fix(deps): update dependency @sentry/nextjs to v7.77.0 [security] #628

renovate · 2024-08-06T06:21:08Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@sentry/nextjs (source)	`7.74.1` -> `7.77.0`

GitHub Vulnerability Alerts

CVE-2023-46729

Impact

An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This could open door for other attack vectors:

client-side vulnerabilities: XSS/CSRF in the context of the trusted domain;
interaction with internal network;
read cloud metadata endpoints (AWS, Azure, Google Cloud, etc.);
local/remote port scan.

This issue only affects users who have Next.js SDK tunneling feature enabled.

Patches

The problem has been fixed in sentry/[email protected]

Workarounds

Disable tunneling by removing the tunnelRoute option from Sentry Next.js SDK config — next.config.js or next.config.mjs.

References

Credits

Praveen Kumar

Release Notes

getsentry/sentry-javascript (@sentry/nextjs)

`v7.77.0`

Compare Source

feat: Move LinkedErrors integration to @sentry/core (#9404)
feat(remix): Update sentry-cli version to ^2.21.2 (#9401)
feat(replay): Allow to treeshake & configure compression worker URL (#9409)
fix(angular-ivy): Adjust package entry points to support Angular 17 with SSR config (#9412)
fix(feedback): Fixing feedback import (#9403)
fix(nextjs): Match only numbers as orgid in tunnelRoute (#9416)
fix(nextjs): Strictly validate tunnel target parameters (#9415)
fix(utils): Avoid keeping a reference of last used event (#9387)

`v7.76.0`

Compare Source

Important Changes

feat(core): Add cron monitor wrapper helper (#9395)

This release adds Sentry.withMonitor(), a wrapping function that wraps a callback with a cron monitor that will automatically report completions and failures:

import * as Sentry from '@&#8203;sentry/node';

// withMonitor() will send checkin when callback is started/finished
// works with async and sync callbacks.
const result = Sentry.withMonitor(
  'dailyEmail',
  () => {
    // withCheckIn return value is same return value here
    return sendEmail();
  },
  // Optional upsert options
  {
    schedule: {
      type: 'crontab',
      value: '0 * * * *',
    },
    // 🇨🇦🫡
    timezone: 'Canada/Eastern',
  },
);

Other Changes

chore(angular-ivy): Allow Angular 17 in peer dependencies (#9386)
feat(nextjs): Instrument SSR page components (#9346)
feat(nextjs): Trace errors in page component SSR (#9388)
fix(nextjs): Instrument route handlers with jsx and tsx file extensions (#9362)
fix(nextjs): Trace with performance disabled (#9389)
fix(replay): Ensure replay_id is not added to DSC if session expired (#9359)
fix(replay): Remove unused parts of pako from build (#9369)
fix(serverless): Don't mark all errors as unhandled (#9368)
fix(tracing-internal): Fix case when middleware contain array of routes with special chars as @ (#9375)
meta(nextjs): Bump peer deps for Next.js 14 (#9390)

Work in this release contributed by @LubomirIgonda1. Thank you for your contribution!

`v7.75.1`

Compare Source

feat(browser): Allow collecting of pageload profiles (#9317)
fix(browser): Correct timestamp on pageload profiles (#9350)
fix(nextjs): Use webpack plugin release value to inject release (#9348)

`v7.75.0`

Compare Source

Important Changes

feat(opentelemetry): Add new @sentry/opentelemetry package (#9238)

This release publishes a new package, @sentry/opentelemetry. This is a runtime agnostic replacement for @sentry/opentelemetry-node and exports a couple of useful utilities which can be used to use Sentry together with OpenTelemetry.

You can read more about @sentry/opentelemetry in the Readme.

feat(replay): Allow to treeshake rrweb features (#9274)

Starting with this release, you can configure the following build-time flags in order to reduce the SDK bundle size:

__RRWEB_EXCLUDE_CANVAS__
__RRWEB_EXCLUDE_IFRAME__
__RRWEB_EXCLUDE_SHADOW_DOM__

You can read more about tree shaking in our docs.

Other Changes

build(deno): Prepare Deno SDK for release on npm (#9281)
feat: Remove tslib (#9299)
feat(node): Add abnormal session support for ANR (#9268)
feat(node): Remove lru_map dependency (#9300)
feat(node): Vendor cookie module (#9308)
feat(replay): Share performance instrumentation with tracing (#9296)
feat(types): Add missing Profiling types (macho debug image, profile measurements, stack frame properties) (#9277)
feat(types): Add statsd envelope types (#9304)
fix(astro): Add integration default export to types entry point (#9337)
fix(astro): Convert SDK init file import paths to POSIX paths (#9336)
fix(astro): Make Replay and BrowserTracing integrations tree-shakeable (#9287)
fix(integrations): Fix transaction integration (#9334)
fix(nextjs): Restore autoInstrumentMiddleware functionality (#9323)
fix(nextjs): Guard for case where getInitialProps may return undefined (#9342)
fix(node-experimental): Make node-fetch support optional (#9321)
fix(node): Check buffer length when attempting to parse ANR frame (#9314)
fix(replay): Fix xhr start timestamps (#9341)
fix(tracing-internal): Remove query params from urls with a trailing slash (#9328)
fix(types): Remove typo with CheckInEnvelope (#9303)

Bundle size 📦

Path	Size
@sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)	82.66 KB
@sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)	71.77 KB
@sentry/browser (incl. Tracing) - Webpack (gzipped)	30.94 KB
@sentry/browser - Webpack (gzipped)	21.26 KB
@sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)	73.03 KB
@sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)	28.93 KB
@sentry/browser - ES6 CDN Bundle (gzipped)	21.09 KB
@sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)	233.81 KB
@sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)	87.77 KB
@sentry/browser - ES6 CDN Bundle (minified & uncompressed)	62.76 KB
@sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)	31.71 KB
@sentry/react (incl. Tracing, Replay) - Webpack (gzipped)	83.05 KB
@sentry/react - Webpack (gzipped)	21.29 KB
@sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)	99.43 KB
@sentry/nextjs Client - Webpack (gzipped)	47.83 KB

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2024-08-06T06:21:41Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source	CI
Critical CVE	npm/[email protected]	CVE: GHSA-jf85-cpcp-j695 Prototype Pollution in lodash (CRITICAL) Affected versions: < 4.17.12 Patched version: 4.17.12	`yarn.lock`	⚠︎

View full report↗︎

Next steps

What is a critical CVE?

Contains a Critical Common Vulnerability and Exposure (CVE).

Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore npm/[email protected]

sonarqubecloud · 2024-09-01T23:29:50Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud · 2024-10-09T10:28:42Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud · 2024-12-02T10:14:11Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

socket-security · 2025-03-13T17:25:50Z

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@cspotcode/[email protected]	filesystem	`+1`	194 kB	cspotcode
npm/@one-ini/[email protected]	filesystem	`0`	98 kB	hildjj
npm/@prisma/[email protected]	None	`0`	2.71 MB	prismabot
npm/@tsconfig/[email protected]	None	`0`	2.39 kB	typescript-deploys
npm/@tsconfig/[email protected]	None	`0`	2.5 kB	typescript-deploys
npm/@tsconfig/[email protected]	None	`0`	2.39 kB	typescript-deploys
npm/@tsconfig/[email protected]	None	`0`	2.45 kB	typescript-deploys
npm/[email protected]	None	`0`	16.8 kB	dougwilson
npm/[email protected]	None	`0`	11.7 kB	andris
npm/[email protected]	None	`0`	7.19 kB	raynos
npm/[email protected]	None	`0`	12.9 kB	qix
npm/[email protected]	None	`0`	4.42 kB	blakeembrey
npm/[email protected]	None	`0`	10 kB	rase-
npm/[email protected]	None	`0`	6.9 kB	strml
npm/[email protected]	None	`0`	3.1 kB	mokesmokes
npm/[email protected]	None	`0`	62.3 kB	mikepb
npm/[email protected]	None	`0`	4.26 kB	darrachequesne
npm/[email protected]	environment, filesystem	`0`	3.91 kB	tony_ado
npm/[email protected]	None	`0`	30.6 kB	amitport
npm/[email protected]	network Transitive: unsafe	`+3`	434 kB	dougwilson
npm/[email protected]	None	`0`	1.33 kB	feedic
npm/[email protected]	None	`0`	1.47 kB	tjholowaychuk
npm/[email protected]	None	`0`	2.99 kB	blakeembrey
npm/[email protected]	None	`0`	62.6 kB	feedic
npm/[email protected]	Transitive: network	`+10`	2.06 MB	jugglinmike
npm/[email protected]	environment, filesystem, network	`0`	438 kB	jakub.pawlowicz
npm/[email protected]	None	`0`	2.43 kB	tootallnate
npm/[email protected]	None	`0`	7.57 kB	nami-doc
npm/[email protected]	None	`0`	1.65 kB	coreh
npm/[email protected]	environment, filesystem, network	`0`	15 kB	isaacs
npm/[email protected]	None	`0`	19.1 kB	dougwilson
npm/[email protected]	None	`0`	10.5 kB	dougwilson
npm/[email protected]	None	`0`	3.94 kB	natevw
npm/[email protected]	None	`0`	20 kB	dougwilson
npm/[email protected]	filesystem, unsafe	`0`	6.25 kB	pi0
npm/[email protected]	None	`0`	224 kB	feedic
npm/[email protected]	None	`0`	66 kB	feedic
npm/[email protected]	None	`+1`	16 kB
npm/[email protected]	None	`0`	0 B
npm/[email protected]	filesystem	`0`	9.02 kB	dougwilson
npm/[email protected]	None	`0`	2.76 kB	iliakan
npm/[email protected]	None	`0`	335 kB	kpdecker
npm/[email protected]	filesystem Transitive: environment, shell	`+2`	638 kB	hildjj
npm/[email protected]	None	`0`	7.86 kB	dougwilson
npm/[email protected]	None	`0`	176 kB	darrachequesne
npm/[email protected]	None	`0`	39.2 kB	darrachequesne
npm/[email protected]	environment, network	`+3`	240 kB	darrachequesne
npm/[email protected]	None	`0`	6.36 kB	sindresorhus
npm/[email protected]	None	`0`	3.66 kB	dougwilson
npm/[email protected]	environment, filesystem, network Transitive: eval	`+8`	542 kB	dougwilson
npm/[email protected]	None	`0`	23.5 kB	ljharb
npm/[email protected]	environment	`0`	18.6 kB	dougwilson
npm/[email protected]	None	`0`	5.88 kB	dougwilson
npm/[email protected]	None	`0`	10.1 kB	dougwilson
npm/[email protected]	None	`+1`	7.93 kB	darrachequesne
npm/[email protected]	None	`0`	2.71 kB	shtylman
npm/[email protected]	Transitive: filesystem, shell	`+1`	159 kB	alexlamsl
npm/[email protected]	None	`0`	909 B
npm/[email protected]	None	`0`	9.3 kB	isaacs
npm/[email protected]	None	`0`	42.1 kB	whitequark
npm/[email protected]	None	`0`	4.66 kB	poying
npm/[email protected]	Transitive: filesystem	`+2`	1.06 MB	bitwiseman
npm/[email protected]	filesystem Transitive: shell	`+1`	162 kB	jrit
npm/[email protected]	None	`0`	4.78 kB	blakeembrey
npm/[email protected]	None	`0`	335 kB	rossj
npm/[email protected]	None	`0`	12.4 kB	julien-f
npm/[email protected]	None	`0`	36.6 kB	brett
npm/[email protected]	None	`0`	4.89 kB	dougwilson
npm/[email protected]	network	`0`	5.29 kB	dougwilson
npm/[email protected]	None	`0`	26.6 kB	iryusa
npm/[email protected]	None	`0`	4.95 kB	iryusa
npm/[email protected]	None	`0`	13 kB	iryusa
npm/[email protected]	None	`0`	22.6 kB	iryusa
npm/[email protected]	filesystem	`0`	30.3 kB	iryusa
npm/[email protected]	None	`0`	16.8 kB	iryusa
npm/[email protected]	filesystem Transitive: network	`+6`	2.05 MB	iryusa
npm/[email protected]	None	`0`	8.08 kB	iryusa
npm/[email protected]	None	`0`	11.4 kB	iryusa
npm/[email protected]	None	`0`	5.42 kB	iryusa
npm/[email protected]	None	`0`	4.25 kB	iryusa
npm/[email protected]	None	`0`	4.44 kB	iryusa
npm/[email protected]	None	`0`	5.33 kB	iryusa
npm/[email protected]	None	`0`	3.92 kB	iryusa
npm/[email protected]	None	`0`	5.34 kB	iryusa
npm/[email protected]	None	`0`	3.82 kB	iryusa
npm/[email protected]	None	`0`	3.13 kB	iryusa
npm/[email protected]	None	`0`	19.1 kB	iryusa
npm/[email protected]	None	`0`	11.3 kB	iryusa
npm/[email protected]	None	`0`	10.2 kB	iryusa
npm/[email protected]	None	`0`	35.8 kB	iryusa
npm/[email protected]	filesystem	`+2`	283 kB	iryusa
npm/[email protected]	None	`0`	7.27 kB	iryusa
npm/[email protected]	None	`0`	5.36 kB	iryusa
npm/[email protected]	None	`0`	21.3 kB	iryusa
npm/[email protected]	None	`0`	24.4 kB	iryusa
npm/[email protected]	None	`0`	5.34 kB	iryusa
npm/[email protected]	None	`0`	9.02 kB	iryusa
npm/[email protected]	None	`0`	8.48 kB	iryusa
npm/[email protected]	None	`0`	30 kB	iryusa
npm/[email protected]	None	`0`	8.06 kB	iryusa
npm/[email protected]	None	`0`	10.5 kB	iryusa
npm/[email protected]	None	`0`	30.8 kB	blakeembrey

View full report↗︎

sonarqubecloud · 2025-03-13T17:25:52Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

renovate bot added the dependencies label Aug 6, 2024

renovate bot had a problem deploying to review August 6, 2024 06:21 Error

renovate bot force-pushed the renovate/npm-sentry-nextjs-vulnerability branch from e2a8f88 to 96cca22 Compare September 1, 2024 23:29

renovate bot had a problem deploying to review September 1, 2024 23:29 Failure

renovate bot force-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 96cca22 to 2ef6b76 Compare October 9, 2024 10:28

renovate bot had a problem deploying to review October 9, 2024 10:28 Failure

renovate bot force-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 2ef6b76 to 9b492c5 Compare December 2, 2024 10:13

renovate bot had a problem deploying to review December 2, 2024 10:13 Failure

renovate bot force-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 9b492c5 to f7da420 Compare January 23, 2025 19:12

renovate bot had a problem deploying to review January 23, 2025 19:12 Error

renovate bot force-pushed the renovate/npm-sentry-nextjs-vulnerability branch from f7da420 to 475338c Compare February 9, 2025 15:08

renovate bot had a problem deploying to review February 9, 2025 15:08 Failure

renovate bot force-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 475338c to 736e906 Compare March 11, 2025 16:32

renovate bot had a problem deploying to review March 11, 2025 16:32 Error

fix(deps): update dependency @sentry/nextjs to v7.77.0 [security]

54a1a45

renovate bot force-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 736e906 to 54a1a45 Compare March 13, 2025 17:25

renovate bot requested a deployment to review March 13, 2025 17:25 Waiting

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency @sentry/nextjs to v7.77.0 [security] #628

fix(deps): update dependency @sentry/nextjs to v7.77.0 [security] #628

renovate bot commented Aug 6, 2024 •

edited

Loading

socket-security bot commented Aug 6, 2024 •

edited

Loading

sonarqubecloud bot commented Sep 1, 2024

sonarqubecloud bot commented Oct 9, 2024

sonarqubecloud bot commented Dec 2, 2024

socket-security bot commented Mar 13, 2025

sonarqubecloud bot commented Mar 13, 2025

fix(deps): update dependency @sentry/nextjs to v7.77.0 [security] #628

Are you sure you want to change the base?

fix(deps): update dependency @sentry/nextjs to v7.77.0 [security] #628

Conversation

renovate bot commented Aug 6, 2024 • edited Loading

GitHub Vulnerability Alerts

CVE-2023-46729

Impact

Patches

Workarounds

References

Credits

Release Notes

v7.77.0

v7.76.0

Important Changes

Other Changes

v7.75.1

v7.75.0

Important Changes

Other Changes

Bundle size 📦

Configuration

socket-security bot commented Aug 6, 2024 • edited Loading

Next steps

sonarqubecloud bot commented Sep 1, 2024

Quality Gate passed

sonarqubecloud bot commented Oct 9, 2024

Quality Gate passed

sonarqubecloud bot commented Dec 2, 2024

Quality Gate passed

socket-security bot commented Mar 13, 2025

sonarqubecloud bot commented Mar 13, 2025

Quality Gate passed

renovate bot commented Aug 6, 2024 •

edited

Loading

`v7.77.0`

`v7.76.0`

`v7.75.1`

`v7.75.0`

socket-security bot commented Aug 6, 2024 •

edited

Loading