fix(deps): update dependency next [security]#929
Open
ham-renovate wants to merge 1 commit intomainfrom
Open
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
✅ Files skipped from review due to trivial changes (6)
📝 WalkthroughWalkthroughBumped the Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (5)
platforms/evoting/client/package.json (1)
68-68: Consider updatingeslint-config-nextto match Next.js version.The
eslint-config-nextis at version 15.5.9 whilenextis being updated to 15.5.13. Aligning these versions is recommended.📦 Suggested version alignment
- "eslint-config-next": "15.5.9", + "eslint-config-next": "15.5.13",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@platforms/evoting/client/package.json` at line 68, The package.json dependency "eslint-config-next" is pinned to 15.5.9 while "next" is 15.5.13; update the "eslint-config-next" entry to match the Next.js version (e.g., set "eslint-config-next": "15.5.13") so the ESLint config aligns with the Next version and avoid potential linting mismatches; locate the "eslint-config-next" key in package.json and bump its version accordingly, then run install and verify linting passes.platforms/emover/client/package.json (1)
34-34: Consider updatingeslint-config-nextto match Next.js version.The
eslint-config-nextis at version 15.5.9 whilenextis being updated to 15.5.13. Version alignment ensures consistency.📦 Suggested version alignment
- "eslint-config-next": "15.5.9", + "eslint-config-next": "15.5.13",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@platforms/emover/client/package.json` at line 34, Update the eslint-config-next dependency to match the Next.js version: change the "eslint-config-next" entry in package.json to "15.5.13" (same as "next"), then run your package manager to install and update lockfiles (e.g., npm/yarn/pnpm install) so versions stay aligned and linting rules match the Next.js release.platforms/calendar/client/package.json (1)
72-72: Consider updatingeslint-config-nextto match Next.js version.The
eslint-config-nextis at version 15.1.2 whilenextis being updated to 15.5.13. Aligning these versions ensures linting rules are compatible with the framework version.📦 Suggested version alignment
- "eslint-config-next": "15.1.2", + "eslint-config-next": "15.5.13",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@platforms/calendar/client/package.json` at line 72, Update the eslint-config-next dependency to match the Next.js version used in the project: change the "eslint-config-next" entry in package.json to the same major/minor/patch as the "next" dependency (e.g., set "eslint-config-next" to 15.5.13) so lint rules stay compatible with the framework version and then run npm/yarn install and lint to verify no rule regressions.platforms/blabsy/client/package.json (1)
47-47: Consider updatingeslint-config-nextto match Next.js version.The
eslint-config-nextis at version 15.5.9 whilenextis being updated to 15.5.13. While not critical for security, keeping these versions aligned helps ensure linting rules match the framework version in use.📦 Suggested version alignment
- "eslint-config-next": "15.5.9", + "eslint-config-next": "15.5.13",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@platforms/blabsy/client/package.json` at line 47, Update the package.json dependency for eslint-config-next to match the Next.js version by changing "eslint-config-next" from 15.5.9 to 15.5.13 (to align with the "next" dependency at 15.5.13), then reinstall dependencies (npm/yarn/pnpm) to update the lockfile and run the linter (or CI) to verify there are no rule regressions.platforms/group-charter-manager/client/package.json (1)
67-67: Consider updatingeslint-config-nextto match Next.js version.The
eslint-config-nextis at version 15.5.9 whilenextis being updated to 15.5.13. Version alignment is recommended for consistency.📦 Suggested version alignment
- "eslint-config-next": "15.5.9", + "eslint-config-next": "15.5.13",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@platforms/group-charter-manager/client/package.json` at line 67, The package.json has "eslint-config-next": "15.5.9" that is out of sync with the updated "next" (15.5.13); update the "eslint-config-next" dependency to "15.5.13" to align versions, then reinstall dependencies (npm/yarn/pnpm install) and run your lint/build/test commands to verify no breakages; look for and update any lockfile changes as needed.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@platforms/evoting/api/package.json`:
- Line 25: Update the Next.js dependency in package.json to the patched version
"15.5.13" (replace the existing "next" entry), then run your package manager to
update node_modules and the lockfile (npm install or yarn install), commit the
updated lockfile, run the test suite and any integration checks for rewrites,
and run a security audit (npm audit or yarn audit) to confirm CVE-2026-29057 is
resolved.
---
Nitpick comments:
In `@platforms/blabsy/client/package.json`:
- Line 47: Update the package.json dependency for eslint-config-next to match
the Next.js version by changing "eslint-config-next" from 15.5.9 to 15.5.13 (to
align with the "next" dependency at 15.5.13), then reinstall dependencies
(npm/yarn/pnpm) to update the lockfile and run the linter (or CI) to verify
there are no rule regressions.
In `@platforms/calendar/client/package.json`:
- Line 72: Update the eslint-config-next dependency to match the Next.js version
used in the project: change the "eslint-config-next" entry in package.json to
the same major/minor/patch as the "next" dependency (e.g., set
"eslint-config-next" to 15.5.13) so lint rules stay compatible with the
framework version and then run npm/yarn install and lint to verify no rule
regressions.
In `@platforms/emover/client/package.json`:
- Line 34: Update the eslint-config-next dependency to match the Next.js
version: change the "eslint-config-next" entry in package.json to "15.5.13"
(same as "next"), then run your package manager to install and update lockfiles
(e.g., npm/yarn/pnpm install) so versions stay aligned and linting rules match
the Next.js release.
In `@platforms/evoting/client/package.json`:
- Line 68: The package.json dependency "eslint-config-next" is pinned to 15.5.9
while "next" is 15.5.13; update the "eslint-config-next" entry to match the
Next.js version (e.g., set "eslint-config-next": "15.5.13") so the ESLint config
aligns with the Next version and avoid potential linting mismatches; locate the
"eslint-config-next" key in package.json and bump its version accordingly, then
run install and verify linting passes.
In `@platforms/group-charter-manager/client/package.json`:
- Line 67: The package.json has "eslint-config-next": "15.5.9" that is out of
sync with the updated "next" (15.5.13); update the "eslint-config-next"
dependency to "15.5.13" to align versions, then reinstall dependencies
(npm/yarn/pnpm install) and run your lint/build/test commands to verify no
breakages; look for and update any lockfile changes as needed.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 00478f85-7f62-4cfe-8889-c142ac10115e
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (6)
platforms/blabsy/client/package.jsonplatforms/calendar/client/package.jsonplatforms/emover/client/package.jsonplatforms/evoting/api/package.jsonplatforms/evoting/client/package.jsonplatforms/group-charter-manager/client/package.json
ham-renovate
force-pushed
the
renovate/npm-next-vulnerability
branch
from
50a738d to
25ddd25
Compare
ham-renovate
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
15.5.10→15.5.1315.5.10→15.5.14GitHub Vulnerability Alerts
CVE-2026-29057
Summary
When Next.js rewrites proxy traffic to an external backend, a crafted
DELETE/OPTIONSrequest usingTransfer-Encoding: chunkedcould trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.
Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so
content-length: 0is added only when bothcontent-lengthandtransfer-encodingare absent, andtransfer-encodingis no longer removed in that code path.Workarounds
If upgrade is not immediately possible:
DELETE/OPTIONSrequests on rewritten routes at your edge/proxy.CVE-2026-27980
Summary
The default Next.js image optimization disk cache (
/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.
Patches
Fixed by adding an LRU-backed disk cache with
images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. SettingmaximumDiskCacheSize: 0disables disk caching.Workarounds
If upgrade is not immediately possible:
.next/cache/images.images.localPatterns,images.remotePatterns, andimages.qualities)Release Notes
vercel/next.js (next)
v15.5.13Compare Source
Core Changes
Credits
Huge thanks to @ztanner for helping!
v15.5.12Compare Source
This is a re-release of v15.5.11 applying the turbopack changes.
v15.5.11Compare Source
Core Changes
Credits
Huge thanks to @timneutkens, @mischnic, @ztanner, and @wyattjoh for helping!
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.