🚨 [security] Update next 12.0.5 → 16.2.11 (major) by depfu[bot] · Pull Request #299 · https-quantumblockchainai-atlassian-net/crystal-ai-nextjs-planetscale-starter

depfu · 2026-07-23T00:11:22Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ next (12.0.5 → 16.2.11) · Repo

Security Advisories 🚨

🚨 Next.js: Unauthenticated disclosure of internal Server Function endpoints

🚨 Next.js: Cache confusion of response bodies for requests with bodies

🚨 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

🚨 Next.js: Denial of Service in App Router using Server Actions

🚨 Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

🚨 Next.js: Denial of Service in the Image Optimization API using SVGs

🚨 Next.js: Unbounded Server Action payload in Edge runtime

🚨 Next.js: Server-Side Request Forgery in Server Actions on custom servers

🚨 Next.js: Cache confusion of response bodies for requests with bodies

🚨 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

🚨 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

🚨 Next.js: Server-Side Request Forgery in Server Actions on custom servers

🚨 Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

🚨 Next.js: Unbounded Server Action payload in Edge runtime

🚨 Next.js: Denial of Service in the Image Optimization API using SVGs

🚨 Next.js: Unauthenticated disclosure of internal Server Function endpoints

🚨 Next.js: Denial of Service in App Router using Server Actions

🚨 Next.js vulnerable to cache poisoning in React Server Component responses

🚨 Next.js vulnerable to cache poisoning in React Server Component responses

🚨 Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

🚨 Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

🚨 Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

🚨 Next.js has cross-site scripting in beforeInteractive scripts with untrusted input

🚨 Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

🚨 Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

🚨 Next.js Vulnerable to Denial of Service with Server Components

🚨 Next.js Vulnerable to Denial of Service with Server Components

🚨 Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

🚨 Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

🚨 Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces

🚨 Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces

🚨 Next.js's Middleware / Proxy redirects can be cache-poisoned

🚨 Next.js's Middleware / Proxy redirects can be cache-poisoned

🚨 Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

🚨 Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

🚨 Next.js has cross-site scripting in beforeInteractive scripts with untrusted input

🚨 Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components

🚨 Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components

🚨 Next.js has a Denial of Service in the Image Optimization API

🚨 Next.js has a Denial of Service in the Image Optimization API

🚨 Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

🚨 Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

🚨 Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

🚨 Next.js has a Denial of Service with Server Components

🚨 Next.js has a Denial of Service with Server Components

🚨 Next.js: HTTP request smuggling in rewrites

🚨 Next.js: Unbounded next/image disk cache growth can exhaust storage

🚨 Next.js: HTTP request smuggling in rewrites

🚨 Next.js: Unbounded next/image disk cache growth can exhaust storage

🚨 Next.js: Unbounded postponed resume buffering can lead to DoS

🚨 Next.js: null origin can bypass Server Actions CSRF checks

🚨 Next.js: null origin can bypass dev HMR websocket CSRF checks

🚨 Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

🚨 Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

🚨 Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

🚨 Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

🚨 Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

🚨 Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

🚨 Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

🚨 Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

🚨 Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

🚨 Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

🚨 Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

🚨 Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration

🚨 Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration

🚨 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

🚨 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

🚨 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

🚨 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

🚨 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

🚨 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

🚨 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

🚨 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

🚨 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

🚨 Next Vulnerable to Denial of Service with Server Components

🚨 Next Server Actions Source Code Exposure

🚨 Next Server Actions Source Code Exposure

🚨 Next Server Actions Source Code Exposure

🚨 Next Server Actions Source Code Exposure

🚨 Next Server Actions Source Code Exposure

🚨 Next Server Actions Source Code Exposure

🚨 Next Server Actions Source Code Exposure

🚨 Next Server Actions Source Code Exposure

🚨 Next Vulnerable to Denial of Service with Server Components

🚨 Next Vulnerable to Denial of Service with Server Components

🚨 Next Vulnerable to Denial of Service with Server Components

🚨 Next Vulnerable to Denial of Service with Server Components

🚨 Next Vulnerable to Denial of Service with Server Components

🚨 Next Vulnerable to Denial of Service with Server Components

🚨 Next Vulnerable to Denial of Service with Server Components

🚨 Next Vulnerable to Denial of Service with Server Components

🚨 Next.js is vulnerable to RCE in React flight protocol

🚨 Next.js is vulnerable to RCE in React flight protocol

🚨 Next.js is vulnerable to RCE in React flight protocol

🚨 Next.js is vulnerable to RCE in React flight protocol

🚨 Next.js is vulnerable to RCE in React flight protocol

🚨 Next.js is vulnerable to RCE in React flight protocol

🚨 Next.js is vulnerable to RCE in React flight protocol

🚨 Next.js Improper Middleware Redirect Handling Leads to SSRF

🚨 Next.js Improper Middleware Redirect Handling Leads to SSRF

🚨 Next.js Affected by Cache Key Confusion for Image Optimization API Routes

🚨 Next.js Content Injection Vulnerability for Image Optimization

🚨 Next.js Content Injection Vulnerability for Image Optimization

🚨 Next.JS vulnerability can lead to DoS via cache poisoning

🚨 Next.js has a Cache poisoning vulnerability due to omission of the Vary header

🚨 Information exposure in Next.js dev server due to lack of origin verification

🚨 Information exposure in Next.js dev server due to lack of origin verification

🚨 Next.js Race Condition to Cache Poisoning

🚨 Next.js Race Condition to Cache Poisoning

🚨 Next.js may leak x-middleware-subrequest-id to external hosts

🚨 Next.js may leak x-middleware-subrequest-id to external hosts

🚨 Next.js may leak x-middleware-subrequest-id to external hosts

🚨 Next.js may leak x-middleware-subrequest-id to external hosts

🚨 Authorization Bypass in Next.js Middleware

🚨 Authorization Bypass in Next.js Middleware

🚨 Authorization Bypass in Next.js Middleware

🚨 Authorization Bypass in Next.js Middleware

🚨 Next.js Allows a Denial of Service (DoS) with Server Actions

🚨 Next.js Allows a Denial of Service (DoS) with Server Actions

🚨 Next.js Allows a Denial of Service (DoS) with Server Actions

🚨 Next.js authorization bypass vulnerability

🚨 Denial of Service condition in Next.js image optimization

🚨 Next.js Cache Poisoning

🚨 Next.js Cache Poisoning

🚨 Next.js Denial of Service (DoS) condition

🚨 Next.js Vulnerable to HTTP Request Smuggling

🚨 Next.js Server-Side Request Forgery in Server Actions

🚨 Next.js missing cache-control header may lead to CDN caching empty reply

🚨 Unexpected server crash in Next.js

🚨 Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0

🚨 Denial of Service Vulnerability in next.js

Release Notes

Too many releases to show here. View the full release notes.

Sorry, we couldn't find anything useful about this release.

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

changeset-bot · 2026-07-23T00:11:27Z

⚠️ No Changeset found

Latest commit: 1de84e1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

guardrails · 2026-07-23T00:11:38Z

⚠️ We detected 47 security issues in this pull request:

Vulnerable Libraries (47)

Severity	Details
N/A	pkg:npm/ajv@6.12.6 (t) upgrade to: 8.18.0
N/A	pkg:npm/ajv@8.6.3 (t) upgrade to: 8.18.0
Medium	pkg:npm/brace-expansion@1.1.11 (t) upgrade to: 5.0.7,1.1.16,2.1.2
High	pkg:npm/braces@3.0.2 (t) upgrade to: 3.0.3
Medium	pkg:npm/cookiejar@2.1.3 (t) upgrade to: 2.1.4
High	pkg:npm/cross-spawn@6.0.5 (t) upgrade to: 7.0.5
High	pkg:npm/cross-spawn@7.0.3 (t) upgrade to: 7.0.5
High	pkg:npm/defu@5.0.0 (t) upgrade to: 6.1.5
N/A	pkg:npm/diff@4.0.2 (t) upgrade to: 8.0.3,5.2.2,4.0.4
Medium	pkg:npm/eslint@7.32.0 (t) upgrade to: 9.26.0
Critical	pkg:npm/flatted@3.2.2 (t) upgrade to: 3.4.2
High	pkg:npm/form-data@3.0.1 (t) upgrade to: 3.0.5,4.0.6,2.5.6
Critical	pkg:npm/formidable@1.2.2 (t) upgrade to: 3.2.4
Medium	pkg:npm/h3@0.2.12 (t) upgrade to: 2.0.1-rc.17,1.15.9
Critical	pkg:npm/ipx@0.7.2 (t) upgrade to: 2.1.1,3.1.1,1.3.2
Medium	pkg:npm/jose@4.1.4 (t) upgrade to: 4.15.5,2.0.7
High	pkg:npm/js-yaml@3.14.1 (t) upgrade to: 3.15.0,4.3.0
High	pkg:npm/json5@2.2.0 (t) upgrade to: 2.2.2
Medium	pkg:npm/lodash@4.17.21 (t) upgrade to: 4.18.0
Medium	pkg:npm/micromatch@4.0.4 (t) - no patch available
High	pkg:npm/minimatch@3.0.4 (t) upgrade to: 5.1.8,4.2.5,3.1.4,10.2.3,9.0.7,8.0.6,7.4.8,6.2.2
Critical	pkg:npm/minimist@1.2.5 (t) upgrade to: 1.2.6
N/A	pkg:npm/nanoid@3.1.30 (t) upgrade to: 5.0.9,3.3.8
N/A	pkg:npm/next-auth@4.0.0-beta.6 (t) upgrade to: 4.24.12,5.0.0-beta.30
High	pkg:npm/node-fetch@2.6.6 (t) upgrade to: 3.1.1,2.6.7
High	pkg:npm/node-forge@0.10.0 (t) upgrade to: 1.4.0
Medium	pkg:npm/picomatch@2.3.0 (t) upgrade to: 2.3.2,4.0.4,3.0.2
Medium	pkg:npm/postcss@8.4.31 (t) upgrade to: 8.5.10
Medium	pkg:npm/postcss@8.3.11 (t) upgrade to: 8.5.10
Low	pkg:npm/qs@6.10.1 (t) upgrade to: 6.14.2
Medium	pkg:npm/semver@5.7.1 (t) upgrade to: 7.5.2
Medium	pkg:npm/semver@6.3.0 (t) upgrade to: 7.5.2
Medium	pkg:npm/semver@7.3.5 (t) upgrade to: 7.5.2
Medium	pkg:npm/serialize-javascript@6.0.0 (t) upgrade to: 7.0.5
High	pkg:npm/sharp@0.28.3 (t) upgrade to: 0.32.6
N/A	pkg:npm/sharp@0.34.5 (t) upgrade to: 0.35.0
High	pkg:npm/simple-get@3.1.0 (t) upgrade to: 3.1.1,2.8.2,4.0.1
N/A	pkg:npm/tar-fs@2.1.1 (t) upgrade to: 3.0.9,1.16.5,2.1.3
High	pkg:npm/terser@5.9.0 (t) upgrade to: 4.8.1,5.14.2
High	pkg:npm/tmp@0.2.1 (t) upgrade to: 0.2.6
Medium	pkg:npm/tough-cookie@4.0.0 (t) upgrade to: 4.1.3
N/A	pkg:npm/uuid@8.3.2 (t) upgrade to: 14.0.0
Low	pkg:npm/webpack@5.62.1 (t) upgrade to: 5.104.0
Medium	pkg:npm/word-wrap@1.2.3 (t) - no patch available
High	pkg:npm/ws@7.5.5 (t) upgrade to: 8.17.1,5.2.4,6.2.3,7.5.10
Medium	pkg:npm/ws@8.2.3 (t) upgrade to: 8.20.1
Medium	pkg:npm/yaml@1.10.2 (t) upgrade to: 1.10.3,2.8.3

More info on how to fix Vulnerable Libraries in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

socket-security · 2026-07-23T00:11:45Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@12.0.5 ⏵ 16.2.11	^-3	⁺⁷⁵			^-30

View full report

socket-security · 2026-07-23T00:11:47Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: npm `caniuse-lite` under CC-BY-4.0 License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (npm metadata) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/package.json) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/LICENSE) From: yarn.lock → `npm/next@16.2.11` → `npm/caniuse-lite@1.0.30001806` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001806`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

mergify · 2026-07-23T00:12:12Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

Update all of nextjs to version 16.2.11

1de84e1

depfu Bot added the depfu label Jul 23, 2026

depfu Bot mentioned this pull request Jul 23, 2026

🚨 [security] Update next 12.0.5 → 16.2.6 (major) #286

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🚨 [security] Update next 12.0.5 → 16.2.11 (major) - #299

🚨 [security] Update next 12.0.5 → 16.2.11 (major)#299
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/yarn/next-16.2.11

depfu Bot commented Jul 23, 2026

Uh oh!

changeset-bot Bot commented Jul 23, 2026

Uh oh!

guardrails Bot commented Jul 23, 2026

Uh oh!

socket-security Bot commented Jul 23, 2026

Uh oh!

socket-security Bot commented Jul 23, 2026

Uh oh!

mergify Bot commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

depfu Bot commented Jul 23, 2026

What changed?

✳️ next (12.0.5 → 16.2.11) · Repo

Uh oh!

changeset-bot Bot commented Jul 23, 2026

⚠️ No Changeset found

Uh oh!

guardrails Bot commented Jul 23, 2026

Uh oh!

socket-security Bot commented Jul 23, 2026