[Snyk] Security upgrade next from 12.1.0 to 13.5.0

[Woodpile37]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • src/mono/sample/wasm/browser-nextjs/package.json
  • src/mono/sample/wasm/browser-nextjs/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	89/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00045, Social Trends: No, Days since published: 0, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 3.74, Score Version: V5	Resource Exhaustion SNYK-JS-NEXT-6032387	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: next

The new version differs by 250 commits.

• ffafad2 v13.5.0
• 4a589ed v13.4.20-canary.41
• deb81cf fix styled-jsx alias (Merging internal commits for release/5.0 dotnet/runtime#55581)
• 1a9b0f6 improve internal error logging (HTTP/3 GET Aborted stress scenario fix dotnet/runtime#55582)
• 0631549 Fix react packages are not bundled for metadata routes (Obsolete CryptoConfig.EncodeOID dotnet/runtime#55579)
• bad5365 Update supported config options for Turbopack (Allow specifying a context propagator on SocketsHttpHandler dotnet/runtime#55556)
• 8881c41 Fix useState function initialiser case for `optimize_server_react` transform (Test failure:Loader/classloader/generics/Instantiation/Positive/NestedBaseClass05/NestedBaseClass05.sh  dotnet/runtime#55551)
• 1025011 Add react-icons to optimizePackageImports (Enable Http2_MultipleConnectionsEnabled_ConnectionLimitNotReached_ConcurrentRequestsSuccessfullyHandled dotnet/runtime#55572)
• d5c35a1 chore: replace issue triaing actions with `nissuer` (Add support for logging with more than 6 arguments at runtime dotnet/runtime#55525)
• 33c561b Consolidate experimental React opt-in & add `ppr` flag (alloc-dealloc-mismatch (operator new vs free) on 0x603000596cb0 dotnet/runtime#55560)
• f630cb8 Add `mui-core` to the default `optimizePackageImports` list (Test failure:System.Security.Cryptography.X509Certificates.Tests.RevocationTests.TimeoutTests.RevocationCheckingDelayed dotnet/runtime#55554)
• caa9083 chore: Fix heading hierarchy in revalidateTag documentation (deploy nginx with .net core dotnet/runtime#55470)
• d01ab61 v13.4.20-canary.40
• 6123a97 Fix missing trace file and unhandledRejection in ensurePage (Test failure:JIT\\Directed\\nullabletypes\\Desktop\\boxunboxvaluetype_ro\\boxunboxvaluetype_ro.cmd dotnet/runtime#55553)
• b5beb3a Correct spelling in playwright docs (Regex.Match(string, int, int) throws an exception when using a pattern with '^' or '$' and the Multiline option dotnet/runtime#55557)
• 4c6d4b3 Type Error on Event Type payment_intent webhook (Do abortive connection shutdown in MsQuicConnection.Dispose dotnet/runtime#55493)
• 41c89f0 v13.4.20-canary.39
• 7fe01bb Disable client-only for middleware and pages api layer (Investigate improving perf of int16, int32, int64 parsing dotnet/runtime#55541)
• e4439b1 chore(third-parties): replace rimraf with rm.mjs (Test failure:SetOut.SetOutReadToEnd dotnet/runtime#55547)
• 1b8ce8f Add route groups example to revalidatePath doc (Disable GetHostEntry tests on SLES. dotnet/runtime#55543)
• 9697bcd Fix notFound status code with ISR in app (Adjust for functions renamed for OSSL3 beta1 dotnet/runtime#55542)
• 0338dcd fix next.js own build on windows ([QUIC] Certificate Validation with OpenSSL on Windows dotnet/runtime#55544)
• 4f98dc6 v13.4.20-canary.38
• 0ddb15b fix: run turbopack in forked process (Fix Tizen ARMEL Build Failure dotnet/runtime#55545)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Resource Exhaustion

[codeautopilot]

Pull Request Summary

Your organization has reached the subscribed usage limit. You can upgrade your plan at https://www.codeautopilot.com/#pricing

---

Current plan usage: 100.54%

---

Have feedback or need help?

Discord
Documentation
[email protected]

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7126b33

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Removed dependencies detected. Learn more about Socket for GitHub ↗︎

🚮 Removed packages: [email protected]