From 5138efb96ae7586eb92426aa60a86f1f7cebb1b8 Mon Sep 17 00:00:00 2001 From: Vercel Date: Fri, 13 Feb 2026 18:33:52 +0000 Subject: [PATCH] Fix React Server Components CVE vulnerabilities Updated dependencies to fix Next.js and React CVE vulnerabilities. The fix-react2shell-next tool automatically updated the following packages to their secure versions: - next - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory. Co-authored-by: Vercel --- apps/app/package.json | 2 +- packages/auth/package.json | 2 +- packages/blocknote/package.json | 4 +- packages/lib/package.json | 2 +- pnpm-lock.yaml | 82 +++++++++++++++++---------------- 5 files changed, 47 insertions(+), 45 deletions(-) diff --git a/apps/app/package.json b/apps/app/package.json index 229863a2f..50fd50eb9 100644 --- a/apps/app/package.json +++ b/apps/app/package.json @@ -55,7 +55,7 @@ "lucide-react": "catalog:", "maplibre-gl": "^5.7.2", "motion": "catalog:", - "next": "catalog:", + "next": "15.5.8", "next-safe-action": "catalog:", "next-themes": "catalog:", "next-video": "^2.5.0", diff --git a/packages/auth/package.json b/packages/auth/package.json index d27af023a..a91283c62 100644 --- a/packages/auth/package.json +++ b/packages/auth/package.json @@ -9,7 +9,7 @@ "@t3-oss/env-nextjs": "catalog:", "bcryptjs": "catalog:", "jose": "catalog:", - "next": "catalog:", + "next": "15.5.8", "react": "catalog:", "react-dom": "catalog:", "zod": "catalog:" diff --git a/packages/blocknote/package.json b/packages/blocknote/package.json index 32f8ca2fc..7990a2005 100644 --- a/packages/blocknote/package.json +++ b/packages/blocknote/package.json @@ -20,7 +20,7 @@ "@mapform/ui": "workspace:*", "@tanstack/react-query": "catalog:", "lucide-react": "catalog:", - "next": "catalog:", + "next": "15.5.8", "zod": "catalog:" }, "devDependencies": { @@ -36,4 +36,4 @@ "tailwindcss": "catalog:", "typescript": "catalog:" } -} \ No newline at end of file +} diff --git a/packages/lib/package.json b/packages/lib/package.json index 280689b97..ec207cf5a 100644 --- a/packages/lib/package.json +++ b/packages/lib/package.json @@ -7,7 +7,7 @@ "clsx": "catalog:", "lodash-es": "catalog:", "lucide-react": "catalog:", - "next": "catalog:", + "next": "15.5.8", "stripe": "catalog:", "tailwind-merge": "catalog:", "zod": "catalog:" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 803a3d1d0..611d57484 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -270,9 +270,6 @@ catalogs: motion: specifier: 12.0.0-alpha.2 version: 12.0.0-alpha.2 - next: - specifier: 15.5.7 - version: 15.5.7 next-safe-action: specifier: ^7.10.4 version: 7.10.8 @@ -472,7 +469,7 @@ importers: version: 7.2.0 '@vercel/analytics': specifier: 'catalog:' - version: 1.4.1(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0) + version: 1.4.1(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0) '@vercel/blob': specifier: 'catalog:' version: 0.23.3 @@ -481,7 +478,7 @@ importers: version: 3.1.0(@aws-sdk/credential-provider-web-identity@3.782.0) '@vercel/speed-insights': specifier: 'catalog:' - version: 1.1.0(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0) + version: 1.1.0(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0) ai: specifier: 'catalog:' version: 5.0.56(zod@3.25.1) @@ -510,20 +507,20 @@ importers: specifier: 'catalog:' version: 12.0.0-alpha.2(react-dom@19.0.0(react@19.0.0))(react@19.0.0) next: - specifier: 'catalog:' - version: 15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + specifier: 15.5.8 + version: 15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) next-safe-action: specifier: 'catalog:' - version: 7.10.8(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react-dom@19.0.0(react@19.0.0))(react@19.0.0)(zod@3.25.1) + version: 7.10.8(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react-dom@19.0.0(react@19.0.0))(react@19.0.0)(zod@3.25.1) next-themes: specifier: 'catalog:' version: 0.3.0(react-dom@19.0.0(react@19.0.0))(react@19.0.0) next-video: specifier: ^2.5.0 - version: 2.5.0(@types/react-dom@19.0.2(@types/react@19.0.1))(@types/react@19.0.1)(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + version: 2.5.0(@types/react-dom@19.0.2(@types/react@19.0.1))(@types/react@19.0.1)(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react-dom@19.0.0(react@19.0.0))(react@19.0.0) nuqs: specifier: ^2.4.3 - version: 2.4.3(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0) + version: 2.4.3(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0) papaparse: specifier: 'catalog:' version: 5.4.1 @@ -637,8 +634,8 @@ importers: specifier: 'catalog:' version: 5.9.6 next: - specifier: 'catalog:' - version: 15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + specifier: 15.5.8 + version: 15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) react: specifier: 'catalog:' version: 19.0.0 @@ -711,10 +708,10 @@ importers: version: 5.0.56(zod@3.25.1) inngest: specifier: ^3.39.2 - version: 3.39.2(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(typescript@5.8.3) + version: 3.39.2(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(typescript@5.8.3) next-safe-action: specifier: 'catalog:' - version: 7.10.8(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react-dom@19.0.0(react@19.0.0))(react@19.0.0)(zod@3.25.1) + version: 7.10.8(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react-dom@19.0.0(react@19.0.0))(react@19.0.0)(zod@3.25.1) openai: specifier: ^5.7.0 version: 5.7.0(ws@8.18.0(bufferutil@4.0.8))(zod@3.25.1) @@ -792,8 +789,8 @@ importers: specifier: 'catalog:' version: 0.501.0(react@19.0.0) next: - specifier: 'catalog:' - version: 15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + specifier: 15.5.8 + version: 15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) zod: specifier: 'catalog:' version: 3.25.1 @@ -969,8 +966,8 @@ importers: specifier: 'catalog:' version: 0.501.0(react@19.0.0) next: - specifier: 'catalog:' - version: 15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + specifier: 15.5.8 + version: 15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) stripe: specifier: 'catalog:' version: 17.5.0 @@ -2820,8 +2817,8 @@ packages: '@next/env@15.5.3': resolution: {integrity: sha512-RSEDTRqyihYXygx/OJXwvVupfr9m04+0vH8vyy0HfZ7keRto6VX9BbEk0J2PUk0VGy6YhklJUSrgForov5F9pw==} - '@next/env@15.5.7': - resolution: {integrity: sha512-4h6Y2NyEkIEN7Z8YxkA27pq6zTkS09bUSYC0xjd0NpwFxjnIKeZEeH591o5WECSmjpUhLn3H2QLJcDye3Uzcvg==} + '@next/env@15.5.8': + resolution: {integrity: sha512-ejZHa3ogTxcy851dFoNtfB5B2h7AbSAtHbR5CymUlnz4yW1QjHNufVpvTu8PTnWBKFKjrd4k6Gbi2SsCiJKvxw==} '@next/eslint-plugin-next@15.0.3': resolution: {integrity: sha512-3Ln/nHq2V+v8uIaxCR6YfYo7ceRgZNXfTd3yW1ukTaFbO+/I8jNakrjYWODvG9BuR2v5kgVtH/C8r0i11quOgw==} @@ -7293,11 +7290,13 @@ packages: glob@10.3.10: resolution: {integrity: sha512-fa46+tv1Ak0UPK1TOy/pZrIybNNt4HCv7SDzwyfiOZkvZLEbjsZkJBPtDHVshZjbecAoAGSC20MjLDG/qr679g==} engines: {node: '>=16 || 14 >=14.17'} + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me hasBin: true glob@10.3.4: resolution: {integrity: sha512-6LFElP3A+i/Q8XQKEvZjkEWEOTgAIALR9AO2rwT8bgPhDd1anmqDJDZ6lLddI4ehxxxR1S5RIqKe1uapMQfYaQ==} engines: {node: '>=16 || 14 >=14.17'} + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me hasBin: true global-directory@4.0.1: @@ -8453,6 +8452,7 @@ packages: next@14.2.10: resolution: {integrity: sha512-sDDExXnh33cY3RkS9JuFEKaS4HmlWmDKP1VJioucCG6z5KuA008DPsDZOzi8UfqEk3Ii+2NCQSJrfbEWtZZfww==} engines: {node: '>=18.17.0'} + deprecated: This version has a security vulnerability. Please upgrade to a patched version. See https://nextjs.org/blog/security-update-2025-12-11 for more details. hasBin: true peerDependencies: '@opentelemetry/api': ^1.1.0 @@ -8468,9 +8468,10 @@ packages: sass: optional: true - next@15.5.7: - resolution: {integrity: sha512-+t2/0jIJ48kUpGKkdlhgkv+zPTEOoXyr60qXe68eB/pl3CMJaLeIGjzp5D6Oqt25hCBiBTt8wEeeAzfJvUKnPQ==} + next@15.5.8: + resolution: {integrity: sha512-Tma2R50eiM7Fx6fbDeHiThq7sPgl06mBr76j6Ga0lMFGrmaLitFsy31kykgb8Z++DR2uIEKi2RZ0iyjIwFd15Q==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} + deprecated: This version has a security vulnerability. Please upgrade to a patched version. See https://nextjs.org/blog/security-update-2025-12-11 for more details. hasBin: true peerDependencies: '@opentelemetry/api': ^1.1.0 @@ -10495,6 +10496,7 @@ packages: whatwg-encoding@3.1.1: resolution: {integrity: sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==} engines: {node: '>=18'} + deprecated: Use @exodus/bytes instead for a more spec-conformant and faster implementation whatwg-fetch@3.6.20: resolution: {integrity: sha512-EqhiFU6daOA8kpjOWTL0olhVOF3i7OrFzSYiGsEMB8GcXS+RrzauAERX65xMeNWVqxA6HXH2m69Z9LaKKdisfg==} @@ -11471,7 +11473,7 @@ snapshots: '@commitlint/is-ignored@19.8.1': dependencies: '@commitlint/types': 19.8.1 - semver: 7.6.3 + semver: 7.7.2 '@commitlint/lint@19.8.1': dependencies: @@ -12442,7 +12444,7 @@ snapshots: '@next/env@15.5.3': {} - '@next/env@15.5.7': {} + '@next/env@15.5.8': {} '@next/eslint-plugin-next@15.0.3': dependencies: @@ -12889,7 +12891,7 @@ snapshots: '@opentelemetry/instrumentation': 0.57.2(@opentelemetry/api@1.9.0) '@opentelemetry/semantic-conventions': 1.28.0 forwarded-parse: 2.1.2 - semver: 7.6.3 + semver: 7.7.2 transitivePeerDependencies: - supports-color @@ -15666,9 +15668,9 @@ snapshots: '@ungap/structured-clone@1.2.0': {} - '@vercel/analytics@1.4.1(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0)': + '@vercel/analytics@1.4.1(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0)': optionalDependencies: - next: 15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + next: 15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) react: 19.0.0 '@vercel/blob@0.23.3': @@ -15699,9 +15701,9 @@ snapshots: '@types/ms': 2.1.0 ms: 2.1.3 - '@vercel/speed-insights@1.1.0(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0)': + '@vercel/speed-insights@1.1.0(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0)': optionalDependencies: - next: 15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + next: 15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) react: 19.0.0 '@vis.gl/react-mapbox@8.0.4(react-dom@19.0.0(react@19.0.0))(react@19.0.0)': @@ -16316,7 +16318,7 @@ snapshots: conventional-commits-filter: 5.0.0 handlebars: 4.7.8 meow: 13.2.0 - semver: 7.6.3 + semver: 7.7.2 conventional-commits-filter@5.0.0: {} @@ -17692,7 +17694,7 @@ snapshots: inline-style-parser@0.2.4: {} - inngest@3.39.2(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(typescript@5.8.3): + inngest@3.39.2(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(typescript@5.8.3): dependencies: '@bufbuild/protobuf': 2.5.2 '@inngest/ai': 0.1.4 @@ -17717,7 +17719,7 @@ snapshots: temporal-polyfill: 0.2.5 zod: 3.22.5 optionalDependencies: - next: 15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + next: 15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) typescript: 5.8.3 transitivePeerDependencies: - encoding @@ -18710,9 +18712,9 @@ snapshots: nerf-dart@1.0.0: {} - next-safe-action@7.10.8(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react-dom@19.0.0(react@19.0.0))(react@19.0.0)(zod@3.25.1): + next-safe-action@7.10.8(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react-dom@19.0.0(react@19.0.0))(react@19.0.0)(zod@3.25.1): dependencies: - next: 15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + next: 15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) react: 19.0.0 react-dom: 19.0.0(react@19.0.0) optionalDependencies: @@ -18723,7 +18725,7 @@ snapshots: react: 19.0.0 react-dom: 19.0.0(react@19.0.0) - next-video@2.5.0(@types/react-dom@19.0.2(@types/react@19.0.1))(@types/react@19.0.1)(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react-dom@19.0.0(react@19.0.0))(react@19.0.0): + next-video@2.5.0(@types/react-dom@19.0.2(@types/react@19.0.1))(@types/react@19.0.1)(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react-dom@19.0.0(react@19.0.0))(react@19.0.0): dependencies: '@aws-sdk/client-s3': 3.782.0 '@inquirer/prompts': 4.3.3 @@ -18740,7 +18742,7 @@ snapshots: magicast: 0.3.5 media-chrome: 4.14.0(react@19.0.0) minimatch: 10.0.3 - next: 15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + next: 15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) player.style: 0.1.10(react@19.0.0) react: 19.0.0 react-dom: 19.0.0(react@19.0.0) @@ -18781,9 +18783,9 @@ snapshots: - '@babel/core' - babel-plugin-macros - next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0): + next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0): dependencies: - '@next/env': 15.5.7 + '@next/env': 15.5.8 '@swc/helpers': 0.5.15 caniuse-lite: 1.0.30001679 postcss: 8.4.31 @@ -18850,12 +18852,12 @@ snapshots: npm@10.9.3: {} - nuqs@2.4.3(next@15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0): + nuqs@2.4.3(next@15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0))(react@19.0.0): dependencies: mitt: 3.0.1 react: 19.0.0 optionalDependencies: - next: 15.5.7(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) + next: 15.5.8(@opentelemetry/api@1.9.0)(react-dom@19.0.0(react@19.0.0))(react@19.0.0) nwsapi@2.2.20: {}