mirror of
https://github.com/umami-software/umami.git
synced 2026-02-04 04:37:11 +01:00
1ac2f6bb03
React Flight / Next.js RCE Advisory - Vulnerability Fix and Update Report ## Summary The umami repository was affected by the React Flight / Next.js RCE advisory. The repository had Next.js 15.5.3, which is vulnerable. This has been updated to the patched version 15.5.7. ## Affected Package Detection Inspected all package.json files in the repository: - Root package.json: ./package.json - Monorepo: Not a monorepo (pnpm workspace configured but only root package.json with meaningful dependencies) ## Changes Applied ### Next.js Vulnerability Fix ✅ **PATCHED** - Updated next from 15.5.3 to 15.5.7 - Previous version: next@15.5.3 (vulnerable) - Updated version: next@15.5.7 (patched) - This is the correct patch version for the 15.5.x line per the advisory - Addresses the React Flight RCE vulnerability (CVE impact on Next.js) ### React Flight Packages Status ✅ **NOT AFFECTED** - Project does not use React Flight packages - Project does NOT use react-server-dom-webpack - Project does NOT use react-server-dom-parcel - Project does NOT use react-server-dom-turbopack - No React Flight specific patches required ### React & React-DOM Status ✅ **NO MANUAL CHANGES NEEDED** - Project uses React 19.2.0 and React-DOM 19.2.0 - These versions remain unchanged (correctly per the advisory) - react and react-dom themselves are not vulnerable - Next.js 15.5.7 provides the necessary security patches - Per the advisory: "For Next.js projects, do not manually upgrade react or react-dom" ## Files Modified 1. **package.json** - Changed: `"next": "15.5.3"` → `"next": "15.5.7"` 2. **pnpm-lock.yaml** - Updated dependency locks to reflect Next.js 15.5.7 - Cleaned up unused transitive dependencies (previous versions of sharp and emnapi) ## Verification Performed ✅ **Build Verification**: Next.js build completed successfully with `npm run build-app` - Output shows all pages compiled correctly - No build errors introduced by the package update ✅ **Lockfile Verification**: pnpm-lock.yaml correctly resolves to: - next@15.5.7 (with expected dependencies) - react@19.2.0 (unchanged as recommended) - react-dom@19.2.0 (unchanged as recommended) ## Conclusion The vulnerability has been successfully patched. The repository now uses the secure version of Next.js (15.5.7) that addresses the React Flight RCE advisory. The build completes successfully, confirming compatibility with the patched version. No other changes were required as the project does not use any React Flight packages. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
190 lines
6.5 KiB
JSON
190 lines
6.5 KiB
JSON
{
|
|
"name": "umami",
|
|
"version": "3.0.1",
|
|
"description": "A modern, privacy-focused alternative to Google Analytics.",
|
|
"author": "Umami Software, Inc. <hello@umami.is>",
|
|
"license": "MIT",
|
|
"homepage": "https://umami.is",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/umami-software/umami.git"
|
|
},
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "next dev -p 3001 --turbo",
|
|
"build": "npm-run-all check-env build-db check-db build-tracker build-geo build-app",
|
|
"start": "next start",
|
|
"build-docker": "npm-run-all build-db build-tracker build-geo build-app",
|
|
"start-docker": "npm-run-all check-db update-tracker start-server",
|
|
"start-env": "node scripts/start-env.js",
|
|
"start-server": "node server.js",
|
|
"build-app": "next build --turbo",
|
|
"build-icons": "svgr ./src/assets --out-dir src/components/svg --typescript",
|
|
"build-components": "tsup",
|
|
"build-tracker": "rollup -c rollup.tracker.config.js",
|
|
"build-prisma-client": "node scripts/build-prisma-client.js",
|
|
"build-lang": "npm-run-all format-lang compile-lang download-country-names download-language-names clean-lang",
|
|
"build-geo": "node scripts/build-geo.js",
|
|
"build-db": "npm-run-all build-db-client build-prisma-client",
|
|
"build-db-schema": "prisma db pull",
|
|
"build-db-client": "prisma generate",
|
|
"update-tracker": "node scripts/update-tracker.js",
|
|
"update-db": "prisma migrate deploy",
|
|
"check-db": "node scripts/check-db.js",
|
|
"check-env": "node scripts/check-env.js",
|
|
"copy-db-files": "node scripts/copy-db-files.js",
|
|
"extract-messages": "formatjs extract \"src/components/messages.ts\" --out-file build/extracted-messages.json",
|
|
"merge-messages": "node scripts/merge-messages.js",
|
|
"generate-lang": "npm-run-all extract-messages merge-messages",
|
|
"format-lang": "node scripts/format-lang.js",
|
|
"compile-lang": "formatjs compile-folder --ast build/messages public/intl/messages",
|
|
"clean-lang": "prettier --write ./public/intl/**/*.json",
|
|
"download-country-names": "node scripts/download-country-names.js",
|
|
"download-language-names": "node scripts/download-language-names.js",
|
|
"change-password": "node scripts/change-password.js",
|
|
"lint": "next lint --quiet",
|
|
"prepare": "node -e \"if (process.env.NODE_ENV !== 'production'){process.exit(1)} \" || husky install",
|
|
"postbuild": "node scripts/postbuild.js",
|
|
"test": "jest",
|
|
"cypress-open": "cypress open cypress run",
|
|
"cypress-run": "cypress run cypress run"
|
|
},
|
|
"lint-staged": {
|
|
"**/*.{js,jsx,ts,tsx}": [
|
|
"prettier --write",
|
|
"eslint"
|
|
],
|
|
"**/*.css": [
|
|
"stylelint --fix",
|
|
"prettier --write"
|
|
],
|
|
"**/*.json": [
|
|
"prettier --write"
|
|
]
|
|
},
|
|
"cacheDirectories": [
|
|
".next/cache"
|
|
],
|
|
"dependencies": {
|
|
"@clickhouse/client": "^1.12.0",
|
|
"@date-fns/utc": "^1.2.0",
|
|
"@dicebear/collection": "^9.2.3",
|
|
"@dicebear/core": "^9.2.3",
|
|
"@fontsource/inter": "^5.2.8",
|
|
"@hello-pangea/dnd": "^17.0.0",
|
|
"@prisma/adapter-pg": "^6.18.0",
|
|
"@prisma/client": "^6.18.0",
|
|
"@prisma/extension-read-replicas": "^0.4.1",
|
|
"@react-spring/web": "^10.0.3",
|
|
"@svgr/cli": "^8.1.0",
|
|
"@tanstack/react-query": "^5.90.5",
|
|
"@umami/react-zen": "^0.207.0",
|
|
"@umami/redis-client": "^0.29.0",
|
|
"bcryptjs": "^3.0.2",
|
|
"chalk": "^5.6.2",
|
|
"chart.js": "^4.5.1",
|
|
"chartjs-adapter-date-fns": "^3.0.0",
|
|
"classnames": "^2.3.1",
|
|
"colord": "^2.9.2",
|
|
"cors": "^2.8.5",
|
|
"cross-spawn": "^7.0.3",
|
|
"date-fns": "^2.23.0",
|
|
"date-fns-tz": "^1.1.4",
|
|
"debug": "^4.4.3",
|
|
"del": "^6.0.0",
|
|
"detect-browser": "^5.2.0",
|
|
"dotenv": "^17.2.3",
|
|
"esbuild": "^0.25.11",
|
|
"eslint-plugin-promise": "^6.1.1",
|
|
"fs-extra": "^11.3.2",
|
|
"immer": "^10.2.0",
|
|
"ipaddr.js": "^2.0.1",
|
|
"is-ci": "^3.0.1",
|
|
"is-docker": "^3.0.0",
|
|
"is-localhost-ip": "^2.0.0",
|
|
"isbot": "^5.1.31",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"jszip": "^3.10.1",
|
|
"kafkajs": "^2.1.0",
|
|
"lucide-react": "^0.543.0",
|
|
"maxmind": "^5.0.0",
|
|
"next": "15.5.7",
|
|
"node-fetch": "^3.2.8",
|
|
"npm-run-all": "^4.1.5",
|
|
"papaparse": "^5.5.3",
|
|
"pg": "^8.16.3",
|
|
"prisma": "^6.18.0",
|
|
"pure-rand": "^7.0.1",
|
|
"react": "^19.2.0",
|
|
"react-dom": "^19.2.0",
|
|
"react-error-boundary": "^4.0.4",
|
|
"react-intl": "^7.1.14",
|
|
"react-simple-maps": "^2.3.0",
|
|
"react-use-measure": "^2.0.4",
|
|
"react-window": "^1.8.6",
|
|
"request-ip": "^3.3.0",
|
|
"semver": "^7.7.3",
|
|
"serialize-error": "^12.0.0",
|
|
"thenby": "^1.3.4",
|
|
"ua-parser-js": "^2.0.6",
|
|
"uuid": "^11.1.0",
|
|
"zod": "^4.1.12",
|
|
"zustand": "^5.0.8"
|
|
},
|
|
"devDependencies": {
|
|
"@formatjs/cli": "^4.2.29",
|
|
"@netlify/plugin-nextjs": "^5.14.4",
|
|
"@rollup/plugin-alias": "^5.0.0",
|
|
"@rollup/plugin-commonjs": "^25.0.4",
|
|
"@rollup/plugin-json": "^6.0.0",
|
|
"@rollup/plugin-node-resolve": "^15.2.0",
|
|
"@rollup/plugin-replace": "^5.0.2",
|
|
"@rollup/plugin-terser": "^0.4.4",
|
|
"@rollup/plugin-typescript": "^12.3.0",
|
|
"@types/jest": "^30.0.0",
|
|
"@types/node": "^24.9.2",
|
|
"@types/react": "^19.2.2",
|
|
"@types/react-dom": "^19.2.2",
|
|
"@types/react-window": "^1.8.8",
|
|
"@typescript-eslint/eslint-plugin": "^8.46.2",
|
|
"@typescript-eslint/parser": "^8.46.2",
|
|
"babel-plugin-react-compiler": "19.1.0-rc.2",
|
|
"cross-env": "^10.1.0",
|
|
"cypress": "^13.6.6",
|
|
"eslint": "^8.33.0",
|
|
"eslint-config-next": "^14.2.33",
|
|
"eslint-config-prettier": "^10.1.8",
|
|
"eslint-import-resolver-alias": "^1.1.2",
|
|
"eslint-plugin-css-modules": "^2.12.0",
|
|
"eslint-plugin-cypress": "^2.15.1",
|
|
"eslint-plugin-import": "^2.32.0",
|
|
"eslint-plugin-jest": "^27.9.0",
|
|
"eslint-plugin-prettier": "^5.5.3",
|
|
"extract-react-intl-messages": "^4.1.1",
|
|
"husky": "^9.1.7",
|
|
"jest": "^29.7.0",
|
|
"lint-staged": "^16.2.6",
|
|
"postcss": "^8.5.6",
|
|
"postcss-flexbugs-fixes": "^5.0.2",
|
|
"postcss-import": "^15.1.0",
|
|
"postcss-preset-env": "7.8.3",
|
|
"prettier": "^3.6.2",
|
|
"prompts": "2.4.2",
|
|
"rollup": "^4.52.5",
|
|
"rollup-plugin-copy": "^3.4.0",
|
|
"rollup-plugin-delete": "^3.0.1",
|
|
"rollup-plugin-dts": "^6.2.3",
|
|
"rollup-plugin-node-externals": "^8.1.1",
|
|
"rollup-plugin-peer-deps-external": "^2.2.4",
|
|
"rollup-plugin-postcss": "^4.0.2",
|
|
"stylelint": "^15.10.1",
|
|
"stylelint-config-css-modules": "^4.5.1",
|
|
"stylelint-config-prettier": "^9.0.3",
|
|
"stylelint-config-recommended": "^14.0.0",
|
|
"tar": "^6.1.2",
|
|
"ts-jest": "^29.4.5",
|
|
"ts-node": "^10.9.1",
|
|
"tsup": "^8.5.0",
|
|
"typescript": "^5.9.3"
|
|
}
|
|
}
|