/next.js/issues/28384) - Fix forked NODE_OPTIONS except for inspect: [#28420](https://togithub.com/vercel/next.js/issues/28420) - \[ESLint] Enable caching by default: [#28349](https://togithub.com/vercel/next.js/issues/28349) - Update test config to leverage swc: [#28400](https://togithub.com/vercel/next.js/issues/28400) - Add missing `typescript` property to `NextConfig`: [#28459](https://togithub.com/vercel/next.js/issues/28459) - next/script fix duplicate scripts : [#28428](https://togithub.com/vercel/next.js/issues/28428) - Ensure error is shown correctly for empty headers field: [#28430](https://togithub.com/vercel/next.js/issues/28430) - Add default trace format that is exported automatically: [#28461](https://togithub.com/vercel/next.js/issues/28461) - Update i18n locales limit to warning: [#28429](https://togithub.com/vercel/next.js/issues/28429) - Fix handling for 204 status code with a body: [#28479](https://togithub.com/vercel/next.js/issues/28479) - Update warning when parent styles break `next/image`: [#28517](https://togithub.com/vercel/next.js/issues/28517) - Support for functional Document components: [#28515](https://togithub.com/vercel/next.js/issues/28515) - Ensure dev server side errors are correct: [#28520](https://togithub.com/vercel/next.js/issues/28520) - Add CSP to Image Optimization API: [#28620](https://togithub.com/vercel/next.js/issues/28620) ##### Documentation Changes - Fix incorrect error manifest path: [#27970](https://togithub.com/vercel/next.js/issues/27970) - Add testing docs: [#27965](https://togithub.com/vercel/next.js/issues/27965) - \[DOCS] Update testing docs: [#28064](https://togithub.com/vercel/next.js/issues/28064) - \[ESLint] Disallow Githubissues.

Githubissues is a development platform for aggregating issues.

devinit / datahub