This repository was archived by the owner on Dec 11, 2025. It is now read-only.
🚨 [security] [js] Update all of nextjs 15.1.3 → 15.3.2 (minor)#2220
Closed
depfu[bot] wants to merge 1 commit intomasterfrom
Closed
🚨 [security] [js] Update all of nextjs 15.1.3 → 15.3.2 (minor)#2220depfu[bot] wants to merge 1 commit intomasterfrom
depfu[bot] wants to merge 1 commit intomasterfrom
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #2220 +/- ##
=======================================
Coverage 85.70% 85.70%
=======================================
Files 91 91
Lines 3784 3784
Branches 1221 1221
=======================================
Hits 3243 3243
Misses 455 455
Partials 86 86 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ @next/eslint-plugin-next (15.1.3 → 15.3.2)
Sorry, we couldn't find anything useful about this release.
✳️ eslint-config-next (15.1.3 → 15.3.2)
Sorry, we couldn't find anything useful about this release.
✳️ next (15.1.3 → 15.3.2) · Repo
Security Advisories 🚨
🚨 Information exposure in Next.js dev server due to lack of origin verification
🚨 Next.js Race Condition to Cache Poisoning
🚨 Next.js may leak x-middleware-subrequest-id to external hosts
🚨 Authorization Bypass in Next.js Middleware
Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by 7 commits:
v15.3.2backport: fix(turbopack): Store persistence of wrapped task on RawVc::LocalOutput (#78488) (#78883)@next/mdx: Use stable turbopack config options (#78880)fix(react-compiler): Fix detection of interest (#78879)fix(turbopack): Backport sourcemap bugfix (#78881)[next-server] preserve rsc query for rsc redirects (#78876)Update middleware public/static matching (#78875)✳️ semver (7.6.3 → 7.7.2) · Repo · Changelog
Release Notes
7.7.2
7.7.1
7.7.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 20 commits:
chore: release 7.7.2 (#783)fix: add missing `'use strict'` directives (#780)chore: template-oss-apply for workflow permissions (#784)fix: prerelease identifier starting with digits (#781)chore: bump @npmcli/template-oss from 4.23.6 to 4.24.3 (#778)chore: bump @npmcli/template-oss from 4.23.4 to 4.23.6 (#760)chore: release 7.7.1 (#765)fix(inc): fully capture prerelease identifier (#764)chore: release 7.7.0 (#750)fix(diff): fix prerelease to stable version diff logic (#755)chore: bump @npmcli/template-oss from 4.23.3 to 4.23.4 (#747)fix: add identifier validation to `inc()` (#754)feat: add "release" inc type (#753)docs(readme): added missing period for consistency (#756)docs: clarify comment about obsolete prefixes (#749)chore: bump @npmcli/eslint-config from 4.0.5 to 5.0.0chore: postinstall for dependabot template-oss PRchore: bump @npmcli/template-oss from 4.23.1 to 4.23.3chore: bump @npmcli/template-oss from 4.22.0 to 4.23.1chore: bump @npmcli/template-oss from 4.22.0 to 4.23.1Release Notes
1.4.3
1.4.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 18 commits:
1.4.31.4.2fix: check SharedArrayBuffer (#144)1.4.1add checks for message channel usage in web runtime (#142)1.4.0perf: reduce the overhead of binding function call (#139)build: fix spawning `.bat` on Windowsupdate learn-wasm.dev linkadd learn-wasm.dev linktest: fix operator delete overloadrefactor: store external value in separated WeakMap (#134)test: build napi version 10define version 10 (#133)explicitly specify emnapiInit in testexplicitly specify emnapiInit in documentationremove deprecated attribute from napi_module_register (#132)allow napi_delete_reference in basic finalizers (#130)Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Sorry, we couldn't find anything useful about this release.
Sorry, we couldn't find anything useful about this release.
Sorry, we couldn't find anything useful about this release.
Sorry, we couldn't find anything useful about this release.
Sorry, we couldn't find anything useful about this release.
Sorry, we couldn't find anything useful about this release.
Sorry, we couldn't find anything useful about this release.
Sorry, we couldn't find anything useful about this release.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by 7 commits:
v15.3.2backport: fix(turbopack): Store persistence of wrapped task on RawVc::LocalOutput (#78488) (#78883)@next/mdx: Use stable turbopack config options (#78880)fix(react-compiler): Fix detection of interest (#78879)fix(turbopack): Backport sourcemap bugfix (#78881)[next-server] preserve rsc query for rsc redirects (#78876)Update middleware public/static matching (#78875)Commits
See the full diff on Github. The new version differs by more commits than we can show here.
🆕 @img/sharp-libvips-linux-ppc64 (added, 1.1.0)
🆕 @img/sharp-win32-arm64 (added, 0.34.2)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands