Update patch dependencies (patch) #26
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
renovate
bot
force-pushed
the
renovate/patch-patch-dependencies
branch
from
30a9108
to
7c5270d
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/patch-patch-dependencies
branch
from
7c5270d
to
76111e9
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
This PR contains the following updates:
^3.5.8->^3.5.10^12.0.8->^12.0.10Release Notes
apollographql/apollo-client
v3.5.10Compare Source
Improvements
Add
GraphQLWsLinkin@apollo/client/link/subscriptions. This link is similar to the existingWebSocketLinkin@apollo/client/link/ws, but uses the newergraphql-wspackage and protocol instead of the oldersubscriptions-transport-wsimplementation.@glasser in #9369
v3.5.9Compare Source
Improvements
Interpret
keyFields: [...]andkeyArgs: [...]configurations inInMemoryCachetype/field policies asReadonlyArrays, since they are never mutated internally.@julienfouilhe in #9339
Avoid declaring a global type for the
__DEV__constant, to avoid conflict with other such global declarations.@benjamn in #9386
Bug Fixes
Fix
useSubscriptionexecutingskipped subscription when input changes.@levrik in #9299
Fix partial data appearing in
useQuery().datawhennotifyOnNetworkStatusChange: true.@brainkim in #9367
Prevent
Promises returned byuseLazyQueryexecute functions from causing unhandledPromiserejection errors if uncaught.@brainkim in #9380
vercel/next.js
v12.0.10Compare Source
Core Changes
compressconfigurable in standalone mode: #33717stale-while-revalidatepattern to Image Optimization API: #33735Documentation Changes
Example Changes
with-dockerexample dockerfile: #33695Misc Changes
lock.ymlCredits
Huge thanks to @Vienio99, @balazsorban44, @kyliau, @molebox, @huozhi, @shuding, @PepijnSenders, @krystofex, @PizzaPete, @souljuse, @styfle, @Schniz, @Nelsonfrank, @ijjk, @Mhmdrza, @timneutkens, @hideokamoto-stripe, @Emrin, @gr-qft, @delbaoliveira, @redbar0n, @amandeepmittal, @lxy-yz, and @Divlo for helping!
v12.0.9Compare Source
This upgrade is completely backward-compatible and recommended for all users on versions below 12.0.9
Vulnerable code could allow a bad actor to trigger a denial of service attack via the
/${locale}/_next/route for anyone running a Next.js app at version >= 12.0.0, and using built-in i18n routing functionality.How to Upgrade
npm install next@latest --saveImpact
v12.0.0andv12.0.9We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
How to Assess Impact
If your server has seen requests to any route under the prefix
/${locale}/_next/that have triggered a heap overflow error, this was caused by the patched issue.What is Being Done
As Next.js has grown in popularity and usage by enterprises, it has received the attention of security researchers and auditors. We are thankful to our users for their investigation and responsible disclosure of the original bug.
We've landed a patch that ensures this is handled properly so the requested route no longer crashes and triggers a heap overflow.
Regression tests for this attack were added to the i18n integration test suite
security@vercel.com. We are actively monitoring this mailbox.Core Changes
process.envto inferred usage: #33186postcss: #33142node-fetch: #33466onLoadingComplete(): #33474next-multilingualexample: #29386lazyRootoptional property tonext/imagecomponent : #33290Documentation Changes
next export+next/imageerror message: #33317onLoadgottcha note tonext/scriptdocs: #33097next/serverdocumentation forgeo: #33609next/imageusage withnext exportbased on feedback.: #33555headersconfig option description: #33484netlify-plugin-cache-nextjshas been deprecated: #33629Example Changes
Misc Changes
Credits
Huge thanks to @molebox, @Schniz, @sokra, @kachkaev, @shuding, @teleaziz, @OgbeniHMMD, @goncy, @balazsorban44, @MaedahBatool, @bennettdams, @kdy1, @huozhi, @hsynlms, @styfle, @ijjk, @callumgare, @jonrosner, @karaggeorge, @rpie3, @MartijnHols, @leerob, @bashunaimiroy, @NOCELL, @rishabhpoddar, @omariosouto, @hanneslund, @theMosaad, @javivelasco, @pierrenel, @lobsterkatie, @tharakabimal, @vvo, @saevarb, @lfades, @nbouvrette, @paulnbrd, @ecklf, @11koukou, @renbaoshuo, @chozzz, @tbezman, @karlhorky, @j-mendez, and @ffan0811 for helping!
Configuration
📅 Schedule: "before 7am on Tuesday,before 7am on Wednesday" in timezone Australia/Melbourne.
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by WhiteSource Renovate. View repository job log here.