From 3507684b84ab408ad0a2aa71820bf8e76f9814e2 Mon Sep 17 00:00:00 2001 From: Vercel Date: Sat, 20 Dec 2025 14:26:39 +0000 Subject: [PATCH] Fix React Server Components CVE vulnerabilities Updated dependencies to fix Next.js and React CVE vulnerabilities. The fix-react2shell-next tool automatically updated the following packages to their secure versions: - next - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory. Co-authored-by: Vercel --- approval-tool/package.json | 2 +- approval-tool/pnpm-lock.yaml | 44 ++++++++++++++++++------------------ package.json | 2 +- pnpm-lock.yaml | 24 ++++++++++---------- 4 files changed, 36 insertions(+), 36 deletions(-) diff --git a/approval-tool/package.json b/approval-tool/package.json index 1fbd133..51899e3 100644 --- a/approval-tool/package.json +++ b/approval-tool/package.json @@ -29,7 +29,7 @@ "lucide-react": "^0.460.0", "mcp-handler": "^1.0.2", "nanoid": "^5.1.6", - "next": "15.5.7", + "next": "15.5.9", "next-intl": "^4.6.1", "postmark": "^4.0.5", "react": "19.1.0", diff --git a/approval-tool/pnpm-lock.yaml b/approval-tool/pnpm-lock.yaml index 29ebda6..c982b9f 100644 --- a/approval-tool/pnpm-lock.yaml +++ b/approval-tool/pnpm-lock.yaml @@ -43,7 +43,7 @@ importers: version: 11.8.0(@trpc/server@11.8.0(typescript@5.9.3))(typescript@5.9.3) '@trpc/next': specifier: ^11.8.0 - version: 11.8.0(@tanstack/react-query@5.90.12(react@19.1.0))(@trpc/client@11.8.0(@trpc/server@11.8.0(typescript@5.9.3))(typescript@5.9.3))(@trpc/react-query@11.8.0(@tanstack/react-query@5.90.12(react@19.1.0))(@trpc/client@11.8.0(@trpc/server@11.8.0(typescript@5.9.3))(typescript@5.9.3))(@trpc/server@11.8.0(typescript@5.9.3))(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(typescript@5.9.3))(@trpc/server@11.8.0(typescript@5.9.3))(next@15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(typescript@5.9.3) + version: 11.8.0(@tanstack/react-query@5.90.12(react@19.1.0))(@trpc/client@11.8.0(@trpc/server@11.8.0(typescript@5.9.3))(typescript@5.9.3))(@trpc/react-query@11.8.0(@tanstack/react-query@5.90.12(react@19.1.0))(@trpc/client@11.8.0(@trpc/server@11.8.0(typescript@5.9.3))(typescript@5.9.3))(@trpc/server@11.8.0(typescript@5.9.3))(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(typescript@5.9.3))(@trpc/server@11.8.0(typescript@5.9.3))(next@15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(typescript@5.9.3) '@trpc/react-query': specifier: ^11.8.0 version: 11.8.0(@tanstack/react-query@5.90.12(react@19.1.0))(@trpc/client@11.8.0(@trpc/server@11.8.0(typescript@5.9.3))(typescript@5.9.3))(@trpc/server@11.8.0(typescript@5.9.3))(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(typescript@5.9.3) @@ -52,7 +52,7 @@ importers: version: 11.8.0(typescript@5.9.3) better-auth: specifier: ^1.4.7 - version: 1.4.7(@prisma/client@6.19.1(prisma@6.19.1(typescript@5.9.3))(typescript@5.9.3))(next@15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(prisma@6.19.1(typescript@5.9.3))(react-dom@19.1.0(react@19.1.0))(react@19.1.0) + version: 1.4.7(@prisma/client@6.19.1(prisma@6.19.1(typescript@5.9.3))(typescript@5.9.3))(next@15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(prisma@6.19.1(typescript@5.9.3))(react-dom@19.1.0(react@19.1.0))(react@19.1.0) class-variance-authority: specifier: ^0.7.1 version: 0.7.1 @@ -67,16 +67,16 @@ importers: version: 0.460.0(react@19.1.0) mcp-handler: specifier: ^1.0.2 - version: 1.0.2(@modelcontextprotocol/sdk@1.20.0)(next@15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)) + version: 1.0.2(@modelcontextprotocol/sdk@1.20.0)(next@15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)) nanoid: specifier: ^5.1.6 version: 5.1.6 next: - specifier: 15.5.7 - version: 15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0) + specifier: 15.5.9 + version: 15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0) next-intl: specifier: ^4.6.1 - version: 4.6.1(next@15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(react@19.1.0)(typescript@5.9.3) + version: 4.6.1(next@15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(react@19.1.0)(typescript@5.9.3) postmark: specifier: ^4.0.5 version: 4.0.5 @@ -672,8 +672,8 @@ packages: '@next/env@15.1.2': resolution: {integrity: sha512-Hm3jIGsoUl6RLB1vzY+dZeqb+/kWPZ+h34yiWxW0dV87l8Im/eMOwpOA+a0L78U0HM04syEjXuRlCozqpwuojQ==} - '@next/env@15.5.7': - resolution: {integrity: sha512-4h6Y2NyEkIEN7Z8YxkA27pq6zTkS09bUSYC0xjd0NpwFxjnIKeZEeH591o5WECSmjpUhLn3H2QLJcDye3Uzcvg==} + '@next/env@15.5.9': + resolution: {integrity: sha512-4GlTZ+EJM7WaW2HEZcyU317tIQDjkQIyENDLxYJfSWlfqguN+dHkZgyQTV/7ykvobU7yEH5gKvreNrH4B6QgIg==} '@next/swc-darwin-arm64@15.1.2': resolution: {integrity: sha512-b9TN7q+j5/7+rGLhFAVZiKJGIASuo8tWvInGfAd8wsULjB1uNGRCj1z1WZwwPWzVQbIKWFYqc+9L7W09qwt52w==} @@ -2393,8 +2393,8 @@ packages: sass: optional: true - next@15.5.7: - resolution: {integrity: sha512-+t2/0jIJ48kUpGKkdlhgkv+zPTEOoXyr60qXe68eB/pl3CMJaLeIGjzp5D6Oqt25hCBiBTt8wEeeAzfJvUKnPQ==} + next@15.5.9: + resolution: {integrity: sha512-agNLK89seZEtC5zUHwtut0+tNrc0Xw4FT/Dg+B/VLEo9pAcS9rtTKpek3V6kVcVwsB2YlqMaHdfZL4eLEVYuCg==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -3378,7 +3378,7 @@ snapshots: '@next/env@15.1.2': {} - '@next/env@15.5.7': {} + '@next/env@15.5.9': {} '@next/swc-darwin-arm64@15.1.2': optional: true @@ -4087,11 +4087,11 @@ snapshots: '@trpc/server': 11.8.0(typescript@5.9.3) typescript: 5.9.3 - '@trpc/next@11.8.0(@tanstack/react-query@5.90.12(react@19.1.0))(@trpc/client@11.8.0(@trpc/server@11.8.0(typescript@5.9.3))(typescript@5.9.3))(@trpc/react-query@11.8.0(@tanstack/react-query@5.90.12(react@19.1.0))(@trpc/client@11.8.0(@trpc/server@11.8.0(typescript@5.9.3))(typescript@5.9.3))(@trpc/server@11.8.0(typescript@5.9.3))(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(typescript@5.9.3))(@trpc/server@11.8.0(typescript@5.9.3))(next@15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(typescript@5.9.3)': + '@trpc/next@11.8.0(@tanstack/react-query@5.90.12(react@19.1.0))(@trpc/client@11.8.0(@trpc/server@11.8.0(typescript@5.9.3))(typescript@5.9.3))(@trpc/react-query@11.8.0(@tanstack/react-query@5.90.12(react@19.1.0))(@trpc/client@11.8.0(@trpc/server@11.8.0(typescript@5.9.3))(typescript@5.9.3))(@trpc/server@11.8.0(typescript@5.9.3))(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(typescript@5.9.3))(@trpc/server@11.8.0(typescript@5.9.3))(next@15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(typescript@5.9.3)': dependencies: '@trpc/client': 11.8.0(@trpc/server@11.8.0(typescript@5.9.3))(typescript@5.9.3) '@trpc/server': 11.8.0(typescript@5.9.3) - next: 15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0) + next: 15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0) react: 19.1.0 react-dom: 19.1.0(react@19.1.0) typescript: 5.9.3 @@ -4177,7 +4177,7 @@ snapshots: baseline-browser-mapping@2.9.11: {} - better-auth@1.4.7(@prisma/client@6.19.1(prisma@6.19.1(typescript@5.9.3))(typescript@5.9.3))(next@15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(prisma@6.19.1(typescript@5.9.3))(react-dom@19.1.0(react@19.1.0))(react@19.1.0): + better-auth@1.4.7(@prisma/client@6.19.1(prisma@6.19.1(typescript@5.9.3))(typescript@5.9.3))(next@15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(prisma@6.19.1(typescript@5.9.3))(react-dom@19.1.0(react@19.1.0))(react@19.1.0): dependencies: '@better-auth/core': 1.4.7(@better-auth/utils@0.3.0)(@better-fetch/fetch@1.1.21)(better-call@1.1.5(zod@3.24.2))(jose@6.1.3)(kysely@0.28.9)(nanostores@1.1.0) '@better-auth/telemetry': 1.4.7(@better-auth/core@1.4.7(@better-auth/utils@0.3.0)(@better-fetch/fetch@1.1.21)(better-call@1.1.5(zod@3.24.2))(jose@6.1.3)(kysely@0.28.9)(nanostores@1.1.0)) @@ -4193,7 +4193,7 @@ snapshots: zod: 4.2.1 optionalDependencies: '@prisma/client': 6.19.1(prisma@6.19.1(typescript@5.9.3))(typescript@5.9.3) - next: 15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0) + next: 15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0) prisma: 6.19.1(typescript@5.9.3) react: 19.1.0 react-dom: 19.1.0(react@19.1.0) @@ -4790,14 +4790,14 @@ snapshots: math-intrinsics@1.1.0: {} - mcp-handler@1.0.2(@modelcontextprotocol/sdk@1.20.0)(next@15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)): + mcp-handler@1.0.2(@modelcontextprotocol/sdk@1.20.0)(next@15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0)): dependencies: '@modelcontextprotocol/sdk': 1.20.0 chalk: 5.6.2 commander: 11.1.0 redis: 4.7.1 optionalDependencies: - next: 15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0) + next: 15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0) media-typer@1.1.0: {} @@ -4846,13 +4846,13 @@ snapshots: next-intl-swc-plugin-extractor@4.6.1: {} - next-intl@4.6.1(next@15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(react@19.1.0)(typescript@5.9.3): + next-intl@4.6.1(next@15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(react@19.1.0)(typescript@5.9.3): dependencies: '@formatjs/intl-localematcher': 0.5.10 '@parcel/watcher': 2.5.1 '@swc/core': 1.15.7 negotiator: 1.0.0 - next: 15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0) + next: 15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0) next-intl-swc-plugin-extractor: 4.6.1 po-parser: 2.0.0 react: 19.1.0 @@ -4887,11 +4887,11 @@ snapshots: - '@babel/core' - babel-plugin-macros - next@15.5.7(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0): + next@15.5.9(@babel/core@7.24.5)(react-dom@19.1.0(react@19.1.0))(react@19.1.0): dependencies: - '@next/env': 15.5.7 + '@next/env': 15.5.9 '@swc/helpers': 0.5.15 - caniuse-lite: 1.0.30001749 + caniuse-lite: 1.0.30001761 postcss: 8.4.31 react: 19.1.0 react-dom: 19.1.0(react@19.1.0) diff --git a/package.json b/package.json index e203faf..ab940bb 100644 --- a/package.json +++ b/package.json @@ -10,7 +10,7 @@ "dependencies": { "@modelcontextprotocol/sdk": "^1.20.0", "mcp-handler": "^1.0.2", - "next": "15.5.7", + "next": "15.5.9", "react": "19.1.0", "react-dom": "19.1.0", "zod": "3.24.2" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b331c3e..8024fa8 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,10 +13,10 @@ importers: version: 1.20.0 mcp-handler: specifier: ^1.0.2 - version: 1.0.2(@modelcontextprotocol/sdk@1.20.0)(next@15.5.7(react-dom@19.1.0(react@19.1.0))(react@19.1.0)) + version: 1.0.2(@modelcontextprotocol/sdk@1.20.0)(next@15.5.9(react-dom@19.1.0(react@19.1.0))(react@19.1.0)) next: - specifier: 15.5.7 - version: 15.5.7(react-dom@19.1.0(react@19.1.0))(react@19.1.0) + specifier: 15.5.9 + version: 15.5.9(react-dom@19.1.0(react@19.1.0))(react@19.1.0) react: specifier: 19.1.0 version: 19.1.0 @@ -205,8 +205,8 @@ packages: resolution: {integrity: sha512-kOQ4+fHuT4KbR2iq2IjeV32HiihueuOf1vJkq18z08CLZ1UQrTc8BXJpVfxZkq45+inLLD+D4xx4nBjUelJa4Q==} engines: {node: '>=18'} - '@next/env@15.5.7': - resolution: {integrity: sha512-4h6Y2NyEkIEN7Z8YxkA27pq6zTkS09bUSYC0xjd0NpwFxjnIKeZEeH591o5WECSmjpUhLn3H2QLJcDye3Uzcvg==} + '@next/env@15.5.9': + resolution: {integrity: sha512-4GlTZ+EJM7WaW2HEZcyU317tIQDjkQIyENDLxYJfSWlfqguN+dHkZgyQTV/7ykvobU7yEH5gKvreNrH4B6QgIg==} '@next/swc-darwin-arm64@15.5.7': resolution: {integrity: sha512-IZwtxCEpI91HVU/rAUOOobWSZv4P2DeTtNaCdHqLcTJU4wdNXgAySvKa/qJCgR5m6KI8UsKDXtO2B31jcaw1Yw==} @@ -725,8 +725,8 @@ packages: resolution: {integrity: sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==} engines: {node: '>= 0.6'} - next@15.5.7: - resolution: {integrity: sha512-+t2/0jIJ48kUpGKkdlhgkv+zPTEOoXyr60qXe68eB/pl3CMJaLeIGjzp5D6Oqt25hCBiBTt8wEeeAzfJvUKnPQ==} + next@15.5.9: + resolution: {integrity: sha512-agNLK89seZEtC5zUHwtut0+tNrc0Xw4FT/Dg+B/VLEo9pAcS9rtTKpek3V6kVcVwsB2YlqMaHdfZL4eLEVYuCg==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -1103,7 +1103,7 @@ snapshots: transitivePeerDependencies: - supports-color - '@next/env@15.5.7': {} + '@next/env@15.5.9': {} '@next/swc-darwin-arm64@15.5.7': optional: true @@ -1523,14 +1523,14 @@ snapshots: math-intrinsics@1.1.0: {} - mcp-handler@1.0.2(@modelcontextprotocol/sdk@1.20.0)(next@15.5.7(react-dom@19.1.0(react@19.1.0))(react@19.1.0)): + mcp-handler@1.0.2(@modelcontextprotocol/sdk@1.20.0)(next@15.5.9(react-dom@19.1.0(react@19.1.0))(react@19.1.0)): dependencies: '@modelcontextprotocol/sdk': 1.20.0 chalk: 5.6.2 commander: 11.1.0 redis: 4.7.1 optionalDependencies: - next: 15.5.7(react-dom@19.1.0(react@19.1.0))(react@19.1.0) + next: 15.5.9(react-dom@19.1.0(react@19.1.0))(react@19.1.0) media-typer@1.1.0: {} @@ -1554,9 +1554,9 @@ snapshots: negotiator@1.0.0: {} - next@15.5.7(react-dom@19.1.0(react@19.1.0))(react@19.1.0): + next@15.5.9(react-dom@19.1.0(react@19.1.0))(react@19.1.0): dependencies: - '@next/env': 15.5.7 + '@next/env': 15.5.9 '@swc/helpers': 0.5.15 caniuse-lite: 1.0.30001749 postcss: 8.4.31