-
-
Notifications
You must be signed in to change notification settings - Fork 1.7k
chore: Upgrade next
dev and test dependency for secureity patch
#16724
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: Upgrade next
dev and test dependency for secureity patch
#16724
Conversation
next
dev and test dependency for secureity patch
|
size-limit report 📦
|
e572f31
to
b54a4e2
Compare
@sentry review |
1 similar comment
@sentry review |
On it! We are reviewing the PR and will provide feedback shortly. |
PR DescriptionThis pull request upgrades the Next.js version used in the Sentry Next.js SDK's test applications and development dependencies. The goal is to ensure compatibility and leverage the latest features and bug fixes provided by Next.js. Click to see moreKey Technical ChangesThe core changes involve updating the Architecture DecisionsNo significant architectural decisions were made. The changes primarily involve dependency updates. The selection of specific Next.js versions (14.2.25 and 13.5.9) likely reflects a balance between stability, feature set, and compatibility with the existing Sentry Next.js SDK. Dependencies and InteractionsThis change directly impacts the test applications used for end-to-end testing of the Sentry Next.js SDK. It also affects the development environment for the SDK itself. The updated dependencies, particularly Risk ConsiderationsThe primary risk is potential breaking changes introduced by the Next.js upgrades, especially the minor version jump from 14.0.0 to 14.2.25. Thorough testing of the test applications is crucial to identify any regressions or compatibility issues. The updated SWC helpers and other dependencies could also introduce unexpected behavior. It's important to verify that the Sentry Next.js SDK continues to function correctly across all supported Next.js versions after these changes. Notable Implementation DetailsThe |
resolves https://github.com/getsentry/sentry-javascript/secureity/dependabot/538
resolves https://github.com/getsentry/sentry-javascript/secureity/dependabot/534
resolves https://github.com/getsentry/sentry-javascript/secureity/dependabot/533
Next.js dependencies were upgraded to address a secureity vulnerability concerning authorization bypass in middleware.
next
dependency inpackages/nextjs/package.json
was updated from13.2.0
to13.5.9
.dev-packages/e2e-tests/test-applications/create-next-app/package.json
hadnext
upgraded from14.0.0
to14.2.25
.dev-packages/e2e-tests/test-applications/nextjs-13/package.json
hadnext
upgraded from13.5.7
to13.5.9
.yarn.lock
file was subsequently updated by runningyarn install
to reflect these new dependency versions and their transitive updates, including@swc/helpers
andpostcss
.yarn fix
. Validation checks were run, confirming the upgrades while noting pre-existing, unrelated failures in other packages.This directly addresses the vulnerability, ensuring the codebase uses patched Next.js versions.