Skip to content

Fix React Server Components CVE vulnerabilities#15

Merged
rudra-sah00 merged 1 commit intoproductionfrom
vercel/react-server-components-cve-vu-t51erd
Dec 30, 2025
Merged

Fix React Server Components CVE vulnerabilities#15
rudra-sah00 merged 1 commit intoproductionfrom
vercel/react-server-components-cve-vu-t51erd

Conversation

@vercel
Copy link
Contributor

@vercel vercel bot commented Dec 30, 2025

Important

This is an automatic PR generated by Vercel to help you with patching efforts. We can't guarantee it's comprehensive, and it may contain mistakes. Please review our guidance before merging these changes.

A critical remote code execution (RCE) vulnerability in React Server Components, impacting frameworks such as Next.js, was identified in the project portfolio. The vulnerability enables unauthenticated RCE on the server via insecure deserialization in the React Flight protocol.

This issue is tracked under:

This automated pull request upgrades the affected React and Next.js packages to patched versions that fully remediate the issue.

More Info | security@vercel.com

Updated dependencies to fix Next.js and React CVE vulnerabilities.

The fix-react2shell-next tool automatically updated the following packages to their secure versions:
- next
- react-server-dom-webpack
- react-server-dom-parcel  
- react-server-dom-turbopack

All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory.

Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
@vercel
Copy link
Contributor Author

vercel bot commented Dec 30, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Review Updated (UTC)
portfolio Ignored Ignored Dec 30, 2025 1:47am

@github-actions
Copy link

⚠️ Invalid PR Title

Please use one of these prefixes for your PR title:
- `feat:` - New feature
- `fix:` - Bug fix
- `docs:` - Documentation changes
- `style:` - Code style changes
- `refactor:` - Code refactoring
- `test:` - Test changes
- `chore:` - Maintenance tasks
- `perf:` - Performance improvements
- `ci:` - CI/CD changes
- `build:` - Build system changes

Example: `feat: add new dashboard component`

@github-actions
Copy link

📦 Bundle Size Report

✅ Build completed successfully!

Build Info:

  • Next.js production build completed
  • Check the workflow logs for detailed size metrics

Guidelines:

  • 🎯 First Load JS: Aim for < 200KB
  • Code Splitting: Automatic with Next.js
  • 🗜️ Compression: Enabled (gzip/brotli)

💡 Tip: Review the build output in workflow logs for page-by-page size breakdown

@rudra-sah00 rudra-sah00 marked this pull request as ready for review December 30, 2025 01:50
@rudra-sah00 rudra-sah00 self-requested a review as a code owner December 30, 2025 01:50
@rudra-sah00 rudra-sah00 merged commit 7ba04d5 into production Dec 30, 2025
15 of 16 checks passed
@github-actions
Copy link

📊 Test Coverage Report

Overall Status: ✅ PASSED

Metric Coverage Visual vs Target Status
Statements 90.77% ██████████████████░░ +0.8%
Branches 89.69% ██████████████████░░ +4.7%
Functions 84.11% █████████████████░░░ +4.1%
Lines 90.77% ██████████████████░░ +0.8%

📈 Detailed Metrics

  • Total Files Tested: 34
  • Statements Covered: 4397 / 4844
  • Branches Covered: 418 / 466
  • Functions Covered: 90 / 107
  • Lines Covered: 4397 / 4844

🎯 Target Thresholds

  • Statements: ≥ 90%
  • Branches: ≥ 85%
  • Functions: ≥ 80%
  • Lines: ≥ 90%

Excellent! All coverage thresholds exceeded. Great work! 🎉


💡 Tip: Run npm run test:coverage locally to see detailed coverage reports

@sentry
Copy link

sentry bot commented Dec 30, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@github-actions
Copy link

🚀 Preview Deployment Ready!

🔍 Preview URL: https://portfolio-bfgky7o7v-rudras-projects-194b270d.vercel.app

✅ Build Successful
✅ Preview Environment Created

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant