vercel/next.js
### [`v11.1.0`](https://togithub.com/vercel/next.js/releases/v11.1.0)
[Compare Source](https://togithub.com/vercel/next.js/compare/v11.0.1...v11.1.0)
A security team from one of our partners noticed an issue in Next.js that allowed for an open redirect to occur.
Specially encoded paths could be used when `pages/_error.js` was statically generated allowing an open redirect to occur to an external site.
In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.
We recommend upgrading to the latest version of Next.js to improve the overall security of your application.
#### How to Upgrade
- We have released patch versions for both the stable and canary channels of Next.js.
- To upgrade run `npm install next@latest --save`
#### Impact
- **Affected:** Users of Next.js between 10.0.5 and 10.2.0
- **Affected:** Users of Next.js between 11.0.0 and 11.0.1 using `pages/_error.js` without `getInitialProps`
- **Affected:** Users of Next.js between 11.0.0 and 11.0.1 using `pages/_error.js` and `next export`
- **Not affected**: Deployments on Vercel ([vercel.com](https://vercel.com)) are not affected
- **Not affected:** Deployments **with** `pages/404.js`
We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
##### How to Assess Impact
If you think sensitive code or data could have been exposed, you can filter logs of affected sites by `//` (double slash at the start of the url) followed by a domain.
#### What is Being Done
As Next.js has grown in popularity and usage by enterprises, it has received the attention of security researchers and auditors. We are thankful to Gabriel Benmergui from Robinhood for their investigation and discovery of the original bug and subsequent responsible disclosure.
We've landed a patch that ensures path parsing is handled properly for these paths so that the open redirect can no longer occur.
Regression tests for this attack were added to the [security](https://togithub.com/zeit/next.js/blob/canary/test/integration/production/test/security.js) integration test suite
- We have notified known Next.js users in advance of this publication.
- A public CVE was released.
- We encourage responsible disclosure of future reports. Please email us at `security@vercel.com`. We are actively monitoring this mailbox.
***
#### Release notes
##### Core Changes
- Don't test image domains in test env: [#26502](https://togithub.com/vercel/next.js/issues/26502)
- Fix props not updating when changing the locale and keeping hash: [#26205](https://togithub.com/vercel/next.js/issues/26205)
- Allow user to override next-image-loader: [#26548](https://togithub.com/vercel/next.js/issues/26548)
- Add logging when a custom babelrc is loaded: [#26570](https://togithub.com/vercel/next.js/issues/26570)
- Add comment to not edit in next-env file: [#26573](https://togithub.com/vercel/next.js/issues/26573)
- Add trace url on bootup: [#26594](https://togithub.com/vercel/next.js/issues/26594)
- Add check for ObjectExpression when iterating on tags for font optimization: [#26608](https://togithub.com/vercel/next.js/issues/26608)
- Fix GSP redirect cache error: [#26627](https://togithub.com/vercel/next.js/issues/26627)
- Correct statusCode when visiting \_error directly: [#26610](https://togithub.com/vercel/next.js/issues/26610)
- fix: next dynamic with jest: [#26614](https://togithub.com/vercel/next.js/issues/26614)
- Ensure API routes are not available under the locale: [#26629](https://togithub.com/vercel/next.js/issues/26629)
- Fix image content type octet stream 400: [#26705](https://togithub.com/vercel/next.js/issues/26705)
- \[ESLint] Adds --max-warnings flag to `next lint`: [#26697](https://togithub.com/vercel/next.js/issues/26697)
- Simplify `next-dev-server` implementation: [#26230](https://togithub.com/vercel/next.js/issues/26230)
- Move code shared between server/client to "shared" folder: [#26734](https://togithub.com/vercel/next.js/issues/26734)
- Move next-server directory files to server directory: [#26756](https://togithub.com/vercel/next.js/issues/26756)
- Support new hydrate API in latest react 18 alpha release: [#26664](https://togithub.com/vercel/next.js/issues/26664)
- Add upstream `max-age` to optimized image: [#26739](https://togithub.com/vercel/next.js/issues/26739)
- Fix blurred image position when using objectPosition: [#26590](https://togithub.com/vercel/next.js/issues/26590)
- Leverage blocked page for \_error: [#26748](https://togithub.com/vercel/next.js/issues/26748)
- fix: detect loop in client error page: [#26567](https://togithub.com/vercel/next.js/issues/26567)
- Add `onLoadingComplete()` prop to Image component: [#26824](https://togithub.com/vercel/next.js/issues/26824)
- Add "Vary: Accept" header to /\_next/image responses: [#26788](https://togithub.com/vercel/next.js/issues/26788)
- Add additional tests for image type detection: [#26832](https://togithub.com/vercel/next.js/issues/26832)
- Fix immutable header for image with static import & unoptimized: [#26836](https://togithub.com/vercel/next.js/issues/26836)
- Make sure 404 pages do not get cached by a CDN when using next start: [#24983](https://togithub.com/vercel/next.js/issues/24983)
- Don't emit duplicate image files: [#26843](https://togithub.com/vercel/next.js/issues/26843)
- Warn when response body is larger than 5mb: [#26831](https://togithub.com/vercel/next.js/issues/26831)
- Fix: added the key property to the pre next scripts: [#26646](https://togithub.com/vercel/next.js/issues/26646)
- Ensure API route errors are propagated in minimal mode: [#26875](https://togithub.com/vercel/next.js/issues/26875)
- 5MB -> 4MB body size limit: [#26887](https://togithub.com/vercel/next.js/issues/26887)
- \[ESLint] Update default `.eslintrc` file created to have `.json` format: [#26884](https://togithub.com/vercel/next.js/issues/26884)
- Refactor decode failures: [#26899](https://togithub.com/vercel/next.js/issues/26899)
- Add initial `ResponsePayload` support: [#26938](https://togithub.com/vercel/next.js/issues/26938)
- Fix typo in route-loader: [#26942](https://togithub.com/vercel/next.js/issues/26942)
- More explicit typing for `IncrementalCache` API: [#26941](https://togithub.com/vercel/next.js/issues/26941)
- Fix merge issue and use `respondWith`: [#26961](https://togithub.com/vercel/next.js/issues/26961)
- (next/image): Merge query string params in imgix loader: [#26719](https://togithub.com/vercel/next.js/issues/26719)
- Fix: (rewrites) incorrect parsing of destination query: [#26619](https://togithub.com/vercel/next.js/issues/26619)
- Fix forward slash encoding while interpolating: [#26963](https://togithub.com/vercel/next.js/issues/26963)
- update webpack to 5.43.0: [#26979](https://togithub.com/vercel/next.js/issues/26979)
- Rename `next/script` interface Props to ScriptProps: [#26990](https://togithub.com/vercel/next.js/issues/26990)
- Don't lazy-load already-loaded image in client-side transition: [#26968](https://togithub.com/vercel/next.js/issues/26968)
- Loosen `next/image` TS types for `width` and `height`: [#26991](https://togithub.com/vercel/next.js/issues/26991)
- Add `dangerously-unoptimized` loader for next/image: [#26847](https://togithub.com/vercel/next.js/issues/26847)
- Fix hash change events not firing with i18n: [#26994](https://togithub.com/vercel/next.js/issues/26994)
- Loosen `next/image` TS types for `src`: [#26996](https://togithub.com/vercel/next.js/issues/26996)
- Provide Next.js postcss version to cssnano-simple: [#26952](https://togithub.com/vercel/next.js/issues/26952)
- Rename next/image `dangerously-unoptimized` to `custom` and warn when applicable: [#26998](https://togithub.com/vercel/next.js/issues/26998)
- Add newline to the end of `next-env.d.ts`: [#27028](https://togithub.com/vercel/next.js/issues/27028)
- Add performance tracing for next-image-loader: [#27043](https://togithub.com/vercel/next.js/issues/27043)
- Include message body in redirect responses: [#25257](https://togithub.com/vercel/next.js/issues/25257)
- add support for esm externals: [#27069](https://togithub.com/vercel/next.js/issues/27069)
- Enhance `next dev` performance with placeholder=blur: [#27061](https://togithub.com/vercel/next.js/issues/27061)
- Add batching to zipkin reporter: [#27082](https://togithub.com/vercel/next.js/issues/27082)
- Bind sendBeacon to navigator: [#26601](https://togithub.com/vercel/next.js/issues/26601)
- Fall back to fallbackSend when send is false: [#27113](https://togithub.com/vercel/next.js/issues/27113)
- Upgrades `web-vitals` to v1.1.2.: [#25272](https://togithub.com/vercel/next.js/issues/25272)
- Prevent timeout when loading routes in development: [#25749](https://togithub.com/vercel/next.js/issues/25749)
- Workaround for Node.js 16+ on Apple Silicon M1: [#27031](https://togithub.com/vercel/next.js/issues/27031)
- Replace `withCoalescedInvoke` with `ResponseCache`: [#26997](https://togithub.com/vercel/next.js/issues/26997)
- Add some missing fields to the NextConfig type: [#27126](https://togithub.com/vercel/next.js/issues/27126)
- Update redirect regexes to not match \_next: [#27143](https://togithub.com/vercel/next.js/issues/27143)
- Bump babel target to Node.js 12: [#27147](https://togithub.com/vercel/next.js/issues/27147)
- Use SWC to compile Next.js core server files: [#27167](https://togithub.com/vercel/next.js/issues/27167)
- Fix css minify incorrectly duplicating variables: [#27150](https://togithub.com/vercel/next.js/issues/27150)
- Fix gsp generation with file extension: [#27144](https://togithub.com/vercel/next.js/issues/27144)
- Add `minimumCacheTTL` config for Image Optimization: [#27200](https://togithub.com/vercel/next.js/issues/27200)
- Fix Script beforeInteractive on navigation: [#26995](https://togithub.com/vercel/next.js/issues/26995)
- improve static generation UX: [#27171](https://togithub.com/vercel/next.js/issues/27171)
- Add warning for large number of routes: [#27214](https://togithub.com/vercel/next.js/issues/27214)
- Add x-forward headers to external rewrites: [#17557](https://togithub.com/vercel/next.js/issues/17557)
- \[ESLint] Remove error when file patterns are unmatched + ESLint setup changes: [#27119](https://togithub.com/vercel/next.js/issues/27119)
- Fix inline scripts being duplicated when used with `next/script` component: [#27218](https://togithub.com/vercel/next.js/issues/27218)
- Fix `minimumCacheTTL` so it doesn't affect browser caching: [#27307](https://togithub.com/vercel/next.js/issues/27307)
- Fix default server host value causing issues on Windows: [#27306](https://togithub.com/vercel/next.js/issues/27306)
- Fix `placeholder=blur` inside `
Configuration
📅 Schedule: At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
[ ] If you want to rebase/retry this PR, check this box.
This PR contains the following updates:
11.0.1->11.1.011.0.1->11.1.0Release Notes
vercel/next.js
### [`v11.1.0`](https://togithub.com/vercel/next.js/releases/v11.1.0) [Compare Source](https://togithub.com/vercel/next.js/compare/v11.0.1...v11.1.0) A security team from one of our partners noticed an issue in Next.js that allowed for an open redirect to occur. Specially encoded paths could be used when `pages/_error.js` was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend upgrading to the latest version of Next.js to improve the overall security of your application. #### How to Upgrade - We have released patch versions for both the stable and canary channels of Next.js. - To upgrade run `npm install next@latest --save` #### Impact - **Affected:** Users of Next.js between 10.0.5 and 10.2.0 - **Affected:** Users of Next.js between 11.0.0 and 11.0.1 using `pages/_error.js` without `getInitialProps` - **Affected:** Users of Next.js between 11.0.0 and 11.0.1 using `pages/_error.js` and `next export` - **Not affected**: Deployments on Vercel ([vercel.com](https://vercel.com)) are not affected - **Not affected:** Deployments **with** `pages/404.js` We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. ##### How to Assess Impact If you think sensitive code or data could have been exposed, you can filter logs of affected sites by `//` (double slash at the start of the url) followed by a domain. #### What is Being Done As Next.js has grown in popularity and usage by enterprises, it has received the attention of security researchers and auditors. We are thankful to Gabriel Benmergui from Robinhood for their investigation and discovery of the original bug and subsequent responsible disclosure. We've landed a patch that ensures path parsing is handled properly for these paths so that the open redirect can no longer occur. Regression tests for this attack were added to the [security](https://togithub.com/zeit/next.js/blob/canary/test/integration/production/test/security.js) integration test suite - We have notified known Next.js users in advance of this publication. - A public CVE was released. - We encourage responsible disclosure of future reports. Please email us at `security@vercel.com`. We are actively monitoring this mailbox. *** #### Release notes ##### Core Changes - Don't test image domains in test env: [#26502](https://togithub.com/vercel/next.js/issues/26502) - Fix props not updating when changing the locale and keeping hash: [#26205](https://togithub.com/vercel/next.js/issues/26205) - Allow user to override next-image-loader: [#26548](https://togithub.com/vercel/next.js/issues/26548) - Add logging when a custom babelrc is loaded: [#26570](https://togithub.com/vercel/next.js/issues/26570) - Add comment to not edit in next-env file: [#26573](https://togithub.com/vercel/next.js/issues/26573) - Add trace url on bootup: [#26594](https://togithub.com/vercel/next.js/issues/26594) - Add check for ObjectExpression when iterating on tags for font optimization: [#26608](https://togithub.com/vercel/next.js/issues/26608) - Fix GSP redirect cache error: [#26627](https://togithub.com/vercel/next.js/issues/26627) - Correct statusCode when visiting \_error directly: [#26610](https://togithub.com/vercel/next.js/issues/26610) - fix: next dynamic with jest: [#26614](https://togithub.com/vercel/next.js/issues/26614) - Ensure API routes are not available under the locale: [#26629](https://togithub.com/vercel/next.js/issues/26629) - Fix image content type octet stream 400: [#26705](https://togithub.com/vercel/next.js/issues/26705) - \[ESLint] Adds --max-warnings flag to `next lint`: [#26697](https://togithub.com/vercel/next.js/issues/26697) - Simplify `next-dev-server` implementation: [#26230](https://togithub.com/vercel/next.js/issues/26230) - Move code shared between server/client to "shared" folder: [#26734](https://togithub.com/vercel/next.js/issues/26734) - Move next-server directory files to server directory: [#26756](https://togithub.com/vercel/next.js/issues/26756) - Support new hydrate API in latest react 18 alpha release: [#26664](https://togithub.com/vercel/next.js/issues/26664) - Add upstream `max-age` to optimized image: [#26739](https://togithub.com/vercel/next.js/issues/26739) - Fix blurred image position when using objectPosition: [#26590](https://togithub.com/vercel/next.js/issues/26590) - Leverage blocked page for \_error: [#26748](https://togithub.com/vercel/next.js/issues/26748) - fix: detect loop in client error page: [#26567](https://togithub.com/vercel/next.js/issues/26567) - Add `onLoadingComplete()` prop to Image component: [#26824](https://togithub.com/vercel/next.js/issues/26824) - Add "Vary: Accept" header to /\_next/image responses: [#26788](https://togithub.com/vercel/next.js/issues/26788) - Add additional tests for image type detection: [#26832](https://togithub.com/vercel/next.js/issues/26832) - Fix immutable header for image with static import & unoptimized: [#26836](https://togithub.com/vercel/next.js/issues/26836) - Make sure 404 pages do not get cached by a CDN when using next start: [#24983](https://togithub.com/vercel/next.js/issues/24983) - Don't emit duplicate image files: [#26843](https://togithub.com/vercel/next.js/issues/26843) - Warn when response body is larger than 5mb: [#26831](https://togithub.com/vercel/next.js/issues/26831) - Fix: added the key property to the pre next scripts: [#26646](https://togithub.com/vercel/next.js/issues/26646) - Ensure API route errors are propagated in minimal mode: [#26875](https://togithub.com/vercel/next.js/issues/26875) - 5MB -> 4MB body size limit: [#26887](https://togithub.com/vercel/next.js/issues/26887) - \[ESLint] Update default `.eslintrc` file created to have `.json` format: [#26884](https://togithub.com/vercel/next.js/issues/26884) - Refactor decode failures: [#26899](https://togithub.com/vercel/next.js/issues/26899) - Add initial `ResponsePayload` support: [#26938](https://togithub.com/vercel/next.js/issues/26938) - Fix typo in route-loader: [#26942](https://togithub.com/vercel/next.js/issues/26942) - More explicit typing for `IncrementalCache` API: [#26941](https://togithub.com/vercel/next.js/issues/26941) - Fix merge issue and use `respondWith`: [#26961](https://togithub.com/vercel/next.js/issues/26961) - (next/image): Merge query string params in imgix loader: [#26719](https://togithub.com/vercel/next.js/issues/26719) - Fix: (rewrites) incorrect parsing of destination query: [#26619](https://togithub.com/vercel/next.js/issues/26619) - Fix forward slash encoding while interpolating: [#26963](https://togithub.com/vercel/next.js/issues/26963) - update webpack to 5.43.0: [#26979](https://togithub.com/vercel/next.js/issues/26979) - Rename `next/script` interface Props to ScriptProps: [#26990](https://togithub.com/vercel/next.js/issues/26990) - Don't lazy-load already-loaded image in client-side transition: [#26968](https://togithub.com/vercel/next.js/issues/26968) - Loosen `next/image` TS types for `width` and `height`: [#26991](https://togithub.com/vercel/next.js/issues/26991) - Add `dangerously-unoptimized` loader for next/image: [#26847](https://togithub.com/vercel/next.js/issues/26847) - Fix hash change events not firing with i18n: [#26994](https://togithub.com/vercel/next.js/issues/26994) - Loosen `next/image` TS types for `src`: [#26996](https://togithub.com/vercel/next.js/issues/26996) - Provide Next.js postcss version to cssnano-simple: [#26952](https://togithub.com/vercel/next.js/issues/26952) - Rename next/image `dangerously-unoptimized` to `custom` and warn when applicable: [#26998](https://togithub.com/vercel/next.js/issues/26998) - Add newline to the end of `next-env.d.ts`: [#27028](https://togithub.com/vercel/next.js/issues/27028) - Add performance tracing for next-image-loader: [#27043](https://togithub.com/vercel/next.js/issues/27043) - Include message body in redirect responses: [#25257](https://togithub.com/vercel/next.js/issues/25257) - add support for esm externals: [#27069](https://togithub.com/vercel/next.js/issues/27069) - Enhance `next dev` performance with placeholder=blur: [#27061](https://togithub.com/vercel/next.js/issues/27061) - Add batching to zipkin reporter: [#27082](https://togithub.com/vercel/next.js/issues/27082) - Bind sendBeacon to navigator: [#26601](https://togithub.com/vercel/next.js/issues/26601) - Fall back to fallbackSend when send is false: [#27113](https://togithub.com/vercel/next.js/issues/27113) - Upgrades `web-vitals` to v1.1.2.: [#25272](https://togithub.com/vercel/next.js/issues/25272) - Prevent timeout when loading routes in development: [#25749](https://togithub.com/vercel/next.js/issues/25749) - Workaround for Node.js 16+ on Apple Silicon M1: [#27031](https://togithub.com/vercel/next.js/issues/27031) - Replace `withCoalescedInvoke` with `ResponseCache`: [#26997](https://togithub.com/vercel/next.js/issues/26997) - Add some missing fields to the NextConfig type: [#27126](https://togithub.com/vercel/next.js/issues/27126) - Update redirect regexes to not match \_next: [#27143](https://togithub.com/vercel/next.js/issues/27143) - Bump babel target to Node.js 12: [#27147](https://togithub.com/vercel/next.js/issues/27147) - Use SWC to compile Next.js core server files: [#27167](https://togithub.com/vercel/next.js/issues/27167) - Fix css minify incorrectly duplicating variables: [#27150](https://togithub.com/vercel/next.js/issues/27150) - Fix gsp generation with file extension: [#27144](https://togithub.com/vercel/next.js/issues/27144) - Add `minimumCacheTTL` config for Image Optimization: [#27200](https://togithub.com/vercel/next.js/issues/27200) - Fix Script beforeInteractive on navigation: [#26995](https://togithub.com/vercel/next.js/issues/26995) - improve static generation UX: [#27171](https://togithub.com/vercel/next.js/issues/27171) - Add warning for large number of routes: [#27214](https://togithub.com/vercel/next.js/issues/27214) - Add x-forward headers to external rewrites: [#17557](https://togithub.com/vercel/next.js/issues/17557) - \[ESLint] Remove error when file patterns are unmatched + ESLint setup changes: [#27119](https://togithub.com/vercel/next.js/issues/27119) - Fix inline scripts being duplicated when used with `next/script` component: [#27218](https://togithub.com/vercel/next.js/issues/27218) - Fix `minimumCacheTTL` so it doesn't affect browser caching: [#27307](https://togithub.com/vercel/next.js/issues/27307) - Fix default server host value causing issues on Windows: [#27306](https://togithub.com/vercel/next.js/issues/27306) - Fix `placeholder=blur` inside `Configuration
📅 Schedule: At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by WhiteSource Renovate. View repository job log here.