chore(deps): update dependency next [security]

This PR contains the following updates:

Package	Change
next	`12.0.9` -> `12.1.0`
next	`12.0.7` -> `12.0.9`

GitHub Vulnerability Alerts

CVE-2022-23646

Impact

Affected: All of the following must be true to be affected
- Next.js between version 10.0.0 and 12.0.10
- The next.config.js file has images.domains array assigned
- The image host assigned in images.domains allows user-provided SVG
Not affected: The next.config.js file has images.loader assigned to something other than default

Patches

Next.js 12.1.0

Workarounds

Change next.config.js to use a different loader configuration other than the default, for example:

module.exports = {
  images: {
    loader: 'imgix',
    path: 'https://example.com/myaccount/',
  },
}

Or if you want to use the loader prop on the component, you can use custom:

module.exports = {
  images: {
    loader: 'custom',
  },
}

CVE-2022-21721

Impact

Vulnerable code could allow a bad actor to trigger a denial of service attack for anyone running a Next.js app at version >= 12.0.0, and using i18n functionality.

Affected: All of the following must be true to be affected by this CVE
- Next.js versions above v12.0.0
- Using next start or a custom server
- Using the built-in i18n support
Not affected:
- Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.

Patches

A patch has been released, next@12.0.9, that mitigates this issue. We recommend all affected users upgrade as soon as possible.

Workarounds

We recommend upgrading whether you can reproduce or not although you can ensure /${locale}/_next/ is blocked from reaching the Next.js instance until you upgrade.

For more information

If you have any questions or comments about this advisory:

Open an issue in next
Email us at security@vercel.com

Configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

[ ] If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by WhiteSource Renovate. View repository job log here.

notrab / headless-dropshipping-starter