chore(deps): update dependency next to v14.2.15 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next (source)	14.2.11 -> 14.2.15

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

GitHub Vulnerability Alerts

CVE-2024-51479

Impact

If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

Patches

This issue was patched in Next.js 14.2.15 and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.

---

Release Notes

vercel/next.js (next)

v14.2.15

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• support breadcrumb style catch-all parallel routes #​65063
• Provide non-dynamic segments to catch-all parallel routes #​65233
• Fix client reference access causing metadata missing #​70732
• feat(next/image): add support for decoding prop #​70298
• feat(next/image): add images.localPatterns config #​70529
• fix(next/image): handle undefined images.localPatterns config in images-manifest.json
• fix: Do not omit alt on getImgProps return type, ImgProps #​70608
• [i18n] Routing fix #​70761

Credits

Huge thanks to @​ztanner, @​agadzik, @​huozhi, @​styfle, @​icyJoseph and @​wyattjoh for helping!

v14.2.14

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix: clone response in first handler to prevent race (#​70082) (#​70649)
• Respect reexports from metadata API routes (#​70508) (#​70647)
• Externalize node binary modules for app router (#​70646)
• Fix revalidateTag() behaviour when invoked in server components (#​70446) (#​70642)
• Fix prefetch bailout detection for nested loading segments (#​70618)
• Add missing node modules to externals (#​70382)
• Feature: next/image: add support for images.remotePatterns.search (#​70302)

Credits

Huge thanks to @​styfle, @​ztanner, @​ijjk, @​huozhi and @​wyattjoh for helping!

v14.2.13

Compare Source

v14.2.12

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[code-review-assist]

Hi team,

I'm currently reviewing this pull request and will post my full review in a few minutes. In the meantime, here's a quick summary for you and other reviewers to get up to speed:

This pull request, submitted by renovate-bot, updates the next dependency from version 14.2.11 to 14.2.15. The primary reason for this update is to address a security vulnerability (CVE-2024-51479) that could allow authorization bypass in Next.js middleware under certain conditions. The update affects the package.json and package-lock.json files within the genkit/postcard-generator directory. The changes involve updating the version number and associated integrity checksums for next and related Next.js packages in the package-lock.json file. If your Next.js application is hosted on Vercel, this vulnerability has already been mitigated.

The changes are limited to updating version numbers and checksums in the project's dependency files. No functional code changes are included.

---

Here's a little haiku to brighten your day:

Update the Next.js,
Security patch applied now,
Code runs smoothly on.

Thanks,
Gemini

[code-review-assist]

This pull request updates the next dependency to version 14.2.15, which addresses a critical security vulnerability (CVE-2024-51479) that could allow authorization bypasses. The provided information in the description is comprehensive, detailing the impact, patches, workarounds, and release notes. This level of detail is commendable and makes it easy for reviewers and other developers to understand the importance and scope of the update. Given the security implications, thorough testing is highly recommended after merging this PR.

[mattsday]

LGTM