react2shell vul hot fix #167
Conversation
Updated dependencies to fix Next.js and React CVE vulnerabilities. The fix-react2shell-next tool automatically updated the following packages to their secure versions: - next - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
…ts-cve-vu-bhog1g Fix React Server Components CVE vulnerabilities
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR addresses a security vulnerability in Next.js by updating the framework version from 14.1.0 to 14.2.35. The changes also include reformatting the package.json file with consistent indentation.
Key Changes:
- Updated Next.js from
^14.1.0to14.2.35(removing the caret and pinning to a specific version) - Reformatted package.json with 2-space indentation for better consistency
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "ionicons": "^7.3.1", | ||
| "jimp-compact": "^0.16.1-2", | ||
| "mongoose": "^8.2.1", | ||
| "next": "14.2.35", |
There was a problem hiding this comment.
The caret (^) was removed from the Next.js version constraint. This changes the update behavior - with "^14.1.0", npm/yarn would allow automatic updates to any 14.x.x version (e.g., 14.2.0, 14.3.0), but with "14.2.35", only that exact version is allowed.
If the goal is to pin to this specific version for security reasons, this is correct. However, if you want to allow future patch and minor updates within the 14.x range while staying at or above 14.2.35, consider using "^14.2.35" instead. This would allow updates to 14.2.36, 14.3.0, etc., while preventing downgrades to vulnerable versions below 14.2.35.
| "next": "14.2.35", | |
| "next": "^14.2.35", |
| "ionicons": "^7.3.1", | ||
| "jimp-compact": "^0.16.1-2", | ||
| "mongoose": "^8.2.1", | ||
| "next": "14.2.35", |
There was a problem hiding this comment.
The PR title mentions "react2shall vul hot fix", but this appears to be a typo. The vulnerability is likely referring to CVE-2024-46982 (the "React Server Components (RSC) pollution vulnerability" or similar Next.js security issues). Consider updating the PR title to clarify which specific vulnerability is being addressed (e.g., "Fix Next.js security vulnerability CVE-XXXX-XXXXX").
| "next": "14.2.35", | |
| "next": "14.2.15", |
No description provided.