From 7800ce284e87244db4ef797379d3a5495da2a4f4 Mon Sep 17 00:00:00 2001 From: Chris Tate Date: Thu, 11 Dec 2025 17:24:29 -0600 Subject: [PATCH] fix: upgrade Next.js to 15.1.10 (CVE-2025-55182) This upgrade fixes CVE-2025-55182, a React Server Components RCE vulnerability. --- apps/web/package.json | 4 +- pnpm-lock.yaml | 94 +++++++++++++++++++++---------------------- 2 files changed, 49 insertions(+), 49 deletions(-) diff --git a/apps/web/package.json b/apps/web/package.json index eed961f73..680f27d25 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -32,7 +32,7 @@ "highlight.js": "^11.9.0", "lowlight": "^3.1.0", "lucide-react": "^0.358.0", - "next": "15.1.4", + "next": "15.1.10", "next-themes": "^0.2.1", "novel": "workspace:^", "openai": "^4.28.4", @@ -55,4 +55,4 @@ "tailwindcss": "^3.4.1", "tsconfig": "workspace:*" } -} \ No newline at end of file +} diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index dbcf84037..b8596964c 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -65,7 +65,7 @@ importers: version: 1.2.1 '@vercel/analytics': specifier: ^1.2.2 - version: 1.4.1(next@15.1.4(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react@18.2.0)(svelte@5.17.4)(vue@3.5.13(typescript@5.7.3)) + version: 1.4.1(next@15.1.10(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react@18.2.0)(svelte@5.17.4)(vue@3.5.13(typescript@5.7.3)) '@vercel/blob': specifier: ^0.22.1 version: 0.22.3 @@ -100,11 +100,11 @@ importers: specifier: ^0.358.0 version: 0.358.0(react@18.2.0) next: - specifier: 15.1.4 - version: 15.1.4(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) + specifier: 15.1.10 + version: 15.1.10(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) next-themes: specifier: ^0.2.1 - version: 0.2.1(next@15.1.4(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react-dom@18.2.0(react@18.2.0))(react@18.2.0) + version: 0.2.1(next@15.1.10(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react-dom@18.2.0(react@18.2.0))(react@18.2.0) novel: specifier: workspace:^ version: link:../../packages/headless @@ -902,53 +902,53 @@ packages: '@manypkg/get-packages@1.1.3': resolution: {integrity: sha512-fo+QhuU3qE/2TQMQmbVMqaQ6EWbMhi4ABWP+O4AM1NqPBuy0OrApV5LO6BrrgnhtAHS2NH6RrVk9OL181tTi8A==} - '@next/env@15.1.4': - resolution: {integrity: sha512-2fZ5YZjedi5AGaeoaC0B20zGntEHRhi2SdWcu61i48BllODcAmmtj8n7YarSPt4DaTsJaBFdxQAVEVzgmx2Zpw==} + '@next/env@15.1.10': + resolution: {integrity: sha512-FA4AHiPh0RzXfQn1C7mp6G8KqREgiy+6mE06McrzeT8w1nYvmbLsxBAPZAg8gqDAk4XZKHC7siAkQc2TDRJzfg==} - '@next/swc-darwin-arm64@15.1.4': - resolution: {integrity: sha512-wBEMBs+np+R5ozN1F8Y8d/Dycns2COhRnkxRc+rvnbXke5uZBHkUGFgWxfTXn5rx7OLijuUhyfB+gC/ap58dDw==} + '@next/swc-darwin-arm64@15.1.9': + resolution: {integrity: sha512-sQF6MfW4nk0PwMYYq8xNgqyxZJGIJV16QqNDgaZ5ze9YoVzm4/YNx17X0exZudayjL9PF0/5RGffDtzXapch0Q==} engines: {node: '>= 10'} cpu: [arm64] os: [darwin] - '@next/swc-darwin-x64@15.1.4': - resolution: {integrity: sha512-7sgf5rM7Z81V9w48F02Zz6DgEJulavC0jadab4ZsJ+K2sxMNK0/BtF8J8J3CxnsJN3DGcIdC260wEKssKTukUw==} + '@next/swc-darwin-x64@15.1.9': + resolution: {integrity: sha512-fp0c1rB6jZvdSDhprOur36xzQvqelAkNRXM/An92sKjjtaJxjlqJR8jiQLQImPsClIu8amQn+ZzFwl1lsEf62w==} engines: {node: '>= 10'} cpu: [x64] os: [darwin] - '@next/swc-linux-arm64-gnu@15.1.4': - resolution: {integrity: sha512-JaZlIMNaJenfd55kjaLWMfok+vWBlcRxqnRoZrhFQrhM1uAehP3R0+Aoe+bZOogqlZvAz53nY/k3ZyuKDtT2zQ==} + '@next/swc-linux-arm64-gnu@15.1.9': + resolution: {integrity: sha512-77rYykF6UtaXvxh9YyRIKoaYPI6/YX6cy8j1DL5/1XkjbfOwFDfTEhH7YGPqG/ePl+emBcbDYC2elgEqY2e+ag==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] - '@next/swc-linux-arm64-musl@15.1.4': - resolution: {integrity: sha512-7EBBjNoyTO2ipMDgCiORpwwOf5tIueFntKjcN3NK+GAQD7OzFJe84p7a2eQUeWdpzZvhVXuAtIen8QcH71ZCOQ==} + '@next/swc-linux-arm64-musl@15.1.9': + resolution: {integrity: sha512-uZ1HazKcyWC7RA6j+S/8aYgvxmDqwnG+gE5S9MhY7BTMj7ahXKunpKuX8/BA2M7OvINLv7LTzoobQbw928p3WA==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] - '@next/swc-linux-x64-gnu@15.1.4': - resolution: {integrity: sha512-9TGEgOycqZFuADyFqwmK/9g6S0FYZ3tphR4ebcmCwhL8Y12FW8pIBKJvSwV+UBjMkokstGNH+9F8F031JZKpHw==} + '@next/swc-linux-x64-gnu@15.1.9': + resolution: {integrity: sha512-gQIX1d3ct2RBlgbbWOrp+SHExmtmFm/HSW1Do5sSGMDyzbkYhS2sdq5LRDJWWsQu+/MqpgJHqJT6ORolKp/U1g==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - '@next/swc-linux-x64-musl@15.1.4': - resolution: {integrity: sha512-0578bLRVDJOh+LdIoKvgNDz77+Bd85c5JrFgnlbI1SM3WmEQvsjxTA8ATu9Z9FCiIS/AliVAW2DV/BDwpXbtiQ==} + '@next/swc-linux-x64-musl@15.1.9': + resolution: {integrity: sha512-fJOwxAbCeq6Vo7pXZGDP6iA4+yIBGshp7ie2Evvge7S7lywyg7b/SGqcvWq/jYcmd0EbXdb7hBfdqSQwTtGTPg==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - '@next/swc-win32-arm64-msvc@15.1.4': - resolution: {integrity: sha512-JgFCiV4libQavwII+kncMCl30st0JVxpPOtzWcAI2jtum4HjYaclobKhj+JsRu5tFqMtA5CJIa0MvYyuu9xjjQ==} + '@next/swc-win32-arm64-msvc@15.1.9': + resolution: {integrity: sha512-crfbUkAd9PVg9nGfyjSzQbz82dPvc4pb1TeP0ZaAdGzTH6OfTU9kxidpFIogw0DYIEadI7hRSvuihy2NezkaNQ==} engines: {node: '>= 10'} cpu: [arm64] os: [win32] - '@next/swc-win32-x64-msvc@15.1.4': - resolution: {integrity: sha512-xxsJy9wzq7FR5SqPCUqdgSXiNXrMuidgckBa8nH9HtjjxsilgcN6VgXF6tZ3uEWuVEadotQJI8/9EQ6guTC4Yw==} + '@next/swc-win32-x64-msvc@15.1.9': + resolution: {integrity: sha512-SBB0oA4E2a0axUrUwLqXlLkSn+bRx9OWU6LheqmRrO53QEAJP7JquKh3kF0jRzmlYOWFZtQwyIWJMEJMtvvDcQ==} engines: {node: '>= 10'} cpu: [x64] os: [win32] @@ -2746,8 +2746,8 @@ packages: react: '*' react-dom: '*' - next@15.1.4: - resolution: {integrity: sha512-mTaq9dwaSuwwOrcu3ebjDYObekkxRnXpuVL21zotM8qE2W0HBOdVIdg2Li9QjMEZrj73LN96LcWcz62V19FjAg==} + next@15.1.10: + resolution: {integrity: sha512-t+PruqHTsuSQZpl7H3hzxcJD5NR13JHfZU23z9QNEFC+g/z9QiAp52vykL5r1Tq3m0IrxnaXfjJSCMUAk6FDFQ==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -4300,30 +4300,30 @@ snapshots: globby: 11.1.0 read-yaml-file: 1.1.0 - '@next/env@15.1.4': {} + '@next/env@15.1.10': {} - '@next/swc-darwin-arm64@15.1.4': + '@next/swc-darwin-arm64@15.1.9': optional: true - '@next/swc-darwin-x64@15.1.4': + '@next/swc-darwin-x64@15.1.9': optional: true - '@next/swc-linux-arm64-gnu@15.1.4': + '@next/swc-linux-arm64-gnu@15.1.9': optional: true - '@next/swc-linux-arm64-musl@15.1.4': + '@next/swc-linux-arm64-musl@15.1.9': optional: true - '@next/swc-linux-x64-gnu@15.1.4': + '@next/swc-linux-x64-gnu@15.1.9': optional: true - '@next/swc-linux-x64-musl@15.1.4': + '@next/swc-linux-x64-musl@15.1.9': optional: true - '@next/swc-win32-arm64-msvc@15.1.4': + '@next/swc-win32-arm64-msvc@15.1.9': optional: true - '@next/swc-win32-x64-msvc@15.1.4': + '@next/swc-win32-x64-msvc@15.1.9': optional: true '@nodelib/fs.scandir@2.1.5': @@ -5168,9 +5168,9 @@ snapshots: dependencies: crypto-js: 4.2.0 - '@vercel/analytics@1.4.1(next@15.1.4(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react@18.2.0)(svelte@5.17.4)(vue@3.5.13(typescript@5.7.3))': + '@vercel/analytics@1.4.1(next@15.1.10(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react@18.2.0)(svelte@5.17.4)(vue@3.5.13(typescript@5.7.3))': optionalDependencies: - next: 15.1.4(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) + next: 15.1.10(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) react: 18.2.0 svelte: 5.17.4 vue: 3.5.13(typescript@5.7.3) @@ -6302,15 +6302,15 @@ snapshots: nanoid@3.3.8: {} - next-themes@0.2.1(next@15.1.4(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react-dom@18.2.0(react@18.2.0))(react@18.2.0): + next-themes@0.2.1(next@15.1.10(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react-dom@18.2.0(react@18.2.0))(react@18.2.0): dependencies: - next: 15.1.4(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) + next: 15.1.10(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) react: 18.2.0 react-dom: 18.2.0(react@18.2.0) - next@15.1.4(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0): + next@15.1.10(@opentelemetry/api@1.9.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0): dependencies: - '@next/env': 15.1.4 + '@next/env': 15.1.10 '@swc/counter': 0.1.3 '@swc/helpers': 0.5.15 busboy: 1.6.0 @@ -6320,14 +6320,14 @@ snapshots: react-dom: 18.2.0(react@18.2.0) styled-jsx: 5.1.6(react@18.2.0) optionalDependencies: - '@next/swc-darwin-arm64': 15.1.4 - '@next/swc-darwin-x64': 15.1.4 - '@next/swc-linux-arm64-gnu': 15.1.4 - '@next/swc-linux-arm64-musl': 15.1.4 - '@next/swc-linux-x64-gnu': 15.1.4 - '@next/swc-linux-x64-musl': 15.1.4 - '@next/swc-win32-arm64-msvc': 15.1.4 - '@next/swc-win32-x64-msvc': 15.1.4 + '@next/swc-darwin-arm64': 15.1.9 + '@next/swc-darwin-x64': 15.1.9 + '@next/swc-linux-arm64-gnu': 15.1.9 + '@next/swc-linux-arm64-musl': 15.1.9 + '@next/swc-linux-x64-gnu': 15.1.9 + '@next/swc-linux-x64-musl': 15.1.9 + '@next/swc-win32-arm64-msvc': 15.1.9 + '@next/swc-win32-x64-msvc': 15.1.9 '@opentelemetry/api': 1.9.0 sharp: 0.33.5 transitivePeerDependencies: