From 6859380ffc58708e0fd6e07c0f3e91beca8288f8 Mon Sep 17 00:00:00 2001 From: Chris Tate Date: Mon, 8 Dec 2025 16:11:49 -0600 Subject: [PATCH] fix: upgrade Next.js to 15.1.9 (CVE-2025-55182) This upgrade fixes CVE-2025-55182, a React Server Components RCE vulnerability. --- package.json | 2 +- pnpm-lock.yaml | 82 +++++++++++++++++++++++++------------------------- 2 files changed, 42 insertions(+), 42 deletions(-) diff --git a/package.json b/package.json index ab9b6c0..e1734df 100644 --- a/package.json +++ b/package.json @@ -36,7 +36,7 @@ "@vercel/routing-utils": "^5.0.0", "eslint": "^9.18.0", "eslint-config-next": "^15.1.5", - "next": "^15.1.5", + "next": "15.1.9", "react": "^19.0.0", "react-dom": "^19.0.0", "typescript": "^5.7.3" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7eaaaec..7b82e8e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -55,8 +55,8 @@ importers: specifier: ^15.1.5 version: 15.1.5(eslint@9.18.0)(typescript@5.7.3) next: - specifier: ^15.1.5 - version: 15.1.5(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + specifier: 15.1.9 + version: 15.1.9(react-dom@19.0.0(react@19.0.0))(react@19.0.0) react: specifier: ^19.0.0 version: 19.0.0 @@ -238,56 +238,56 @@ packages: cpu: [x64] os: [win32] - '@next/env@15.1.5': - resolution: {integrity: sha512-jg8ygVq99W3/XXb9Y6UQsritwhjc+qeiO7QrGZRYOfviyr/HcdnhdBQu4gbp2rBIh2ZyBYTBMWbPw3JSCb0GHw==} + '@next/env@15.1.9': + resolution: {integrity: sha512-Te1wbiJ//I40T7UePOUG8QBwh+VVMCc0OTuqesOcD3849TVOVOyX4Hdrkx7wcpLpy/LOABIcGyLX5P/SzzXhFA==} '@next/eslint-plugin-next@15.1.5': resolution: {integrity: sha512-3cCrXBybsqe94UxD6DBQCYCCiP9YohBMgZ5IzzPYHmPzj8oqNlhBii5b6o1HDDaRHdz2pVnSsAROCtrczy8O0g==} - '@next/swc-darwin-arm64@15.1.5': - resolution: {integrity: sha512-5ttHGE75Nw9/l5S8zR2xEwR8OHEqcpPym3idIMAZ2yo+Edk0W/Vf46jGqPOZDk+m/SJ+vYZDSuztzhVha8rcdA==} + '@next/swc-darwin-arm64@15.1.9': + resolution: {integrity: sha512-sQF6MfW4nk0PwMYYq8xNgqyxZJGIJV16QqNDgaZ5ze9YoVzm4/YNx17X0exZudayjL9PF0/5RGffDtzXapch0Q==} engines: {node: '>= 10'} cpu: [arm64] os: [darwin] - '@next/swc-darwin-x64@15.1.5': - resolution: {integrity: sha512-8YnZn7vDURUUTInfOcU5l0UWplZGBqUlzvqKKUFceM11SzfNEz7E28E1Arn4/FsOf90b1Nopboy7i7ufc4jXag==} + '@next/swc-darwin-x64@15.1.9': + resolution: {integrity: sha512-fp0c1rB6jZvdSDhprOur36xzQvqelAkNRXM/An92sKjjtaJxjlqJR8jiQLQImPsClIu8amQn+ZzFwl1lsEf62w==} engines: {node: '>= 10'} cpu: [x64] os: [darwin] - '@next/swc-linux-arm64-gnu@15.1.5': - resolution: {integrity: sha512-rDJC4ctlYbK27tCyFUhgIv8o7miHNlpCjb2XXfTLQszwAUOSbcMN9q2y3urSrrRCyGVOd9ZR9a4S45dRh6JF3A==} + '@next/swc-linux-arm64-gnu@15.1.9': + resolution: {integrity: sha512-77rYykF6UtaXvxh9YyRIKoaYPI6/YX6cy8j1DL5/1XkjbfOwFDfTEhH7YGPqG/ePl+emBcbDYC2elgEqY2e+ag==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] - '@next/swc-linux-arm64-musl@15.1.5': - resolution: {integrity: sha512-FG5RApf4Gu+J+pHUQxXPM81oORZrKBYKUaBTylEIQ6Lz17hKVDsLbSXInfXM0giclvXbyiLXjTv42sQMATmZ0A==} + '@next/swc-linux-arm64-musl@15.1.9': + resolution: {integrity: sha512-uZ1HazKcyWC7RA6j+S/8aYgvxmDqwnG+gE5S9MhY7BTMj7ahXKunpKuX8/BA2M7OvINLv7LTzoobQbw928p3WA==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] - '@next/swc-linux-x64-gnu@15.1.5': - resolution: {integrity: sha512-NX2Ar3BCquAOYpnoYNcKz14eH03XuF7SmSlPzTSSU4PJe7+gelAjxo3Y7F2m8+hLT8ZkkqElawBp7SWBdzwqQw==} + '@next/swc-linux-x64-gnu@15.1.9': + resolution: {integrity: sha512-gQIX1d3ct2RBlgbbWOrp+SHExmtmFm/HSW1Do5sSGMDyzbkYhS2sdq5LRDJWWsQu+/MqpgJHqJT6ORolKp/U1g==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - '@next/swc-linux-x64-musl@15.1.5': - resolution: {integrity: sha512-EQgqMiNu3mrV5eQHOIgeuh6GB5UU57tu17iFnLfBEhYfiOfyK+vleYKh2dkRVkV6ayx3eSqbIYgE7J7na4hhcA==} + '@next/swc-linux-x64-musl@15.1.9': + resolution: {integrity: sha512-fJOwxAbCeq6Vo7pXZGDP6iA4+yIBGshp7ie2Evvge7S7lywyg7b/SGqcvWq/jYcmd0EbXdb7hBfdqSQwTtGTPg==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - '@next/swc-win32-arm64-msvc@15.1.5': - resolution: {integrity: sha512-HPULzqR/VqryQZbZME8HJE3jNFmTGcp+uRMHabFbQl63TtDPm+oCXAz3q8XyGv2AoihwNApVlur9Up7rXWRcjg==} + '@next/swc-win32-arm64-msvc@15.1.9': + resolution: {integrity: sha512-crfbUkAd9PVg9nGfyjSzQbz82dPvc4pb1TeP0ZaAdGzTH6OfTU9kxidpFIogw0DYIEadI7hRSvuihy2NezkaNQ==} engines: {node: '>= 10'} cpu: [arm64] os: [win32] - '@next/swc-win32-x64-msvc@15.1.5': - resolution: {integrity: sha512-n74fUb/Ka1dZSVYfjwQ+nSJ+ifUff7jGurFcTuJNKZmI62FFOxQXUYit/uZXPTj2cirm1rvGWHG2GhbSol5Ikw==} + '@next/swc-win32-x64-msvc@15.1.9': + resolution: {integrity: sha512-SBB0oA4E2a0axUrUwLqXlLkSn+bRx9OWU6LheqmRrO53QEAJP7JquKh3kF0jRzmlYOWFZtQwyIWJMEJMtvvDcQ==} engines: {node: '>= 10'} cpu: [x64] os: [win32] @@ -1205,8 +1205,8 @@ packages: natural-compare@1.4.0: resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==} - next@15.1.5: - resolution: {integrity: sha512-Cf/TEegnt01hn3Hoywh6N8fvkhbOuChO4wFje24+a86wKOubgVaWkDqxGVgoWlz2Hp9luMJ9zw3epftujdnUOg==} + next@15.1.9: + resolution: {integrity: sha512-OoQpDPV2i3o5Hnn46nz2x6fzdFxFO+JsU4ZES12z65/feMjPHKKHLDVQ2NuEvTaXTRisix/G5+6hyTkwK329kA==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -1789,34 +1789,34 @@ snapshots: '@img/sharp-win32-x64@0.33.5': optional: true - '@next/env@15.1.5': {} + '@next/env@15.1.9': {} '@next/eslint-plugin-next@15.1.5': dependencies: fast-glob: 3.3.1 - '@next/swc-darwin-arm64@15.1.5': + '@next/swc-darwin-arm64@15.1.9': optional: true - '@next/swc-darwin-x64@15.1.5': + '@next/swc-darwin-x64@15.1.9': optional: true - '@next/swc-linux-arm64-gnu@15.1.5': + '@next/swc-linux-arm64-gnu@15.1.9': optional: true - '@next/swc-linux-arm64-musl@15.1.5': + '@next/swc-linux-arm64-musl@15.1.9': optional: true - '@next/swc-linux-x64-gnu@15.1.5': + '@next/swc-linux-x64-gnu@15.1.9': optional: true - '@next/swc-linux-x64-musl@15.1.5': + '@next/swc-linux-x64-musl@15.1.9': optional: true - '@next/swc-win32-arm64-msvc@15.1.5': + '@next/swc-win32-arm64-msvc@15.1.9': optional: true - '@next/swc-win32-x64-msvc@15.1.5': + '@next/swc-win32-x64-msvc@15.1.9': optional: true '@nodelib/fs.scandir@2.1.5': @@ -2966,9 +2966,9 @@ snapshots: natural-compare@1.4.0: {} - next@15.1.5(react-dom@19.0.0(react@19.0.0))(react@19.0.0): + next@15.1.9(react-dom@19.0.0(react@19.0.0))(react@19.0.0): dependencies: - '@next/env': 15.1.5 + '@next/env': 15.1.9 '@swc/counter': 0.1.3 '@swc/helpers': 0.5.15 busboy: 1.6.0 @@ -2978,14 +2978,14 @@ snapshots: react-dom: 19.0.0(react@19.0.0) styled-jsx: 5.1.6(react@19.0.0) optionalDependencies: - '@next/swc-darwin-arm64': 15.1.5 - '@next/swc-darwin-x64': 15.1.5 - '@next/swc-linux-arm64-gnu': 15.1.5 - '@next/swc-linux-arm64-musl': 15.1.5 - '@next/swc-linux-x64-gnu': 15.1.5 - '@next/swc-linux-x64-musl': 15.1.5 - '@next/swc-win32-arm64-msvc': 15.1.5 - '@next/swc-win32-x64-msvc': 15.1.5 + '@next/swc-darwin-arm64': 15.1.9 + '@next/swc-darwin-x64': 15.1.9 + '@next/swc-linux-arm64-gnu': 15.1.9 + '@next/swc-linux-arm64-musl': 15.1.9 + '@next/swc-linux-x64-gnu': 15.1.9 + '@next/swc-linux-x64-musl': 15.1.9 + '@next/swc-win32-arm64-msvc': 15.1.9 + '@next/swc-win32-x64-msvc': 15.1.9 sharp: 0.33.5 transitivePeerDependencies: - '@babel/core'