Skip to content

Commit 5f8ab7e

Browse files
dependabot[bot]joker23
dependabot[bot]
and
joker23
authored
chore(deps): bump the npm_and_yarn group across 2 directories with 1 update (#1829)
Bumps the npm_and_yarn group with 1 update in the /packages/sdk/vercel/examples/complete directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/sdk/vercel/examples/route-handler directory: [next](https://github.com/vercel/next.js). Updates `next` from 15.5.18 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.18...v15.5.21">compare view</a></li> </ul> </details> <br /> Updates `next` from 15.5.18 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.18...v15.5.21">compare view</a></li> </ul> </details> <br /> Updates `next` from 15.5.18 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.18...v15.5.21">compare view</a></li> </ul> </details> <br /> Updates `next` from 15.5.18 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.18...v15.5.21">compare view</a></li> </ul> </details> <br /> Updates `next` from 15.5.18 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.18...v15.5.21">compare view</a></li> </ul> </details> <br /> Updates `next` from 15.5.18 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.18...v15.5.21">compare view</a></li> </ul> </details> <br /> <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > Bumps the **`next`** dependency in three internal packages—no application source changes. > > The Vercel SDK examples **`complete`** and **`route-handler`** move from **15.5.18 → 15.5.21**, a patch release that backports **security fixes** (Server Actions DoS/SSRF, middleware bypass, rewrite SSRF, cache confusion, image optimization DoS, and related advisories). > > The React SDK **contract-tests** app moves from **16.2.11 → 16.2.12** on the Next 16 line. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit b2c8357. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: joker23 <2494686+joker23@users.noreply.github.com>
1 parent 09d3188 commit 5f8ab7e

3 files changed

Lines changed: 3 additions & 3 deletions

File tree

‎packages/sdk/react/contract-tests/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"dependencies": {
1414
"@launchdarkly/js-contract-test-utils": "workspace:^",
1515
"@launchdarkly/react-sdk": "workspace:^",
16-
"next": "16.2.11",
16+
"next": "16.2.12",
1717
"react": "19.2.3",
1818
"react-dom": "19.2.3"
1919
},

‎packages/sdk/vercel/examples/complete/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
"@vercel/edge-config": "^1.5.0",
1515
"launchdarkly-js-client-sdk": "^3.1.3",
1616
"launchdarkly-react-client-sdk": "^3.0.6",
17-
"next": "15.5.18",
17+
"next": "15.5.21",
1818
"react": "18.2.0",
1919
"react-dom": "18.2.0"
2020
},

‎packages/sdk/vercel/examples/route-handler/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
"dependencies": {
1212
"@launchdarkly/vercel-server-sdk": "workspace:^",
1313
"@vercel/edge-config": "^1.5.0",
14-
"next": "15.5.18",
14+
"next": "15.5.21",
1515
"react": "^18.2.0",
1616
"react-dom": "18.2.0"
1717
},

0 commit comments

Comments
 (0)