This repository has been archived by the owner on Feb 13, 2022. It is now read-only.
build(deps): update dependency next to v12 #463
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/major-nextjs-monorepo
branch
3 times, most recently
from
157c1be
to
d3493b9
Compare
renovate
bot
force-pushed
the
renovate/major-nextjs-monorepo
branch
from
d3493b9
to
10e96c1
Compare
renovate
bot
force-pushed
the
renovate/major-nextjs-monorepo
branch
from
10e96c1
to
6c434a7
Compare
renovate
bot
force-pushed
the
renovate/major-nextjs-monorepo
branch
from
6c434a7
to
8170b86
Compare
renovate
bot
force-pushed
the
renovate/major-nextjs-monorepo
branch
3 times, most recently
from
48e8b19
to
72faa93
Compare
renovate
bot
force-pushed
the
renovate/major-nextjs-monorepo
branch
from
72faa93
to
195b7d8
Compare
renovate
bot
force-pushed
the
renovate/major-nextjs-monorepo
branch
3 times, most recently
from
8544ede
to
0f19863
Compare
renovate
bot
force-pushed
the
renovate/major-nextjs-monorepo
branch
from
0f19863
to
4414fdc
Compare
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
11.0.1->12.0.10Release Notes
vercel/next.js
v12.0.10Compare Source
Core Changes
compressconfigurable in standalone mode: #33717stale-while-revalidatepattern to Image Optimization API: #33735Documentation Changes
Example Changes
with-dockerexample dockerfile: #33695Misc Changes
lock.ymlCredits
Huge thanks to @Vienio99, @balazsorban44, @kyliau, @molebox, @huozhi, @shuding, @PepijnSenders, @krystofex, @PizzaPete, @souljuse, @styfle, @Schniz, @Nelsonfrank, @ijjk, @Mhmdrza, @timneutkens, @hideokamoto-stripe, @Emrin, @gr-qft, @delbaoliveira, @redbar0n, @amandeepmittal, @lxy-yz, and @Divlo for helping!
v12.0.9Compare Source
This upgrade is completely backward-compatible and recommended for all users on versions below 12.0.9
Vulnerable code could allow a bad actor to trigger a denial of service attack via the
/${locale}/_next/route for anyone running a Next.js app at version >= 12.0.0, and using built-in i18n routing functionality.How to Upgrade
npm install next@latest --saveImpact
v12.0.0andv12.0.9We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
How to Assess Impact
If your server has seen requests to any route under the prefix
/${locale}/_next/that have triggered a heap overflow error, this was caused by the patched issue.What is Being Done
As Next.js has grown in popularity and usage by enterprises, it has received the attention of security researchers and auditors. We are thankful to our users for their investigation and responsible disclosure of the original bug.
We've landed a patch that ensures this is handled properly so the requested route no longer crashes and triggers a heap overflow.
Regression tests for this attack were added to the i18n integration test suite
[email protected]. We are actively monitoring this mailbox.Core Changes
process.envto inferred usage: #33186postcss: #33142node-fetch: #33466onLoadingComplete(): #33474next-multilingualexample: #29386lazyRootoptional property tonext/imagecomponent : #33290Documentation Changes
next export+next/imageerror message: #33317onLoadgottcha note tonext/scriptdocs: #33097next/serverdocumentation forgeo: #33609next/imageusage withnext exportbased on feedback.: #33555headersconfig option description: #33484netlify-plugin-cache-nextjshas been deprecated: #33629Example Changes
Misc Changes
Credits
Huge thanks to @molebox, @Schniz, @sokra, @kachkaev, @shuding, @teleaziz, @OgbeniHMMD, @goncy, @balazsorban44, @MaedahBatool, @bennettdams, @kdy1, @huozhi, @hsynlms, @styfle, @ijjk, @callumgare, @jonrosner, @karaggeorge, @rpie3, @MartijnHols, @leerob, @bashunaimiroy, @NOCELL, @rishabhpoddar, @omariosouto, @hanneslund, @theMosaad, @javivelasco, @pierrenel, @lobsterkatie, @tharakabimal, @vvo, @saevarb, @lfades, @nbouvrette, @paulnbrd, @ecklf, @11koukou, @renbaoshuo, @chozzz, @tbezman, @karlhorky, @j-mendez, and @ffan0811 for helping!
v12.0.8Compare Source
Core Changes
<Main />: #32184Writable: #32247nth: #32358jsxtransform of swc: #32383style.filteron image withplaceholder=blur: #32623.nextfolder: #32659placeholder=blur: #32680afor internal url whentarget="blank"present: #32780<head>: #32897next/imagenoscript tag to only render when lazy: #32918href="/"and hash already present: #32954next infoCLI command: #32972@vercel/nftto 0.17.2: #33048ssr: falseon server-side: #32606Documentation Changes
devswapped arguments: #32135Example Changes
nextjs-graphql-with-prisma-simpleexample API endpoint: #32759with-semantic-uiexample up-to-date: #32805cms-kontentexample: #32806detaversion in examples: #30204Misc Changes
Credits
Huge thanks to @arthurfiorette, @thibautsabot, @shuding, @chimit, @joperron, @devknoll, @MaedahBatool, @kyliau, @padmaia, @moh12594, @rasmusjp, @balazsorban44, @molebox, @bryanrsmith, @TrySound, @josharsh, @kdy1, @styfle, @huozhi, @delbaoliveira, @PizzaPete, @thecrypticace, @arturparkhisenko, @segheysens, @thevinter, @AryanBeezadhur, @xiaohp, @tknickman, @javivelasco, @oriolcp, @sokra, @smakosh, @ijjk, @jorrit, @timneutkens, @hanneslund, @mix3d, @Clecio013, @michielvangendt, @intergalacticspacehighway, @jbraithwaite, @marcelocarmona, @benmerckx, @haykerman, @steven-tey, @jaredpalmer, @pi-guy-in-the-sky, @JuanM04, @apollisa, @D-Pagey, @jameshfisher, @rishabhpoddar, @Kikobeats, @ramosbugs, @dan-weaver, @chris-stytch, @MikevPeeren, @janpio, @emw3, @nubpro, @cmdcolin, @joostdecock, @sgallese, @housseindjirdeh, @minervabot, @cjboco, @Ryuurock, @dm430, @mkarkachov, @nvh95, @gfortaine, @kumard3, @zifeo, @vicente-s, @Rohithgilla12, @brookton, @leerob, @skirsten, @davidfateh, @DavidBabel, @mannybecerra, @Schniz, @glenngijsberts, @pveyes, @kaykdm, and @xhiroga for helping!
v12.0.7Compare Source
Core Changes
Credits
Huge thanks to @timneutkens for helping!
v12.0.6Compare Source
Core Changes
v12.0.5Compare Source
This upgrade is completely backward-compatible and recommended for all users on versions below 12.0.5. A backport of the patch to Next.js 11 is available as 11.1.3.
When a URL is provided to
next-serverthat cannot be parsed, anunhandledPromiseRejectioncould occur. On Node.js versions <v15.0.0this isn't a fatal issue as only a warning is shown. However, in Node.js versions >v15.0.0, this causes the server process to exit, which can result in unexpected server crashes.How to Upgrade
npm install next@latest --saveImpact
v11.1.0and belowv12.0.5v15.0.0being usednext startor a custom serverWe recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
How to Assess Impact
If you are running Node.js >
v15.0.0with Next.js, you can filter any server error logs forERR_INVALID_URL.What is Being Done
As Next.js has grown in popularity and usage by enterprises, it has received the attention of security researchers and auditors. We are thankful to GitHub user
hopeless-programmer-onlinefor their investigation and discovery of the original bug.We've landed a patch that ensures this is handled properly so the
unhandledPromiseRejectionissue no longer occurs.Regression tests for this attack were added to the security integration test suite
[email protected]. We are actively monitoring this mailbox.Core Changes
console.*calls.: #31449next lintwithouteslint-config-nextinstalled: #29823.jsonstatic method: #31483Google-PageRendererbot: #31521Documentcomponents an error: #31505renderToWebStream: #31553no-html-link-for-pagesfrom warning for static files: #31495next/link: #30606Configuration
📅 Schedule: "before 2am" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by WhiteSource Renovate. View repository job log here.