[Snyk] Upgrade next from 9.3.1 to 9.3.2

[snyk-bot]

Snyk has created this PR to upgrade next from 9.3.1 to 9.3.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 11 versions ahead of your current version.
• The recommended version was released 23 days ago, on 2020-03-26.

The recommended version fixes:

Severity	Issue	Exploit Maturity
	Path Traversal SNYK-JS-NEXT-561584	No Known Exploit

Release notes

Package name: next

• 9.3.2 - 2020-03-26
  

  This upgrade is completely backwards compatible and recommended for all users on versions below 9.3.2. For future security related communications of our OSS projects, please join this mailing list.

  Next.js has just been audited by one of the top security firms in the world.

  They found that attackers could craft special requests to access files in the dist directory (.next).

  This does not affect files outside of the dist directory (.next).

  In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory.

  We recommend upgrading to the latest version of Next.js to improve the overall security of your application.

  How to Upgrade

  • We have released patch versions for both the stable and canary channels of Next.js.
  • To upgrade run npm install next@latest --save

  Impact

  • Not affected: Deployments on ZEIT Now v2 (https://zeit.co) are not affected
  • Not affected: Deployments using the serverless target
  • Not affected: Deployments using next export
  • Affected: Users of Next.js below 9.3.2 that use next start

  We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

  How to Assess Impact

  If you think sensitive code or data could have been exposed, you can filter logs of affected sites by ../ with a 200 response.

  What is Being Done

  As Next.js has grown in popularity, it has received the attention of security researchers and auditors. We are thankful to Luca Carettoni from Doyensec for their investigation and discovery of the original bug and subsequent responsible disclosure.

  We've landed a patch that ensures only known filesystem paths of .next/static are made available under /_next/static.
  Regression tests for this attack were added to the security integration test suite.

  • We have notified known Next.js users in advance of this publication.
  • A public CVE was issued.
  • If you want to stay on top of our security related news impacting Next.js or other ZEIT projects, please join this mailing list.
  • We encourage responsible disclosure of future issues. Please email us at [email protected]. We are actively monitoring this mailbox.

  ---

  Patches

  • Add Numeric Separator Support for TypeScript: #11308
  • Update CLI custom config documentation link: #11152
  • Add error when attempting to export GSSP page: #11154
  • Update blog-starter example: #11071
  • Add CSS file to build output: #11145
  • Update <dir> reference in help text: 5274535
  • Clean up examples directory: #11169
  • Remove react-ssr-prepass alias as it's not longer needed: #11170
  • Upgrade @ampproject/toolbox-optimizer to 2.0.1: #11168
  • Add section on reading files: #11084
  • [Examples] fix remark link in blog-starter's README: #11177
  • Updated with-typescript example to SSG: #11081
  • Add CMS example for Sanity: #10907
  • Group CSS files in shared build output separate from JS files: #11184
  • Updating min nodejs requirement: #11181
  • Docs(ssr): req is an IncomingMessage instance, not HttpRequest: #11194
  • Add support for baseUrl option in tsconfig and jsconfig: #11203
  • [Example] with-passport: #10529
  • CMS TakeShape Example: #11038
  • Ensure hybrid AMP works correctly with SSG: #11205
  • Update mocha example with yml configuration.: #11214
  • Fix with-firebase-cloud-messaging example setup code: #10686
  • Update wording of new data fetching methods recommendation: #11221
  • Updated Api Routes Middleware example to use getServerSideProps: #11128
  • With Firebase Client-Side example: #11053
  • Docs(example): Load basic-css example on codesandbox: #11227
  • Remove mkdirp, bump fs-extra to 9.0.0: #11251
  • Add support for paths in tsconfig.json and jsconfig.json: #11293
  • Add test for single alias: #11296
  • Update GIP docs: #11303
  • Add custom amp optimizer and skip validation mode: #10705
  • Update handling for ENOENT from GSSP methods: #11302
  • Docs: clarify how to customize next/babel presets: #11316
  • Fix assignment of props in WithApollo.getInitialProps: #11236
  • Fix: typo in isStaging in with-env example: #11305
  • Skip paths that are routed to a .d.ts file: #11322
  • Upgrade loader-utils: #11324
  • Fix warning for API routes with next export: #11330
  • Make sure to copy AMP SSG files during export: #11331
  • Just a small typo I think, right?: #11344
  • [docs] Mention our channels: #11336
  • Use records to init store: #11343
  • Update data-fetching.md: 074c60e
  • Fix preview-mode docs/examples typo: #11345
  • Update to prevent re-using workers for getStaticPaths in dev mode: #11347

  Credits

  Huge thanks to @chibicode, @ijjk, @timneutkens, @sebastianbenz, @zhe, @shaswatsaxena, @prateekbh, @vvo, @lfades, @bbortt, @aviaryan, @mgranados, @julianbenegas, @gregrickaby, @dulmandakh, @yosuke-furukawa, @tinymachine, @bgoerdt, @nicolasrouanne, @filipesmedeiros, @rishabhsaxena, and @queq1890 for helping!

• 9.3.2-canary.9 - 2020-03-26
  

  Patches

  • [Example] Use .jpg for images in blog-starter: #11176
  • Add with-redux-toolkit example: #11358

  Credits

  Huge thanks to @lfades and @JazibJafri for helping!

• 9.3.2-canary.8 - 2020-03-26
  

  Patches

  • Fix static/ file name encoding: #11373
• 9.3.2-canary.7 - 2020-03-26
  

  Patches

  • Update AMP docs: #11353
  • Add docs for multi zones: #11348
  • Add initial support for new env handling: #10525

  Credits

  Huge thanks to @lfades and @ijjk for helping!

• 9.3.2-canary.6 - 2020-03-25
  

  Patches

  • Make sure to copy AMP SSG files during export: #11331
  • Just a small typo I think, right?: #11344
  • [docs] Mention our channels: #11336
  • Use records to init store: #11343
  • Update data-fetching.md: 074c60e
  • Fix preview-mode docs/examples typo: #11345
  • Update to prevent re-using workers for getStaticPaths in dev mode: #11347

  Credits

  Huge thanks to @ijjk, @filipesmedeiros, @lfades, @rishabhsaxena, and @queq1890 for helping!

• 9.3.2-canary.5 - 2020-03-25
  

  Patches

  • Upgrade loader-utils: #11324
  • Fix warning for API routes with next export: #11330

  Credits

  Huge thanks to @timneutkens and @ijjk for helping!

• 9.3.2-canary.4 - 2020-03-24
  

  Patches

  • Update GIP docs: #11303
  • Add custom amp optimizer and skip validation mode: #10705
  • Update handling for ENOENT from GSSP methods: #11302
  • Docs: clarify how to customize next/babel presets: #11316
  • Fix assignment of props in WithApollo.getInitialProps: #11236
  • Fix: typo in isStaging in with-env example: #11305
  • Skip paths that are routed to a .d.ts file: #11322

  Credits

  Huge thanks to @lfades, @yosuke-furukawa, @ijjk, @tinymachine, @bgoerdt, and @nicolasrouanne for helping!

• 9.3.2-canary.3 - 2020-03-23
  

  Minor Changes

  • Add Numeric Separator Support for TypeScript: #11308

  Patches

  • Add test for single alias: #11296

  Credits

  Huge thanks to @timneutkens for helping!

• 9.3.2-canary.2 - 2020-03-23
  

  Patches

  • Updated Api Routes Middleware example to use getServerSideProps: #11128
  • With Firebase Client-Side example: #11053
  • Docs(example): Load basic-css example on codesandbox: #11227
  • Remove mkdirp, bump fs-extra to 9.0.0: #11251
  • Add support for paths in tsconfig.json and jsconfig.json: #11293

  Credits

  Huge thanks to @mgranados, @julianbenegas, @gregrickaby, @dulmandakh, and @timneutkens for helping!

• 9.3.2-canary.1 - 2020-03-20
  

  Patches

  • Updated with-typescript example to SSG: #11081
  • Add CMS example for Sanity: #10907
  • Group CSS files in shared build output separate from JS files: #11184
  • Updating min nodejs requirement: #11181
  • Docs(ssr): req is an IncomingMessage instance, not HttpRequest: #11194
  • Add support for baseUrl option in tsconfig and jsconfig: #11203
  • [Example] with-passport: #10529
  • CMS TakeShape Example: #11038
  • Ensure hybrid AMP works correctly with SSG: #11205
  • Update mocha example with yml configuration.: #11214
  • Fix with-firebase-cloud-messaging example setup code: #10686
  • Update wording of new data fetching methods recommendation: #11221

  Credits

  Huge thanks to @shaswatsaxena, @ijjk, @prateekbh, @vvo, @lfades, @chibicode, @bbortt, and @aviaryan for helping!

• 9.3.2-canary.0 - 2020-03-18
• 9.3.1 - 2020-03-17

from next GitHub release notes

Commit messages

Package name: next

• ee00813 v9.3.2
• dd4cee7 v9.3.2-canary.9
• e02b66a Add with-redux-toolkit example (#11358)
• 044ddf4 [Example] Use .jpg for images in blog-starter (#11176)
• ee249ee v9.3.2-canary.8
• 1d6ffc3 Fix `static/` file name encoding (#11373)
• e83cd4a v9.3.2-canary.7
• d8155b2 Add initial support for new env handling (#10525)
• a391d32 Add docs for multi zones (#11348)
• 4801dcd Update AMP docs (#11353)
• aac2e3e v9.3.2-canary.6
• 2ba6db6 Update to prevent re-using workers for getStaticPaths in dev mode (#11347)
• 67fd72b Fix preview-mode docs/examples typo (#11345)
• 074c60e Update data-fetching.md
• b46abed use records to init store (#11343)
• 523680c [docs] Mention our channels (#11336)
• a6ac0a5 Just a small typo I think, right? (#11344)
• 7738050 Make sure to copy AMP SSG files during export (#11331)
• e7842af v9.3.2-canary.5
• eeea53c Fix warning for API routes with next export (#11330)
• 876ae3f Upgrade loader-utils (#11324)
• 55186ca v9.3.2-canary.4
• 7774101 Skip paths that are routed to a .d.ts file (#11322)
• ed06434 fix: typo in `isStaging` in `with-env` example (#11305)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[pcraig3]

Closed since bb700df