🚨 [security] Update next 14.2.15 → 14.2.22 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ next (14.2.15 → 14.2.22) · Repo

Security Advisories 🚨

🚨 Next.js Allows a Denial of Service (DoS) with Server Actions

Impact

A Denial of Service (DoS) attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution.

Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.

Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing.

This is the same issue as if the incoming HTTP request has an invalid Content-Length header or never closes. If the host has no other mitigations to those then this vulnerability is novel.

This vulnerability affects only Next.js deployments using Server Actions.

Patches

This vulnerability was resolved in Next.js 14.2.21, 15.1.2, and 13.5.8. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

Thanks to the PackDraw team for responsibly disclosing this vulnerability.

Release Notes

14.2.22

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Retry manifest file loading only in dev mode: #73900
• Ensure workers are cleaned up: #71564
• Use shared worker for lint & typecheck steps: #74154

Credits

Huge thanks to @unstubbable, @ijjk, and @ztanner for helping!

14.2.21

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Upgrade React from 14898b6a9 to 178c267a4e: #74115
• Fix unstable_allowDynamic when used with pnpm: #73765

Misc Changes

• chore(docs): add missing search: '' on remotePatterns: #73927
• chore(docs): update version history of next/image: #73926

Credits

Huge thanks to @unstubbable, @ztanner, and @styfle for helping!

14.2.20

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix fetch cloning bug (#73532)

Credits

Huge thanks to @wyattjoh for helping!

14.2.18

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix: (third-parties) sendGTMEvent not queueing events before GTM init (#68683) (#72111)
• Ignore error pages for cache revalidate (#72412) (#72484)

Credits

Huge thanks to @huozhi and @ijjk for helping!

14.2.17

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix: revert the bad node binary handling (#72356)
• Ensure pages/500 handles cache-control as expected (#72050) (#72110)
• fix unhandled runtime error from generateMetadata in parallel routes (#72153)

Credits

Huge thanks to @huozhi, @ztanner, and @ijjk for helping!

Does any of this look wrong? Please let us know.

Sorry, we couldn't find anything useful about this release.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
aulianza-id	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 3, 2025 10:12pm