fix(deps): update dependency next to v14 [security] by renovate[bot] · Pull Request #207 · mrtousif/youtube-clone

renovate · 2024-09-25T14:07:45Z

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	`12.2.4` → `14.2.35`

Next.js missing cache-control header may lead to CDN caching empty reply

CVE-2023-46298 / GHSA-c59h-r6p8-q9wc

More information

Details

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.

Severity

Low

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Denial of Service condition in Next.js image optimization

CVE-2024-47831 / GHSA-g77x-44xx-532m

More information

Details

Impact

The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.

Not affected:

The next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value.
The Next.js application is hosted on Vercel.

Patches

This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.

Workarounds

Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.

Credits

Brandon Dahler (brandondahler), AWS
Dimitrios Vlastaras

Severity

CVSS Score: 4.6 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js authorization bypass vulnerability

CVE-2024-51479 / GHSA-7gfc-8cq8-jh5f

More information

Details

Impact

If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

Patches

This issue was patched in Next.js 14.2.15 and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js Affected by Cache Key Confusion for Image Optimization API Routes

CVE-2025-57752 / GHSA-g5qg-72qw-gw5v

More information

Details

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at Vercel Changelog

Severity

CVSS Score: 6.2 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vercel/next.js (next)

Core Changes

omit searchParam data from FlightRouterState before transport (#80734)

Credits

Huge thanks to @ztanner for helping!

`v14.2.32`

Compare Source

Core Changes

fix router handling when setting a location response header #82588

Credits

Huge thanks to @ztanner for helping!

`v14.2.31`

Compare Source

Core Changes

fix(next/image): improve and simplify detect-content-type (#82179)
fix(next/image): fix image-optimizer.ts headers (#82178)

Credits

Huge thanks to @styfle and @ztanner for helping!

`v14.2.30`

Compare Source

Core Changes

Backport config.allowedDevOrigins (#80410) (Learn More)

Credits

Huge thanks to @ijjk and @ztanner for helping!

`v14.2.29`

Compare Source

Core Changes

Only share incremental cache for edge in next start (#79389)

Credits

Huge thanks to @ijjk for helping!

`v14.2.28`

Compare Source

Core Changes

fix: node.js module import error when using middleware (#77945)

Credits

Huge thanks to @ztanner for helping!

`v14.2.27`

Compare Source

Core Changes

fix dynamic route interception not working when deployed with middleware (#64923)

Credits

Huge thanks to @ztanner for helping!

`v14.2.26`

Compare Source

Core Changes

Match subrequest handling for edge and node (#77476)

`v14.2.25`

Compare Source

Core Changes

Update middleware request header (#77202)

Credits

Huge thanks to @ijjk for helping!

`v14.2.24`

Compare Source

Core Changes

fix: ensure lint worker errors aren't silenced (#75779)
add additional x-middleware-set-cookie filtering (#75561 & #73482)

Credits

Huge thanks to @ztanner for helping!

`v14.2.23`

Compare Source

Core Changes

backport: force module format for virtual client-proxy (#74590)
Backport: Use provided waitUntil for pending revalidates (#74573)
Feature: next/image: add support for images.qualities in next.config (#74500)

Credits

Huge thanks to @styfle, @ijjk and @lubieowoce for helping!

`v14.2.22`

Compare Source

Core Changes

Retry manifest file loading only in dev mode: #73900
Ensure workers are cleaned up: #71564
Use shared worker for lint & typecheck steps: #74154

Credits

Huge thanks to @unstubbable, @ijjk, and @ztanner for helping!

`v14.2.21`

Compare Source

Core Changes

Upgrade React from 14898b6 to 178c267: #74115
Fix unstable_allowDynamic when used with pnpm: #73765

Misc Changes

chore(docs): add missing search: '' on remotePatterns: #73927
chore(docs): update version history of next/image: #73926

Credits

Huge thanks to @unstubbable, @ztanner, and @styfle for helping!

`v14.2.20`

Compare Source

Core Changes

Fix fetch cloning bug (#73532)

Credits

Huge thanks to @wyattjoh for helping!

`v14.2.19`

Compare Source

Core Changes

ensure worker exits bubble to parent process (#73433)
Increase max cache tags to 128 (#73125)

Misc Changes

Update max tag items limit in docs (#73445)

Credits

Huge thanks to @ztanner and @ijjk for helping!

`v14.2.18`

Compare Source

Core Changes

Fix: (third-parties) sendGTMEvent not queueing events before GTM init (#68683) (#72111)
Ignore error pages for cache revalidate (#72412) (#72484)

Credits

Huge thanks to @huozhi and @ijjk for helping!

`v14.2.17`

Compare Source

Core Changes

Fix: revert the bad node binary handling (#72356)
Ensure pages/500 handles cache-control as expected (#72050) (#72110)
fix unhandled runtime error from generateMetadata in parallel routes (#72153)

Credits

Huge thanks to @huozhi, @ztanner, and @ijjk for helping!

`v14.2.16`

Compare Source

`v14.2.15`

Compare Source

Core Changes

support breadcrumb style catch-all parallel routes #65063
Provide non-dynamic segments to catch-all parallel routes #65233
Fix client reference access causing metadata missing #70732
feat(next/image): add support for decoding prop #70298
feat(next/image): add images.localPatterns config #70529
fix(next/image): handle undefined images.localPatterns config in images-manifest.json
fix: Do not omit alt on getImgProps return type, ImgProps #70608
[i18n] Routing fix #70761

Credits

Huge thanks to @ztanner, @agadzik, @huozhi, @styfle, @icyJoseph and @wyattjoh for helping!

`v14.2.14`

Compare Source

Core Changes

Fix: clone response in first handler to prevent race (#70082) (#70649)
Respect reexports from metadata API routes (#70508) (#70647)
Externalize node binary modules for app router (#70646)
Fix revalidateTag() behaviour when invoked in server components (#70446) (#70642)
Fix prefetch bailout detection for nested loading segments (#70618)
Add missing node modules to externals (#70382)
Feature: next/image: add support for images.remotePatterns.search (#70302)

Credits

Huge thanks to @styfle, @ztanner, @ijjk, @huozhi and @wyattjoh for helping!

`v14.2.13`

Compare Source

Core Changes

Fix missing cache-control on SSR app route (#70265)
feat: add polyfill of URL.canParse for browser compatibility (#70228)
Fix vercel og package memory leak (#70214)
Fix startTime error on Android 9 with Chrome 74 (#67391)

Credits

Huge thanks to @raeyoung-kim, @huozhi, @devjiwonchoi, and @ijjk for helping!

`v14.2.12`

Compare Source

Core Changes

update prefetching jsdoc & documentation (#68047)
Ensure we chunk revalidate tag requests (#70189)
(backport) fix(eslint): allow typescript-eslint v8 (#70090)
[ppr] Don't mark RSC requests as /_next/data requests (backport of #66249) (#70083)

Credits

Huge thanks to @alvarlagerlof, @wyattjoh, @delbaoliveira, and @ijjk for helping!

`v14.2.11`

Compare Source

Core Changes

fix: correct metadata url suffix (#69959)
fix: setting assetPrefix to URL format breaks HMR (#70040)
Update revalidateTag to batch tags in one request (#65296)

Credits

Huge thanks to @huozhi, @devjiwonchoi, and @ijjk for helping!

`v14.2.10`

Compare Source

Core Changes

Remove invalid fallback revalidate value (#69990)
Revert server action optimization (#69925)
Add ability to customize Cache-Control (#69802)

Credits

Huge thanks to @huozhi and @ijjk for helping!

`v14.2.9`

Compare Source

Core Changes

Revert "Fix esm property def in flight loader (#66990)" (#69749)
Disable experimental.optimizeServer by default to fix failed server action (#69788)
Fix middleware fallback: false case (#69799)
Fix status code for /_not-found route (#64058) (#69808)
Fix metadata prop merging (#69807)
create-next-app: fix font file corruption when using import alias (#69806)

Credits

Huge thanks to @huozhi, @ztanner, @ijjk, and @lubieowoce for helping!

`v14.2.8`

Compare Source

What's Changed

Support `esmExternals` in app directory

Support esm externals in app router (#65041)
Turbopack: Allow client components from foreign code in app routes (#64751)
Turbopack: add support for esm externals in app dir (#64918)
other related PRs: #66990 #66727 #66286 #65519

Reading cookies set in middleware in components and actions

initialize ALS with cookies in middleware (#65008)
fix middleware cookie initialization (#65820)
ensure cookies set in middleware can be read in a server action (#67924)
fix: merged middleware cookies should preserve options (#67956)

Metadata and icons

support facebook-specific metadata (fb:app_id, fb:admins) in generateMetaData (#65713)
Always collect static icons for all segments (#68712)
Fix favicon merging with customized icons (#67982)
Warn metadataBase missing in standalone mode or non vercel deployment (#66296)

Parallel routes fixes

fix missing stylesheets when parallel routes are present (#69507)

Draft mode and edge improvements

fix: unstable_cache should not cache new result in draft mode (#67772)
Add draft mode flag for multi-zone (#68997)
Fix edge preview props are not matched with cookie (#67779)
other related PRs: #65426, #67787, #64946, #64313, #64370

`next/image` fixes

Allow external image urls with _next/image pathname to be rendered via Image component (#69586)

Server actions improvements

optimize server actions (#66523)
Apply optimization for unused actions (#69178)
Improve SWC transform ID generation (#69183)

Other changes

Ensure we match comment minify behavior between terser and swc (#68372)
send initialCanonicalUrl in array format to prevent crawler confusion (#69509)

Create-next-app updates

enable @typescript-eslint/recommended in create-next-app --typescript (#52845)
Update create-next-app template CSS (#66233)
Update create-next-app template CSS (#66043)
Update create-next-app template (#65803)
add font antialiasing to templates (#67425)
Move create-next-app public/ assets from local folder→ remote URL (#66931)
Use classnames to set font family in Tailwind create-next-app templates (#66374)
other related PRs: #64478, #68899, #68534, #69021, #67146, #66145

Full Changelog: vercel/next.js@v14.2.7...v14.2.8

Huge thanks to everyone who contributed to this release:
@abhi12299, @delbaoliveira, @eps1lon, @ForsakenHarmony, @huozhi, @ijjk, @JoshuaKGoldberg, @leerob, @lubieowoce, @Netail, @ronanru, @samcx, @shuding, @sokra, @stylessh, @timfuhrmann, @wbinnssmith, @wyattjoh, @ypessoa, @ztanner

`v14.2.7`

Compare Source

Core Changes

Revert "chore: externalize undici for bundling" (#65727)
Refactor internal routing headers to use request meta (#66987)
fix(next): add cross origin in react dom preload (#67423)
build: upgrade edge-runtime (#67565)
GTM dataLayer parameter should take an object, not an array of strings (#66339)
fix: properly patch lockfile against swc bindings (#66515)
Add deployment id header for rsc payload if present (#67255)
Update font data (#68639)
fix i18n data pathname resolving (#68947)
pages router: ensure x-middleware-cache is respected (#67734)
Fix bad modRequest in flight entry manifest #68888
Reject next image urls in image optimizer #68628
Fix hmr assetPrefix escaping and reuse logic from other files #67983

Credits

Huge thanks to @kjugi, @huozhi, @ztanner, @SukkaW, @marlier, @Kikobeats, @syi0808, @ijjk, and @samcx for helping!

`v14.2.6`

Compare Source

Core Changes

Ensure fetch cache TTL is updated properly (#69164)

`v14.2.5`

Compare Source

Core Changes

avoid merging global css in a way that leaks into other chunk groups (#67373)
Fix server action edge redirect with middleware rewrite (#67148)
fix(next): reject protocol-relative URLs in image optimization (#65752)
fix(next-swc): correct path interop to filepath for wasm (#65633)
Use addDependency to track metadata route file changes (#66714)
Fix noindex is missing on static not-found page (#67135)
perf: improve retrieving versionInfo on Turbo HMR (#67309)
fix(next/image): handle invalid url (#67465)
fix(next): initial prefetch cache not set properly with different search params (#65977)
fix: Backport class properties fix (#67377)
Upgrade acorn (#67592)

Misc

Log stdio for pull-turbo-cache script (#66759)
Ensure turbo is setup when building in docker (#66804)

Credits

Huge thanks to @devjiwonchoi, @ijjk, @emmerich, @huozhi, @kdy1, @kwonoj, @styfle, and @sokra for helping!

`v14.2.4`

Compare Source

Core Changes

fix: ensure route handlers properly track dynamic access (#66446)
fix NextRequest proxy in edge runtime (#66551)
Fix next/dynamic with babel and src dir (#65177)
Use vercel deployment url for metadataBase fallbacks (#65089)
fix(next/image): detect react@19 for fetchPriority prop (#65235)
Fix loading navigation with metadata and prefetch (#66447)
prevent duplicate RSC fetch when action redirects (#66620)
ensure router cache updates reference the latest cache values (#66681)
Prevent append of trailing slash in cases where path ends with a file extension (#66636)
Fix inconsistency with 404 getStaticProps cache-control (#66674)
Use addDependency to track metadata route file changes (#66714)
Add timeout/retry handling for fetch cache (#66652)
fix: app-router prefetch crash when an invalid URL is passed to Link (#66755)

Credits

Huge thanks to @ztanner, @ijjk, @wbinnssmith, @huozhi, and @lubieowoce for helping!

`v14.2.3`

Compare Source

Core Changes

Fix: resolve mixed re-exports module as cjs (#64681)
fix: mixing namespace import and named import client components (#64809)
Fix mixed exports in server component with barrel optimization (#64894)
Fix next/image usage in mdx(#64875)
fix(fetch-cache): fix additional typo, add type & data validation (#64799)
prevent erroneous route interception during lazy fetch (#64692)
fix root page revalidation when redirecting in a server action (#64730)
fix: remove traceparent from cachekey should not remove traceparent from original object (#64727)
Clean-up fetch metrics tracking (#64746)

Credits

Huge thanks to @huozhi, @samcx, @ztanner, @Jeffrey-Zutt, and @ijjk for helping!

`v14.2.2`

Compare Source

Core Changes

Fix Server Action error logs for unhandled POST requests (#64315)
Improve rendering performance (#64408)
Fix the method prop case in Server Actions transform (#64398)
fix(next-lint): update option --report-unused-disable-directives to --report-unused-disable-directives-severity (#64405)
tweak test for Azure (#64424)
router restore should take priority over pending actions (#64449)
Fix client boundary inheritance for barrel optimization (#64467)
improve turborepo caching (#64493)
feat: strip traceparent header from cachekey (#64499)
Fix more Turbopack build tests
Update lockfile for compatibility with turbo (#64360)
Fix typo in dynamic-rendering.ts (#64365)
Fix DynamicServerError not being thrown in fetch (#64511)
fix(next): Metadata.openGraph values not resolving basic values when type is set (#63620)
disable production chunking in dev (#64488)
Fix cjs client components tree-shaking (#64558)
fix refresh behavior for discarded actions (#64532)
fix: filter out middleware requests in logging (#64549)
Turbopack: Allow client components to be imported in app routes (#64520)
Fix ASL bundling for dynamic css (#64451)
add pathname normalizer for actions (#64592)
fix incorrect refresh request when basePath is set (#64589)
test: skip turbopack build test (#64356)
hotfix(turbopack): Update with patch for postcss.config.js path resolution on Windows (#64677)

Credits

Huge thanks to @shuding, @coltonehrman, @ztanner, @huozhi, @sokra, @Jeffrey-Zutt, @timneutkens, @wbinnssmith, @wiesson, @ijjk, @devjiwonchoi, and @bgw for helping!

`v14.2.1`

Compare Source

Core Changes

use pathToFileUrl to make esm import()s work with absolute windows paths (#64386) @sokra

Credits

Huge thanks to @sokra for helping!

`v14.2.0`

Compare Source

Learn more: https://nextjs.org/blog/next-14-2

Core Changes

Update build worker warning to use debug: #60847
fix: added @sentry/profiling-node to sep list to prevent build/bundle breakage: #60855
Optimize build trace ignores: #60859
Deprecation warning for config.analyticsId: #60677
chore: indicate staleness more prominently in next info output: #60376
Telemetry: createComponentTree span: #60857
chore: replace micromatch w/ picomatch: #60699
Report HMR latency as trace spans for Turbopack: #60799
Turbopack: always log HMR rebuild times: #60908
Error overlay refactors: #60886
Use precompiled source-map in overlay middleware: #60932
Use more precompiled deps in react-dev-overlay: #60959
Fix next phase for next build: #60969
chore: update turbopack: #60980
refactor(analysis): rust based page-static-info, deprecate js parse interface in next-swc: #59300
disable static generation on interception routes: #61004
Docs: Address community feedback: #60960
avoid output of webpack stats: #61023
Revert "refactor(analysis): rust based page-static-info, deprecate js parse interface in next-swc": #61021
fix useSelectedLayoutSegment's support for parallel routes: #60912
Dynamic APIs: #60645
Enable next.js version checker in turbopack: #61034
chore: Update terser to v5.27.0: #61068
Update swc_core to v0.87.28: #60876
update turbopack: #61015
Implement client_root for edge in Turbopack: #61024
fix parallel route top-level catch-all normalization logic to support nested explicit (non-catchall) slot routes: #60776
fix(image): warn when animated image is missing unoptimized prop: #61045
Fix version checker not displaying when version newer than npm: #61075
Fix sitemap generateSitemaps support for string id: #61088
ppr: ensure the router state tree is provided for interception routes: #61059
Improve the Server Actions SWC transform: #61001
Fix instrument bundling as client components: #60984
fix(turbopack): use correct layout for 404 page: #61032
fix: emotion import source should be enabled in SSR contexts: #61099
chore: update turbopack: #61090
fix(turbopack): custom page extensions for _app: #60789
Disable trace uploads with NEXT_TRACE_UPLOAD_DISABLE: #61101
add optimizeServerReact to config-shared: #61106
Fix filesystempublicroutes test for Turbopack: #61132
chore: upgrade webpack to 5.90.0: #61109
Add maxDuration to typescript plugin allowed exports: #59193
Upgrade Turbopack: #61190
build: remove sentry from the externals list: #61194
exclude default routes from isPageStatic check: #61173
Add stack trace to client rendering bailout error: #61200
chore: refactor image optimization to separate external/internal urls: #61172
parallel routes: support multi-slot layouts: #61115
Refine revalidatePath warning message: #61220
revert changes to process default routes at build: #61241
Fix cookie merging in Server Action redirections: #61113
Update swc_core to v0.89.x: [#61086](https://redirect.github.com/vercel/next.js/is

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2024-09-25T14:07:53Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🔍 Trigger a full review

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

renovate Bot changed the title ~~fix(deps): update dependency next to v13 [security]~~ fix(deps): update dependency next to v13 [security] - autoclosed Sep 25, 2024

renovate Bot closed this Sep 25, 2024

renovate Bot deleted the renovate/npm-next-vulnerability branch September 25, 2024 16:49

renovate Bot changed the title ~~fix(deps): update dependency next to v13 [security] - autoclosed~~ fix(deps): update dependency next to v13 [security] Sep 26, 2024

renovate Bot reopened this Sep 26, 2024

renovate Bot restored the renovate/npm-next-vulnerability branch September 26, 2024 19:13

renovate Bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from e3701bf to 00c7f15 Compare September 30, 2024 04:10

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 00c7f15 to 49dd4da Compare October 7, 2024 03:47

renovate Bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from 59fe5b7 to 30a3f7f Compare October 15, 2024 03:39

renovate Bot changed the title ~~fix(deps): update dependency next to v13 [security]~~ fix(deps): update dependency next to v14 [security] Oct 15, 2024

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 30a3f7f to d0cac0d Compare October 21, 2024 03:25

renovate Bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from d7961d8 to 3bced00 Compare November 4, 2024 03:39

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 3bced00 to 429c454 Compare November 11, 2024 03:36

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 429c454 to bcfed17 Compare December 18, 2024 00:13

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from bcfed17 to 77a665e Compare January 22, 2025 05:34

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 77a665e to 20319b0 Compare May 17, 2025 01:53

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 20319b0 to 6978def Compare August 10, 2025 12:30

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 6978def to 091784e Compare August 19, 2025 14:07

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 091784e to e97ef53 Compare August 31, 2025 09:15

renovate Bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from b592767 to b0b1e2d Compare September 13, 2025 23:13

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from b0b1e2d to f5968d7 Compare September 25, 2025 19:04

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from f5968d7 to d614868 Compare October 15, 2025 22:50

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from d614868 to 04a9287 Compare November 11, 2025 00:48

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 04a9287 to ac3c33c Compare November 18, 2025 11:44

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from ac3c33c to a3c50d3 Compare December 12, 2025 04:43

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from a3c50d3 to ad2afbe Compare December 31, 2025 14:12

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from ad2afbe to 965535b Compare January 8, 2026 17:45

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 965535b to b7ff357 Compare January 19, 2026 18:14

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from b7ff357 to 0dc405a Compare February 2, 2026 20:30

renovate Bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from 3925c29 to 985c958 Compare February 17, 2026 19:06

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 985c958 to 1e435fa Compare March 5, 2026 17:54

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 1e435fa to f05ab01 Compare March 13, 2026 16:53

renovate Bot changed the title ~~fix(deps): update dependency next to v14 [security]~~ fix(deps): update dependency next to v14 [security] - autoclosed Mar 27, 2026

renovate Bot closed this Mar 27, 2026

renovate Bot deleted the renovate/npm-next-vulnerability branch March 27, 2026 00:56

renovate Bot changed the title ~~fix(deps): update dependency next to v14 [security] - autoclosed~~ fix(deps): update dependency next to v14 [security] Mar 30, 2026

renovate Bot reopened this Mar 30, 2026

renovate Bot force-pushed the renovate/npm-next-vulnerability branch 4 times, most recently from dd5f608 to 9ca49c8 Compare April 1, 2026 20:14

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 9ca49c8 to b9233b0 Compare April 8, 2026 19:19

renovate Bot changed the title ~~fix(deps): update dependency next to v14 [security]~~ fix(deps): update dependency next to v14 [security] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

renovate Bot changed the title ~~fix(deps): update dependency next to v14 [security] - autoclosed~~ fix(deps): update dependency next to v14 [security] Apr 27, 2026

renovate Bot reopened this Apr 27, 2026

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from b9233b0 to 8128146 Compare April 27, 2026 22:12

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 8128146 to 7df1dda Compare May 12, 2026 11:38

fix(deps): update dependency next to v14 [security]

08564f3

renovate Bot force-pushed the renovate/npm-next-vulnerability branch from 7df1dda to 08564f3 Compare May 18, 2026 11:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency next to v14 [security]#207

fix(deps): update dependency next to v14 [security]#207
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-next-vulnerability

renovate Bot commented Sep 25, 2024 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 25, 2024 •

edited

Loading

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Next.js missing cache-control header may lead to CDN caching empty reply

Details

Severity

References

Denial of Service condition in Next.js image optimization

Details

Impact

Patches

Workarounds

Credits

Severity

References

Next.js authorization bypass vulnerability

Details

Impact

Patches

Workarounds

Credits

Severity

References

Next.js Affected by Cache Key Confusion for Image Optimization API Routes

Details

Severity

References

Release Notes

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Misc Changes

Credits

Core Changes

Credits

Core Changes

Misc Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

What's Changed

Support esmExternals in app directory

Reading cookies set in middleware in components and actions

renovate Bot commented Sep 25, 2024 •

edited

Loading

Support `esmExternals` in app directory

`next/image` fixes

coderabbitai Bot commented Sep 25, 2024 •

edited

Loading