Update dependency next to v14 [SECURITY] #60

renovate · 2024-09-25T14:55:19Z

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	`12.3.4` → `14.2.35`

GitHub Vulnerability Alerts

CVE-2023-46298

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.

CVE-2024-47831

Impact

The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.

Not affected:

The next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value.
The Next.js application is hosted on Vercel.

Patches

This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.

Workarounds

Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.

Credits

Brandon Dahler (brandondahler), AWS
Dimitrios Vlastaras

CVE-2024-51479

Impact

If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

Patches

This issue was patched in Next.js 14.2.15 and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.

Release Notes

vercel/next.js (next)

Core Changes

omit searchParam data from FlightRouterState before transport (#80734)

Credits

Huge thanks to @ztanner for helping!

`v14.2.32`

Compare Source

Core Changes

fix router handling when setting a location response header #82588

Credits

Huge thanks to @ztanner for helping!

`v14.2.31`

Compare Source

Core Changes

fix(next/image): improve and simplify detect-content-type (#82179)
fix(next/image): fix image-optimizer.ts headers (#82178)

Credits

Huge thanks to @styfle and @ztanner for helping!

`v14.2.30`

Compare Source

Core Changes

Backport config.allowedDevOrigins (#80410) (Learn More)

Credits

Huge thanks to @ijjk and @ztanner for helping!

`v14.2.29`

Compare Source

Core Changes

Only share incremental cache for edge in next start (#79389)

Credits

Huge thanks to @ijjk for helping!

`v14.2.28`

Compare Source

Core Changes

fix: node.js module import error when using middleware (#77945)

Credits

Huge thanks to @ztanner for helping!

`v14.2.27`

Compare Source

Core Changes

fix dynamic route interception not working when deployed with middleware (#64923)

Credits

Huge thanks to @ztanner for helping!

`v14.2.26`

Compare Source

Core Changes

Match subrequest handling for edge and node (#77476)

`v14.2.25`

Compare Source

Core Changes

Update middleware request header (#77202)

Credits

Huge thanks to @ijjk for helping!

`v14.2.24`

Compare Source

Core Changes

fix: ensure lint worker errors aren't silenced (#75779)
add additional x-middleware-set-cookie filtering (#75561 & #73482)

Credits

Huge thanks to @ztanner for helping!

`v14.2.23`

Compare Source

Core Changes

backport: force module format for virtual client-proxy (#74590)
Backport: Use provided waitUntil for pending revalidates (#74573)
Feature: next/image: add support for images.qualities in next.config (#74500)

Credits

Huge thanks to @styfle, @ijjk and @lubieowoce for helping!

`v14.2.22`

Compare Source

Core Changes

Retry manifest file loading only in dev mode: #73900
Ensure workers are cleaned up: #71564
Use shared worker for lint & typecheck steps: #74154

Credits

Huge thanks to @unstubbable, @ijjk, and @ztanner for helping!

`v14.2.21`

Compare Source

Core Changes

Upgrade React from 14898b6 to 178c267: #74115
Fix unstable_allowDynamic when used with pnpm: #73765

Misc Changes

chore(docs): add missing search: '' on remotePatterns: #73927
chore(docs): update version history of next/image: #73926

Credits

Huge thanks to @unstubbable, @ztanner, and @styfle for helping!

`v14.2.20`

Compare Source

Core Changes

Fix fetch cloning bug (#73532)

Credits

Huge thanks to @wyattjoh for helping!

`v14.2.19`

Compare Source

Core Changes

ensure worker exits bubble to parent process (#73433)
Increase max cache tags to 128 (#73125)

Misc Changes

Update max tag items limit in docs (#73445)

Credits

Huge thanks to @ztanner and @ijjk for helping!

`v14.2.18`

Compare Source

Core Changes

Fix: (third-parties) sendGTMEvent not queueing events before GTM init (#68683) (#72111)
Ignore error pages for cache revalidate (#72412) (#72484)

Credits

Huge thanks to @huozhi and @ijjk for helping!

`v14.2.17`

Compare Source

Core Changes

Fix: revert the bad node binary handling (#72356)
Ensure pages/500 handles cache-control as expected (#72050) (#72110)
fix unhandled runtime error from generateMetadata in parallel routes (#72153)

Credits

Huge thanks to @huozhi, @ztanner, and @ijjk for helping!

`v14.2.16`

Compare Source

`v14.2.15`

Compare Source

Core Changes

support breadcrumb style catch-all parallel routes #65063
Provide non-dynamic segments to catch-all parallel routes #65233
Fix client reference access causing metadata missing #70732
feat(next/image): add support for decoding prop #70298
feat(next/image): add images.localPatterns config #70529
fix(next/image): handle undefined images.localPatterns config in images-manifest.json
fix: Do not omit alt on getImgProps return type, ImgProps #70608
[i18n] Routing fix #70761

Credits

Huge thanks to @ztanner, @agadzik, @huozhi, @styfle, @icyJoseph and @wyattjoh for helping!

`v14.2.14`

Compare Source

Core Changes

Fix: clone response in first handler to prevent race (#70082) (#70649)
Respect reexports from metadata API routes (#70508) (#70647)
Externalize node binary modules for app router (#70646)
Fix revalidateTag() behaviour when invoked in server components (#70446) (#70642)
Fix prefetch bailout detection for nested loading segments (#70618)
Add missing node modules to externals (#70382)
Feature: next/image: add support for images.remotePatterns.search (#70302)

Credits

Huge thanks to @styfle, @ztanner, @ijjk, @huozhi and @wyattjoh for helping!

`v14.2.13`

Compare Source

Core Changes

Fix missing cache-control on SSR app route (#70265)
feat: add polyfill of URL.canParse for browser compatibility (#70228)
Fix vercel og package memory leak (#70214)
Fix startTime error on Android 9 with Chrome 74 (#67391)

Credits

Huge thanks to @raeyoung-kim, @huozhi, @devjiwonchoi, and @ijjk for helping!

`v14.2.12`

Compare Source

Core Changes

update prefetching jsdoc & documentation (#68047)
Ensure we chunk revalidate tag requests (#70189)
(backport) fix(eslint): allow typescript-eslint v8 (#70090)
[ppr] Don't mark RSC requests as /_next/data requests (backport of #66249) (#70083)

Credits

Huge thanks to @alvarlagerlof, @wyattjoh, @delbaoliveira, and @ijjk for helping!

`v14.2.11`

Compare Source

Core Changes

fix: correct metadata url suffix (#69959)
fix: setting assetPrefix to URL format breaks HMR (#70040)
Update revalidateTag to batch tags in one request (#65296)

Credits

Huge thanks to @huozhi, @devjiwonchoi, and @ijjk for helping!

`v14.2.10`

Compare Source

Core Changes

Remove invalid fallback revalidate value (#69990)
Revert server action optimization (#69925)
Add ability to customize Cache-Control (#69802)

Credits

Huge thanks to @huozhi and @ijjk for helping!

`v14.2.9`

Compare Source

Core Changes

Revert "Fix esm property def in flight loader (#66990)" (#69749)
Disable experimental.optimizeServer by default to fix failed server action (#69788)
Fix middleware fallback: false case (#69799)
Fix status code for /_not-found route (#64058) (#69808)
Fix metadata prop merging (#69807)
create-next-app: fix font file corruption when using import alias (#69806)

Credits

Huge thanks to @huozhi, @ztanner, @ijjk, and @lubieowoce for helping!

`v14.2.8`

Compare Source

What's Changed

Support `esmExternals` in app directory

Support esm externals in app router (#65041)
Turbopack: Allow client components from foreign code in app routes (#64751)
Turbopack: add support for esm externals in app dir (#64918)
other related PRs: #66990 #66727 #66286 #65519

Reading cookies set in middleware in components and actions

initialize ALS with cookies in middleware (#65008)
fix middleware cookie initialization (#65820)
ensure cookies set in middleware can be read in a server action (#67924)
fix: merged middleware cookies should preserve options (#67956)

Metadata and icons

support facebook-specific metadata (fb:app_id, fb:admins) in generateMetaData (#65713)
Always collect static icons for all segments (#68712)
Fix favicon merging with customized icons (#67982)
Warn metadataBase missing in standalone mode or non vercel deployment (#66296)

Parallel routes fixes

fix missing stylesheets when parallel routes are present (#69507)

Draft mode and edge improvements

fix: unstable_cache should not cache new result in draft mode (#67772)
Add draft mode flag for multi-zone (#68997)
Fix edge preview props are not matched with cookie (#67779)
other related PRs: #65426, #67787, #64946, #64313, #64370

`next/image` fixes

Allow external image urls with _next/image pathname to be rendered via Image component (#69586)

Server actions improvements

optimize server actions (#66523)
Apply optimization for unused actions (#69178)
Improve SWC transform ID generation (#69183)

Other changes

Ensure we match comment minify behavior between terser and swc (#68372)
send initialCanonicalUrl in array format to prevent crawler confusion (#69509)

Create-next-app updates

enable @typescript-eslint/recommended in create-next-app --typescript (#52845)
Update create-next-app template CSS (#66233)
Update create-next-app template CSS (#66043)
Update create-next-app template (#65803)
add font antialiasing to templates (#67425)
Move create-next-app public/ assets from local folder→ remote URL (#66931)
Use classnames to set font family in Tailwind create-next-app templates (#66374)
other related PRs: #64478, #68899, #68534, #69021, #67146, #66145

Full Changelog: vercel/next.js@v14.2.7...v14.2.8

Huge thanks to everyone who contributed to this release:
@abhi12299, @delbaoliveira, @eps1lon, @ForsakenHarmony, @huozhi, @ijjk, @JoshuaKGoldberg, @leerob, @lubieowoce, @Netail, @ronanru, @samcx, @shuding, @sokra, @stylessh, @timfuhrmann, @wbinnssmith, @wyattjoh, @ypessoa, @ztanner

`v14.2.7`

Compare Source

Core Changes

Revert "chore: externalize undici for bundling" (#65727)
Refactor internal routing headers to use request meta (#66987)
fix(next): add cross origin in react dom preload (#67423)
build: upgrade edge-runtime (#67565)
GTM dataLayer parameter should take an object, not an array of strings (#66339)
fix: properly patch lockfile against swc bindings (#66515)
Add deployment id header for rsc payload if present (#67255)
Update font data (#68639)
fix i18n data pathname resolving (#68947)
pages router: ensure x-middleware-cache is respected (#67734)
Fix bad modRequest in flight entry manifest #68888
Reject next image urls in image optimizer #68628
Fix hmr assetPrefix escaping and reuse logic from other files #67983

Credits

Huge thanks to @kjugi, @huozhi, @ztanner, @SukkaW, @marlier, @Kikobeats, @syi0808, @ijjk, and @samcx for helping!

`v14.2.6`

Compare Source

Core Changes

Ensure fetch cache TTL is updated properly (#69164)

`v14.2.5`

Compare Source

Core Changes

avoid merging global css in a way that leaks into other chunk groups (#67373)
Fix server action edge redirect with middleware rewrite (#67148)
fix(next): reject protocol-relative URLs in image optimization (#65752)
fix(next-swc): correct path interop to filepath for wasm (#65633)
Use addDependency to track metadata route file changes (#66714)
Fix noindex is missing on static not-found page (#67135)
perf: improve retrieving versionInfo on Turbo HMR (#67309)
fix(next/image): handle invalid url (#67465)
fix(next): initial prefetch cache not set properly with different search params (#65977)
fix: Backport class properties fix (#67377)
Upgrade acorn (#67592)

Misc

Log stdio for pull-turbo-cache script (#66759)
Ensure turbo is setup when building in docker (#66804)

Credits

Huge thanks to @devjiwonchoi, @ijjk, @emmerich, @huozhi, @kdy1, @kwonoj, @styfle, and @sokra for helping!

`v14.2.4`

Compare Source

Core Changes

fix: ensure route handlers properly track dynamic access (#66446)
fix NextRequest proxy in edge runtime (#66551)
Fix next/dynamic with babel and src dir (#65177)
Use vercel deployment url for metadataBase fallbacks (#65089)
fix(next/image): detect react@19 for fetchPriority prop (#65235)
Fix loading navigation with metadata and prefetch (#66447)
prevent duplicate RSC fetch when action redirects (#66620)
ensure router cache updates reference the latest cache values (#66681)
Prevent append of trailing slash in cases where path ends with a file extension (#66636)
Fix inconsistency with 404 getStaticProps cache-control (#66674)
Use addDependency to track metadata route file changes (#66714)
Add timeout/retry handling for fetch cache (#66652)
fix: app-router prefetch crash when an invalid URL is passed to Link (#66755)

Credits

Huge thanks to @ztanner, @ijjk, @wbinnssmith, @huozhi, and @lubieowoce for helping!

`v14.2.3`

Compare Source

Core Changes

Fix: resolve mixed re-exports module as cjs (#64681)
fix: mixing namespace import and named import client components (#64809)
Fix mixed exports in server component with barrel optimization (#64894)
Fix next/image usage in mdx(#64875)
fix(fetch-cache): fix additional typo, add type & data validation (#64799)
prevent erroneous route interception during lazy fetch (#64692)
fix root page revalidation when redirecting in a server action (#64730)
fix: remove traceparent from cachekey should not remove traceparent from original object (#64727)
Clean-up fetch metrics tracking (#64746)

Credits

Huge thanks to @huozhi, @samcx, @ztanner, @Jeffrey-Zutt, and @ijjk for helping!

`v14.2.2`

Compare Source

Core Changes

Fix Server Action error logs for unhandled POST requests (#64315)
Improve rendering performance (#64408)
Fix the method prop case in Server Actions transform (#64398)
fix(next-lint): update option --report-unused-disable-directives to --report-unused-disable-directives-severity (#64405)
tweak test for Azure (#64424)
router restore should take priority over pending actions (#64449)
Fix client boundary inheritance for barrel optimization (#64467)
improve turborepo caching (#64493)
feat: strip traceparent header from cachekey (#64499)
Fix more Turbopack build tests
Update lockfile for compatibility with turbo (#64360)
Fix typo in dynamic-rendering.ts (#64365)
Fix DynamicServerError not being thrown in fetch (#64511)
fix(next): Metadata.openGraph values not resolving basic values when type is set (#63620)
disable production chunking in dev (#64488)
Fix cjs client components tree-shaking (#64558)
fix refresh behavior for discarded actions (#64532)
fix: filter out middleware requests in logging (#64549)
Turbopack: Allow client components to be imported in app routes (#64520)
Fix ASL bundling for dynamic css (#64451)
add pathname normalizer for actions (#64592)
fix incorrect refresh request when basePath is set (#64589)
test: skip turbopack build test (#64356)
hotfix(turbopack): Update with patch for postcss.config.js path resolution on Windows (#64677)

Credits

Huge thanks to @shuding, @coltonehrman, @ztanner, @huozhi, @sokra, @Jeffrey-Zutt, @timneutkens, @wbinnssmith, @wiesson, @ijjk, @devjiwonchoi, and @bgw for helping!

`v14.2.1`

Compare Source

Core Changes

use pathToFileUrl to make esm import()s work with absolute windows paths (#64386) @sokra

Credits

Huge thanks to @sokra for helping!

`v14.2.0`

Compare Source

Learn more: https://nextjs.org/blog/next-14-2

Core Changes

Update build worker warning to use debug: #60847
fix: added @sentry/profiling-node to sep list to prevent build/bundle breakage: #60855
Optimize build trace ignores: #60859
Deprecation warning for config.analyticsId: #60677
chore: indicate staleness more prominently in next info output: #60376
Telemetry: createComponentTree span: #60857
chore: replace micromatch w/ picomatch: #60699
Report HMR latency as trace spans for Turbopack: #60799
Turbopack: always log HMR rebuild times: #60908
Error overlay refactors: #60886
Use precompiled source-map in overlay middleware: #60932
Use more precompiled deps in react-dev-overlay: #60959
Fix next phase for next build: #60969
chore: update turbopack: #60980
refactor(analysis): rust based page-static-info, deprecate js parse interface in next-swc: #59300
disable static generation on interception routes: #61004
Docs: Address community feedback: #60960
avoid output of webpack stats: #61023
Revert "refactor(analysis): rust based page-static-info, deprecate js parse interface in next-swc": #61021
fix useSelectedLayoutSegment's support for parallel routes: #60912
Dynamic APIs: #60645
Enable next.js version checker in turbopack: #61034
chore: Update terser to v5.27.0: #61068
Update swc_core to v0.87.28: #60876
update turbopack: #61015
Implement client_root for edge in Turbopack: #61024
fix parallel route top-level catch-all normalization logic to support nested explicit (non-catchall) slot routes: #60776
fix(image): warn when animated image is missing unoptimized prop: #61045
Fix version checker not displaying when version newer than npm: #61075
Fix sitemap generateSitemaps support for string id: #61088
ppr: ensure the router state tree is provided for interception routes: #61059
Improve the Server Actions SWC transform: #61001
Fix instrument bundling as client components: #60984
fix(turbopack): use correct layout for 404 page: #61032
fix: emotion import source should be enabled in SSR contexts: #61099
chore: update turbopack: #61090
fix(turbopack): custom page extensions for _app: #60789
Disable trace uploads with NEXT_TRACE_UPLOAD_DISABLE: #61101
add optimizeServerReact to config-shared: #61106
Fix filesystempublicroutes test for Turbopack: #61132
chore: upgrade webpack to 5.90.0: #61109
Add maxDuration to typescript plugin allowed exports: #59193
Upgrade Turbopack: #61190
build: remove sentry from the externals list: #61194
exclude default routes from isPageStatic check: #61173
Add stack trace to client rendering bailout error: #61200
chore: refactor image optimization to separate external/internal urls: #61172
parallel routes: support multi-slot layouts: #61115
Refine revalidatePath warning message: #61220
revert changes to process default routes at build: #61241
Fix cookie merging in Server Action redirections: #61113
Update swc_core to v0.89.x: #61086
Fix Server Reference being double registered: #61244
Fix Server Action redirection with absolute internal URL: #60798
Fix indentation in source code of dev overlay: #61216
Update swc_core to v0.89.4: #61285
fix: Revert preset-env mode of styled-jsx in webpack mode: #61306
DX: add route context to the dynamic errors: #61332
Telemetry: add time-to-first-byte signal: #61238
Refine logging message of experiments: #61337
fix(turbopack): don't parse .ts files as .tsx: #61219
Update turbopack: #61381
Same as #61360: #61369
Always respect NEXT_TRACE_UPLOAD_DISABLED: #61402
parallel routes: fix catch-all slots being treated as optional catch-all: #61174
fix hmr telemetry reporting: #61420
chore: Update swc_core to v0.89.6: #61426
Update turbopack: #61433
fix a perf problem in VersionedContentMap: #61442
Fix next dynamic import named export from client components: #61378
fix issues loading CSS in default slots: #61428
avoid sending issues turbopack messages to browser: #61443
Support crossOrigin in Turbopack: #61461
Pass down __NEXT_EXPERIMENTAL_REACT env to webpack build worker explicitly: #61463
Replace image optimizer IPC call with request handler: #61471
feat(next): trace build dependencies for turborepo: #59553
Turbopack: fix telemetry attributes for swc options: #61474
Always show version text in error overlay: #61421
Fix build worker callback arg missing correct page path : #61347
Update font data: #61479
build: upgrade edge-runtime: #61030
Fix experimental react support in app-route runtime: #61511
Fix .env hmr for Node.js runtime in Turbopack: #61504
remove unnecessary PPR branch in non-PPR reducer: #61176
fix: bump @vercel/[email protected]: #61538
chore: update ESLint and plugins to latest: #61544
Update turbopack: #61553
feat: first pass of next/font manifest: #61424
Fix .env HMR for Turbopack in Edge runtime: #61565
build(cargo): bump up turbopack: #61590
refactor(next-core): consolidate custom ecma transform rules: #61481
ensure server action errors notify rejection handlers: #61588
feat(turbopack): only preload fonts that opt in: #61591
feat(turbopack): serve google fonts locally and allow preloading them: #61596
Update font data: #61621
Remove unused mockedRes in resolveRoutes: #61635
Fix @react-pdf/renderer not working in RSC: [#61

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot changed the title ~~Update dependency next to v13 [SECURITY]~~ Update dependency next to v13 [SECURITY] - autoclosed Sep 25, 2024

renovate bot closed this Sep 25, 2024

renovate bot deleted the renovate/npm-next-vulnerability branch September 25, 2024 18:22

renovate bot restored the renovate/npm-next-vulnerability branch September 26, 2024 20:14

renovate bot changed the title ~~Update dependency next to v13 [SECURITY] - autoclosed~~ Update dependency next to v13 [SECURITY] Sep 26, 2024

renovate bot reopened this Sep 26, 2024

renovate bot force-pushed the renovate/npm-next-vulnerability branch from d211c72 to 84c616e Compare September 26, 2024 20:14

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 84c616e to 20df6ab Compare October 15, 2024 04:31

renovate bot changed the title ~~Update dependency next to v13 [SECURITY]~~ Update dependency next to v14 [SECURITY] Oct 15, 2024

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 20df6ab to 3f82e17 Compare December 21, 2024 14:49

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 3f82e17 to cd00725 Compare March 24, 2025 17:34

renovate bot changed the title ~~Update dependency next to v14 [SECURITY]~~ Update dependency next to v12.3.5 [SECURITY] Mar 24, 2025

renovate bot force-pushed the renovate/npm-next-vulnerability branch from cd00725 to 872bf3d Compare March 24, 2025 21:57

renovate bot changed the title ~~Update dependency next to v12.3.5 [SECURITY]~~ Update dependency next to v14 [SECURITY] Mar 24, 2025

renovate bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from 2e92fca to d36ee5c Compare May 18, 2025 03:24

renovate bot force-pushed the renovate/npm-next-vulnerability branch from d36ee5c to 0e03785 Compare July 26, 2025 12:01

renovate bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from 80f067b to ff7c50f Compare August 13, 2025 15:13

renovate bot force-pushed the renovate/npm-next-vulnerability branch from ff7c50f to 785d71d Compare August 24, 2025 00:12

renovate bot force-pushed the renovate/npm-next-vulnerability branch 3 times, most recently from d9846cd to 3b522aa Compare September 4, 2025 09:11

renovate bot force-pushed the renovate/npm-next-vulnerability branch 4 times, most recently from 2b03b31 to 1783997 Compare September 22, 2025 01:47

renovate bot force-pushed the renovate/npm-next-vulnerability branch 2 times, most recently from 77983e2 to 00d34a8 Compare September 26, 2025 19:56

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 00d34a8 to a88ee41 Compare September 30, 2025 19:26

renovate bot force-pushed the renovate/npm-next-vulnerability branch from a88ee41 to 2579823 Compare October 10, 2025 14:14

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 2579823 to 833aa3f Compare October 21, 2025 16:14

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 833aa3f to bf6b76b Compare November 10, 2025 23:54

renovate bot force-pushed the renovate/npm-next-vulnerability branch from bf6b76b to 29a1bcd Compare November 19, 2025 00:43

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 29a1bcd to a1ffd0d Compare December 3, 2025 18:39

renovate bot force-pushed the renovate/npm-next-vulnerability branch from a1ffd0d to 23ab37e Compare December 13, 2025 07:01

Update dependency next to v14 [SECURITY]

6510ecc

renovate bot force-pushed the renovate/npm-next-vulnerability branch from 23ab37e to 6510ecc Compare December 31, 2025 23:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update dependency next to v14 [SECURITY] #60

Update dependency next to v14 [SECURITY] #60

Uh oh!

renovate bot commented Sep 25, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Update dependency next to v14 [SECURITY] #60

Are you sure you want to change the base?

Update dependency next to v14 [SECURITY] #60

Uh oh!

Conversation

renovate bot commented Sep 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

Credits

Impact

Patches

Workarounds

Credits

Release Notes

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Misc Changes

Credits

Core Changes

Credits

Core Changes

Misc Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

Core Changes

Credits

What's Changed

Support esmExternals in app directory

Reading cookies set in middleware in components and actions

Metadata and icons

Parallel routes fixes

Draft mode and edge improvements

next/image fixes

Server actions improvements

Other changes

Create-next-app updates

Core Changes

Credits

Core Changes

Core Changes

renovate bot commented Sep 25, 2024 •

edited

Loading

Support `esmExternals` in app directory

`next/image` fixes