chore(deps): update dependency next to v15.4.7 [security] #2293
Conversation
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @renovate-bot, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request performs a crucial update of the Next.js framework to its latest stable version within the v15 series. The primary purpose of this update is to incorporate important security patches and ensure the application benefits from the most recent bug fixes and performance improvements provided by the Next.js team.
Highlights
- Dependency Update: Updated the
nextdependency from version15.2.2to15.4.7. - Security Fixes: This update includes critical security fixes for Next.js, addressing vulnerabilities related to Image Optimization (CVE-2025-55173, CVE-2025-57752) and Middleware (CVE-2025-57822).
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request updates the next dependency to v15.4.7. While the diff shows an update from v15.2.2, other information in the PR suggests this might be a major upgrade from v14. In either case, this is a valuable update as it addresses several security vulnerabilities. If this is a major version upgrade, thorough testing is highly recommended to catch any potential breaking changes. My review includes a suggestion to also update the eslint-config-next package to maintain version consistency with next, which is important for ensuring the linter works correctly.
| "genkitx-ollama": "^0.9.0", | ||
| "google-auth-library": "^9.14.1", | ||
| "next": "15.2.2", | ||
| "next": "15.4.7", |
There was a problem hiding this comment.
It's great to see next being updated. To ensure compatibility and prevent potential linting issues, it's best practice to keep the eslint-config-next package version in sync with the next package version. Please consider updating eslint-config-next to 15.4.7 in your devDependencies as part of this change.
renovate-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
from
9fd5c82 to
2456940
Compare
renovate-bot
changed the title
renovate-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
7 times, most recently
from
b1c926b to
b570881
Compare
renovate-bot
force-pushed
the
renovate/npm-next-vulnerability
branch
from
b570881 to
5875248
Compare
2 participants
This PR contains the following updates:
15.2.2->15.4.715.2.4->15.4.7Warning
Some dependencies could not be looked up. Check the warning logs for more information.
GitHub Vulnerability Alerts
CVE-2025-55173
A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.
All users relying on
images.domainsorimages.remotePatternsare encouraged to upgrade and verify that external image sources are strictly validated.More details at Vercel Changelog
CVE-2025-57822
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into
NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the
next()function.More details at Vercel Changelog
CVE-2025-57752
A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as
CookieorAuthorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.
More details at Vercel Changelog
Release Notes
vercel/next.js (next)
v15.4.7Compare Source
v15.4.6Compare Source
Core Changes
_errorpage'sreq.urlcan be overwritten to dynamic param on minimal mode (#82347)?dplto fonts in/_next/static/media(#82384)Credits
Huge thanks to @devjiwonchoi, @ijjk, and @styfle for helping!
v15.4.5Compare Source
v15.4.4Compare Source
v15.4.3Compare Source
v15.4.2Compare Source
v15.4.1Compare Source
v15.4.0Compare Source
v15.3.5Compare Source
v15.3.4Compare Source
v15.3.3Compare Source
v15.3.2Compare Source
v15.3.1Compare Source
Core Changes
Credits
Huge thanks to @kdy1 and @styfle for helping!
v15.3.0Compare Source
Core Changes
<select>styling for consistency: #76973029e8bd6-20250306to0ca3deeb-20250311: #769890ca3deeb-20250311to6aa8254b-20250312: #77033sizesetting to preferences: #77027'seconds'cache life profile: #77084next info: #770596aa8254b-20250312to5398b711-20250314: #77129useLightningcssoption tostyled-jsxcorrectly: #77008useErrorOverlayReducer: #77205revalidate*: #76885revalidate*work when followed by a redirect in a route handler: #770905398b711-20250314toc69a5fc5-20250318: #77249"use cache"caches when Draft Mode is enabled: #77141c69a5fc5-20250318todb7dfe05-20250319: #77295db7dfe05-20250319to740a4f7a-20250325: #77507740a4f7a-20250325to313332d1-20250326: #77527expireTags/getExpirationunnecessarily: #77570NEXT_PRIVATE_DEBUG_CACHEenv variable for cache handler debug logs: #77585nodejsruntime in middleware: #77553"use cache"revalidation logic out of incremental cache: #77577313332d1-20250326to63779030-20250328: #77643isrFlushToDiskoption to prevent writing optimized images to cache: #70645nodejsruntime in middleware": #77690new URL()forimages.remotePatterns: #7769263779030-20250328to040f8286-20250402: #77742useLayoutEffectwarning if React 18 is used: #77737next start: #77714TurbopackInternalErrors occur: #77660sideEffectsmatching for non-relative globs: #77693issueCountfrom non-asyncerrorsarray: #77821refreshTagsandgetExpiration: #77779"use cache"wrapper: #77827searchParamsaccess in"use cache"triggers error when caught: #77838getSourceFileinstead offileExiststo check file existence: #77863040f8286-20250402to33661467-20250407: #77899next/*entrypoints: #77844Example Changes
canaryversion: #77754Misc Changes
charset=utf-8in data-url source maps: #77112react-refreshas a dependency of plugin: #77142swc_coretov16.6.0: #77155swc_coretov16.6.2: #77194.minify()of lightningcssStyleSheet: #77313swc_coreand userayoninstead ofchili: #77338copy_dirconcurrency to avoid running out of file descriptors: #77468swc_coretov16.10.0: #77489launch.jsonto improve debugging in VSCode: #76559bunand other package manager: #77633--js-buildas option instead of--no-js-build: #77686Metadata and OG imagespage: #74077Upgradepage: #77717ExamplestoGuides: #77722swc_coretov19.0.0: #77669Vcin a struct: #77756instrumentation-clientfollow up: #77752styled-components: #77736use serverand update examples: #77770use serverand update examples": #77771hygieneif mangling is disabled: #77815Deep Divesection placeholder: #77724await import("path")in static analysis: #77811import_mapoption ofswc_emotioncorrectly: #71776swc_coretov21.0.1: #77918Getting StartedSection: #77921Credits
Huge thanks to @raunofreiberg, @huozhi, @ijjk, @timneutkens, @gaojude, @leerob, @mezotv, @bgw, @samcx, @ztanner, @sokra, @mischnic, @wbinnssmith, @kdy1, @unstubbable, @ahabhgk, @ScriptedAlchemy, @SukkaW, @wyattjoh, @eps1lon, @Amirroid, @Netail, @lubieowoce, @gnoff, @jackwilson323, @acdlite, @sbougerel, @kevva, @kasperpeulen, @Cy-Tek, @dvoytenko, @husseinraoouf, @isBatak, @iamkd, @delbaoliveira, @jantimon, @padmaia, @Bernardoow, @styfle, @devjiwonchoi, @JamBalaya56562, and @Marukome0743 for helping!
v15.2.5Compare Source
Core Changes
Credits
Huge thanks to @huozhi, @gaojude and @kdy1 for helping!
v15.2.4Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.