fix(deps): update dependency next to v14 [security] #108

renovate · 2024-09-25T13:40:25Z

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	`12.2.5` -> `14.2.31`

GitHub Vulnerability Alerts

CVE-2023-46298

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.

CVE-2024-47831

Impact

The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.

Not affected:

The next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value.
The Next.js application is hosted on Vercel.

Patches

This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.

Workarounds

Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.

Credits

Brandon Dahler (brandondahler), AWS
Dimitrios Vlastaras

CVE-2024-51479

Impact

If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

Patches

This issue was patched in Next.js 14.2.15 and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.

CVE-2025-29927

Impact

It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.

Patches

For Next.js 15.x, this issue is fixed in 15.2.3
For Next.js 14.x, this issue is fixed in 14.2.25
For Next.js 13.x, this issue is fixed in 13.5.9
For Next.js 12.x, this issue is fixed in 12.3.5
For Next.js 11.x, consult the below workaround.

Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability.

Workaround

If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application.

Credits

Allam Rachid (zhero;)
Allam Yasser (inzo_)

CVE-2025-57752

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at Vercel Changelog

Release Notes

vercel/next.js (next)

`v14.2.31`

Compare Source

Core Changes

fix(next/image): improve and simplify detect-content-type (#82179)
fix(next/image): fix image-optimizer.ts headers (#82178)

Credits

Huge thanks to @styfle and @ztanner for helping!

`v14.2.30`

Compare Source

Core Changes

Backport config.allowedDevOrigins (#80410) (Learn More)

Credits

Huge thanks to @ijjk and @ztanner for helping!

`v14.2.29`

Compare Source

Core Changes

Only share incremental cache for edge in next start (#79389)

Credits

Huge thanks to @ijjk for helping!

`v14.2.28`

Compare Source

Core Changes

fix: node.js module import error when using middleware (#77945)

Credits

Huge thanks to @ztanner for helping!

`v14.2.27`

Compare Source

Core Changes

fix dynamic route interception not working when deployed with middleware (#64923)

Credits

Huge thanks to @ztanner for helping!

`v14.2.26`

Compare Source

Core Changes

Match subrequest handling for edge and node (#77476)

`v14.2.25`

Compare Source

Core Changes

Update middleware request header (#77202)

Credits

Huge thanks to @ijjk for helping!

`v14.2.24`

Compare Source

Core Changes

fix: ensure lint worker errors aren't silenced (#75779)
add additional x-middleware-set-cookie filtering (#75561 & #73482)

Credits

Huge thanks to @ztanner for helping!

`v14.2.23`

Compare Source

Core Changes

backport: force module format for virtual client-proxy (#74590)
Backport: Use provided waitUntil for pending revalidates (#74573)
Feature: next/image: add support for images.qualities in next.config (#74500)

Credits

Huge thanks to @styfle, @ijjk and @lubieowoce for helping!

`v14.2.22`

Compare Source

Core Changes

Retry manifest file loading only in dev mode: #73900
Ensure workers are cleaned up: #71564
Use shared worker for lint & typecheck steps: #74154

Credits

Huge thanks to @unstubbable, @ijjk, and @ztanner for helping!

`v14.2.21`

Compare Source

Core Changes

Upgrade React from 14898b6 to 178c267: #74115
Fix unstable_allowDynamic when used with pnpm: #73765

Misc Changes

chore(docs): add missing search: '' on remotePatterns: #73927
chore(docs): update version history of next/image: #73926

Credits

Huge thanks to @unstubbable, @ztanner, and @styfle for helping!

`v14.2.20`

Compare Source

Core Changes

Fix fetch cloning bug (#73532)

Credits

Huge thanks to @wyattjoh for helping!

`v14.2.19`

Compare Source

Core Changes

ensure worker exits bubble to parent process (#73433)
Increase max cache tags to 128 (#73125)

Misc Changes

Update max tag items limit in docs (#73445)

Credits

Huge thanks to @ztanner and @ijjk for helping!

`v14.2.18`

Compare Source

Core Changes

Fix: (third-parties) sendGTMEvent not queueing events before GTM init (#68683) (#72111)
Ignore error pages for cache revalidate (#72412) (#72484)

Credits

Huge thanks to @huozhi and @ijjk for helping!

`v14.2.17`

Compare Source

Core Changes

Fix: revert the bad node binary handling (#72356)
Ensure pages/500 handles cache-control as expected (#72050) (#72110)
fix unhandled runtime error from generateMetadata in parallel routes (#72153)

Credits

Huge thanks to @huozhi, @ztanner, and @ijjk for helping!

`v14.2.16`

Compare Source

`v14.2.15`

Compare Source

Core Changes

support breadcrumb style catch-all parallel routes #65063
Provide non-dynamic segments to catch-all parallel routes #65233
Fix client reference access causing metadata missing #70732
feat(next/image): add support for decoding prop #70298
feat(next/image): add images.localPatterns config #70529
fix(next/image): handle undefined images.localPatterns config in images-manifest.json
fix: Do not omit alt on getImgProps return type, ImgProps #70608
[i18n] Routing fix #70761

Credits

Huge thanks to @ztanner, @agadzik, @huozhi, @styfle, @icyJoseph and @wyattjoh for helping!

`v14.2.14`

Compare Source

Core Changes

Fix: clone response in first handler to prevent race (#70082) (#70649)
Respect reexports from metadata API routes (#70508) (#70647)
Externalize node binary modules for app router (#70646)
Fix revalidateTag() behaviour when invoked in server components (#70446) (#70642)
Fix prefetch bailout detection for nested loading segments (#70618)
Add missing node modules to externals (#70382)
Feature: next/image: add support for images.remotePatterns.search (#70302)

Credits

Huge thanks to @styfle, @ztanner, @ijjk, @huozhi and @wyattjoh for helping!

`v14.2.13`

Compare Source

Core Changes

Fix missing cache-control on SSR app route (#70265)
feat: add polyfill of URL.canParse for browser compatibility (#70228)
Fix vercel og package memory leak (#70214)
Fix startTime error on Android 9 with Chrome 74 (#67391)

Credits

Huge thanks to @raeyoung-kim, @huozhi, @devjiwonchoi, and @ijjk for helping!

`v14.2.12`

Compare Source

Core Changes

update prefetching jsdoc & documentation (#68047)
Ensure we chunk revalidate tag requests (#70189)
(backport) fix(eslint): allow typescript-eslint v8 (#70090)
[ppr] Don't mark RSC requests as /_next/data requests (backport of #66249) (#70083)

Credits

Huge thanks to @alvarlagerlof, @wyattjoh, @delbaoliveira, and @ijjk for helping!

`v14.2.11`

Compare Source

Core Changes

fix: correct metadata url suffix (#69959)
fix: setting assetPrefix to URL format breaks HMR (#70040)
Update revalidateTag to batch tags in one request (#65296)

Credits

Huge thanks to @huozhi, @devjiwonchoi, and @ijjk for helping!

`v14.2.10`

Compare Source

Core Changes

Remove invalid fallback revalidate value (#69990)
Revert server action optimization (#69925)
Add ability to customize Cache-Control (#69802)

Credits

Huge thanks to @huozhi and @ijjk for helping!

`v14.2.9`

Compare Source

Core Changes

Revert "Fix esm property def in flight loader (#66990)" (#69749)
Disable experimental.optimizeServer by default to fix failed server action (#69788)
Fix middleware fallback: false case (#69799)
Fix status code for /_not-found route (#64058) (#69808)
Fix metadata prop merging (#69807)
create-next-app: fix font file corruption when using import alias (#69806)

Credits

Huge thanks to @huozhi, @ztanner, @ijjk, and @lubieowoce for helping!

`v14.2.8`

Compare Source

What's Changed

Support `esmExternals` in app directory

Support esm externals in app router (#65041)
Turbopack: Allow client components from foreign code in app routes (#64751)
Turbopack: add support for esm externals in app dir (#64918)
other related PRs: #66990 #66727 #66286 #65519

Reading cookies set in middleware in components and actions

initialize ALS with cookies in middleware (#65008)
fix middleware cookie initialization (#65820)
ensure cookies set in middleware can be read in a server action (#67924)
fix: merged middleware cookies should preserve options (#67956)

Metadata and icons

support facebook-specific metadata (fb:app_id, fb:admins) in generateMetaData (#65713)
Always collect static icons for all segments (#68712)
Fix favicon merging with customized icons (#67982)
Warn metadataBase missing in standalone mode or non vercel deployment (#66296)

Parallel routes fixes

fix missing stylesheets when parallel routes are present (#69507)

Draft mode and edge improvements

fix: unstable_cache should not cache new result in draft mode (#67772)
Add draft mode flag for multi-zone (#68997)
Fix edge preview props are not matched with cookie (#67779)
other related PRs: #65426, #67787, #64946, #64313, #64370

`next/image` fixes

Allow external image urls with _next/image pathname to be rendered via Image component (#69586)

Server actions improvements

optimize server actions (#66523)
Apply optimization for unused actions (#69178)
Improve SWC transform ID generation (#69183)

Other changes

Ensure we match comment minify behavior between terser and swc (#68372)
send initialCanonicalUrl in array format to prevent crawler confusion (#69509)

Create-next-app updates

enable @typescript-eslint/recommended in create-next-app --typescript (#52845)
Update create-next-app template CSS (#66233)
Update create-next-app template CSS (#66043)
Update create-next-app template (#65803)
add font antialiasing to templates (#67425)
Move create-next-app public/ assets from local folder→ remote URL (#66931)
Use classnames to set font family in Tailwind create-next-app templates (#66374)
other related PRs: #64478, #68899, #68534, #69021, #67146, #66145

Full Changelog: vercel/next.js@v14.2.7...v14.2.8

Huge thanks to everyone who contributed to this release:
@abhi12299, @delbaoliveira, @eps1lon, @ForsakenHarmony, @huozhi, @ijjk, @JoshuaKGoldberg, @leerob, @lubieowoce, @Netail, @ronanru, @samcx, @shuding, @sokra, @stylessh, @timfuhrmann, @wbinnssmith, @wyattjoh, @ypessoa, @ztanner

`v14.2.7`

Compare Source

Core Changes

Revert "chore: externalize undici for bundling" (#65727)
Refactor internal routing headers to use request meta (#66987)
fix(next): add cross origin in react dom preload (#67423)
build: upgrade edge-runtime (#67565)
GTM dataLayer parameter should take an object, not an array of strings (#66339)
fix: properly patch lockfile against swc bindings (#66515)
Add deployment id header for rsc payload if present (#67255)
Update font data (#68639)
fix i18n data pathname resolving (#68947)
pages router: ensure x-middleware-cache is respected (#67734)
Fix bad modRequest in flight entry manifest #68888
Reject next image urls in image optimizer #68628
Fix hmr assetPrefix escaping and reuse logic from other files #67983

Credits

Huge thanks to @kjugi, @huozhi, @ztanner, @SukkaW, @marlier, @Kikobeats, @syi0808, @ijjk, and @samcx for helping!

`v14.2.6`

Compare Source

Core Changes

Ensure fetch cache TTL is updated properly (#69164)

`v14.2.5`

Compare Source

Core Changes

avoid merging global css in a way that leaks into other chunk groups (#67373)
Fix server action edge redirect with middleware rewrite (#67148)
fix(next): reject protocol-relative URLs in image optimization (#65752)
fix(next-swc): correct path interop to filepath for wasm (#65633)
Use addDependency to track metadata route file changes (#66714)
Fix noindex is missing on static not-found page (#67135)
perf: improve retrieving versionInfo on Turbo HMR (#67309)
fix(next/image): handle invalid url (#67465)
fix(next): initial prefetch cache not set properly with different search params (#65977)
fix: Backport class properties fix (#67377)
Upgrade acorn (#67592)

Misc

Log stdio for pull-turbo-cache script (#66759)
Ensure turbo is setup when building in docker (#66804)

Credits

Huge thanks to @devjiwonchoi, @ijjk, @emmerich, @huozhi, @kdy1, @kwonoj, @styfle, and @sokra for helping!

`v14.2.4`

Compare Source

Core Changes

fix: ensure route handlers properly track dynamic access (#66446)
fix NextRequest proxy in edge runtime (#66551)
Fix next/dynamic with babel and src dir (#65177)
Use vercel deployment url for metadataBase fallbacks (#65089)
fix(next/image): detect react@19 for fetchPriority prop (#65235)
Fix loading navigation with metadata and prefetch (#66447)
prevent duplicate RSC fetch when action redirects (#66620)
ensure router cache updates reference the latest cache values (#66681)
Prevent append of trailing slash in cases where path ends with a file extension (#66636)
Fix inconsistency with 404 getStaticProps cache-control (#66674)
Use addDependency to track metadata route file changes (#66714)
Add timeout/retry handling for fetch cache (#66652)
fix: app-router prefetch crash when an invalid URL is passed to Link (#66755)

Credits

Huge thanks to @ztanner, @ijjk, @wbinnssmith, @huozhi, and @lubieowoce for helping!

`v14.2.3`

Compare Source

Core Changes

Fix: resolve mixed re-exports module as cjs (#64681)
fix: mixing namespace import and named import client components (#64809)
Fix mixed exports in server component with barrel optimization (#64894)
Fix next/image usage in mdx(#64875)
fix(fetch-cache): fix additional typo, add type & data validation (#64799)
prevent erroneous route interception during lazy fetch (#64692)
fix root page revalidation when redirecting in a server action (#64730)
fix: remove traceparent from cachekey should not remove traceparent from original object (#64727)
Clean-up fetch metrics tracking (#64746)

Credits

Huge thanks to @huozhi, @samcx, @ztanner, @Jeffrey-Zutt, and @ijjk for helping!

`v14.2.2`

Compare Source

Core Changes

Fix Server Action error logs for unhandled POST requests (#64315)
Improve rendering performance (#64408)
Fix the method prop case in Server Actions transform (#64398)
fix(next-lint): update option --report-unused-disable-directives to --report-unused-disable-directives-severity (#64405)
tweak test for Azure (#64424)
router restore should take priority over pending actions (#64449)
Fix client boundary inheritance for barrel optimization (#64467)
improve turborepo caching (#64493)
feat: strip traceparent header from cachekey (#64499)
Fix more Turbopack build tests
Update lockfile for compatibility with turbo (#64360)
Fix typo in dynamic-rendering.ts (#64365)
Fix DynamicServerError not being thrown in fetch (#64511)
fix(next): Metadata.openGraph values not resolving basic values when type is set (#63620)
disable production chunking in dev (#64488)
Fix cjs client components tree-shaking (#64558)
fix refresh behavior for discarded actions (#64532)
fix: filter out middleware requests in logging (#64549)
Turbopack: Allow client components to be imported in app routes (#64520)
Fix ASL bundling for dynamic css (#64451)
add pathname normalizer for actions (#64592)
fix incorrect refresh request when basePath is set (#64589)
test: skip turbopack build test (#64356)
hotfix(turbopack): Update with patch for postcss.config.js path resolution on Windows (#64677)

Credits

Huge thanks to @shuding, @coltonehrman, @ztanner, @huozhi, @sokra, @Jeffrey-Zutt, @timneutkens, @wbinnssmith, @wiesson, @ijjk, @devjiwonchoi, and @bgw for helping!

`v14.2.1`

Compare Source

Core Changes

use pathToFileUrl to make esm import()s work with absolute windows paths (#64386) @sokra

Credits

Huge thanks to @sokra for helping!

`v14.2.0`

Compare Source

Learn more: https://nextjs.org/blog/next-14-2

Core Changes

Update build worker warning to use debug: #60847
fix: added @sentry/profiling-node to sep list to prevent build/bundle breakage: #60855
Optimize build trace ignores: #60859
Deprecation warning for config.analyticsId: #60677
chore: indicate staleness more prominently in next info output: #60376
Telemetry: createComponentTree span: #60857
chore: replace micromatch w/ picomatch: #60699
Report HMR latency as trace spans for Turbopack: #60799
Turbopack: always log HMR rebuild times: #60908
Error overlay refactors: #60886
Use precompiled source-map in overlay middleware: #60932
Use more precompiled deps in react-dev-overlay: #60959
Fix next phase for next build: #60969
chore: update turbopack: #60980
refactor(analysis): rust based page-static-info, deprecate js parse interface in next-swc: #59300
disable static generation on interception routes: #61004
Docs: Address community feedback: #60960
avoid output of webpack stats: #61023
Revert "refactor(analysis): rust based page-static-info, deprecate js parse interface in next-swc": #61021
fix useSelectedLayoutSegment's support for parallel routes: #60912
Dynamic APIs: #60645
Enable next.js version checker in turbopack: #61034
chore: Update terser to v5.27.0: #61068
Update swc_core to v0.87.28: #60876
update turbopack: #61015
Implement client_root for edge in Turbopack: #61024
fix parallel route top-level catch-all normalization logic to support nested explicit (non-catchall) slot routes: #60776
fix(image): warn when animated image is missing unoptimized prop: #61045
Fix version checker not displaying when version newer than npm: #61075
Fix sitemap generateSitemaps support for string id: #61088
ppr: ensure the router state tree is provided for interception routes: #61059
Improve the Server Actions SWC transform: #61001
Fix instrument bundling as client components: #60984
fix(turbopack): use correct layout for 404 page: #61032
fix: emotion import source should be enabled in SSR contexts: #61099
chore: update turbopack: #61090
fix(turbopack): custom page extensions for _app: #60789
Disable trace uploads with NEXT_TRACE_UPLOAD_DISABLE: #61101
add optimizeServerReact to config-shared: #61106
Fix filesystempublicroutes test for Turbopack: #61132
chore: upgrade webpack to 5.90.0: #61109
Add maxDuration to typescript plugin allowed exports: #59193
Upgrade Turbopack: #61190
build: remove sentry from the externals list: #61194
exclude default routes from isPageStatic check: #61173
Add stack trace to client rendering bailout error: #61200
chore: refactor image optimization to separate external/internal urls: #61172
parallel routes: support multi-slot layouts: #61115
Refine revalidatePath warning message: #61220
revert changes to process default routes at build: #61241
Fix cookie merging in Server Action redirections: #61113
Update swc_core to v0.89.x: #61086
Fix Server Reference being double registered: #61244
Fix Server Action redirection with absolute internal URL: #60798
Fix indentation in source code of dev overlay: #61216
Update swc_core to v0.89.4: #61285
fix: Revert preset-env mode of styled-jsx in webpack mode: #61306
DX: add route context to the dynamic errors: #61332
Telemetry: add time-to-first-byte signal: #61238
Refine logging message of experiments: #61337
fix(turbopack): don't parse .ts files as .tsx: #61219
Update turbopack: #61381
Same as #61360: #61369
Always respect NEXT_TRACE_UPLOAD_DISABLED: #61402
parallel routes: fix catch-all slots being treated as optional catch-all: #61174
fix hmr telemetry reporting: #61420
chore: Update swc_core to v0.89.6: #61426
Update turbopack: #61433
fix a perf problem in VersionedContentMap: #61442
Fix next dynamic import named export from client components: #61378
fix issues loading CSS in default slots: #61428
avoid sending issues turbopack messages to browser: #61443
Support crossOrigin in Turbopack: #61461
Pass down __NEXT_EXPERIMENTAL_REACT env to webpack build worker explicitly: #61463
Replace image optimizer IPC call with request handler: #61471
feat(next): trace build dependencies for turborepo: #59553
Turbopack: fix telemetry attributes for swc options: #61474
Always show version text in error overlay: #61421
Fix build worker callback arg missing correct page path : #61347
Update font data: #61479
build: upgrade edge-runtime: #61030
Fix experimental react support in app-route runtime: #61511
Fix .env hmr for Node.js runtime in Turbopack: #61504
remove unnecessary PPR branch in non-PPR reducer: #61176
fix: bump @vercel/nft@0.26.3: #61538
chore: update ESLint and plugins to latest: #61544
Update turbopack: #61553
feat: first pass of next/font manifest: #61424
Fix .env HMR for Turbopack in Edge runtime: #61565
build(cargo): bump up turbopack: #61590
refactor(next-core): consolidate custom ecma transform rules: #61481
ensure server action errors notify rejection handlers: #61588
feat(turbopack): only preload fonts that opt in: #61591
feat(turbopack): serve google fonts locally and allow preloading them: #61596
Update font data: #61621
Remove unused mockedRes in resolveRoutes: #61635
Fix @react-pdf/renderer not working in RSC: [#613

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2024-09-25T13:40:27Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: mdx-bundler@9.0.1
npm ERR! Found: esbuild@0.15.10
npm ERR! node_modules/esbuild
npm ERR!   esbuild@"0.15.10" from the root project
npm ERR!   peer esbuild@"*" from @esbuild-plugins/node-resolve@0.1.4
npm ERR!   node_modules/@esbuild-plugins/node-resolve
npm ERR!     @esbuild-plugins/node-resolve@"^0.1.4" from mdx-bundler@9.0.1
npm ERR!     node_modules/mdx-bundler
npm ERR!       mdx-bundler@"9.0.1" from the root project
npm ERR!   1 more (@mdx-js/esbuild)
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer esbuild@"0.11.x || 0.12.x || 0.13.x || 0.14.x" from mdx-bundler@9.0.1
npm ERR! node_modules/mdx-bundler
npm ERR!   mdx-bundler@"9.0.1" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: esbuild@0.14.54
npm ERR! node_modules/esbuild
npm ERR!   peer esbuild@"0.11.x || 0.12.x || 0.13.x || 0.14.x" from mdx-bundler@9.0.1
npm ERR!   node_modules/mdx-bundler
npm ERR!     mdx-bundler@"9.0.1" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /runner/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2025-12-03T18_53_10_781Z-debug-0.log

renovate bot changed the title ~~fix(deps): update dependency next to v13 [security]~~ fix(deps): update dependency next to v13 [security] - autoclosed Sep 25, 2024

renovate bot closed this Sep 25, 2024

renovate bot deleted the renovate/npm-next-vulnerability branch September 25, 2024 16:31

renovate bot changed the title ~~fix(deps): update dependency next to v13 [security] - autoclosed~~ fix(deps): update dependency next to v13 [security] Sep 26, 2024

renovate bot reopened this Sep 26, 2024

renovate bot restored the renovate/npm-next-vulnerability branch September 26, 2024 18:53

renovate bot force-pushed the renovate/npm-next-vulnerability branch from e09532a to 1e6f13f Compare September 26, 2024 18:54

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 1e6f13f to 7ca9b41 Compare October 15, 2024 03:53

renovate bot changed the title ~~fix(deps): update dependency next to v13 [security]~~ fix(deps): update dependency next to v14 [security] Oct 15, 2024

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 7ca9b41 to 5efd71f Compare January 23, 2025 20:51

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 5efd71f to 483c4b4 Compare March 24, 2025 20:24

renovate bot changed the title ~~fix(deps): update dependency next to v14 [security]~~ fix(deps): update dependency next to v12.3.5 [security] Mar 24, 2025

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 483c4b4 to d298267 Compare May 16, 2025 19:07

renovate bot changed the title ~~fix(deps): update dependency next to v12.3.5 [security]~~ fix(deps): update dependency next to v14 [security] May 16, 2025

renovate bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from 2418852 to 3bd4b4c Compare August 13, 2025 15:54

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 3bd4b4c to 0c08a6c Compare August 19, 2025 19:03

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 0c08a6c to b0a53f8 Compare August 31, 2025 09:40

renovate bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from f746970 to a8ea1c8 Compare September 13, 2025 18:47

renovate bot force-pushed the renovate/npm-next-vulnerability branch from a8ea1c8 to 7b9dc5d Compare September 25, 2025 19:32

renovate bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from 5feecf3 to 915b22d Compare October 21, 2025 10:50

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 915b22d to 290196e Compare November 11, 2025 01:57

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 290196e to 764b6b3 Compare November 18, 2025 12:37

fix(deps): update dependency next to v14 [security]

f8637da

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 764b6b3 to f8637da Compare December 3, 2025 18:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update dependency next to v14 [security] #108

fix(deps): update dependency next to v14 [security] #108

Uh oh!

renovate bot commented Sep 25, 2024 •

edited

Loading

Uh oh!

renovate bot commented Sep 25, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fix(deps): update dependency next to v14 [security] #108

Are you sure you want to change the base?

fix(deps): update dependency next to v14 [security] #108

Uh oh!

Conversation

renovate bot commented Sep 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

Credits

Impact

Patches

Workarounds

Credits

Impact

Patches

Workaround

Credits

Release Notes

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Misc Changes

Credits

Core Changes

Credits

Core Changes

Misc Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

What's Changed

Support esmExternals in app directory

Reading cookies set in middleware in components and actions

Metadata and icons

Parallel routes fixes

Draft mode and edge improvements

next/image fixes

Server actions improvements

Other changes

Create-next-app updates

Core Changes

Credits

Core Changes

Core Changes

renovate bot commented Sep 25, 2024 •

edited

Loading

Support `esmExternals` in app directory

`next/image` fixes

renovate bot commented Sep 25, 2024 •

edited

Loading