Skip to content

chore: Resolve nextjs vuln #190

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Nov 15, 2024
Merged

chore: Resolve nextjs vuln #190

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4797839
chore: Resolve nextjs vuln
suejung-sentry Nov 14, 2024
5e067c2
fix next
suejung-sentry Nov 14, 2024
a769712
add changeset
suejung-sentry Nov 14, 2024
6498d6a
Merge remote-tracking branch 'origin/main' into sshin/chore/nextjs
suejung-sentry Nov 14, 2024
f90c6f3
restore peer dep range
suejung-sentry Nov 14, 2024
2efad06
Merge remote-tracking branch 'origin/main' into sshin/chore/nextjs
suejung-sentry Nov 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .changeset/moody-goats-sing.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
---
"@codecov/nextjs-webpack-plugin": patch
"@codecov/bundle-analyzer": patch
"@codecov/bundler-plugin-core": patch
"@codecov/nuxt-plugin": patch
"@codecov/remix-vite-plugin": patch
"@codecov/rollup-plugin": patch
"@codecov/solidstart-plugin": patch
"@codecov/sveltekit-plugin": patch
"@codecov/vite-plugin": patch
"@codecov/webpack-plugin": patch
---

Bump nextjs versions
4 changes: 2 additions & 2 deletions examples/next-js/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"lint": "next lint"
},
"dependencies": {
"next": "14.2.3",
"next": "14.2.10",
"react": "^18.3.1",
"react-dom": "^18.3.1"
},
Expand All @@ -20,7 +20,7 @@
"@types/react-dom": "^18.3.0",
"autoprefixer": "^10.4.19",
"eslint": "^8.56.0",
"eslint-config-next": "14.2.3",
"eslint-config-next": "14.2.10",
"postcss": "^8.4.38",
"tailwindcss": "^3.4.3",
"typescript": "^5.4.5"
Expand Down
2 changes: 1 addition & 1 deletion integration-tests/test-apps/nextjs/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
"dependencies": {
"react": "^18",
"react-dom": "^18",
"next": "14.2.5"
"next": "14.2.10"
},
"devDependencies": {
"@codecov/nextjs-webpack-plugin": "workspace:^",
Expand Down
2 changes: 1 addition & 1 deletion packages/nextjs-webpack-plugin/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@
"webpack": "^5.90.0"
},
"peerDependencies": {
"next": "14.x || 15.x",
"next": ">=14.2.10 <16.0.0",
Copy link

@nicholas-codecov nicholas-codecov Nov 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@suejung-sentry are we able to rollback to the prior implementation of peer deps declarations?

With these changes, we'd have to move from a patch to a major release as we're requiring users to update their version of next. If they don't, peer dep resolution would fail while they try to install the plugin.

Copy link
Contributor Author

@suejung-sentry suejung-sentry Nov 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yeah good point. I won't force that upon people & just fix in our examples / integration-tests instead to resolve the vulnerability - thanks!

"webpack": "5.x"
},
"volta": {
Expand Down
Loading
Loading