Bump @nx/next from 19.5.7 to 20.2.2 #4680
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
dependabot
bot
added
the
dependencies
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Sorry, only users with push access can use that command. |
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/nx/next-20.2.2
branch
from
4d9ef22 to
952187d
Compare
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/nx/next-20.2.2
branch
from
952187d to
a8d417e
Compare
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/nx/next-20.2.2
branch
from
a8d417e to
fdab2c6
Compare
Bumps [@nx/next](https://github.com/nrwl/nx/tree/HEAD/packages/next) from 19.5.7 to 20.2.2. - [Release notes](https://github.com/nrwl/nx/releases) - [Commits](https://github.com/nrwl/nx/commits/20.2.2/packages/next) --- updated-dependencies: - dependency-name: "@nx/next" dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/nx/next-20.2.2
branch
from
fdab2c6 to
5318e67
Compare
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
| } | ||
| } | ||
| }, | ||
| "node_modules/@nx/module-federation/node_modules/webpack": { |
There was a problem hiding this comment.
The issue identified by the Trivy linter is a security vulnerability in the webpack package version 5.88.0, specifically related to a DOM Clobbering vulnerability (CVE-2024-43788). This vulnerability can potentially allow an attacker to manipulate the DOM in a way that may lead to unintended behaviors or security issues in applications that use this version of webpack. The recommended action is to update to a patched version, which in this case is 5.94.0.
To fix this issue, you should update the version of webpack in your project's dependency tree. Here is the single line change that you can make:
| "node_modules/@nx/module-federation/node_modules/webpack": { | |
| "version": "5.94.0", |
This change should be made in the relevant section of your package.json or wherever the version of webpack is specified in your project. After making this change, remember to run npm install or yarn install to update the package in your node_modules.
This comment was generated by an experimental AI tool.
|
Superseded by #4690. |
Bumps @nx/next from 19.5.7 to 20.2.2.
Release notes
Sourced from
@nx/next's releases.... (truncated)
Commits
2d36684feat(misc): handle artifact generators'pathoptions including file extensi...ec5a5e6feat(react): update app and lib generators to support new TS solution setup (...dc67660fix(misc): update artifact generator option descriptions and cleanup leftover...8eb6159fix(nextjs): Add support for next.config.ts for executors (#29071)5514329server-next-executor-examples: minor typo documentation (#28830)d4b9e0dfix(nextjs): update default next-env (#28861)39b0a6cchore(nextjs): bump Next.js version to 14.2.16 (#28782)0706c7ffix(nextjs): Formatting for pages (#28734)0ad7c6bfix(nextjs): do not generate spec files if unitTestRunner is not set programm...b89a62efix(nextjs): Fix json spread typo (#28728)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)