Skip to content

Production deployment#1855

Merged
simonknittel merged 1 commit intomainfrom
develop
Dec 14, 2025
Merged

Production deployment#1855
simonknittel merged 1 commit intomainfrom
develop

Conversation

@github-actions
Copy link

Only merge using a merge commit!

This PR contains the following updates:

| Package | Change | Age | Confidence |
|---|---|---|---|
| [next](https://nextjs.org)
([source](https://redirect.github.com/vercel/next.js)) | [`16.0.9` ->
`16.0.10`](https://renovatebot.com/diffs/npm/next/16.0.9/16.0.10) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/next/16.0.10?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/next/16.0.9/16.0.10?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[GHSA-5j59-xgg2-r9c4](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4)

It was found that the fix
addressing [CVE-2025-55184](https://redirect.github.com/advisories/GHSA-2m3v-v2m8-q956) in
React Server Components was incomplete and did not fully prevent
denial-of-service attacks in all payload types. This affects React
package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the
affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the
App Router. The issue is tracked upstream as
[CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).

A malicious HTTP request can be crafted and sent to any Server Function
endpoint that, when deserialized, can enter an infinite loop within the
React Server Components runtime. This can cause the server process to
hang and consume CPU, resulting in denial of service in unpatched
environments.

---

### Release Notes

<details>
<summary>vercel/next.js (next)</summary>

###
[`v16.0.10`](https://redirect.github.com/vercel/next.js/releases/tag/v16.0.10)

[Compare
Source](https://redirect.github.com/vercel/next.js/compare/v16.0.9...v16.0.10)

Please see the [Next.js Security
Update](https://nextjs.org/blog/security-update-2025-12-11) for
information about this security patch.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCIsImxhYmVscyI6W119-->

Co-authored-by: Renovate Bot <renovate@whitesourcesoftware.com>
@vercel
Copy link

vercel bot commented Dec 14, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
sam Ready Ready Preview Dec 14, 2025 9:42pm

@socket-security
Copy link

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm safer-buffer is 94.0% likely obfuscated

Confidence: 0.94

Location: Package overview

From: pnpm-monorepo/pnpm-lock.yamlnpm/web-push@3.6.7npm/safer-buffer@2.1.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/safer-buffer@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@simonknittel simonknittel merged commit 4080e01 into main Dec 14, 2025
19 checks passed
@sonarqubecloud
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant