Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/setup-node	action	patch	v4.0.2 -> v4.0.3
next (source)	dependencies	patch	14.2.3 -> 14.2.5
node	final	patch	18.20.3-alpine -> 18.20.4-alpine
unzipper	dependencies	minor	^0.11.0 -> ^0.12.0
yarn (source)	packageManager	minor	4.2.2 -> 4.3.1

---

Release Notes

actions/setup-node (actions/setup-node)

v4.0.3

Compare Source

vercel/next.js (next)

v14.2.5

Compare Source

v14.2.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: ensure route handlers properly track dynamic access (#​66446)
• fix NextRequest proxy in edge runtime (#​66551)
• Fix next/dynamic with babel and src dir (#​65177)
• Use vercel deployment url for metadataBase fallbacks (#​65089)
• fix(next/image): detect react@19 for fetchPriority prop (#​65235)
• Fix loading navigation with metadata and prefetch (#​66447)
• prevent duplicate RSC fetch when action redirects (#​66620)
• ensure router cache updates reference the latest cache values (#​66681)
• Prevent append of trailing slash in cases where path ends with a file extension (#​66636)
• Fix inconsistency with 404 getStaticProps cache-control (#​66674)
• Use addDependency to track metadata route file changes (#​66714)
• Add timeout/retry handling for fetch cache (#​66652)
• fix: app-router prefetch crash when an invalid URL is passed to Link (#​66755)

Credits

Huge thanks to @​ztanner, @​ijjk, @​wbinnssmith, @​huozhi, and @​lubieowoce for helping!

nodejs/node (node)

v18.20.4: 2024-07-08, Version 18.20.4 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

• CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
• CVE-2024-22020 - Bypass network import restriction via data URL (Medium)

Commits

• [85abedf1ff] - lib,esm: handle bypass network-import via data: (RafaelGSS) nodejs-private/node-private#522
• [eccd63b865] - src: handle permissive extension on cmd check (RafaelGSS) nodejs-private/node-private#596

ZJONSSON/node-unzipper (unzipper)

v0.12.1

Compare Source

• unmaintained fstream replaced with fs-extra
• empty directories in a zip file will now be created when zip file is extracted
• big-integer replaced with node-int64 (up to 20x performance increase on large encrypted files)
• npm deployment added to github actions

v0.11.6

Compare Source

v0.11.5

Compare Source

v0.11.4

Compare Source

v0.11.3

Compare Source

yarnpkg/berry (yarn)

v4.3.1

Compare Source

v4.3.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.