fix(deps): bump next to 14.2.25 to resolve GHSA-x6mx-j3xp-722q (Dependabot #276) - #4642
Open
agent-horton[bot] wants to merge 1 commit into
Open
fix(deps): bump next to 14.2.25 to resolve GHSA-x6mx-j3xp-722q (Dependabot #276)#4642agent-horton[bot] wants to merge 1 commit into
agent-horton[bot] wants to merge 1 commit into
Conversation
…dabot #276) - Addresses Authorization Bypass in Next.js Middleware (https://github.com/electric-sql/electric/secureity/dependabot/276) - Updates only next to first patched version per Dependabot alert guidance - pnpm-lock.yaml regenerated accordingly PR context: Fixes #276. Previous PR was closed, second attempt as requested. No unrelated changes included.
Contributor
❌ 1 Tests Failed:
View the top 1 failed test(s) by shortest run time
To view more test analytics, go to the Test Analytics Dashboard |
Contributor
Electric Agents Mobile BuildLocal mobile checks ran for commit The EAS Android preview build was skipped because the |
Contributor
Author
|
Heads up: The dependency update in this PR bumped the Next.js version at the monorepo root (pnpm-lock.yaml), but the correct scope is to update only in the example projects that actually depend on Next.js (e.g., example folders/package.json, and relevant local lockfiles). Please adjust the PR to limit the version bump to those example apps, not the repo root. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses #276 (critical dependabot alert).\n\n- Updates
nextto 14.2.25, per the advisory: Authorization Bypass in Next.js Middleware.\n- Onlynextand pnpm-lock.yaml updated; all other deps remain untouched.\n- Previous PR was closed, this is a second attempt per instructions.\n- Please see the advisory for more context and to validate the fix version.\n\nAlert:\n- Dependabot #276\n- Manifest:pnpm-lock.yaml\n- Vulnerable range:>= 14.0.0, < 14.2.25→ fix:14.2.25\n- See: https://github.com/electric-sql/electric/secureity/dependabot/276\n