[Snyk] Security upgrade next from 14.2.4 to 14.2.35 #43
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-NEXT-14400636 - https://snyk.io/vuln/SNYK-JS-BABELHELPERS-9397697 - https://snyk.io/vuln/SNYK-JS-NANOID-8492085
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Pull request overview
This PR applies a security upgrade to Next.js, updating it from version 14.2.4 to 14.2.35 to address three security vulnerabilities: a high severity deserialization issue (SNYK-JS-NEXT-14400636), and two medium severity issues related to ReDoS (SNYK-JS-BABELHELPERS-9397697) and improper input validation (SNYK-JS-NANOID-8492085).
Key Changes
- Upgrades Next.js from 14.2.4 to 14.2.35 to resolve security vulnerabilities
- Fixes high severity deserialization of untrusted data vulnerability
- Addresses medium severity ReDoS and improper input validation issues
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "clsx": "2.1.1", | ||
| "jiti": "1.21.6", | ||
| "next": "14.2.4", | ||
| "next": "14.2.35", |
There was a problem hiding this comment.
The Next.js dependency is being upgraded to version 14.2.35, but the related package eslint-config-next on line 84 remains at version 14.2.4. It's recommended to keep these packages in sync to ensure ESLint rules are compatible with the Next.js version being used. Consider upgrading eslint-config-next to match the Next.js version.
Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-NEXT-14400636
SNYK-JS-BABELHELPERS-9397697
SNYK-JS-NANOID-8492085
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Improper Input Validation
🦉 Deserialization of Untrusted Data