sanity-io / visual-editing

https://visual-editing-studio.sanity.build
MIT License
36 stars 20 forks source link

chore(deps): update dependency next to v14.2.13 [security] (canary) - autoclosed #1866

Closed renovate[bot] closed 6 days ago

renovate[bot] commented 6 days ago

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
next (source) 14.2.12 -> 14.2.13 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-46982

Impact

By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a Cache-Control: s-maxage=1, stale-while-revalidate header which some upstream CDNs may cache as well.

To be potentially affected all of the following must apply:

The below configurations are unaffected:

Patches

This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not.

Workarounds

There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

Credits


Release Notes

vercel/next.js (next) ### [`v14.2.13`](https://redirect.github.com/vercel/next.js/compare/v14.2.12...f550237aa564bd59bfef7462350ac6c502f0206d) [Compare Source](https://redirect.github.com/vercel/next.js/compare/v14.2.12...v14.2.13)

Configuration

๐Ÿ“… Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

๐Ÿšฆ Automerge: Enabled.

โ™ป Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

๐Ÿ”• Ignore: Close this PR and you won't be reminded about this update again.



This PR has been generated by Mend Renovate using a curated preset maintained by Sanity. View repository job log here

vercel[bot] commented 6 days ago

The latest updates on your projects. Learn more about Vercel for Git โ†—๏ธŽ

Name Status Preview Comments Updated (UTC)
live-visual-editing-next โœ… Ready (Inspect) Visit Preview ๐Ÿ’ฌ Add feedback Sep 25, 2024 2:34pm
visual-editing-astro โœ… Ready (Inspect) Visit Preview ๐Ÿ’ฌ Add feedback Sep 25, 2024 2:34pm
visual-editing-next โœ… Ready (Inspect) Visit Preview ๐Ÿ’ฌ Add feedback Sep 25, 2024 2:34pm
visual-editing-next-with-i18n โœ… Ready (Inspect) Visit Preview ๐Ÿ’ฌ Add feedback Sep 25, 2024 2:34pm
visual-editing-nuxt โŒ Failed (Inspect) Sep 25, 2024 2:34pm
visual-editing-page-builder-demo โœ… Ready (Inspect) Visit Preview ๐Ÿ’ฌ Add feedback Sep 25, 2024 2:34pm
visual-editing-remix โœ… Ready (Inspect) Visit Preview ๐Ÿ’ฌ Add feedback Sep 25, 2024 2:34pm
visual-editing-storybook โœ… Ready (Inspect) Visit Preview ๐Ÿ’ฌ Add feedback Sep 25, 2024 2:34pm
visual-editing-studio โœ… Ready (Inspect) Visit Preview ๐Ÿ’ฌ Add feedback Sep 25, 2024 2:34pm
visual-editing-svelte โœ… Ready (Inspect) Visit Preview ๐Ÿ’ฌ Add feedback Sep 25, 2024 2:34pm
socket-security[bot] commented 6 days ago

Removed dependencies detected. Learn more about Socket for GitHub โ†—๏ธŽ

๐Ÿšฎ Removed packages: npm/next@14.2.12

View full reportโ†—๏ธŽ