Merge pull request #445 from frontegg/deps-security-bump

fix: bump dependencies and resolve security vulnerabilities

Author: dianaKhortiuk-frontegg

README.md

@@ -19,6 +19,7 @@ and integrate them into their SaaS portals in up to 5 lines of code.
   - [withSSRSession](#withssrsession)
   - [Next.js middlewares usage](#nextjs-middlewares-usage)
   - for more [visit](https://docs.frontegg.com/docs/self-service-introduction)
+- [Security](#security)
 
 ## Installation
 
@@ -384,4 +385,20 @@ export const config = {
 
 To easily clone frontegg app sample and deploy with Vercel click [here](https://vercel.com/new/clone?repository-url=https%3A%2F%2Fgithub.com%2Ffrontegg%2Ffrontegg-nextjs%2Ftree%2Fmaster%2Fdemos%2Fquick-starter-demo&env=FRONTEGG_BASE_URL,FRONTEGG_CLIENT_ID,FRONTEGG_ENCRYPTION_PASSWORD&envDescription=Used%20to%20connect%20to%20your%20frontegg%20account%20and%20encrypt%20the%20frontegg%20session%20cookie&envLink=https%3A%2F%2Fdocs.frontegg.com%2Fdocs%2Fnextjs-12-13-ssr-hosted-login%23step-4-setup-environment&project-name=my-frontegg-app&repository-name=my-frontegg-app&demo-title=Authentication&demo-description=Basic%20application%20with%20Frontegg%20authentication%20&demo-url=https%3A%2F%2Fmy-frontegg-app.vercel.app&demo-image=https%3A%2F%2Ffronteggprodeustorage.blob.core.windows.net%2Fpublic-vendor-assets%2F4f091b2c-5755-4145-a313-10d9a530276f%2Fassets%2Flogo-fa2b14b1-d07d-49fd-8c24-a51f5d92c4d7.png)
 
+## Security
+
+The `@frontegg/nextjs` SDK is actively maintained, and its dependencies are kept on current, patched versions. Patched versions of transitive dependencies are enforced through the `resolutions` field in the root `package.json`.
+
+To keep your application protected, always use the latest release:
+
+```bash
+yarn add @frontegg/nextjs@latest
+# or
+npm install @frontegg/nextjs@latest
+```
+
+### Reporting a vulnerability
+
+If you discover a security vulnerability in this SDK, please report it responsibly by emailing **security@frontegg.com**. Please do not open a public GitHub issue for security reports.
+
 

package.json

@@ -75,5 +75,10 @@
   "workspaces": [
     "packages/*"
   ],
+  "resolutions": {
+    "follow-redirects": "^1.16.0",
+    "cookie": "^0.7.0",
+    "@babel/runtime": "^7.26.10"
+  },
   "dependencies": {}
 }

packages/example-app-directory/package.json

@@ -14,8 +14,8 @@
     "@types/react": "^18",
     "@types/react-dom": "^18",
     "eslint": "^10.0.2",
-    "eslint-config-next": "14.2.0",
-    "next": "14.2.0",
+    "eslint-config-next": "14.2.35",
+    "next": "14.2.35",
     "react": "^18.3.0",
     "react-dom": "^18.3.0",
     "typescript": "5.9.3"

packages/example-pages/package.json

@@ -14,7 +14,7 @@
     "test:dev": "concurrently \"yarn test:dev-1\" \"yarn test:dev-2\" \"yarn test:dev-3\""
   },
   "dependencies": {
-    "next": "^14.2.0",
+    "next": "^14.2.35",
     "react": "^18.3.0",
     "react-dom": "^18.3.0"
   },
@@ -23,7 +23,7 @@
     "@types/react": "^18",
     "@types/react-dom": "^18",
     "eslint": "^10.0.2",
-    "eslint-config-next": "14.2.0",
+    "eslint-config-next": "14.2.35",
     "typescript": "5.9.3"
   },
   "browserslist": {

packages/example-ssg/package.json

@@ -10,14 +10,14 @@
     "lint": "next lint"
   },
   "dependencies": {
-    "next": "^14.2.0"
+    "next": "^14.2.35"
   },
   "devDependencies": {
     "@types/node": "^20",
     "@types/react": "^18",
     "@types/react-dom": "^18",
     "eslint": "^10.0.2",
-    "eslint-config-next": "14.2.0",
+    "eslint-config-next": "14.2.35",
     "typescript": "5.9.3"
   },
   "browserslist": {

scripts/build.js

@@ -77,8 +77,9 @@ async function run(argv) {
 
   try {
     const { stderr, stdout } = await exec(command, { env: { ...process.env, ...env } });
-    // Don't treat Node/babel deprecation warnings on stderr as failure
-    if (stderr && !/DeprecationWarning|url\.parse/.test(stderr)) {
+    // Don't treat Node/babel deprecation warnings or Browserslist data-age
+    // notices (e.g. "caniuse-lite is N months old") on stderr as failure
+    if (stderr && !/DeprecationWarning|url\.parse|Browserslist/.test(stderr)) {
       throw new Error(`'${command}' failed with \n${stderr}`);
     }
     if (verbose) {