[Snyk] Upgrade next from 9.3.2 to 9.3.3

[snyk-bot]

Snyk has created this PR to upgrade next from 9.3.2 to 9.3.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 2 versions ahead of your current version.
• The recommended version was released 23 days ago, on 2020-03-30.

Release notes

Package name: next

• 9.3.3 - 2020-03-30
  

  Patches

  • Revert "Fix assignment of props in WithApollo.getInitialProps " (#11384): #11236
  • Add support for comments in tsconfig.json: e7ea276
  • Docs: Replace micro-cors with cors middleware: #11395
  • Add support for comments in tsconfig.json: #11392
  • Fixed typo: libraray -> library: #11435
  • Minor change in README.md: #11434
  • Fix with-aphrodite readme typo: #11436
  • Update api-rest-example to SSG: #11362
  • Change mdx options description: #11409
  • Update .gitignore: #11421
  • Update emotion dependencies in with-emotion-11: #11414
  • Fix #11396: #11397
  • Fix type ignore: #11479
  • Typos fixed: overriden --> overridden and innaccurate -->inacc…: #11454
  • Fix small punctuation issue: #11439

  Credits

  Huge thanks to @bgoerdt, @herrstucki, @MichelleLucero, @liulanz, @sdhani, @JazibJafri, @ElForastero, @moeyashi, @Andarist, @comxd, @chislee0708, and @PullJosh for helping!

• 9.3.3-canary.0 - 2020-03-30
  

  Patches

  • Revert "Fix assignment of props in WithApollo.getInitialProps " (#11384): #11236
  • Add support for comments in tsconfig.json: e7ea276
  • Docs: Replace micro-cors with cors middleware: #11395
  • Add support for comments in tsconfig.json: #11392
  • Fixed typo: libraray -> library: #11435
  • Minor change in README.md: #11434
  • Fix with-aphrodite readme typo: #11436
  • Update api-rest-example to SSG: #11362
  • Change mdx options description: #11409
  • Update .gitignore: #11421
  • Update emotion dependencies in with-emotion-11: #11414
  • Fix #11396: #11397
  • Fix type ignore: #11479
  • Typos fixed: overriden --> overridden and innaccurate -->inacc…: #11454
  • Fix small punctuation issue: #11439
  • Merge branch 'canary' of github.com:zeit/next.js into canary: dd098ca

  Credits

  Huge thanks to @bgoerdt, @herrstucki, @MichelleLucero, @liulanz, @sdhani, @JazibJafri, @ElForastero, @moeyashi, @Andarist, @comxd, @chislee0708, and @PullJosh for helping!

• 9.3.2 - 2020-03-26
  

  This upgrade is completely backwards compatible and recommended for all users on versions below 9.3.2. For future security related communications of our OSS projects, please join this mailing list.

  Next.js has just been audited by one of the top security firms in the world.

  They found that attackers could craft special requests to access files in the dist directory (.next).

  This does not affect files outside of the dist directory (.next).

  In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory.

  We recommend upgrading to the latest version of Next.js to improve the overall security of your application.

  How to Upgrade

  • We have released patch versions for both the stable and canary channels of Next.js.
  • To upgrade run npm install next@latest --save

  Impact

  • Not affected: Deployments on ZEIT Now v2 (https://zeit.co) are not affected
  • Not affected: Deployments using the serverless target
  • Not affected: Deployments using next export
  • Affected: Users of Next.js below 9.3.2 that use next start

  We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

  How to Assess Impact

  If you think sensitive code or data could have been exposed, you can filter logs of affected sites by ../ with a 200 response.

  What is Being Done

  As Next.js has grown in popularity, it has received the attention of security researchers and auditors. We are thankful to Luca Carettoni from Doyensec for their investigation and discovery of the original bug and subsequent responsible disclosure.

  We've landed a patch that ensures only known filesystem paths of .next/static are made available under /_next/static.
  Regression tests for this attack were added to the security integration test suite.

  • We have notified known Next.js users in advance of this publication.
  • A public CVE was issued.
  • If you want to stay on top of our security related news impacting Next.js or other ZEIT projects, please join this mailing list.
  • We encourage responsible disclosure of future issues. Please email us at [email protected]. We are actively monitoring this mailbox.

  ---

  Patches

  • Add Numeric Separator Support for TypeScript: #11308
  • Update CLI custom config documentation link: #11152
  • Add error when attempting to export GSSP page: #11154
  • Update blog-starter example: #11071
  • Add CSS file to build output: #11145
  • Update <dir> reference in help text: 5274535
  • Clean up examples directory: #11169
  • Remove react-ssr-prepass alias as it's not longer needed: #11170
  • Upgrade @ampproject/toolbox-optimizer to 2.0.1: #11168
  • Add section on reading files: #11084
  • [Examples] fix remark link in blog-starter's README: #11177
  • Updated with-typescript example to SSG: #11081
  • Add CMS example for Sanity: #10907
  • Group CSS files in shared build output separate from JS files: #11184
  • Updating min nodejs requirement: #11181
  • Docs(ssr): req is an IncomingMessage instance, not HttpRequest: #11194
  • Add support for baseUrl option in tsconfig and jsconfig: #11203
  • [Example] with-passport: #10529
  • CMS TakeShape Example: #11038
  • Ensure hybrid AMP works correctly with SSG: #11205
  • Update mocha example with yml configuration.: #11214
  • Fix with-firebase-cloud-messaging example setup code: #10686
  • Update wording of new data fetching methods recommendation: #11221
  • Updated Api Routes Middleware example to use getServerSideProps: #11128
  • With Firebase Client-Side example: #11053
  • Docs(example): Load basic-css example on codesandbox: #11227
  • Remove mkdirp, bump fs-extra to 9.0.0: #11251
  • Add support for paths in tsconfig.json and jsconfig.json: #11293
  • Add test for single alias: #11296
  • Update GIP docs: #11303
  • Add custom amp optimizer and skip validation mode: #10705
  • Update handling for ENOENT from GSSP methods: #11302
  • Docs: clarify how to customize next/babel presets: #11316
  • Fix assignment of props in WithApollo.getInitialProps: #11236
  • Fix: typo in isStaging in with-env example: #11305
  • Skip paths that are routed to a .d.ts file: #11322
  • Upgrade loader-utils: #11324
  • Fix warning for API routes with next export: #11330
  • Make sure to copy AMP SSG files during export: #11331
  • Just a small typo I think, right?: #11344
  • [docs] Mention our channels: #11336
  • Use records to init store: #11343
  • Update data-fetching.md: 074c60e
  • Fix preview-mode docs/examples typo: #11345
  • Update to prevent re-using workers for getStaticPaths in dev mode: #11347

  Credits

  Huge thanks to @chibicode, @ijjk, @timneutkens, @sebastianbenz, @zhe, @shaswatsaxena, @prateekbh, @vvo, @lfades, @bbortt, @aviaryan, @mgranados, @julianbenegas, @gregrickaby, @dulmandakh, @yosuke-furukawa, @tinymachine, @bgoerdt, @nicolasrouanne, @filipesmedeiros, @rishabhsaxena, and @queq1890 for helping!

from next GitHub release notes

Commit messages

Package name: next

• b5d8660 v9.3.3
• ac223e2 v9.3.3-canary.0
• dd098ca Merge branch 'canary' of github.com:zeit/next.js into canary
• e4bf0d4 Fix small punctuation issue (#11439)
• a553768 Typos fixed: overriden --> overridden and innaccurate -->inacc… (#11454)
• d3d0b93 Fix type ignore (#11479)
• 6f27e21 Fix #11396 (#11397)
• fc94605 Update emotion dependencies in with-emotion-11 (#11414)
• 41764b2 Update .gitignore (#11421)
• 8d63330 Change mdx options description (#11409)
• 9e2ae69 Update api-rest-example to SSG (#11362)
• 48650a7 Fix with-aphrodite readme typo (#11436)
• 39a70d8 Minor change in README.md (#11434)
• 2b818a1 fixed typo: libraray -> library (#11435)
• 8fdc13a Add support for comments in tsconfig.json (#11392)
• a81d762 docs: Replace micro-cors with cors middleware (#11395)
• e7ea276 Add support for comments in tsconfig.json
• 44b4070 Revert "Fix assignment of props in WithApollo.getInitialProps (#11236)" (#11384)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs