[Snyk] Fix for 1 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/next/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	713/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.4	Prototype Pollution SNYK-JS-JSON5-3182856	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: loader-utils

The new version differs by 56 commits.

• d9f4e23 chore(release): 2.0.0
• 865dc03 refactor: switch to `md4` by default ([Snyk] Fix for 1 vulnerable dependencies #168)
• b595cfb refactor: the `getOptions` method returns empty object on empty query ([Snyk] Fix for 1 vulnerable dependencies #167)
• c937e8c chore: minimum required `Node.js` version is `8.9.0` ([Snyk] Fix for 1 vulnerable dependencies #166)
• c78786d chore: upgrade json5 to fix a vulnerability ([Snyk] Fix for 1 vulnerable dependencies #165)
• d95b8b5 chore(release): 1.4.0
• cd0e428 feat: the `resourceQuery` is passed to the `interpolateName` method ([Snyk] Fix for 1 vulnerable dependencies #163)
• 06d36cf chore(release): 1.3.0
• 469eeba feat: support the `[query]` template for the `interpolatedName` method ([Snyk] Fix for 1 vulnerable dependencies #162)
• 909c99d chore: funding.yml config and CI fix ([Snyk] Fix for 1 vulnerable dependencies #159)
• b5b74f0 Set up CI with Azure Pipelines
• 7970c48 docs: small grammar change ([Snyk] Fix for 1 vulnerable dependencies #144)
• b91a76c chore(release): 1.2.3
• 3528fd9 fix(interpolateName): don't interpolated `hashType` without `hash` or `contenthash` ([Snyk] Fix for 1 vulnerable dependencies #140)
• 809b690 chore(release): 1.2.2
• d69c303 test: `interpolateName` util ([Snyk] Fix for 1 vulnerable dependencies #138)
• f8a71f4 fix: fixed a hash type extracting in interpolateName ([Snyk] Fix for 1 vulnerable dependencies #137)
• 489ef12 chore(release): 1.2.1
• 73d350a revert: PR [Snyk] Fix for 1 vulnerable dependencies #79 ([Snyk] Fix for 1 vulnerable dependencies #135)
• aca43da fix(isUrlRequest): better handle absolute urls and non standards ([Snyk] Fix for 1 vulnerable dependencies #134)
• ba4f0d0 chore(release): 1.2.0 ([Snyk] Fix for 1 vulnerable dependencies #131)
• c5c7322 test: more ([Snyk] Fix for 1 vulnerable dependencies #132)
• c17d9cd refactor: migrate on `jest` ([Snyk] Fix for 1 vulnerable dependencies #130)
• 3a854ba style: integrate prettier

See the full diff

Package name: styled-jsx

The new version differs by 92 commits.

• 13bd38d docs: update issue template
• 75ee544 docs: add changelog and update readme ([Snyk] Security upgrade firebase-admin from 5.13.1 to 10.0.2 #775)
• 104ab76 docs: update ssr and nextjs ([Snyk] Security upgrade next from 6.1.2 to 7.0.0 #771)
• 36fe10a perf: Pre-compile dependencies to reduce install size/time ([Snyk] Security upgrade next from 6.0.0-canary.6 to 7.0.0 #770)
• b7832e9 perf: fallback to module level registry in browser ([Snyk] Security upgrade next from 6.1.1 to 7.0.0 #768)
• 9956457 doc: update issue template asking for nextjs version ([Snyk] Fix for 1 vulnerabilities #765)
• b67b0d9 fix: use string for nonce typing ([Snyk] Fix for 1 vulnerabilities #766)
• d43074f fix: typo acceps -> accepts ([Snyk] Fix for 1 vulnerabilities #760)
• 9951745 typing: return JSX.Element for registry.styles ([Snyk] Security upgrade next from 6.1.2 to 7.0.0 #759)
• 6e224a9 feat: opt in insertion effect hook when available ([Snyk] Fix for 1 vulnerabilities #753)
• dcadf5d fix: Make `JSXStyle` return a noop if the registry context is not provided ([Snyk] Fix for 1 vulnerabilities #749)
• 174a186 chore: setup beta release
• 45753c3 fix: zeit -> vercel ([Snyk] Fix for 1 vulnerabilities #746)
• 48faf00 feat: contextual styles ([Snyk] Fix for 1 vulnerabilities #744)
• 8b585d5 chore: update npm token ([Snyk] Security upgrade next from 7.0.3 to 8.0.4 #743)
• 69a76f2 fix: mark @ babel/core as optional peer dependency ([Snyk] Security upgrade nanoid from 1.2.1 to 3.1.31 #739)
• 2a1bb87 chore: format files with prettier ([Snyk] Security upgrade firebase-admin from 5.13.1 to 7.0.0 #740)
• 2428d38 test: remove broken test input ([Snyk] Security upgrade firebase-admin from 5.12.1 to 6.0.0 #738)
• 8f4404a chore: use modern eslint and limit engines ([Snyk] Security upgrade firebase-admin from 5.13.1 to 9.0.0 #735)
• 7c04667 docs: remove old Spectrum link from the README ([Snyk] Security upgrade node-sass from 4.14.1 to 7.0.1 #734)
• d591ce2 perf: drop babel 6 support ([Snyk] Security upgrade next from 6.1.2 to 10.0.6 #730)
• 48a2599 feat: use react hooks to manage styles injection ([Snyk] Security upgrade next from 6.1.2 to 10.0.6 #720)
• b7f7dc3 chore: auto publish when merging to alpha ([Snyk] Security upgrade next from 5.1.0 to 10.0.6 #727)
• 452d2e8 fix: update test snapshots ([Snyk] Security upgrade next from 5.1.0 to 10.0.6 #729)

See the full diff

Package name: webpack

The new version differs by 250 commits.

• 610f368 5.0.0
• 5ce65c1 update examples
• bbe1230 Merge pull request create-next-app always uses yarn if it is installed vercel/next.js#11628 from webpack/bugfix/real-content-hash
• 75ecff2 5.0.0-rc.6
• bfc35d6 Merge pull request Warn when user has pages/_error but no pages/404 vercel/next.js#11603 from MayaWolf/master
• 76e8cbd Merge pull request Next.js application is looking for wrong "_next" directory after build & start vercel/next.js#11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
• 9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
• 36bcfaa Merge pull request [Docs] Remove concepts folder vercel/next.js#11621 from webpack/bugfix/11619
• 9130d10 fix called variables with ProvidePlugin
• 3e42105 Merge pull request [docs] Mention the new data fetching methods on missing places vercel/next.js#11620 from webpack/bugfix/11617
• 4709719 skip connections copied to concatenated module
• 57b493f 5.0.0-rc.5
• 1658e2f Merge pull request Update Automatic Static Optimization docs vercel/next.js#11618 from webpack/bugfix/11615
• a8fb45d fixes crash in SideEffectsFlagPlugin
• 84b196d emit error instead of crashing when unexpected problem occurs
• 5573fed Merge pull request File already exists error when building vercel/next.js#11601 from Hornwitser/improve-suggested-polyfill-config
• 9b5cce9 Merge pull request /Page works just fine but /page throws an error? Need lowercase urls to work vercel/next.js#11609 from snitin315/export-types
• 37c495c export type RuleSetUseItem
• 39faf34 export type RuleSetUse
• e5fd246 export type RuleSetConditionAbsolute
• 660baad export RuleSetCondition types
• 13e3ca5 Merge pull request Rename unstable GSP field vercel/next.js#11602 from webpack/bugfix/shared-runtime-chunk
• 9c0587e Merge pull request Distributing a next.js app via NPM vercel/next.js#11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
• 502d166 Merge pull request Yarn 2 not working with basic setup vercel/next.js#11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4

See the full diff

Package name: webpackbar

The new version differs by 74 commits.

• 3a0d830 chore(release): 3.0.0
• 132a882 chore: fix yarn.lock
• c8e0f9d chore(release): 3.0.0-3
• 0705bf9 chore: update dependencies
• 36cce4e chore: update readme
• ed6aa92 chore: update docs
• 8057e4c feat: add change hook support
• e279575 refactor: move hook utility into utils/webpack
• 52caede chore: enable commtlint in pre-commit hook
• 954e8ce chore: removed unused package
• 556f830 fix: unused plugin instances store state in global
• be9b171 ci: add cache for appveyor
• b5627f4 test: fix basic test
• 7f089c1 chore: use defaults for demo
• 0ebbaa2 chore(release): 3.0.0-2
• 8c0441b fix: fix globalState bug
• f96ad47 feat: allow easily disabling reporters
• 05cf301 fix: use compile instead of beforeCompile to prevent duplicate calls
• 09459af feat: improve stats reporter
• 35ef721 refactor: use statesArray
• ca4ecc7 refactor: remove this.name
• 4dd3e6c chore: update demo
• d7a10c9 fix: minor fixes
• 150699d fix: handler assignment should be happened after super() call

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution