fix(deps): update dependency next to v14.2.15 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next (source)	14.2.3 -> 14.2.15

---

Denial of Service condition in Next.js image optimization

CVE-2024-47831 / GHSA-g77x-44xx-532m

More information

Details

Impact

The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.

Not affected:

• The next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value.
• The Next.js application is hosted on Vercel.

Patches

This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.

Workarounds

Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.

Credits

Brandon Dahler (brandondahler), AWS
Dimitrios Vlastaras

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m
• https://nvd.nist.gov/vuln/detail/CVE-2024-47831
• https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a
• https://github.com/vercel/next.js

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Next.js Cache Poisoning

CVE-2024-46982 / GHSA-gp8f-8m3g-qvj9

More information

Details

Impact

By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a Cache-Control: s-maxage=1, stale-while-revalidate header which some upstream CDNs may cache as well.

To be potentially affected all of the following must apply:

• Next.js between 13.5.1 and 14.2.9
• Using pages router
• Using non-dynamic server-side rendered routes e.g. pages/dashboard.tsx not pages/blog/[slug].tsx

The below configurations are unaffected:

• Deployments using only app router
• Deployments on Vercel are not affected

Patches

This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not.

Workarounds

There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

Credits

• Allam Rachid (zhero_)
• Henry Chen

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9
• https://nvd.nist.gov/vuln/detail/CVE-2024-46982
• https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3
• https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda
• https://github.com/vercel/next.js

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Next.js authorization bypass vulnerability

CVE-2024-51479 / GHSA-7gfc-8cq8-jh5f

More information

Details

Impact

If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

Patches

This issue was patched in Next.js 14.2.15 and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f
• https://nvd.nist.gov/vuln/detail/CVE-2024-51479
• https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/releases/tag/v14.2.15

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v14.2.15

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• support breadcrumb style catch-all parallel routes #​65063
• Provide non-dynamic segments to catch-all parallel routes #​65233
• Fix client reference access causing metadata missing #​70732
• feat(next/image): add support for decoding prop #​70298
• feat(next/image): add images.localPatterns config #​70529
• fix(next/image): handle undefined images.localPatterns config in images-manifest.json
• fix: Do not omit alt on getImgProps return type, ImgProps #​70608
• [i18n] Routing fix #​70761

Credits

Huge thanks to @​ztanner, @​agadzik, @​huozhi, @​styfle, @​icyJoseph and @​wyattjoh for helping!

v14.2.14

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix: clone response in first handler to prevent race (#​70082) (#​70649)
• Respect reexports from metadata API routes (#​70508) (#​70647)
• Externalize node binary modules for app router (#​70646)
• Fix revalidateTag() behaviour when invoked in server components (#​70446) (#​70642)
• Fix prefetch bailout detection for nested loading segments (#​70618)
• Add missing node modules to externals (#​70382)
• Feature: next/image: add support for images.remotePatterns.search (#​70302)

Credits

Huge thanks to @​styfle, @​ztanner, @​ijjk, @​huozhi and @​wyattjoh for helping!

v14.2.13

Compare Source

v14.2.12

Compare Source

v14.2.11

Compare Source

v14.2.10

Compare Source

v14.2.9

Compare Source

v14.2.8

Compare Source

v14.2.7

Compare Source

v14.2.6

Compare Source

v14.2.5

Compare Source

v14.2.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: ensure route handlers properly track dynamic access (#​66446)
• fix NextRequest proxy in edge runtime (#​66551)
• Fix next/dynamic with babel and src dir (#​65177)
• Use vercel deployment url for metadataBase fallbacks (#​65089)
• fix(next/image): detect react@19 for fetchPriority prop (#​65235)
• Fix loading navigation with metadata and prefetch (#​66447)
• prevent duplicate RSC fetch when action redirects (#​66620)
• ensure router cache updates reference the latest cache values (#​66681)
• Prevent append of trailing slash in cases where path ends with a file extension (#​66636)
• Fix inconsistency with 404 getStaticProps cache-control (#​66674)
• Use addDependency to track metadata route file changes (#​66714)
• Add timeout/retry handling for fetch cache (#​66652)
• fix: app-router prefetch crash when an invalid URL is passed to Link (#​66755)

Credits

Huge thanks to @​ztanner, @​ijjk, @​wbinnssmith, @​huozhi, and @​lubieowoce for helping!

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
next-enterprise	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Dec 17, 2024 8:31pm

[github-actions]

📦 Next.js Bundle Analysis for next-enterprise

This analysis was generated by the Next.js Bundle Analysis action. 🤖

⚠️ Global Bundle Size Increased

Page	Size (compressed)
global	85.04 KB (🟢 131 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

Three Pages Changed Size

The following pages changed size from the code in this PR compared to its base branch:

Page	Size (compressed)	First Load
/_not-found/page	873 B (🟢 2 B)	85.9 KB
/layout	2.71 KB (🟢 1 B)	87.75 KB
/page	138 B (🟢 1 B)	85.18 KB

Details

Only the gzipped size is provided here based on an expert tip.

First Load is the size of the global bundle plus the bundle for the individual page. If a user were to show up to your website and land on a given page, the first load size represents the amount of javascript that user would need to download. If next/link is used, subsequent page loads would only need to download that page's bundle (the number in the "Size" column), since the global bundle has already been downloaded.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

Next to the size is how much the size has increased or decreased compared with the base branch of this PR. If this percentage has increased by undefined% or more, there will be a red status indicator applied, indicating that special attention should be given to this.

[github-actions]

Code review by ChatGPT

[github-actions]

Code review by ChatGPT

[github-actions]

Code Review Summary

The code patch appears to update the dependencies of a project, primarily changing versions for various packages associated with Next.js to a newer version (from 14.2.3 to 14.2.20 for several packages). Here are some observations regarding potential bugs and suggestions for improvements.

Observations

1. Version Upgrades:

   • The patch updates package versions appropriately across several @next packages. It looks like a consistent upgrade from 14.2.3 to 14.2.20 was made.

2. Integrity Hashes:

   • The integrity hashes for the packages were also changed to match the new versions, ensuring that the content of the packages cannot be tampered with. This is good practice.

3. Caniuse-lite Updates:

   • The caniuse-lite package was updated, which is also a good practice since it provides the latest browser compatibility data.

4. Redundant Dependency Definitions:

   • By defining nanoid@^3.3.6 and nanoid@^3.3.7, but updating nanoid@^3.3.6 to 3.3.8, there's possible redundancy. It might be worthwhile to clarify the need for maintaining both definitions.

Potential Bug Risks

1. Compatibility:

   • Upgrading versions (especially in large libraries like Next.js) could lead to breaking changes. Ensure that the rest of the codebase is compatible with version 14.2.20 functionalities.

2. Testing:

   • Make sure that adequate test coverage exists. If the new versions introduce breaking changes or depreciated functionalities, this could lead to runtime errors.

3. Locking Version Ranges:

   • In some cases, using caret (^) in version specifications could inadvertently allow more recent (potentially breaking) updates. Consider locking versions strictly when stability is paramount.

4. Dependencies that Provide Peer Dependencies:

   • Not checking the peer dependencies of upgraded packages can lead to issues if other packages you rely on depend on mismatched versions.

Improvement Suggestions

1. Use of yarn.lock or package-lock.json:

   • Ensure that the lock file (if using Yarn or npm) is updated to prevent discrepancies between environments.

2. Dependency Cleanup:

   • Consider documenting or commenting on the reason behind upgrading specific dependencies, as well as noting any removed or deprecated packages.

3. Run Automated Tests:

   • After the update, make sure to conduct regression testing to detect any issues early.

4. Monitor the Changelog:

   • Regularly check the changelogs of critical dependencies, like Next.js, to be aware of any breaking changes introduced in new versions.

5. Semantic Versioning Understanding:

   • Clarity on how versioning works (semantic versioning) can make future updates more predictable; using ~ for minor updates and ^ for major updates can help balance upgrade risks and benefits.

Conclusion

The changes you’ve made mainly focus on keeping dependencies up to date, which is crucial for security and performance. However, do ensure proper testing and compatibility checks to mitigate any risk associated with such upgrades. Additionally, consider the points made above to improve maintainability and stability in the project's dependency management.