SAP / ui5-webcomponents-react / 14006760740

89%

push

github

chore(deps): update dependency next to v15.2.3 [security] (main) (#7122)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [next](https://nextjs.org)
([source](https://redirect.github.com/vercel/next.js)) | [`15.2.2` ->
`15.2.3`](https://renovatebot.com/diffs/npm/next/15.2.2/15.2.3) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/next/15.2.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/next/15.2.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/next/15.2.2/15.2.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/next/15.2.2/15.2.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-29927](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw)

# Impact
It is possible to bypass authorization checks within a Next.js
application, if the authorization check occurs in middleware.

# Patches
* For Next.js 15.x, this issue is fixed in `15.2.3`
* For Next.js 14.x, this issue is fixed in `14.2.25`
* For Next.js versions `11.1.4` thru `13.5.6`, consult the below
workaround.

# Workaround
If patching to a safe version is infeasible, it is recommend that you
prevent external user requests which contain the
`x-middleware-subrequest` header from reaching your Next.js application.

## Credits

- Allam Rachid (zhero;)
- Allam Yasser (inzo_)

---

### Release Notes

<details>
<summary>vercel/next.js (next)</summary>

###
[`v15.2.3`](https://redirect.github.com/vercel/next.js/compare/v15.2.2...v15.2.3)

[Compare
Source](https://redirect.github.com/vercel/next.js/compare/v15.2.2...v15.2.3)

</details>

---

### Configuration

📅 **Schedule**: Branch c... (continued)

2944 of 3900 branches covered (75.49%)

5123 of 5856 relevant lines covered (87.48%)

91459.68 hits per line