SAP / ui5-webcomponents-react / 14006760740 / 5 – base

89%

main: 89%

push

github

chore(deps): update dependency next to v15.2.3 [security] (main) (#7122)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [next](https://nextjs.org)
([source](https://redirect.github.com/vercel/next.js)) | [`15.2.2` ->
`15.2.3`](https://renovatebot.com/diffs/npm/next/15.2.2/15.2.3) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/next/15.2.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/next/15.2.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/next/15.2.2/15.2.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/next/15.2.2/15.2.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-29927](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw)

# Impact
It is possible to bypass authorization checks within a Next.js
application, if the authorization check occurs in middleware.

# Patches
* For Next.js 15.x, this issue is fixed in `15.2.3`
* For Next.js 14.x, this issue is fixed in `14.2.25`
* For Next.js versions `11.1.4` thru `13.5.6`, consult the below
workaround.

# Workaround
If patching to a safe version is infeasible, it is recommend that you
prevent external user requests which contain the
`x-middleware-subrequest` header from reaching your Next.js application.

## Credits

- Allam Rachid (zhero;)
- Allam Yasser (inzo_)

---

### Release Notes

<details>
<summary>vercel/next.js (next)</summary>

###
[`v15.2.3`](https://redirect.github.com/vercel/next.js/compare/v15.2.2...v15.2.3)

[Compare
Source](https://redirect.github.com/vercel/next.js/compare/v15.2.2...v15.2.3)

</details>

---

### Configuration

📅 **Schedule**: Branch c... (continued)

114 of 2904 branches covered (3.93%)

781 of 4548 relevant lines covered (17.17%)

16.16 hits per line