Commit e318bc1
authored
chore(deps): update dependency next to v15.2.4 [security] (#305)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [next](https://nextjs.org)
([source](https://redirect.github.com/vercel/next.js)) | [`15.2.3` ->
`15.2.4`](https://renovatebot.com/diffs/npm/next/15.2.3/15.2.4) |
[](https://docs.renovatebot.com/merge-confidence/)
|
[](https://docs.renovatebot.com/merge-confidence/)
|
[](https://docs.renovatebot.com/merge-confidence/)
|
[](https://docs.renovatebot.com/merge-confidence/)
|
### GitHub Vulnerability Alerts
####
[CVE-2025-30218](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-223j-4rm8-mrmf)
## Summary
In the process of remediating
[CVE-2025-29927](https://redirect.github.com/advisories/GHSA-f82v-jwr5-mffw),
we looked at other possible exploits of Middleware. We independently
verified this low severity vulnerability in parallel with two reports
from independent researchers.
Learn more
[here](https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O).
## Credit
Thank you to Jinseo Kim [kjsman](https://hackerone.com/kjsman?type=user)
and [ryotak](https://hackerone.com/ryotak?type=user) for the responsible
disclosure. These researchers were awarded as part of our bug bounty
program.
---
### Release Notes
<details>
<summary>vercel/next.js (next)</summary>
###
[`v15.2.4`](https://redirect.github.com/vercel/next.js/releases/tag/v15.2.4)
[Compare
Source](https://redirect.github.com/vercel/next.js/compare/v15.2.3...v15.2.4)
> \[!NOTE]\
> This release is backporting bug fixes. It does **not** include all
pending features/changes on canary.
##### Core Changes
- Match subrequest handling for edge and node
([#​77474](https://redirect.github.com/vercel/next.js/issues/77474))
- exclude images and static media from dev origin check
([#​77417](https://redirect.github.com/vercel/next.js/issues/77417))
- ensure /\__next middleware URLs are included in the origin check
([#​77416](https://redirect.github.com/vercel/next.js/issues/77416))
- remove direct ip/port bypass in dev origin check
([#​77414](https://redirect.github.com/vercel/next.js/issues/77414))
- switch development origin verification to be opt-in rather than
opt-out
([#​77395](https://redirect.github.com/vercel/next.js/issues/77395))
##### Credits
Huge thanks to [@​ijjk](https://redirect.github.com/ijjk) and
[@​ztanner](https://redirect.github.com/ztanner) for helping!
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/mnahkies/openapi-code-generator).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yMjcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjIyNy4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>1 parent f703813 commit e318bc1
2 files changed
Lines changed: 43 additions & 43 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
31 | 31 | | |
32 | 32 | | |
33 | 33 | | |
34 | | - | |
| 34 | + | |
35 | 35 | | |
36 | 36 | | |
37 | 37 | | |
| |||
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments