Block builds on vulnerable nextjs versions #447
Conversation
This reverts commit 71a239c.
annajowang
requested review from
Yuangwang,
blidd-google,
jamesdaniels,
leoortizz,
sjjj986 and
taeold
as code owners
Summary of ChangesHello @annajowang, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a critical security enhancement by integrating a version validation step into the Next.js application build process. Its primary goal is to prevent the deployment of applications that rely on Next.js versions known to contain security vulnerabilities, specifically CVE-2025-55182. By proactively blocking builds with unsafe versions, this change significantly improves the overall security posture of applications using the adapter, guiding developers towards using patched and secure Next.js releases. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](http://www.gproxx.com/https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a check to block builds on vulnerable Next.js versions. It adds a new function checkNextJSVersion that validates the framework version against a list of safe versions using semver. The changes include adding tests for this new functionality and pinning the semver dependency. My main feedback is regarding the error message thrown for vulnerable versions, which contains placeholder CVE numbers and a broken link. This should be corrected to avoid confusing users.
| } | ||
| if (!satisfies(version, SAFE_NEXTJS_VERSIONS)) { | ||
| throw new Error( | ||
| `CVE-2025-55182: Vulnerable Next version ${version} detected. Deployment blocked. Update your app's dependencies to a patched Next.js version and redeploy: https://nextjs.org/blog/CVE-2025-66478#fixed-versions`, |
There was a problem hiding this comment.
The error message contains placeholder CVE numbers and a broken link. This will be confusing for users who encounter this error. Please replace CVE-2025-55182 and CVE-2025-66478 with the actual CVE identifier for the vulnerability being addressed. The URL https://nextjs.org/blog/CVE-2025-66478#fixed-versions is also incorrect and should be updated to point to the official security advisory.
If a specific CVE is not yet available, I suggest using a more generic but still helpful message.
| `CVE-2025-55182: Vulnerable Next version ${version} detected. Deployment blocked. Update your app's dependencies to a patched Next.js version and redeploy: https://nextjs.org/blog/CVE-2025-66478#fixed-versions`, | |
| `Vulnerable Next.js version ${version} detected. Deployment blocked due to a security vulnerability. Please update your app's dependencies to a patched Next.js version and redeploy. For more information, see the Next.js security advisories.` |
| export const { satisfies } = semVer; | ||
|
|
||
| const SAFE_NEXTJS_VERSIONS = | ||
| ">=16.1.0 || ~16.0.7 || ~v15.5.7 || ~v15.4.8 || ~v15.3.6 || ~v15.2.6 || ~v15.1.9 || ~v15.0.5 || <14.3.0-canary.77"; |
There was a problem hiding this comment.
Nit, <14.3.0-canary.77 will match all the 14.3.0 range due to limitations matching canary with semver. That's fine. Safer.
This reverts commit 714b0e6.
2 participants
Reverts #446
and add semver to
dependencies