hash icon indicating copy to clipboard operation
hash copied to clipboard
verified publisher icon hashintel

Update npm package `next` to v14 [SECURITY]

Open hash-worker[bot] opened this issue 1 year ago β€’ 2 comments

This PR contains the following updates:

Package Type Update Change
next (source) devDependencies major 13.5.5 -> 14.1.1
next (source) dependencies major 13.5.5 -> 14.2.7

GitHub Vulnerability Alerts

CVE-2024-34351

Impact

A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.

Prerequisites

  • Next.js (<14.1.1) is running in a self-hosted* manner.
  • The Next.js application makes use of Server Actions.
  • The Server Action performs a redirect to a relative path which starts with a /.

* Many hosting providers (including Vercel) route requests based on the Host header, so we do not believe that this vulnerability affects any Next.js applications where routing is done in this manner.

Patches

This vulnerability was patched in #​62561 and fixed in Next.js 14.1.1.

Workarounds

There are no official workarounds for this vulnerability. We recommend upgrading to Next.js 14.1.1.

Credit

Vercel and the Next.js team thank Assetnote for responsibly disclosing this issue to us, and for working with us to verify the fix. Thanks to:

Adam Kues - Assetnote Shubham Shah - Assetnote

CVE-2024-46982

Impact

By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a Cache-Control: s-maxage=1, stale-while-revalidate header which some upstream CDNs may cache as well.

To be potentially affected all of the following must apply:

  • Next.js between 13.5.1 and 14.2.9
  • Using pages router
  • Using non-dynamic server-side rendered routes e.g. pages/dashboard.tsx not pages/blog/[slug].tsx

The below configurations are unaffected:

  • Deployments using only app router
  • Deployments on Vercel are not affected

Patches

This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not.

Workarounds

There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

Credits

  • Allam Rachid (zhero_)
  • Henry Chen

CVE-2024-47831

Impact

The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.

Not affected:

  • The next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value.
  • The Next.js application is hosted on Vercel.

Patches

This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.

Workarounds

Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.

Credits

Brandon Dahler (brandondahler), AWS Dimitrios Vlastaras

Release Notes

vercel/next.js (next)

v14.1.1

Compare Source

Note: this is a backport release for critical bug fixes -- this does not include all pending features/changes on canary

Core Changes
Credits

Huge thanks to @​huozhi, @​shuding, @​Ethan-Arrowood, @​styfle, @​ijjk, @​ztanner, @​balazsorban44, @​kdy1, and @​williamli for helping!

v14.1.0

Compare Source

Core Changes
Documentation Changes
Example Changes
Misc Changes

Configuration

πŸ“… Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

β™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

πŸ”• Ignore: Close this PR and you won't be reminded about these updates again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

hash-worker[bot] avatar Sep 10 '24 07:09 hash-worker[bot]

Benchmark results

@rust/hash-graph-benches – Integrations

representative_read_entity

Function Value Mean Flame graphs
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1 $$16.7 \mathrm{ms} \pm 232 \mathrm{ΞΌs}\left({\color{lightgreen}-31.287 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2 $$17.2 \mathrm{ms} \pm 220 \mathrm{ΞΌs}\left({\color{gray}3.50 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1 $$17.1 \mathrm{ms} \pm 212 \mathrm{ΞΌs}\left({\color{gray}0.247 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1 $$16.4 \mathrm{ms} \pm 235 \mathrm{ΞΌs}\left({\color{lightgreen}-5.320 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1 $$16.7 \mathrm{ms} \pm 223 \mathrm{ΞΌs}\left({\color{gray}-2.971 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1 $$17.3 \mathrm{ms} \pm 200 \mathrm{ΞΌs}\left({\color{gray}-4.496 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1 $$16.4 \mathrm{ms} \pm 193 \mathrm{ΞΌs}\left({\color{lightgreen}-5.555 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1 $$17.7 \mathrm{ms} \pm 245 \mathrm{ΞΌs}\left({\color{lightgreen}-26.654 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1 $$16.5 \mathrm{ms} \pm 196 \mathrm{ΞΌs}\left({\color{lightgreen}-6.033 \mathrm{\%}}\right) $$ Flame Graph

representative_read_multiple_entities

Function Value Mean Flame graphs
entity_by_property depths: DT=255, PT=255, ET=255, E=255 $$70.3 \mathrm{ms} \pm 321 \mathrm{ΞΌs}\left({\color{gray}0.007 \mathrm{\%}}\right) $$ Flame Graph
entity_by_property depths: DT=0, PT=0, ET=0, E=0 $$42.0 \mathrm{ms} \pm 185 \mathrm{ΞΌs}\left({\color{gray}-2.837 \mathrm{\%}}\right) $$ Flame Graph
entity_by_property depths: DT=2, PT=2, ET=2, E=2 $$60.3 \mathrm{ms} \pm 391 \mathrm{ΞΌs}\left({\color{gray}-0.747 \mathrm{\%}}\right) $$ Flame Graph
entity_by_property depths: DT=0, PT=0, ET=0, E=2 $$46.9 \mathrm{ms} \pm 124 \mathrm{ΞΌs}\left({\color{gray}-0.053 \mathrm{\%}}\right) $$ Flame Graph
entity_by_property depths: DT=0, PT=0, ET=2, E=2 $$52.8 \mathrm{ms} \pm 298 \mathrm{ΞΌs}\left({\color{gray}0.481 \mathrm{\%}}\right) $$ Flame Graph
entity_by_property depths: DT=0, PT=2, ET=2, E=2 $$56.8 \mathrm{ms} \pm 279 \mathrm{ΞΌs}\left({\color{gray}-0.115 \mathrm{\%}}\right) $$ Flame Graph
link_by_source_by_property depths: DT=255, PT=255, ET=255, E=255 $$108 \mathrm{ms} \pm 733 \mathrm{ΞΌs}\left({\color{gray}-0.023 \mathrm{\%}}\right) $$ Flame Graph
link_by_source_by_property depths: DT=0, PT=0, ET=0, E=0 $$42.4 \mathrm{ms} \pm 293 \mathrm{ΞΌs}\left({\color{gray}-0.266 \mathrm{\%}}\right) $$ Flame Graph
link_by_source_by_property depths: DT=2, PT=2, ET=2, E=2 $$99.1 \mathrm{ms} \pm 679 \mathrm{ΞΌs}\left({\color{gray}-0.287 \mathrm{\%}}\right) $$ Flame Graph
link_by_source_by_property depths: DT=0, PT=0, ET=0, E=2 $$81.6 \mathrm{ms} \pm 380 \mathrm{ΞΌs}\left({\color{gray}0.421 \mathrm{\%}}\right) $$ Flame Graph
link_by_source_by_property depths: DT=0, PT=0, ET=2, E=2 $$90.0 \mathrm{ms} \pm 376 \mathrm{ΞΌs}\left({\color{gray}-0.293 \mathrm{\%}}\right) $$ Flame Graph
link_by_source_by_property depths: DT=0, PT=2, ET=2, E=2 $$94.6 \mathrm{ms} \pm 654 \mathrm{ΞΌs}\left({\color{gray}-0.725 \mathrm{\%}}\right) $$ Flame Graph

representative_read_entity_type

Function Value Mean Flame graphs
get_entity_type_by_id Account ID: d4e16033-c281-4cde-aa35-9085bf2e7579 $$2.19 \mathrm{ms} \pm 9.12 \mathrm{ΞΌs}\left({\color{gray}1.77 \mathrm{\%}}\right) $$ Flame Graph

scaling_read_entity_complete_one_depth

Function Value Mean Flame graphs
entity_by_id 50 entities $$5.39 \mathrm{s} \pm 540 \mathrm{ms}\left({\color{red}1861 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 5 entities $$27.4 \mathrm{ms} \pm 205 \mathrm{ΞΌs}\left({\color{gray}1.53 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 1 entities $$20.8 \mathrm{ms} \pm 94.1 \mathrm{ΞΌs}\left({\color{gray}-0.238 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10 entities $$31.9 \mathrm{ms} \pm 157 \mathrm{ΞΌs}\left({\color{lightgreen}-45.317 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 25 entities $$179 \mathrm{ms} \pm 902 \mathrm{ΞΌs}\left({\color{gray}-0.440 \mathrm{\%}}\right) $$ Flame Graph

scaling_read_entity_linkless

Function Value Mean Flame graphs
entity_by_id 1 entities $$1.94 \mathrm{ms} \pm 6.91 \mathrm{ΞΌs}\left({\color{gray}-1.185 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 100 entities $$2.17 \mathrm{ms} \pm 9.59 \mathrm{ΞΌs}\left({\color{gray}-0.591 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10 entities $$1.97 \mathrm{ms} \pm 6.96 \mathrm{ΞΌs}\left({\color{gray}-0.177 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 1000 entities $$3.10 \mathrm{ms} \pm 19.5 \mathrm{ΞΌs}\left({\color{red}5.55 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10000 entities $$14.4 \mathrm{ms} \pm 51.1 \mathrm{ΞΌs}\left({\color{red}49.4 \mathrm{\%}}\right) $$ Flame Graph

scaling_read_entity_complete_zero_depth

Function Value Mean Flame graphs
entity_by_id 50 entities $$5.22 \mathrm{ms} \pm 22.4 \mathrm{ΞΌs}\left({\color{red}26.2 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 5 entities $$1.98 \mathrm{ms} \pm 8.05 \mathrm{ΞΌs}\left({\color{gray}-0.412 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 1 entities $$1.97 \mathrm{ms} \pm 6.63 \mathrm{ΞΌs}\left({\color{gray}-0.257 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 10 entities $$2.14 \mathrm{ms} \pm 14.6 \mathrm{ΞΌs}\left({\color{gray}-1.403 \mathrm{\%}}\right) $$ Flame Graph
entity_by_id 25 entities $$2.77 \mathrm{ms} \pm 18.2 \mathrm{ΞΌs}\left({\color{lightgreen}-17.773 \mathrm{\%}}\right) $$ Flame Graph

github-actions[bot] avatar Dec 17 '24 17:12 github-actions[bot]

Superseded by #5945

CiaranMn avatar Dec 18 '24 09:12 CiaranMn

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 14.x releases. But if you manually upgrade to 14.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

hash-worker[bot] avatar Dec 18 '24 09:12 hash-worker[bot]