From 2308fd8659c6ef2507f75c8a4d83e7bc61441f7b Mon Sep 17 00:00:00 2001 From: Vercel Date: Fri, 12 Dec 2025 03:25:27 +0000 Subject: [PATCH] Fix React Server Components CVE vulnerabilities Updated dependencies to fix Next.js and React CVE vulnerabilities. The fix-react2shell-next tool automatically updated the following packages to their secure versions: - next - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory. Co-authored-by: Vercel --- package.json | 2 +- pnpm-lock.yaml | 85 +++++++++++++++++++++++++------------------------- 2 files changed, 44 insertions(+), 43 deletions(-) diff --git a/package.json b/package.json index fa39824..a2e5f2e 100644 --- a/package.json +++ b/package.json @@ -64,7 +64,7 @@ "jotai": "^2.12.5", "lucide-react": "^0.487.0", "motion": "^12.23.12", - "next": "15.3.6", + "next": "15.3.8", "next-themes": "^0.4.6", "react": "19.1.2", "react-day-picker": "^9.8.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f3faa0c..1cb1f06 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -131,7 +131,7 @@ importers: version: 8.21.3(react-dom@19.1.2(react@19.1.2))(react@19.1.2) '@vercel/analytics': specifier: ^1.5.0 - version: 1.5.0(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2) + version: 1.5.0(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2) class-variance-authority: specifier: ^0.7.1 version: 0.7.1 @@ -146,16 +146,16 @@ importers: version: 4.1.0 fumadocs-core: specifier: ^15.6.6 - version: 15.6.6(@types/react@19.1.2)(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2) + version: 15.6.6(@types/react@19.1.2)(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2) fumadocs-docgen: specifier: ^2.1.0 version: 2.1.0 fumadocs-mdx: specifier: ^11.7.1 - version: 11.7.1(acorn@8.14.1)(fumadocs-core@15.6.6(@types/react@19.1.2)(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2) + version: 11.7.1(acorn@8.15.0)(fumadocs-core@15.6.6(@types/react@19.1.2)(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2) fumadocs-ui: specifier: ^15.6.6 - version: 15.6.6(@types/react-dom@19.1.2(@types/react@19.1.2))(@types/react@19.1.2)(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2)(tailwindcss@4.1.3) + version: 15.6.6(@types/react-dom@19.1.2(@types/react@19.1.2))(@types/react@19.1.2)(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2)(tailwindcss@4.1.3) iron-session: specifier: ^8.0.4 version: 8.0.4 @@ -169,8 +169,8 @@ importers: specifier: ^12.23.12 version: 12.23.12(@emotion/is-prop-valid@1.2.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) next: - specifier: 15.3.6 - version: 15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) + specifier: 15.3.8 + version: 15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) next-themes: specifier: ^0.4.6 version: 0.4.6(react-dom@19.1.2(react@19.1.2))(react@19.1.2) @@ -501,9 +501,6 @@ packages: '@emnapi/core@1.4.5': resolution: {integrity: sha512-XsLw1dEOpkSX/WucdqUhPWP7hDxSvZiY+fsUC14h+FtQ2Ifni4znbBt8punRX+Uj2JG/uDb8nEHVKvrVlvdZ5Q==} - '@emnapi/runtime@1.4.0': - resolution: {integrity: sha512-64WYIf4UYcdLnbKn/umDlNjQDSS8AgZrI/R9+x5ilkUVFxXcA1Ebl+gQLc/6mERA4407Xof0R7wEyEuj091CVw==} - '@emnapi/runtime@1.4.5': resolution: {integrity: sha512-++LApOtY0pEEz1zrd9vy1/zXVaVJJ/EbAF3u0fXIzPJEDtnITsBGbbK0EkM72amhl/R5b+5xx0Y/QhcVOpuulg==} @@ -1160,8 +1157,8 @@ packages: '@napi-rs/wasm-runtime@0.2.8': resolution: {integrity: sha512-OBlgKdX7gin7OIq4fadsjpg+cp2ZphvAIKucHsNfTdJiqdOmOEwQd/bHi0VwNrcw5xpBJyUw6cK/QilCqy1BSg==} - '@next/env@15.3.6': - resolution: {integrity: sha512-/cK+QPcfRbDZxmI/uckT4lu9pHCfRIPBLqy88MhE+7Vg5hKrEYc333Ae76dn/cw2FBP2bR/GoK/4DU+U7by/Nw==} + '@next/env@15.3.8': + resolution: {integrity: sha512-SAfHg0g91MQVMPioeFeDjE+8UPF3j3BvHjs8ZKJAUz1BG7eMPvfCKOAgNWJ6s1MLNeP6O2InKQRTNblxPWuq+Q==} '@next/eslint-plugin-next@15.3.1': resolution: {integrity: sha512-oEs4dsfM6iyER3jTzMm4kDSbrQJq8wZw5fmT6fg2V3SMo+kgG+cShzLfEV20senZzv8VF+puNLheiGPlBGsv2A==} @@ -2819,6 +2816,7 @@ packages: '@walletconnect/ethereum-provider@2.21.1': resolution: {integrity: sha512-SSlIG6QEVxClgl1s0LMk4xr2wg4eT3Zn/Hb81IocyqNSGfXpjtawWxKxiC5/9Z95f1INyBD6MctJbL/R1oBwIw==} + deprecated: 'Reliability and performance improvements. See: https://github.com/WalletConnect/walletconnect-monorepo/releases' '@walletconnect/ethereum-provider@2.21.5': resolution: {integrity: sha512-ov1VyMINE9Gg9lk2LIXAhHOd6Nzd8q20QqGBs0JwjqqiP3pSoyxbmOI4fcddEGSnK4qwRQv1uU+aR0TXiiy5uA==} @@ -2867,9 +2865,11 @@ packages: '@walletconnect/sign-client@2.21.0': resolution: {integrity: sha512-z7h+PeLa5Au2R591d/8ZlziE0stJvdzP9jNFzFolf2RG/OiXulgFKum8PrIyXy+Rg2q95U9nRVUF9fWcn78yBA==} + deprecated: 'Reliability and performance improvements. See: https://github.com/WalletConnect/walletconnect-monorepo/releases' '@walletconnect/sign-client@2.21.1': resolution: {integrity: sha512-QaXzmPsMnKGV6tc4UcdnQVNOz4zyXgarvdIQibJ4L3EmLat73r5ZVl4c0cCOcoaV7rgM9Wbphgu5E/7jNcd3Zg==} + deprecated: 'Reliability and performance improvements. See: https://github.com/WalletConnect/walletconnect-monorepo/releases' '@walletconnect/sign-client@2.21.5': resolution: {integrity: sha512-IAs/IqmE1HVL9EsvqkNRU4NeAYe//h9NwqKi7ToKYZv4jhcC3BBemUD1r8iQJSTHMhO41EKn1G9/DiBln3ZiwQ==} @@ -2889,9 +2889,11 @@ packages: '@walletconnect/universal-provider@2.21.0': resolution: {integrity: sha512-mtUQvewt+X0VBQay/xOJBvxsB3Xsm1lTwFjZ6WUwSOTR1X+FNb71hSApnV5kbsdDIpYPXeQUbGt2se1n5E5UBg==} + deprecated: 'Reliability and performance improvements. See: https://github.com/WalletConnect/walletconnect-monorepo/releases' '@walletconnect/universal-provider@2.21.1': resolution: {integrity: sha512-Wjx9G8gUHVMnYfxtasC9poGm8QMiPCpXpbbLFT+iPoQskDDly8BwueWnqKs4Mx2SdIAWAwuXeZ5ojk5qQOxJJg==} + deprecated: 'Reliability and performance improvements. See: https://github.com/WalletConnect/walletconnect-monorepo/releases' '@walletconnect/universal-provider@2.21.5': resolution: {integrity: sha512-SMXGGXyj78c8Ru2f665ZFZU24phn0yZyCP5Ej7goxVQxABwqWKM/odj3j/IxZv+hxA8yU13yxaubgVefnereqw==} @@ -5303,8 +5305,8 @@ packages: react: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc react-dom: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc - next@15.3.6: - resolution: {integrity: sha512-oI6D1zbbsh6JzzZFDCSHnnx6Qpvd1fSkVJu/5d8uluqnxzuoqtodVZjYvNovooznUq8udSAiKp7MbwlfZ8Gm6w==} + next@15.3.8: + resolution: {integrity: sha512-L+4c5Hlr84fuaNADZbB9+ceRX9/CzwxJ+obXIGHupboB/Q1OLbSUapFs4bO8hnS/E6zV/JDX7sG1QpKVR2bguA==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -7400,11 +7402,6 @@ snapshots: tslib: 2.8.1 optional: true - '@emnapi/runtime@1.4.0': - dependencies: - tslib: 2.8.1 - optional: true - '@emnapi/runtime@1.4.5': dependencies: tslib: 2.8.1 @@ -7976,7 +7973,7 @@ snapshots: react: 19.1.2 react-dom: 19.1.2(react@19.1.2) - '@mdx-js/mdx@3.1.0(acorn@8.14.1)': + '@mdx-js/mdx@3.1.0(acorn@8.15.0)': dependencies: '@types/estree': 1.0.7 '@types/estree-jsx': 1.0.5 @@ -7990,7 +7987,7 @@ snapshots: hast-util-to-jsx-runtime: 2.3.6 markdown-extensions: 2.0.0 recma-build-jsx: 1.0.0 - recma-jsx: 1.0.1(acorn@8.14.1) + recma-jsx: 1.0.1(acorn@8.15.0) recma-stringify: 1.0.0 rehype-recma: 1.0.0 remark-mdx: 3.1.0 @@ -8171,7 +8168,7 @@ snapshots: '@types/debug': 4.1.12 debug: 4.4.0 pony-cause: 2.1.11 - semver: 7.7.1 + semver: 7.7.2 uuid: 9.0.1 transitivePeerDependencies: - supports-color @@ -8185,7 +8182,7 @@ snapshots: '@types/debug': 4.1.12 debug: 4.4.0 pony-cause: 2.1.11 - semver: 7.7.1 + semver: 7.7.2 uuid: 9.0.1 transitivePeerDependencies: - supports-color @@ -8228,11 +8225,11 @@ snapshots: '@napi-rs/wasm-runtime@0.2.8': dependencies: '@emnapi/core': 1.4.0 - '@emnapi/runtime': 1.4.0 + '@emnapi/runtime': 1.4.5 '@tybys/wasm-util': 0.9.0 optional: true - '@next/env@15.3.6': {} + '@next/env@15.3.8': {} '@next/eslint-plugin-next@15.3.1': dependencies: @@ -10327,7 +10324,7 @@ snapshots: fast-glob: 3.3.3 is-glob: 4.0.3 minimatch: 9.0.5 - semver: 7.7.1 + semver: 7.7.2 ts-api-utils: 2.1.0(typescript@5.8.3) typescript: 5.8.3 transitivePeerDependencies: @@ -10398,9 +10395,9 @@ snapshots: '@unrs/resolver-binding-win32-x64-msvc@1.4.1': optional: true - '@vercel/analytics@1.5.0(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2)': + '@vercel/analytics@1.5.0(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2)': optionalDependencies: - next: 15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) + next: 15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) react: 19.1.2 '@wagmi/connectors@5.9.0(@types/react@19.1.2)(@wagmi/core@2.18.0(@tanstack/query-core@5.83.0)(@types/react@19.1.2)(immer@10.1.1)(react@19.1.2)(typescript@5.8.3)(use-sync-external-store@1.4.0(react@19.1.2))(viem@2.33.1(bufferutil@4.0.9)(typescript@5.8.3)(utf-8-validate@5.0.10)(zod@3.24.3)))(bufferutil@4.0.9)(encoding@0.1.13)(immer@10.1.1)(react@19.1.2)(typescript@5.8.3)(use-sync-external-store@1.4.0(react@19.1.2))(utf-8-validate@5.0.10)(viem@2.33.1(bufferutil@4.0.9)(typescript@5.8.3)(utf-8-validate@5.0.10)(zod@3.24.3))(wagmi@2.16.0(@tanstack/query-core@5.83.0)(@tanstack/react-query@5.83.0(react@19.1.2))(@types/react@19.1.2)(bufferutil@4.0.9)(encoding@0.1.13)(immer@10.1.1)(react@19.1.2)(typescript@5.8.3)(utf-8-validate@5.0.10)(viem@2.33.1(bufferutil@4.0.9)(typescript@5.8.3)(utf-8-validate@5.0.10)(zod@3.24.3))(zod@3.24.3))(zod@3.24.3)': @@ -11343,6 +11340,10 @@ snapshots: dependencies: acorn: 8.14.1 + acorn-jsx@5.3.2(acorn@8.15.0): + dependencies: + acorn: 8.15.0 + acorn-walk@8.3.4: dependencies: acorn: 8.14.1 @@ -12672,7 +12673,7 @@ snapshots: extension-port-stream@3.0.0: dependencies: - readable-stream: 3.6.2 + readable-stream: 4.7.0 webextension-polyfill: 0.10.0 eyes@0.1.8: {} @@ -12812,7 +12813,7 @@ snapshots: fsevents@2.3.3: optional: true - fumadocs-core@15.6.6(@types/react@19.1.2)(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2): + fumadocs-core@15.6.6(@types/react@19.1.2)(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2): dependencies: '@formatjs/intl-localematcher': 0.6.1 '@orama/orama': 3.1.11 @@ -12833,7 +12834,7 @@ snapshots: unist-util-visit: 5.0.0 optionalDependencies: '@types/react': 19.1.2 - next: 15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) + next: 15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) react: 19.1.2 react-dom: 19.1.2(react@19.1.2) transitivePeerDependencies: @@ -12848,14 +12849,14 @@ snapshots: unist-util-visit: 5.0.0 zod: 3.25.76 - fumadocs-mdx@11.7.1(acorn@8.14.1)(fumadocs-core@15.6.6(@types/react@19.1.2)(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2): + fumadocs-mdx@11.7.1(acorn@8.15.0)(fumadocs-core@15.6.6(@types/react@19.1.2)(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2): dependencies: - '@mdx-js/mdx': 3.1.0(acorn@8.14.1) + '@mdx-js/mdx': 3.1.0(acorn@8.15.0) '@standard-schema/spec': 1.0.0 chokidar: 4.0.3 esbuild: 0.25.8 estree-util-value-to-estree: 3.4.0 - fumadocs-core: 15.6.6(@types/react@19.1.2)(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2) + fumadocs-core: 15.6.6(@types/react@19.1.2)(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2) js-yaml: 4.1.0 lru-cache: 11.1.0 picocolors: 1.1.1 @@ -12864,13 +12865,13 @@ snapshots: unist-util-visit: 5.0.0 zod: 4.0.13 optionalDependencies: - next: 15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) + next: 15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) react: 19.1.2 transitivePeerDependencies: - acorn - supports-color - fumadocs-ui@15.6.6(@types/react-dom@19.1.2(@types/react@19.1.2))(@types/react@19.1.2)(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2)(tailwindcss@4.1.3): + fumadocs-ui@15.6.6(@types/react-dom@19.1.2(@types/react@19.1.2))(@types/react@19.1.2)(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2)(tailwindcss@4.1.3): dependencies: '@radix-ui/react-accordion': 1.2.11(@types/react-dom@19.1.2(@types/react@19.1.2))(@types/react@19.1.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) '@radix-ui/react-collapsible': 1.1.11(@types/react-dom@19.1.2(@types/react@19.1.2))(@types/react@19.1.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) @@ -12883,7 +12884,7 @@ snapshots: '@radix-ui/react-slot': 1.2.3(@types/react@19.1.2)(react@19.1.2) '@radix-ui/react-tabs': 1.1.12(@types/react-dom@19.1.2(@types/react@19.1.2))(@types/react@19.1.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) class-variance-authority: 0.7.1 - fumadocs-core: 15.6.6(@types/react@19.1.2)(next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2) + fumadocs-core: 15.6.6(@types/react@19.1.2)(next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react-dom@19.1.2(react@19.1.2))(react@19.1.2) lodash.merge: 4.6.2 next-themes: 0.4.6(react-dom@19.1.2(react@19.1.2))(react@19.1.2) postcss-selector-parser: 7.1.0 @@ -12894,7 +12895,7 @@ snapshots: tailwind-merge: 3.3.1 optionalDependencies: '@types/react': 19.1.2 - next: 15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) + next: 15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2) tailwindcss: 4.1.3 transitivePeerDependencies: - '@mixedbread/sdk' @@ -14191,9 +14192,9 @@ snapshots: react: 19.1.2 react-dom: 19.1.2(react@19.1.2) - next@15.3.6(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2): + next@15.3.8(@babel/core@7.26.10)(react-dom@19.1.2(react@19.1.2))(react@19.1.2): dependencies: - '@next/env': 15.3.6 + '@next/env': 15.3.8 '@swc/counter': 0.1.3 '@swc/helpers': 0.5.15 busboy: 1.6.0 @@ -14853,10 +14854,10 @@ snapshots: estree-util-build-jsx: 3.0.1 vfile: 6.0.3 - recma-jsx@1.0.1(acorn@8.14.1): + recma-jsx@1.0.1(acorn@8.15.0): dependencies: - acorn: 8.14.1 - acorn-jsx: 5.3.2(acorn@8.14.1) + acorn: 8.15.0 + acorn-jsx: 5.3.2(acorn@8.15.0) estree-util-to-js: 2.0.0 recma-parse: 1.0.0 recma-stringify: 1.0.0