Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency next to v13 [security] - autoclosed #64

Closed
wants to merge 1 commit into from
Closed

fix(deps): update dependency next to v13 [security] - autoclosed #64

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 17, 2024 •
edited
Loading

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
next (source) ^10.0.9 -> ^13.0.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2021-39178

Impact

  • Affected: All of the following must be true to be affected
    • Next.js between version 10.0.0 and 11.1.0
    • The next.config.js file has images.domains array assigned
    • The image host assigned in images.domains allows user-provided SVG
  • Not affected: The next.config.js file has images.loader assigned to something other than default
  • Not affected: Deployments on Vercel are not affected

Patches

Next.js v11.1.1

CVE-2022-23646

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the next.config.js file must have an images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change next.config.js to use a different loader configuration other than the default.

Impact

  • Affected: All of the following must be true to be affected
    • Next.js between version 10.0.0 and 12.0.10
    • The next.config.js file has images.domains array assigned
    • The image host assigned in images.domains allows user-provided SVG
  • Not affected: The next.config.js file has images.loader assigned to something other than default

Patches

Next.js 12.1.0

Workarounds

Change next.config.js to use a different loader configuration other than the default, for example:

module.exports = {
  images: {
    loader: 'imgix',
    path: 'https://example.com/myaccount/',
  },
}

Or if you want to use the loader prop on the component, you can use custom:

module.exports = {
  images: {
    loader: 'custom',
  },
}

CVE-2021-43803

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. Note that prior version 0.9.9 package next hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

CVE-2021-37699

Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated, allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although it can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.

Impact

  • Affected: Users of Next.js between 10.0.5 and 10.2.0
  • Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js without getInitialProps
  • Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js and next export
  • Not affected: Deployments on Vercel (vercel.com) are not affected
  • Not affected: Deployments with pages/404.js
  • Note that versions prior to 0.9.9 package next npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

We recommend upgrading to the latest version of Next.js to improve the overall security of your application.

Patches

https://github.com/vercel/next.js/releases/tag/v11.1.0

CVE-2023-46298

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.

Release Notes

vercel/next.js (next)

v13.5.0

Compare Source

v13.4.19

Compare Source

Core Changes
  • fix: invalid module transform for @headlessui/react: #​54206
  • chore: remove unnecessary type cast in dev-build-watcher: #​54221
  • fix process.env not being available in standalone mode: #​54203
  • Fix missing devPageFiles collection: #​54224
  • Add Route and LinkProps stub generics: #​54226
  • Use createClientModuleProxy from Flight Server: #​54232
  • Add default not found to loader tree of group routes root layer: #​54228
  • feat(image): add support for custom loaderFile when loader: default: #​53417
  • Fix renamed export of Server Actions: #​54241
  • Ensures App Router Link respects scroll-behavior: smooth when only hash is changed.: #​54243
Misc Changes
  • Update dd-trace used for internal tools: #​54214
  • (Fix)Broken upgrading.mdx link : #​54234
  • chore: skip CI run on forks: #​54219
  • chore(ci): bump cancel-workflow-action@0.11.0: #​54246
Credits

Huge thanks to @​opnay, @​styfle, @​timneutkens, @​ztanner, @​shuding, @​huozhi, @​vinaykulk621, @​balazsorban44, @​goguda, and @​coreyleelarson for helping!

v13.4.18

Compare Source

Core Changes
  • refactor: remove edge condition for module proxy path: #​54167
  • Remove unused variables: #​54149
  • chore: improve ts types for position in dev-build-watcher: #​54124
  • Turbopack: Strip relative path prefix when generating PageLoaderAsset: #​54040
  • Add size property to ReadonlySearchParams: #​53144
  • Assign default not-found boundary if custom not-found is not present for root layer only: #​54185
  • Allow range version for eslint config: #​53751
  • Automatically modularizeImports for the popular @​headlessui/react library: #​54188
  • fix bfcache restoration behavior: #​54198
Misc Changes
Credits

Huge thanks to @​huozhi, @​shuding, @​styfle, @​jridgewell, @​bencmbrook, @​cramforce, and @​ztanner for helping!

v13.4.17

Compare Source

Core Changes
  • fix(next/image): empty blur image when animated #​54028
  • Do not output pages 404 in tree view if app not-found is used: #​54051
  • Fix scroll bailout logic when targeting fixed/sticky elements: #​53873
  • Debug tracing: add updated modules and page to HMR span: #​53698
  • fix(next-swc): coerce mdxrs default options: #​54068
  • fix: don't add forceConsistentCasingInFileNames to tsconfig when ts version >= 5.0: #​51564
  • fix(47299): allow testing pages with metadata in jsdom test environment: #​53578
  • upgrade edge-runtime dependency: #​54117
  • Fix root not-found page tree loader structure: #​54080
  • chore: remove as any type cast: #​54074
  • chore: refactor to use fs.promises.rm(): #​54076
  • Refactor layout router creation in app-render: #​54126
  • chore(image): remove apple silicon workaround for versions older than node@16.5.0: #​54125
  • fix routing bug when bfcache is hit following an mpa navigation: #​54081
  • Tracing: add opt-in flag to send a subset of development traces to url: #​53880
  • fix(edge): override init when cloning with NextRequest: #​54108
  • OpenTel: remove the internal (ipc) fetched from traces in a non-verbose mode: #​54083
  • cleanup: remove unnecessary effect dep: #​54134
  • Next build: use exported handle_issues from turbopack: #​52972
  • node-web-streams: remove tee shim, use ReadableStream.tee: #​54079
  • fix: cookies().has() breaks in app-route: #​54112
  • Revert "fix(47299): allow testing pages with metadata in jsdom test environment": #​54160
Documentation Changes
  • fix missing ' in data-fetching/fetching-caching-and-revalidating: #​54058
Example Changes
  • Update Docker example to remove HOSTNAME: #​54102
Misc Changes
  • chore: hide "same on new version" without link: #​54048
  • chore(ci): small notes for the build steps: #​54073
  • chore: update lock bot wording: #​54099
  • Update swc_core to v0.79.59: #​54082
  • install-native.mjs: include packageManager field: #​54132
Credits

Huge thanks to @​balazsorban44, @​huozhi, @​ztanner, @​williamli, @​wbinnssmith, @​kwonoj, @​stefanprobst, @​feugy, @​timneutkens, @​kdy1, @​Kikobeats, @​styfle, @​dvoytenko, @​MaxLeiter, and @​devjiwonchoi for helping!

v13.4.16

Compare Source

Core Changes
  • Concept: test mode for Playwright and similar integration tools: #​52520
  • Turbopack: fix hiding node_modules warnings in error overlay.: #​54022
  • ci(next-swc): print glibc version when build: #​54026
  • Adjust internal action proxy export: #​54004
Documentation Changes
  • Update 05-client-side-rendering.mdx with latest tanstack query version: #​54009
  • Open Graph Image font declaration moved to correct place: #​53998
  • Update opengraph-image.mdx: Fix typo: #​54020
Misc Changes
  • Remove extra label from runner: #​54002
  • add standalone testcase for ipv6 hostnames: #​53999
  • release: add release log generation script: #​54006
  • test(ci): refine test suite name unique: #​54013
  • Leverage previous swc build images: #​54027
  • chore: mark build folder indexable: #​54029
  • Move turbo outside of build for docker swc builds: #​54035
Credits

Huge thanks to @​ijjk, @​ztanner, @​huozhi, @​lacymorrow, @​dvoytenko, @​kylemcd, @​kwonoj, @​tibi1220, @​wbinnssmith, and @​shuding for helping!

v13.4.15

Compare Source

Core Changes
  • Fix action failures due to state tree encoding: #​53655
  • Initial HMR Nexturbo API implementation: #​52950
  • Turbopack: add edge app routes : #​53387
  • Turbopack: Hide Turbo Engine internals: #​53007
  • add unit test case for next.rs api: #​53679
  • Fix not-found rendering in production with edge: #​53687
  • fix(next/image): don't call ReactDOM.preload if missing, such as jest: #​53443
  • Add docs page for uncaught DynamicServerErrors: #​53402
  • Consolidate Server and Routing process into one process: #​53523
  • fix: Update outdated transform imports lucide-react: #​53697
  • Update font data: #​53759
  • Add warnings for static generation bail outs: #​53761
  • Sort root entries per pageExtensions config for consistency: #​53769
  • improve error message for conflicting parallel segments: #​53803
  • Add changeFrequency and priority attributes to sitemaps: #​48484
  • Ensure we set cache-control: no-cache for actions: #​53824
  • Reuse RenderWorker type: #​53782
  • fix: normalize backslash in getStaticPaths() for windows: #​53876
  • Delete errorneous empty content length header: #​53843
  • Turbopack: more tests and bugfixes for next.rs api: #​53809
  • Add @heroicons/react to modularizeImports: #​53902
  • Turbopack: Fix debugging in napi for next-api: #​53889
  • Fix/match resource: #​53796
  • Use summary_large_image as twitter card if images present by default: #​53919
  • Turbopack: Emit whether server or client assets changed: #​53879
  • Limit sharp's concurrency: #​53385
  • enable @​vercel/og support for turbopack: #​53917
  • feat(image): DataURL placeholder support for : #​53442
  • Recover not found errors from flight data to render with proper boundary: #​53703
  • Update React to 18.3.0-canary-1a001dac6-20230812: #​53881
  • add "expect" to list of forbidden IPC headers: #​53947
  • Update swc runners config: #​53939
  • Better IPv6 support for next-server: #​53131
Documentation Changes
  • Update 11-middleware.mdx: Added Switcher: #​53977
  • Fix doc grammatical errors: #​53672
  • Fix a link in incrementalCacheHandlerPath.mdx: #​53718
  • Fix typo in data fetching documentation: #​53772
  • Docs: Add option for fetching data using route handlers - from the client: #​53793
  • docs: Add more information about Server Actions: #​53805
  • docs: document cache tagging mechanism: #​53806
  • chore(docs): add missing "try it out": #​53815
  • docs: Opting out of scrolling with next/link and useRouter.: #​53804
  • chore(docs): note cache-control header for preview/draft mode: #​53825
  • Include instructions for bun package manager: #​53590
  • Docs: Update confusing wording in intercepting routes: #​53854
  • (docs) Fixes Server Actions example: #​53920
  • fix typo: #​53908
  • Docs: fix pnpm command for saving dev deps (#​53937): #​53938
  • The extra word 'the' has been deleted: #​53951
Example Changes
  • [Examples] Update Example Prepr CMS: #​49224
  • Update to with-supertokens example app: #​53434
  • docs(with-stripe-typescript): Update README demo link: #​53662
  • (example) update github-pages example: #​52168
  • chore: add light/dark mode theme detection to image component example: #​53760
Misc Changes
Credits

Huge thanks to @​iamarpitpatidar, @​pythagoras-yamamoto, @​alexkirsz, @​sokra, @​jsteele-stripe, @​tknickman, @​gaojude, @​styfle, @​janicklas-ralph, @​huozhi, @​ijjk, @​vinaykulk621, @​balazsorban44, @​ztanner, @​timneutkens, @​ericfennis, @​JohnAdib, @​MiLk, @​kwonoj, @​delbaoliveira, @​leerob, @​LuudJanssen, @​lucasconstantino, @​davecarlson, @​colinhacks, @​shuding, @​jridgewell, @​jantimon, @​Banbarashik, @​ForsakenHarmony, @​kdy1, @​dvoytenko, @​arturbien, @​gnoff, @​hsrvms, and @​DuCanhGH, @​tim-hanssen, @​Aryan9592, and @​rishabhpoddar for helping!

v13.4.13

Compare Source

Core Changes
  • Improve internal web stream utils: #​53004
  • fix: Add Next-Url to http vary in consideration of intercept routes.: #​52746
  • update Turbopack: #​53098
  • Add app, error, and document entrypoints: #​53013
  • Turbopack: use edge environment in server-side rendering of client components too: #​53099
  • refactor(codemod): replace chalk with picocolors: #​53115
  • move webpack specific logic into a separate file: #​53114
  • feat(turbopack): emit MODULE_FEATURE telemetry from turbopack: #​52356
  • Fix not found hangs the build with overridden node env: #​53106
  • chore: update warning message from yarn add sharp to npm i sharp: #​53130
  • fix(edge): allow Request cloning via NextRequest: #​53157
  • chore: extract common get-validated-args: #​53165
  • Fix minimal basePath handling: #​53174
  • Updates @​typescript-eslint/parser to 6.1.0: #​52848
  • fix(next/image): washed out blur placeholder: #​52583
  • Handle basePath app-dir minimal case: #​53189
Documentation Changes
  • (Docs) add missing import.: #​52992
  • Fix formData code snippet in route handler docs: #​52532
  • docs: remove unneeded good to know section during installation: #​53078
  • docs: fix typo in 08-parallel-routes.mdx: #​53069
  • chore(docs): Extend the options for custom server init: #​52851
  • (Docs) Add missing import for useRef(): #​53015
  • (Docs) Remove FormData type on formData defined in .js file: #​53014
  • docs: fix codeblock for redirect: #​53120
  • chore(docs): client-side data fetching loading state: #​53164
Example Changes
  • feat: remove unused global variable: #​51767
Misc Changes
  • chore(ci): always run validate-docs-links action: #​53022
  • update install-native postinstall to use pnpm: #​53080
  • chore(ci): make validate-docs-links required: #​53123
  • chore(test): fix flaky tsconfig.json test: #​53132
  • chore(ci): fix validate-docs-links for non-PR: #​53129
  • Temporarily skip flakey action revalidate: #​53134
Credits

Huge thanks to @​vinaykulk621, @​Lantianyou, @​styfle, @​shuding, @​joulev, @​AkifumiSato, @​trigaten, @​HurSungYun, @​DevLab2425, @​sokra, @​alexkirsz, @​ztanner, @​leerob, @​SukkaW, @​kwonoj, @​huozhi, @​ijjk, @​balazsorban44, @​daniel-web-developer, @​ky1ejs, and @​arturbien for helping!

v13.4.12

Compare Source

Core Changes
  • Separate routing code from render servers: #​52492
  • Move Pages API rendering into bundle: #​52149
  • update Turbopack: #​52986
  • Turbopack: Refactoring module references: #​52930
  • Increase timeout for 404 tests: #​52998
  • Reland "Refine the not-found rendering process for app router": #​52985
  • Revert "Separate routing code from render servers (#​52492)": #​53016
Documentation Changes
  • "Clarify the 'Existing Projects' section of the TypeScript docs:: #​52944
  • Update 02-dynamic-routes.mdx: #​52975
  • chore(docs): fix broken link: #​53021
Misc Changes
  • Update to latest version of turborepo: #​52979
  • Update swc_core to v0.79.22: #​52945
  • chore(ci): add pnpm workspace for github actions: #​52976
  • Changed package manager for install-native.mjs to pnpm: #​52971
  • update CODEOWNERS config: #​53017
Credits

Huge thanks to @​ijjk, @​wyattjoh, @​sokra, @​kdy1, @​alexkirsz, @​styfle, @​ShaunFerris, @​syedtaqi95, @​Heidar-An, @​huozhi, and @​ztanner for helping!

v13.4.11

Compare Source

Core Changes
  • fix: add missing <preload> for next/image in App Router: #​52425
  • Support metadata exports for server components not-found: #​52678
  • feat(next-swc): try to fallback native bindings with MODULE_NOT_FOUND: #​52667
  • Turbopack: Vc and Turbo Engine type system improvements : #​51792
  • Fix runtime edge not-found handling: #​52754
  • fix: forward NavigateOptions in adaptForAppRouterInstance: #​52498
  • fix(output): do not slice pathname unless ends with .txt: #​52640
  • Fix tagsManifest initialization check: #​52776
  • Turbopack: Experimental dev app pages support: #​52680
  • Turbopack: move Asset::ident to more specific traits: #​52683
  • Fix tracking of ContextModule: #​52795
  • Set process.title for router and render workers: #​52779
  • fix Remove unnecessary await: #​52800
  • Revert "perf: improve URL validation performance": #​52818
  • Refactor the client entry plugin: #​52798
  • Turbopack: Add manifest generation to pages: #​52793
  • Turbopack: move references() to specific traits: #​52822
  • Update default moduleResolution in tsconfig.json from node to bundler: #​51957
  • Turbopack: Next.rs API improvements: #​52856
  • update turbopack: #​52899
  • Update vendor @​vercel/og: #​52897
  • Fixed:#​52853 Lacking 'color' attribute in IconDescriptor Metadata: #​52902
  • Support basePath with edge runtime for Custom App Routes: #​52910
  • improve error DX on pages with RSC build errors: #​52843
  • fix: allow smooth scrolling if only hash changes (pages & app): #​52915
  • add edge support for next.rs API: #​52885
  • Allow general language codes in the Metadata API: #​52920
  • Fix client reference manifest for interception routes: #​52961
  • Refine the not-found rendering process for app router: #​52790
  • app-router: prefetching tweaks: #​52949
  • Revert "Refine the not-found rendering process for app router": #​52977
Documentation Changes
  • Update mention of route handlers for forms: #​52781
  • (Docs) add missing js version for generateMetadata.: #​52763
  • docs : fix typo in React cache example: #​52787
  • chore(docs): Add mentioning of HOSTNAME env variable for standalone output: #​52804
  • Fix typo in docs: #​52815
  • Update 02-edge-and-nodejs-runtimes.mdx: #​52888
  • chore(docs): add Typescript statically typed links mention in link doc: #​52847
  • chore(docs): fix typo in generate metadata docs: #​52904
  • fix example component in MDX documentation: #​52753
  • wrong content for next.config.mjs for MDX Plugins: #​52738
  • Update 06-lazy-loading.mdx: Incorrect filename in Example on "Importing Named Imports": #​52932
  • Change "publically" to "publicly" in the routing docs: #​52966
Example Changes
  • examples: export force-dynamic from all dynamic routes: #​52916
Misc Changes
  • chore: add "please simplify reproduction" comment: #​52631
  • update job concurrency: #​52788
  • Lock node version to 18.16: #​52894
  • Update runs-on tags
  • chore: add GitHub Action to manage "+1" comments: #​52866
Credits

Huge thanks to @​styfle, @​huozhi, @​balazsorban44, @​kwonoj, @​alexkirsz, @​ijjk, @​Jeffrey-Zutt, @​timneutkens, @​vinaykulk621, @​Ryan-Dia, @​sokra, @​shuding, @​steppefox, @​hiro0218, @​rjsdnql123, @​feedthejim, @​fgiuliani, @​steven-tey, @​AntoineBourin, @​adamrhunter, @​darshanjain-entrepreneur, @​s0h311, @​wyattjoh, @​ztanner, @​djreillo, @​dijonmusters, and @​cassidoo for helping!

v13.4.10

Compare Source

Core Changes
  • Fix trailing slash with locale domain: #​52343
  • perf: use fs.readdirSync with withFileTypes: #​52340
  • Make get_client_chunking_context independent of context: #​51928
  • perf: use fs.opendir for better resource usage: #​52341
  • fix: metadatabase warning message: #​52363
  • perf: simplify getShortDynamicParamType on app-render: #​52355
  • fix: prevent infinite dev refresh on nested parallel routes: #​52362
  • turbopack: add incremental cache for node.js app rendering: #​52172
  • Refactor metadata og and twitter title to be always presented: #​52320
  • perf: reduce system calls on eslint plugin: #​52359
  • Turbopack: Use a different chunking context for web entry: #​52404
  • Temporarily revert change to pages render: #​52407
  • Remove integration tests now in vercel/turbo: #​52413
  • Update Rust nightly toolchain: #​51757
  • Cache concurrent ensurePage requests for the same page: #​52360
  • [turbopack]: Remove skipped integration tests: #​52421
  • Fix metadata layer webpack rule for server-only: #​52403
  • Override file based images with social images property: #​52416
  • Split the client reference manifest file to be generated per-entry: #​52450
  • fix(standalone): fixed output: "standalone" crashing build when there is no app/ page: #​51993
  • fix: add aws packages to default serverComponentsExternalPackages: #​52388
  • refactor: avoid unnecessary async scopes in eslint: #​52418
  • Ensure useParams return array for catch-all routes: #​52494
  • turbopack: Module Trait: #​52401
  • Fix tracking of client reference manifest: #​52505
  • perf: create an experimental bundled version of the next server: #​52206
  • Chore: Remove redundant intersection type: #​52453
  • perf: Refactor recursiveReadDirSync: #​52517
  • add version to function config manifest: #​52507
  • Turbopack: Source trait: #​52511
  • Update id handling for fonts: #​52559
  • feat(turbopack): support swc transform plugins : #​50401
  • feat(babel-loader): provide migration help message for babel config: #​52565
  • Support global-error for ssr fallback: #​52573
  • Fix ISR case with bot requests: #​52581
  • fix(next/jest): jest can not load server-only code: #​52393
  • Turbopack: App Router build POC: #​52036
  • Avoid loading Next.js config again in render workers: #​52587
  • Add more extensions to next-types-plugin for Node16/NodeNext: #​52562
  • feat(next-swc): report native bindings load err code: #​52570
  • Move App Pages rendering into bundle: #​52290
  • feat(turbopack): support native webp: #​52285
  • Set sizes prop to any for svg icons: #​52609
  • Turbopack: OutputAsset trait: #​52606
  • chore(deps): bump react@18.3.0-canary-9377e1010-20230712: #​52649
  • Ensure root layout only render once per request: #​52589
  • Fix bundle path normalization for /index routes: #​52650
  • Turobpack: Next.rs API (part 1): #​52259
  • Clean up promises after resolving: #​52656
  • Catch layout error in global-error: #​52654
  • Fix per-entry client reference manifest for grouped and named segments: #​52664
Documentation Changes
  • chore(docs): fix link to useSearchParams: #​52348
  • docs: Clarify create-next-app requires public GitHub URLs.: #​52367
  • remove unnecessary dot.: #​52387
  • fix metadata-related typo in MDX documentation: #​52446
  • docs: Simplify message in React essentials section.: #​52469
  • docs: Improve error handling docs for server-side errors.: #​52302
  • docs: Add Playwright/Cypress Discord links: #​52084
  • docs: Add Kuma to CSS-in-JS supported list.: #​52438
  • docs: clarify fetch request de-duplication: #​52100
  • docs: Update TypeScript plugin section for VS Code prompt: #​52111
  • docs: Improve hydration mismatch error guide.: #​52481
  • docs: add Supabase loader for next/image: #​52480
  • docs: fix the incrementalCacheHandlerPath: #​52124
  • fixed error #​52486 fetchUsers to fetchUser: #​52487
  • Update 08-parallel-routes.mdx: #​52419
  • docs: Add formData example for Route Handlers: #​52358
  • chore(docs): Typesafe metadata object: #​52252
  • docs: Update _app and _document: #​52479
  • docs: add CDN optimization as possible hydration error cause: #​52489
  • docs: correct TypeScript spelling on the home page: #​52500
  • chore(docs): fix a few typos in image loader docs: #​52508
  • docs: fix grammar on Server Actions: #​52556
  • Fixed grammar in 03-react-essentials.mdx: #​52597
  • docs: fix typo in CSS Modules Description: #​52599
  • docs: Fix typo in generate-static-params.mdx: #​52595
  • docs: move MUI to supported list: #​52584
  • docs: Add missing closing tag for react hydration error message.: #​52607
Example Changes
  • examples: Update Convex to latest version (0.19): #​52473
  • Update examples: counter.tsx - Don't need empty space: #​52576
Misc Changes
  • Update swc_core to v0.79.13: #​52371
  • chore(ci): fix turbo input path globs: #​52414
  • fix(create-next-app): click event blockage under 1024px by adjusting z-index: #​52074
  • chore: add label to locked threads: #​52497
  • fix: not-found.tsx with output: export: #​52526
  • use npm pack instead of yarn pack: #​52563
  • ci: skip build-native for docs only change: #​52571
  • Remove unnecessary body-parser: #​52580
Credits

Huge thanks to @​ijjk, @​anonrig, @​alexkirsz, @​gfgabrielfranca, @​styfle, @​ztanner, @​leerob, @​sokra, @​huozhi, @​Bitbbot, @​wyattjoh, @​kdy1, @​wbinnssmith, @​shuding, @​jridgewell, @​BrennanColberg, @​Nick-Mazuk, @​delbaoliveira, @​thomasballinger, @​lucgagan, @​nroland013, @​SonMooSans, @​jenewland1999, @​thorwebdev, @​jyunhanlin, @​darshanjain-entrepreneur, @​DuCanhGH, @​Gnadhi, @​yagogmaisp, @​carlos-menezes, @​balazsorban44, @​ryo-manba, @​timneutkens, @​feedthejim, @​vamcs, @​matepapp, @​SleeplessOne1917, @​ecklf, @​djreillo, @​kwonoj, @​gnoff, @​feugy, @​karlhorky, @​starunaway, @​FernandVEYRIER, @​Ryan-Dia, @​Terro216, @​anthonyshew, and @​suhaotian for helping!

v13.4.9

Compare Source

Core Changes
  • Reland "ReverseTopological -> AdjacencyMap"": #​52142
  • Change the Server Actions feature flag to be validated at compile time: #​52147
  • Fix modularizeImports transform of antd: #​52148
  • fix: next.config.js with unstable_getImgProps(): #​52153
  • update tests list to include all passing tests: #​52026
  • Support scroll: false for Link component for app router: #​51869
  • Memoize useRouter from next/navigation when used in Pages Router: #​52177
  • chore(deps): bump react 18.3.0-canary-1fdacbefd-20230630: #​52005
  • fix: infinite dev reloads when parallel route is treated a page entry: #​52061
  • disable flaky test cases: #​52184
  • Revert "chore(deps): bump react 18.3.0-canary-1fdacbefd-20230630": #​52192
  • update turbopack: #​52186
  • Update CustomModuleType import: #​52133
  • Skip build-time dynamic code checks for specific polyfills in the Edge runtime: [#​52009](https://togithub.com/vercel/next.

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Jun 17, 2024
@sonarcloud SonarCloud
Copy link

sonarcloud bot commented Jun 17, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

@renovate renovate bot changed the title fix(deps): update dependency next to v13 [security] fix(deps): update dependency next to v13 [security] - autoclosed Aug 6, 2024
@renovate renovate bot closed this Aug 6, 2024
@renovate renovate bot deleted the renovate/npm-next-vulnerability branch August 6, 2024 08:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants