Bump next from 14.2.3 to 15.5.18#159
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps [next](https://github.com/vercel/next.js) from 14.2.3 to 15.5.18. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.2.3...v15.5.18) --- updated-dependencies: - dependency-name: next dependency-version: 15.5.18 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
✅ Deploy Preview for alloradocs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 2 files
Architecture diagram
sequenceDiagram
participant Client as Browser Client
participant SS as Next.js Server<br/>v15.5.18
participant MW as Request Middleware
participant RSC as React Server<br/>Components
participant Image as Image<br/>Optimization API
participant WS as WebSocket<br/>Upgrade Handler
participant Cache as Response Cache
Note over Client,Cache: NEW: Next 15 Security Boundary Enforcement
Client->>SS: HTTP Request (page/navigation)
alt Segment-prefetch routes detected
SS->>MW: CHANGED: Validate route (strict matcher)
alt Invalid/malicious route
MW-->>SS: Reject (403)
SS-->>Client: Blocked response
else Valid route
MW->>RSC: Continue to Server Component
end
else Normal navigation
SS->>MW: Standard middleware match
alt Middleware redirect
MW->>Cache: CHANGED: Bypass cache for redirect
MW->>SS: Return redirect
SS-->>Client: 307/308 redirect + no-cache headers
else Direct render
MW->>RSC: Proceed
end
end
RSC->>RSC: CHANGED: Strict input validation
alt Malformed props/data
RSC-->>SS: Reject (DoS prevention)
SS-->>Client: 413/400
else Valid request
RSC-->>SS: Rendered component
SS-->>Client: HTML + CSP nonce header
end
Note over Client,Image: Image Optimization Path
Client->>SS: HTTP GET /_next/image
alt image optimization
opt sharp not installed
SS->>SS: Use built-in sharp fallback
end
SS->>Image: Process image
Image-->>SS: Optimized image
SS-->>Client: Response + cache headers
end
Note over Client,WS: WebSocket Upgrade Protection
Client->>SS: Upgrade request (ws://)
SS->>WS: CHANGED: Validate target URL
alt Absolute URL in upgrade (SSRF attempt)
WS-->>SS: Reject upgrade
SS-->>Client: 403 Forbidden
else Relative/safe URL
WS-->>SS: Allow upgrade
SS-->>Client: 101 Switching Protocols
end
Note over Client,Cache: Cache Poisoning Prevention
SS->>RSC: CHANGED: Generate cache key
alt Cache key collision detected
RSC->>RSC: Add random cache-busting value
RSC-->>Cache: Store with unique key
else Standard
RSC-->>Cache: Store rendered component
end
ghost
removed
the
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps next from 14.2.3 to 15.5.18.
Release notes
Sourced from next's releases.
... (truncated)
Commits
9ff92cev15.5.1800ebe23[backport] Disable build caches for production/staging/force-preview deploys ...62c97abv15.5.17423623aTurbopack: Match proxy matchers with webpack implementation (#93594)fa78739Turbopack: Fix middleware matcher suffix (#93590)36e62c6[backport] Turbopack: more strict vergen setup (#93588)36589b5[backport][test] Pin package manager to patch versions (#93596)ad6fd4ev15.5.1679d7dffIgnore malformed CSP nonce headers (#103)c4f6908router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Upgrade
nextfrom 14.2.3 to 15.5.18 to apply the latest security fixes and Next 15 runtime updates. This also updates SWC andstyled-jsx, and introduces an optionalsharpdependency for image optimization.Dependencies
nextto 15.5.18 (includes fixes for DoS, middleware/proxy bypass, SSRF, and XSS advisories).sharp@^0.34.3and platform-specific@img/sharp-*packages.@next/swc-*to 15.5.18 andstyled-jsxto 5.1.6.Migration
.next/, runyarn install, then build.sharpinstalls; verify image optimization and middleware behave as expected.Written for commit 6f8355a. Summary will update on new commits.