chore(deps): update dependency next to v12 [security] #411
Conversation
|
This pull request is being automatically deployed with Vercel (learn more). coderscamp-website – ./🔍 Inspect: https://vercel.com/coderscamp/coderscamp-website/Hhs8rgvP5fMDrQdvPdHeENQE4wjG coderscamp-storybook – ./🔍 Inspect: https://vercel.com/coderscamp/coderscamp-storybook/AkNzwdXCFi29i2CQgMdBXLf2og81 coderscamp-docs – ./🔍 Inspect: https://vercel.com/coderscamp/coderscamp-docs/9TcsdHUybex3ECyyqRGXBYpCioQj |
Codecov Report
@@ Coverage Diff @@
## main #411 +/- ##
=======================================
Coverage 90.67% 90.67%
=======================================
Files 161 161
Lines 2006 2006
Branches 271 271
=======================================
Hits 1819 1819
Misses 186 186
Partials 1 1
Flags with carried forward coverage won't be shown. Click here to find out more. Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
renovate
bot
force-pushed
the
chore-update-dependencies-npm-next-vulnerability
branch
from
53262d5 to
90feefb
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
chore-update-dependencies-npm-next-vulnerability
branch
from
90feefb to
e783717
Compare
This PR contains the following updates:
11.1.2->12.1.0GitHub Vulnerability Alerts
CVE-2022-23646
Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the
next.config.jsfile must have animages.domainsarray assigned and the image host assigned inimages.domainsmust allow user-provided SVG. If thenext.config.jsfile hasimages.loaderassigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, changenext.config.jsto use a differentloader configurationother than the default.Impact
next.config.jsfile has images.domains array assignednext.config.jsfile has images.loader assigned to something other than defaultPatches
Next.js 12.1.0
Workarounds
Change
next.config.jsto use a different loader configuration other than the default, for example:Or if you want to use the
loaderprop on the component, you can usecustom:Release Notes
vercel/next.js
v12.1.0Compare Source
Core Changes
artifactDirectory: #33918react-dom/server.browserin Node.js: #33950ReadableStreaminRenderResult: #34005Linkto pass event toonClickhandler: #27723lazyRootfunctionality fornext/image: #33933Routerstate immutable: #33925renderandrenderErrormethods fromnext/client: #34069concurrentFeatureswithruntime: #34068renderToStreamwith React 18: #34106next/imageusage fromnode_modules: #33559react-dom/server.browserwhenreactRoot: true: #34116.envfile in standalone mode: #34143next-server.ts: #34230runtimeis set tonodejs: #34228node-sass@7as peer dependency: #34107<RouteAnnouncer/>shouldn't announce initial path under strict mode and React 18: #34338dangerouslyAllowSVGandcontentSecurityPolicy: #34431.svgimage optimization with aloaderprop: #34452Documentation Changes
.endinstead of.sendwhen no body is being sent: #33611profileDatatodatain CSR page: #34018asyncto middleware docs.: #31356urltonextUrlinside delete-query-params-in-middlewa…: #33796fallback: true: #34114invalid-api-status-bodyerror: #34150lazyRootprop: #34241getting started: #34282getInitialProps: #34309Example Changes
yarn lint.: #34019next/imagein the Sanity example: #34203profilein firebase example: #34457Misc Changes
Credits
Huge thanks to @MaedahBatool, @mutebg, @sokra, @huozhi, @hanford, @shuding, @sean6bucks, @jameshfisher, @devknoll, @yuta-ike, @zh-lx, @amandeepmittal, @alunyov, @stefanprobst, @leerob, @balazsorban44, @kdy1, @brittanyrw, @jord1e, @kara, @vvo, @ismaelrumzan, @dlindenkreuz, @MohammadxAli, @nguyenyou, @thibautsabot, @hanneslund, @vertti, @KateKate, @stefee, @mikinovation, @Leticijak, @mohsen1, @ncphillips, @ehowey, @lancechentw, @krychaxp, @fmacherey, @pklawansky, @RyanClementsHax, @lakbychance, @sannajammeh, @oliviertassinari, @alexander-akait, @u-yas, @Cheprer, @msp5382, @chrispat, @getspooky, @Ryz0nd, @klaasman, @midgleyc, @kumard3, @jesstelford, @neeraj3029, @glenngijsberts, @pie6k, @wouterraateland, @timneutkens, @11koukou, @thesyedbasim, @aeneasr, @ijjk, @lfades, @JuniorTour, @xavhan, @mattyocode, @padmaia, @Skn0tt, @gwer, @Nutlope, @styfle, @stipsan, @xhoantran, @eolme, @sespinosa, @zenorocha, @hjaber, @benmvp, @T-O-R-U-S, @dburrows, @atcastle, @kiriny, @molebox, @kitayoshi, and @Schniz for helping!
v12.0.10Compare Source
Core Changes
compressconfigurable in standalone mode: #33717stale-while-revalidatepattern to Image Optimization API: #33735Documentation Changes
Example Changes
with-dockerexample dockerfile: #33695Misc Changes
lock.ymlCredits
Huge thanks to @Vienio99, @balazsorban44, @kyliau, @molebox, @huozhi, @shuding, @PepijnSenders, @krystofex, @PizzaPete, @souljuse, @styfle, @Schniz, @Nelsonfrank, @ijjk, @Mhmdrza, @timneutkens, @hideokamoto-stripe, @Emrin, @gr-qft, @delbaoliveira, @redbar0n, @amandeepmittal, @lxy-yz, and @Divlo for helping!
v12.0.9Compare Source
This upgrade is completely backward-compatible and recommended for all users on versions below 12.0.9
Vulnerable code could allow a bad actor to trigger a denial of service attack via the
/${locale}/_next/route for anyone running a Next.js app at version >= 12.0.0, and using built-in i18n routing functionality.How to Upgrade
npm install next@latest --saveImpact
v12.0.0andv12.0.9We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
How to Assess Impact
If your server has seen requests to any route under the prefix
/${locale}/_next/that have triggered a heap overflow error, this was caused by the patched issue.What is Being Done
As Next.js has grown in popularity and usage by enterprises, it has received the attention of security researchers and auditors. We are thankful to our users for their investigation and responsible disclosure of the original bug.
We've landed a patch that ensures this is handled properly so the requested route no longer crashes and triggers a heap overflow.
Regression tests for this attack were added to the i18n integration test suite
security@vercel.com. We are actively monitoring this mailbox.Core Changes
process.envto inferred usage: #33186postcss: #33142node-fetch: #33466onLoadingComplete(): #33474next-multilingualexample: #29386lazyRootoptional property tonext/imagecomponent : #33290Documentation Changes
next export+next/imageerror message: #33317onLoadgottcha note tonext/scriptdocs: #33097next/serverdocumentation forgeo: #33609next/imageusage withnext exportbased on feedback.: #33555headersconfig option description: #33484netlify-plugin-cache-nextjshas been deprecated: #33629Example Changes
Misc Changes
Credits
Huge thanks to @molebox, @Schniz, @sokra, @kachkaev, @shuding, @teleaziz, @OgbeniHMMD, @goncy, @balazsorban44, @MaedahBatool, @bennettdams, @kdy1, @huozhi, @hsynlms, @styfle, @ijjk, @callumgare, @jonrosner, @karaggeorge, @rpie3, @MartijnHols, @leerob, @bashunaimiroy, @NOCELL, @rishabhpoddar, @omariosouto, @hanneslund, @theMosaad, @javivelasco, @pierrenel, @lobsterkatie, @tharakabimal, @vvo, @saevarb, @lfades, @nbouvrette, @paulnbrd, @ecklf, @11koukou, @renbaoshuo, @chozzz, @tbezman, @karlhorky, @j-mendez, and @ffan0811 for helping!
v12.0.8Compare Source
Core Changes
<Main />: #32184Writable: #32247nth: #32358jsxtransform of swc: #32383style.filteron image withplaceholder=blur: #32623.nextfolder: #32659placeholder=blur: #32680afor internal url whentarget="blank"present: #32780<head>: #32897Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.