Update patch dependencies (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@apollo/client (source)	^3.5.8 -> ^3.5.10
next (source)	^12.0.8 -> ^12.0.10

---

Release Notes

apollographql/apollo-client

v3.5.10

Compare Source

Improvements

• Add GraphQLWsLink in @apollo/client/link/subscriptions. This link is similar to the existing WebSocketLink in @apollo/client/link/ws, but uses the newer graphql-ws package and protocol instead of the older subscriptions-transport-ws implementation.
  
  @​glasser in #​9369

  Note from @​benjamn: since GraphQLWsLink is new functionality, we would normally wait for the next minor version (v3.6), but we were asked to expedite this release. These changes are strictly additive/opt-in/backwards-compatible, so shipping them in a patch release (3.5.10) seems safe, if unusual.

v3.5.9

Compare Source

Improvements

• Interpret keyFields: [...] and keyArgs: [...] configurations in InMemoryCache type/field policies as ReadonlyArrays, since they are never mutated internally.
  
  @​julienfouilhe in #​9339

• Avoid declaring a global type for the __DEV__ constant, to avoid conflict with other such global declarations.
  
  @​benjamn in #​9386

Bug Fixes

• Fix useSubscription executing skipped subscription when input changes.
  
  @​levrik in #​9299

• Fix partial data appearing in useQuery().data when notifyOnNetworkStatusChange: true.
  
  @​brainkim in #​9367

• Prevent Promises returned by useLazyQuery execute functions from causing unhandled Promise rejection errors if uncaught.
  
  @​brainkim in #​9380

vercel/next.js

v12.0.10

Compare Source

Core Changes

• fix: image optimizer hangs when invalid image is requested: #​33719
• feat: make compress configurable in standalone mode: #​33717
• fix: allow certain variable names in development: #​33638
• Use swc parse for flight server and client loaders: #​33713
• Properly support custom 500 page in the web server: #​33729
• chore: deprecate process.browser: #​32862
• Improve tests for streaming and server components: #​33740
• fix: fixes #​33314 move is-plain-object for es5 compilation: #​33690
• Add stale-while-revalidate pattern to Image Optimization API: #​33735
• Allow to delete URL search params in middleware rewrites: #​33725
• Ensure all CSS files are included for experimental critical CSS: #​33752
• Ensure non-error thrown in getStaticPaths shows correctly: #​33753
• Fix encoding error with location and refresh headers: #​33763
• Fix duplicate image src causing canceled request: #​33776
• Generate functions manifest: #​33770
• Enable jest hoist transform when using next/jest: #​33731
• fix typo: #​33840
• fix(next/image): render valid html according to W3C: #​33825

Documentation Changes

• Update Time to First Byte (TTFB) link: #​33715
• Changed data fetching file name to overview to fix meta data title: #​33232
• Correct misspelling in testing documentation #​33754: #​33755
• Move custom server note from middleware doc: #​33744
• Fixed duplicate data fetching overview page + links: #​33774
• [docs] Mention SWC in TypeScript documentation.: #​33801
• Testing docs: Comment out optional config that points to a file: #​33827
• Update Content-Security-Policy header usage explanation: #​33833

Example Changes

• Fix with-docker example dockerfile: #​33695
• Added next.config.js with datocms-assets domain in allow list: #​33647
• Fix: broken npm install: #​33767
• [example] Upgrade the with-stripe-typescript example app: #​33761
• Upgrade to @​stitches/react 1.2.6: #​33817
• Doc: fix broken link to api routes doc: #​33836

Misc Changes

• run stale 20 minutes earlier
• fix: use github action instead of bot: #​33718
• fix syntax error in lock.yml
• fix rsc test suite runner: #​33745

Credits

Huge thanks to @​Vienio99, @​balazsorban44, @​kyliau, @​molebox, @​huozhi, @​shuding, @​PepijnSenders, @​krystofex, @​PizzaPete, @​souljuse, @​styfle, @​Schniz, @​Nelsonfrank, @​ijjk, @​Mhmdrza, @​timneutkens, @​hideokamoto-stripe, @​Emrin, @​gr-qft, @​delbaoliveira, @​redbar0n, @​amandeepmittal, @​lxy-yz, and @​Divlo for helping!

v12.0.9

Compare Source

This upgrade is completely backward-compatible and recommended for all users on versions below 12.0.9

Vulnerable code could allow a bad actor to trigger a denial of service attack via the /${locale}/_next/ route for anyone running a Next.js app at version >= 12.0.0, and using built-in i18n routing functionality.

How to Upgrade

• We have released patch versions for both the stable and canary channels of Next.js.
• To upgrade run npm install next@latest --save

Impact

• Affected: All of the following must be true to be affected by this CVE
  • Next.js versions between v12.0.0 and v12.0.9
  • Using next start or a custom server
  • Using the built-in i18n support
• Not affected:
  • Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

How to Assess Impact

If your server has seen requests to any route under the prefix /${locale}/_next/ that have triggered a heap overflow error, this was caused by the patched issue.

What is Being Done

As Next.js has grown in popularity and usage by enterprises, it has received the attention of security researchers and auditors. We are thankful to our users for their investigation and responsible disclosure of the original bug.

We've landed a patch that ensures this is handled properly so the requested route no longer crashes and triggers a heap overflow.

Regression tests for this attack were added to the i18n integration test suite

• A public CVE was released.
• We encourage responsible disclosure of future reports. Please email us at [email protected]. We are actively monitoring this mailbox.

Core Changes

• middlewares: limit process.env to inferred usage: #​33186
• update webpack: #​33207
• Abstract out native filesystem usage from the base server: #​33226
• use text data url instead of base64 for shorter encoding: #​33218
• chore(deps): upgrade postcss: #​33142
• Fix global process testing for the process polyfill: #​33220
• Update swc: #​33201
• improve full refresh overlay: #​33301
• Custom app for server components: #​33149
• Update yarn PnP tests and disable swc file reading for PnP: #​33236
• Base Http for BaseServer: #​32999
• Update swc: #​33342
• Update check for fallback pages during export: #​33323
• Pre-compile more dependencies: #​32742
• Remove node fetch polyfill from base server: #​33395
• Replace regexp to plain string for optimization render HTML: #​33306
• Fix broken html on streaming render for error page: #​33399
• Disable cache for rsc pages: #​33438
• Fix pre-compiled check from copying react-refresh-utils: #​33442
• fix(next-swc): Update swc: #​33427
• Move middleware handling to node server: #​33448
• Enforce absolute URLs in Edge Functions runtime: #​33410
• feat(next-swc): Update swc: #​33461
• Update main field for nccd jest-worker: #​33465
• chore(deps): upgrade node-fetch: #​33466
• Move static serving to next server: #​33475
• feat(next-swc): Update swc: #​33485
• Fix multiple calls to image onLoadingComplete(): #​33474
• Refactor base server to remove native dependencies: #​33499
• Update swc: #​33514
• Implement abstract methods to get manifest files in the base server: #​33537
• Simplify getMiddlewareInfo calls: #​33542
• Fix static file check with i18n: #​33503
• Bump styled-jsx: #​33546
• Ensure optional value normalizing is correct for index: #​33547
• Bump nft to 0.17.4: #​33548
• Add next-multilingual example: #​29386
• Removed the s from NextConfig: #​33560
• feat(next-swc): Update swc: #​33595
• Fix rsc export component name detection: #​33608
• upgrade webpack: #​33549
• Ensure fetch polyfill is loaded in next-server: #​33616
• feat(next-swc): Update swc: #​33628
• Add lazyRoot optional property to next/image component : #​33290
• feat(next-swc): Update swc: #​33675
• Implement web server as the request handler for edge SSR: #​33635
• Relay Support in Rust Compiler: #​33240
• Revert "Relay Support in Rust Compiler": #​33699

Documentation Changes

• Fixed broken link related to the recently merged Data fetching docs refactor: #​33209
• Removed backticks on data fetching api titles: #​33216
• Added links to data fetching api refs, fixed title: #​33221
• Remove outdated & possibly confusing statement about redirects: #​33224
• [examples] Add a statically generated blog example using Next.js and Builder.io: #​22094
• Typo Fix: #​33252
• Update font-optimization.md: #​33266
• Fixed broken links in data fetching docs: #​33250
• docs: Mention middleware for getStaticProps: #​33273
• Add sections for Remove React Properties and Remove Console to compiler docs: #​33311
• Update links in next export + next/image error message: #​33317
• Add onLoad gottcha note to next/script docs: #​33097
• Update security-headers.md: fix path does not match homepage: #​33137
• fix minor typo in SWR: #​33378
• ReferenceError in authentication.md example fixed: #​33411
• docs: fix url: #​33409
• fix(docs): Fix typo in Custom Build Id docs: #​33515
• [docs] Update authentication docs to fix iron-session link.: #​33483
• docs(authentication): fix iron-session example link: #​33502
• Update middleware documentation for custom server: #​33535
• Removed unrequired path in docs' manifest: #​33579
• Update next/server documentation for geo: #​33609
• Clarify next/image usage with next export based on feedback.: #​33555
• Clarify headers config option description: #​33484
• fix(errors/no-cache): netlify-plugin-cache-nextjs has been deprecated: #​33629
• Updated docs for getServerSideProps and getStaticProps return values: #​33577
• Use relative path for example: #​33565
• chore(docs): update security headers specification: #​33673
• REMOVE: duplicate key in docs/testing.md: #​33681

Example Changes

• [examples] Update remark dependency for blog-starter: #​33313
• Update package.json for examples/with-supabase-auth-realtime-db: #​33321
• Working example for building forms with Next.js: #​32669
• Updates dependency version of frontend SDK in with-supertokens example: #​33393
• docs: add skynexui to examples: #​33326
• Update with-linaria dependency: #​33487
• Update Supabase example README.: #​33610
• [examples] Add new Tailwind CSS Prettier plugin to example: #​33614

Misc Changes

• Update license year
• fix(docs): master branch renaming: #​33312
• Add link to security email directly.: #​33358
• Fix getServerSideProps hanging in dev on early end: #​33366
• [docs] Fix 404 link for testing example.: #​33407
• Update to latest version of turbo: #​33613
• Update other instances of node-fetch: #​33617

Credits

Huge thanks to @​molebox, @​Schniz, @​sokra, @​kachkaev, @​shuding, @​teleaziz, @​OgbeniHMMD, @​goncy, @​balazsorban44, @​MaedahBatool, @​bennettdams, @​kdy1, @​huozhi, @​hsynlms, @​styfle, @​ijjk, @​callumgare, @​jonrosner, @​karaggeorge, @​rpie3, @​MartijnHols, @​leerob, @​bashunaimiroy, @​NOCELL, @​rishabhpoddar, @​omariosouto, @​hanneslund, @​theMosaad, @​javivelasco, @​pierrenel, @​lobsterkatie, @​tharakabimal, @​vvo, @​saevarb, @​lfades, @​nbouvrette, @​paulnbrd, @​ecklf, @​11koukou, @​renbaoshuo, @​chozzz, @​tbezman, @​karlhorky, @​j-mendez, and @​ffan0811 for helping!

---

Configuration

📅 Schedule: "before 7am on Tuesday,before 7am on Wednesday" in timezone Australia/Melbourne.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by WhiteSource Renovate. View repository job log here.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 76111e9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.