From 09cfefd3879d3eb69e884c201971a8932dc79f8b Mon Sep 17 00:00:00 2001 From: Vercel Date: Mon, 12 Jan 2026 13:46:11 +0000 Subject: [PATCH] Fix React Server Components CVE vulnerabilities Updated dependencies to fix Next.js and React CVE vulnerabilities. The fix-react2shell-next tool automatically updated the following packages to their secure versions: - next - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory. Co-authored-by: Vercel --- package.json | 2 +- pnpm-lock.yaml | 24 ++++++++++++------------ 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/package.json b/package.json index a37ae35..7538100 100644 --- a/package.json +++ b/package.json @@ -62,7 +62,7 @@ "input-otp": "^1.4.2", "lucide-react": "^0.469.0", "mipd": "^0.0.7", - "next": "15.5.7", + "next": "15.5.9", "next-auth": "^4.24.11", "next-themes": "^0.4.5", "ox": "^0.4.4", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3086ae5..b224ff1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -169,11 +169,11 @@ importers: specifier: ^0.0.7 version: 0.0.7(typescript@5.9.3) next: - specifier: 15.5.7 - version: 15.5.7(@babel/core@7.28.0)(react-dom@19.2.1(react@19.2.1))(react@19.2.1) + specifier: 15.5.9 + version: 15.5.9(@babel/core@7.28.0)(react-dom@19.2.1(react@19.2.1))(react@19.2.1) next-auth: specifier: ^4.24.11 - version: 4.24.13(next@15.5.7(@babel/core@7.28.0)(react-dom@19.2.1(react@19.2.1))(react@19.2.1))(react-dom@19.2.1(react@19.2.1))(react@19.2.1) + version: 4.24.13(next@15.5.9(@babel/core@7.28.0)(react-dom@19.2.1(react@19.2.1))(react@19.2.1))(react-dom@19.2.1(react@19.2.1))(react@19.2.1) next-themes: specifier: ^0.4.5 version: 0.4.6(react-dom@19.2.1(react@19.2.1))(react@19.2.1) @@ -1113,8 +1113,8 @@ packages: '@nestjs/websockets': optional: true - '@next/env@15.5.7': - resolution: {integrity: sha512-4h6Y2NyEkIEN7Z8YxkA27pq6zTkS09bUSYC0xjd0NpwFxjnIKeZEeH591o5WECSmjpUhLn3H2QLJcDye3Uzcvg==} + '@next/env@15.5.9': + resolution: {integrity: sha512-4GlTZ+EJM7WaW2HEZcyU317tIQDjkQIyENDLxYJfSWlfqguN+dHkZgyQTV/7ykvobU7yEH5gKvreNrH4B6QgIg==} '@next/eslint-plugin-next@15.0.3': resolution: {integrity: sha512-3Ln/nHq2V+v8uIaxCR6YfYo7ceRgZNXfTd3yW1ukTaFbO+/I8jNakrjYWODvG9BuR2v5kgVtH/C8r0i11quOgw==} @@ -5273,8 +5273,8 @@ packages: next-tick@1.1.0: resolution: {integrity: sha512-CXdUiJembsNjuToQvxayPZF9Vqht7hewsvy2sOWafLvi2awflj9mOC6bHIg50orX8IJvWKY9wYQ/zB2kogPslQ==} - next@15.5.7: - resolution: {integrity: sha512-+t2/0jIJ48kUpGKkdlhgkv+zPTEOoXyr60qXe68eB/pl3CMJaLeIGjzp5D6Oqt25hCBiBTt8wEeeAzfJvUKnPQ==} + next@15.5.9: + resolution: {integrity: sha512-agNLK89seZEtC5zUHwtut0+tNrc0Xw4FT/Dg+B/VLEo9pAcS9rtTKpek3V6kVcVwsB2YlqMaHdfZL4eLEVYuCg==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -8286,7 +8286,7 @@ snapshots: tslib: 2.8.1 uid: 2.0.2 - '@next/env@15.5.7': {} + '@next/env@15.5.9': {} '@next/eslint-plugin-next@15.0.3': dependencies: @@ -13873,13 +13873,13 @@ snapshots: netmask@2.0.2: {} - next-auth@4.24.13(next@15.5.7(@babel/core@7.28.0)(react-dom@19.2.1(react@19.2.1))(react@19.2.1))(react-dom@19.2.1(react@19.2.1))(react@19.2.1): + next-auth@4.24.13(next@15.5.9(@babel/core@7.28.0)(react-dom@19.2.1(react@19.2.1))(react@19.2.1))(react-dom@19.2.1(react@19.2.1))(react@19.2.1): dependencies: '@babel/runtime': 7.27.6 '@panva/hkdf': 1.2.1 cookie: 0.7.2 jose: 4.15.9 - next: 15.5.7(@babel/core@7.28.0)(react-dom@19.2.1(react@19.2.1))(react@19.2.1) + next: 15.5.9(@babel/core@7.28.0)(react-dom@19.2.1(react@19.2.1))(react@19.2.1) oauth: 0.9.15 openid-client: 5.7.1 preact: 10.26.9 @@ -13895,9 +13895,9 @@ snapshots: next-tick@1.1.0: {} - next@15.5.7(@babel/core@7.28.0)(react-dom@19.2.1(react@19.2.1))(react@19.2.1): + next@15.5.9(@babel/core@7.28.0)(react-dom@19.2.1(react@19.2.1))(react@19.2.1): dependencies: - '@next/env': 15.5.7 + '@next/env': 15.5.9 '@swc/helpers': 0.5.15 caniuse-lite: 1.0.30001759 postcss: 8.4.31