From cd15caa846ca23c85a0e4aa8f0edae4ed6ad428f Mon Sep 17 00:00:00 2001 From: "depfu[bot]" <23717796+depfu[bot]@users.noreply.github.com> Date: Mon, 6 Jan 2025 10:23:13 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9A=A8=20[security]=20Update=20all=20of?= =?UTF-8?q?=20nextjs=2015.1.0=20=E2=86=92=2015.1.3=20(patch)=20(#15535)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit
🚨 Your current dependencies have known security vulnerabilities 🚨 This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request. ### What changed? #### ✳️ eslint-config-next (15.1.0 → 15.1.3) Sorry, we couldn't find anything useful about this release. #### ✳️ next (15.1.0 → 15.1.3) · [Repo](https://github.com/vercel/next.js)
Security Advisories 🚨

🚨 Next.js Allows a Denial of Service (DoS) with Server Actions

Impact

A Denial of Service (DoS) attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution.

Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.

Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing.

This is the same issue as if the incoming HTTP request has an invalid Content-Length header or never closes. If the host has no other mitigations to those then this vulnerability is novel.

This vulnerability affects only Next.js deployments using Server Actions.

Patches

This vulnerability was resolved in Next.js 14.2.21, 15.1.2, and 13.5.8. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

Thanks to the PackDraw team for responsibly disclosing this vulnerability.

Release Notes

15.1.3

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Credits

Huge thanks to @unstubbable and @ztanner for helping!

15.1.2

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Credits

Huge thanks to @ztanner for helping!

15.1.1

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Credits

Huge thanks to @devjiwonchoi and @ztanner for helping!

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 11 commits:

--- ![Depfu Status](https://depfu.com/badges/edd6acd35d74c8d41cbb540c30442adf/stats.svg) [Depfu](https://depfu.com) will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with `@depfu rebase`.
All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
Co-authored-by: depfu[bot] <23717796+depfu[bot]@users.noreply.github.com> --- playgrounds/nextjs/package.json | 4 +- playgrounds/v3/package.json | 4 +- pnpm-lock.yaml | 112 ++++++++++++++++---------------- 3 files changed, 60 insertions(+), 60 deletions(-) diff --git a/playgrounds/nextjs/package.json b/playgrounds/nextjs/package.json index e306a4cf7..61a8f3626 100644 --- a/playgrounds/nextjs/package.json +++ b/playgrounds/nextjs/package.json @@ -11,7 +11,7 @@ "dependencies": { "@tailwindcss/postcss": "workspace:^", "fast-glob": "^3.3.2", - "next": "15.1.0", + "next": "15.1.3", "react": "^18.3.1", "react-dom": "^18.3.1", "tailwindcss": "workspace:^" @@ -21,7 +21,7 @@ "@types/react": "^18.3.12", "@types/react-dom": "^18.3.1", "eslint": "^9.15.0", - "eslint-config-next": "^15.1.0", + "eslint-config-next": "^15.1.3", "typescript": "^5.5.4" } } diff --git a/playgrounds/v3/package.json b/playgrounds/v3/package.json index 18309031f..96bcc8621 100644 --- a/playgrounds/v3/package.json +++ b/playgrounds/v3/package.json @@ -9,7 +9,7 @@ "upgrade": "node scripts/upgrade.mjs" }, "dependencies": { - "next": "15.1.0", + "next": "15.1.3", "react": "^18.3.1", "react-dom": "^18.3.1", "tailwindcss": "^3" @@ -20,7 +20,7 @@ "@types/react-dom": "^18.3.1", "autoprefixer": "^10.4.20", "eslint": "^9.15.0", - "eslint-config-next": "^15.1.0", + "eslint-config-next": "^15.1.3", "typescript": "^5.5.4" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index ddc1c77c7..4b12f977e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -393,8 +393,8 @@ importers: specifier: ^3.3.2 version: 3.3.2 next: - specifier: 15.1.0 - version: 15.1.0(@playwright/test@1.49.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + specifier: 15.1.3 + version: 15.1.3(@playwright/test@1.49.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) react: specifier: ^18.3.1 version: 18.3.1 @@ -418,8 +418,8 @@ importers: specifier: ^9.15.0 version: 9.15.0(jiti@2.4.0) eslint-config-next: - specifier: ^15.1.0 - version: 15.1.0(eslint@9.15.0(jiti@2.4.0))(typescript@5.5.4) + specifier: ^15.1.3 + version: 15.1.3(eslint@9.15.0(jiti@2.4.0))(typescript@5.5.4) typescript: specifier: ^5.5.4 version: 5.5.4 @@ -427,8 +427,8 @@ importers: playgrounds/v3: dependencies: next: - specifier: 15.1.0 - version: 15.1.0(@playwright/test@1.49.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + specifier: 15.1.3 + version: 15.1.3(@playwright/test@1.49.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) react: specifier: ^18.3.1 version: 18.3.1 @@ -455,8 +455,8 @@ importers: specifier: ^9.15.0 version: 9.15.0(jiti@2.4.0) eslint-config-next: - specifier: ^15.1.0 - version: 15.1.0(eslint@9.15.0(jiti@2.4.0))(typescript@5.6.3) + specifier: ^15.1.3 + version: 15.1.3(eslint@9.15.0(jiti@2.4.0))(typescript@5.6.3) typescript: specifier: ^5.5.4 version: 5.6.3 @@ -1343,56 +1343,56 @@ packages: engines: {node: '>= 10'} hasBin: true - '@next/env@15.1.0': - resolution: {integrity: sha512-UcCO481cROsqJuszPPXJnb7GGuLq617ve4xuAyyNG4VSSocJNtMU5Fsx+Lp6mlN8c7W58aZLc5y6D/2xNmaK+w==} + '@next/env@15.1.3': + resolution: {integrity: sha512-Q1tXwQCGWyA3ehMph3VO+E6xFPHDKdHFYosadt0F78EObYxPio0S09H9UGYznDe6Wc8eLKLG89GqcFJJDiK5xw==} - '@next/eslint-plugin-next@15.1.0': - resolution: {integrity: sha512-+jPT0h+nelBT6HC9ZCHGc7DgGVy04cv4shYdAe6tKlEbjQUtwU3LzQhzbDHQyY2m6g39m6B0kOFVuLGBrxxbGg==} + '@next/eslint-plugin-next@15.1.3': + resolution: {integrity: sha512-oeP1vnc5Cq9UoOb8SYHAEPbCXMzOgG70l+Zfd+Ie00R25FOm+CCVNrcIubJvB1tvBgakXE37MmqSycksXVPRqg==} - '@next/swc-darwin-arm64@15.1.0': - resolution: {integrity: sha512-ZU8d7xxpX14uIaFC3nsr4L++5ZS/AkWDm1PzPO6gD9xWhFkOj2hzSbSIxoncsnlJXB1CbLOfGVN4Zk9tg83PUw==} + '@next/swc-darwin-arm64@15.1.3': + resolution: {integrity: sha512-aZtmIh8jU89DZahXQt1La0f2EMPt/i7W+rG1sLtYJERsP7GRnNFghsciFpQcKHcGh4dUiyTB5C1X3Dde/Gw8gg==} engines: {node: '>= 10'} cpu: [arm64] os: [darwin] - '@next/swc-darwin-x64@15.1.0': - resolution: {integrity: sha512-DQ3RiUoW2XC9FcSM4ffpfndq1EsLV0fj0/UY33i7eklW5akPUCo6OX2qkcLXZ3jyPdo4sf2flwAED3AAq3Om2Q==} + '@next/swc-darwin-x64@15.1.3': + resolution: {integrity: sha512-aw8901rjkVBK5mbq5oV32IqkJg+CQa6aULNlN8zyCWSsePzEG3kpDkAFkkTOh3eJ0p95KbkLyWBzslQKamXsLA==} engines: {node: '>= 10'} cpu: [x64] os: [darwin] - '@next/swc-linux-arm64-gnu@15.1.0': - resolution: {integrity: sha512-M+vhTovRS2F//LMx9KtxbkWk627l5Q7AqXWWWrfIzNIaUFiz2/NkOFkxCFyNyGACi5YbA8aekzCLtbDyfF/v5Q==} + '@next/swc-linux-arm64-gnu@15.1.3': + resolution: {integrity: sha512-YbdaYjyHa4fPK4GR4k2XgXV0p8vbU1SZh7vv6El4bl9N+ZSiMfbmqCuCuNU1Z4ebJMumafaz6UCC2zaJCsdzjw==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] - '@next/swc-linux-arm64-musl@15.1.0': - resolution: {integrity: sha512-Qn6vOuwaTCx3pNwygpSGtdIu0TfS1KiaYLYXLH5zq1scoTXdwYfdZtwvJTpB1WrLgiQE2Ne2kt8MZok3HlFqmg==} + '@next/swc-linux-arm64-musl@15.1.3': + resolution: {integrity: sha512-qgH/aRj2xcr4BouwKG3XdqNu33SDadqbkqB6KaZZkozar857upxKakbRllpqZgWl/NDeSCBYPmUAZPBHZpbA0w==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] - '@next/swc-linux-x64-gnu@15.1.0': - resolution: {integrity: sha512-yeNh9ofMqzOZ5yTOk+2rwncBzucc6a1lyqtg8xZv0rH5znyjxHOWsoUtSq4cUTeeBIiXXX51QOOe+VoCjdXJRw==} + '@next/swc-linux-x64-gnu@15.1.3': + resolution: {integrity: sha512-uzafnTFwZCPN499fNVnS2xFME8WLC9y7PLRs/yqz5lz1X/ySoxfaK2Hbz74zYUdEg+iDZPd8KlsWaw9HKkLEVw==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - '@next/swc-linux-x64-musl@15.1.0': - resolution: {integrity: sha512-t9IfNkHQs/uKgPoyEtU912MG6a1j7Had37cSUyLTKx9MnUpjj+ZDKw9OyqTI9OwIIv0wmkr1pkZy+3T5pxhJPg==} + '@next/swc-linux-x64-musl@15.1.3': + resolution: {integrity: sha512-el6GUFi4SiDYnMTTlJJFMU+GHvw0UIFnffP1qhurrN1qJV3BqaSRUjkDUgVV44T6zpw1Lc6u+yn0puDKHs+Sbw==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - '@next/swc-win32-arm64-msvc@15.1.0': - resolution: {integrity: sha512-WEAoHyG14t5sTavZa1c6BnOIEukll9iqFRTavqRVPfYmfegOAd5MaZfXgOGG6kGo1RduyGdTHD4+YZQSdsNZXg==} + '@next/swc-win32-arm64-msvc@15.1.3': + resolution: {integrity: sha512-6RxKjvnvVMM89giYGI1qye9ODsBQpHSHVo8vqA8xGhmRPZHDQUE4jcDbhBwK0GnFMqBnu+XMg3nYukNkmLOLWw==} engines: {node: '>= 10'} cpu: [arm64] os: [win32] - '@next/swc-win32-x64-msvc@15.1.0': - resolution: {integrity: sha512-J1YdKuJv9xcixzXR24Dv+4SaDKc2jj31IVUEMdO5xJivMTXuE6MAdIi4qPjSymHuFG8O5wbfWKnhJUcHHpj5CA==} + '@next/swc-win32-x64-msvc@15.1.3': + resolution: {integrity: sha512-VId/f5blObG7IodwC5Grf+aYP0O8Saz1/aeU3YcWqNdIUAmFQY3VEPKPaIzfv32F/clvanOb2K2BR5DtDs6XyQ==} engines: {node: '>= 10'} cpu: [x64] os: [win32] @@ -2337,8 +2337,8 @@ packages: resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==} engines: {node: '>=10'} - eslint-config-next@15.1.0: - resolution: {integrity: sha512-gADO+nKVseGso3DtOrYX9H7TxB/MuX7AUYhMlvQMqLYvUWu4HrOQuU7cC1HW74tHIqkAvXdwgAz3TCbczzSEXw==} + eslint-config-next@15.1.3: + resolution: {integrity: sha512-wGYlNuWnh4ujuKtZvH+7B2Z2vy9nONZE6ztd+DKF7hAsIabkrxmD4TzYHzASHENo42lmz2tnT2B+zN2sOHvpJg==} peerDependencies: eslint: ^7.23.0 || ^8.0.0 || ^9.0.0 typescript: '>=3.3.1' @@ -3026,8 +3026,8 @@ packages: natural-compare@1.4.0: resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==} - next@15.1.0: - resolution: {integrity: sha512-QKhzt6Y8rgLNlj30izdMbxAwjHMFANnLwDwZ+WQh5sMhyt4lEBqDK9QpvWHtIM4rINKPoJ8aiRZKg5ULSybVHw==} + next@15.1.3: + resolution: {integrity: sha512-5igmb8N8AEhWDYzogcJvtcRDU6n4cMGtBklxKD4biYv4LXN8+awc/bbQ2IM2NQHdVPgJ6XumYXfo3hBtErg1DA==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -4492,34 +4492,34 @@ snapshots: '@napi-rs/cli@2.18.4': {} - '@next/env@15.1.0': {} + '@next/env@15.1.3': {} - '@next/eslint-plugin-next@15.1.0': + '@next/eslint-plugin-next@15.1.3': dependencies: fast-glob: 3.3.1 - '@next/swc-darwin-arm64@15.1.0': + '@next/swc-darwin-arm64@15.1.3': optional: true - '@next/swc-darwin-x64@15.1.0': + '@next/swc-darwin-x64@15.1.3': optional: true - '@next/swc-linux-arm64-gnu@15.1.0': + '@next/swc-linux-arm64-gnu@15.1.3': optional: true - '@next/swc-linux-arm64-musl@15.1.0': + '@next/swc-linux-arm64-musl@15.1.3': optional: true - '@next/swc-linux-x64-gnu@15.1.0': + '@next/swc-linux-x64-gnu@15.1.3': optional: true - '@next/swc-linux-x64-musl@15.1.0': + '@next/swc-linux-x64-musl@15.1.3': optional: true - '@next/swc-win32-arm64-msvc@15.1.0': + '@next/swc-win32-arm64-msvc@15.1.3': optional: true - '@next/swc-win32-x64-msvc@15.1.0': + '@next/swc-win32-x64-msvc@15.1.3': optional: true '@nodelib/fs.scandir@2.1.5': @@ -5605,9 +5605,9 @@ snapshots: escape-string-regexp@4.0.0: {} - eslint-config-next@15.1.0(eslint@9.15.0(jiti@2.4.0))(typescript@5.5.4): + eslint-config-next@15.1.3(eslint@9.15.0(jiti@2.4.0))(typescript@5.5.4): dependencies: - '@next/eslint-plugin-next': 15.1.0 + '@next/eslint-plugin-next': 15.1.3 '@rushstack/eslint-patch': 1.10.4 '@typescript-eslint/eslint-plugin': 8.11.0(@typescript-eslint/parser@8.11.0(eslint@9.15.0(jiti@2.4.0))(typescript@5.5.4))(eslint@9.15.0(jiti@2.4.0))(typescript@5.5.4) '@typescript-eslint/parser': 8.11.0(eslint@9.15.0(jiti@2.4.0))(typescript@5.5.4) @@ -5625,9 +5625,9 @@ snapshots: - eslint-plugin-import-x - supports-color - eslint-config-next@15.1.0(eslint@9.15.0(jiti@2.4.0))(typescript@5.6.3): + eslint-config-next@15.1.3(eslint@9.15.0(jiti@2.4.0))(typescript@5.6.3): dependencies: - '@next/eslint-plugin-next': 15.1.0 + '@next/eslint-plugin-next': 15.1.3 '@rushstack/eslint-patch': 1.10.4 '@typescript-eslint/eslint-plugin': 8.11.0(@typescript-eslint/parser@8.11.0(eslint@9.15.0(jiti@2.4.0))(typescript@5.6.3))(eslint@9.15.0(jiti@2.4.0))(typescript@5.6.3) '@typescript-eslint/parser': 8.11.0(eslint@9.15.0(jiti@2.4.0))(typescript@5.6.3) @@ -6406,9 +6406,9 @@ snapshots: natural-compare@1.4.0: {} - next@15.1.0(@playwright/test@1.49.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): + next@15.1.3(@playwright/test@1.49.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1): dependencies: - '@next/env': 15.1.0 + '@next/env': 15.1.3 '@swc/counter': 0.1.3 '@swc/helpers': 0.5.15 busboy: 1.6.0 @@ -6418,14 +6418,14 @@ snapshots: react-dom: 18.3.1(react@18.3.1) styled-jsx: 5.1.6(react@18.3.1) optionalDependencies: - '@next/swc-darwin-arm64': 15.1.0 - '@next/swc-darwin-x64': 15.1.0 - '@next/swc-linux-arm64-gnu': 15.1.0 - '@next/swc-linux-arm64-musl': 15.1.0 - '@next/swc-linux-x64-gnu': 15.1.0 - '@next/swc-linux-x64-musl': 15.1.0 - '@next/swc-win32-arm64-msvc': 15.1.0 - '@next/swc-win32-x64-msvc': 15.1.0 + '@next/swc-darwin-arm64': 15.1.3 + '@next/swc-darwin-x64': 15.1.3 + '@next/swc-linux-arm64-gnu': 15.1.3 + '@next/swc-linux-arm64-musl': 15.1.3 + '@next/swc-linux-x64-gnu': 15.1.3 + '@next/swc-linux-x64-musl': 15.1.3 + '@next/swc-win32-arm64-msvc': 15.1.3 + '@next/swc-win32-x64-msvc': 15.1.3 '@playwright/test': 1.49.0 sharp: 0.33.5 transitivePeerDependencies: