Skip to content

chore(deps): update dependency @opennextjs/cloudflare to v1.17.1 [security]#331

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-opennextjs-cloudflare-vulnerability
Open

chore(deps): update dependency @opennextjs/cloudflare to v1.17.1 [security]#331
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-opennextjs-cloudflare-vulnerability

Conversation

@renovate
Copy link
Copy Markdown

@renovate renovate bot commented Mar 5, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
@opennextjs/cloudflare (source) 1.6.2 → 1.17.1 age confidence

GitHub Vulnerability Alerts

CVE-2026-3125

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @​opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler.

The @​opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for development use only. In production, Cloudflare's edge intercepts /cdn-cgi/image/ requests before they reach the Worker. However, by substituting a backslash for a forward slash (/cdn-cgi\image/ instead of /cdn-cgi/image/), an attacker can bypass edge interception and have the request reach the Worker directly. The JavaScript URL class then normalizes the backslash to a forward slash, causing the request to match the handler and trigger an unvalidated fetch of arbitrary remote URLs.

For example: https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com

In this example, attacker-controlled content from attacker.com is served through the victim site's domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.

Note: This bypass only works via HTTP clients that preserve backslashes in paths (e.g., curl --path-as-is). Browsers normalize backslashes to forward slashes before sending requests.

Additionally, Cloudflare Workers with Assets and Cloudflare Pages suffer from a similar vulnerability. Assets stored under /cdn-cgi/ paths are not publicly accessible under normal conditions. However, using the same backslash bypass (/cdn-cgi... instead of /cdn-cgi/...), these assets become publicly accessible. This could be used to retrieve private data. For example, Open Next projects store incremental cache data under /cdn-cgi/_next_cache, which could be exposed via this bypass.

Impact

  • SSRF via path normalization bypass of Cloudflare edge interception
  • Arbitrary remote content loading under the victim site's domain
  • Same-origin policy bypass
  • Potential for infrastructure abuse (scanning from Cloudflare IP space, worker resource exhaustion)
  • Exposure of private assets stored under /cdn-cgi/ paths. For example, Open Next projects store incremental cache data under /cdn-cgi/_next_cache, which could be exposed via this bypass.

Credits

Disclosed responsibly by security researcher @​Ezzer17.

Mitigations

The following mitigations have been put in place:

Server-side updates to Cloudflare's Workers platform to block backslash path normalization bypasses for /cdn-cgi requests. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare Workers.

In addition to the platform level fix, Root cause fix has been implemented to the Cloudflare adapter for Open Next. The patched version of the adapter is found at @​opennextjs/cloudflare@1.17.1 (https://www.npmjs.com/package/@​opennextjs/cloudflare)

Dependency update to the Next.js template used with create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. Despite the automatic mitigation deployed on Cloudflare's platform, we encourage affected users to upgrade to the patched version of @​opennextjs/cloudflare.

Release Notes

opennextjs/opennextjs-cloudflare (@​opennextjs/cloudflare)

v1.17.1

Compare Source

Patch Changes

v1.17.0

Compare Source

Minor Changes
  • #​1133 25d5835 Thanks @​dario-piotrowicz! - Update the migrate command to attempt to create an R2 bucket for caching, if that is not possible an application without caching enabled will be generated instead.

v1.16.6

Compare Source

Patch Changes
  • #​1138 4487f1f Thanks @​james-elicx! - Fix the CLI potentially setting a future compatibility date in the wrangler config when workerd has published a version matching a future date, by capping to the current date.

v1.16.5

Compare Source

Patch Changes

v1.16.4

Compare Source

Patch Changes

v1.16.3

Compare Source

Patch Changes

v1.16.2

Compare Source

Patch Changes

v1.16.1

Compare Source

Patch Changes

v1.16.0

Compare Source

Minor Changes

  • #​1083 b062597 Thanks @​dario-piotrowicz! - feature: add migrate command to set up OpenNext for Cloudflare adapter

    This command helps users migrate existing Next.js applications to the OpenNext Cloudflare adapter by automatically setting up all necessary configuration files, dependencies, and scripts.

    To use the command simply run: npx opennextjs-cloudflare migrate

Patch Changes

  • #​1092 4279043 Thanks @​vicb! - Check for supported Next version

    The build will now error for unsupported Next version which may contain unpatched security vulnerabilities.
    You can bypass the check using the --dangerouslyUseUnsupportedNextVersion flag.

v1.15.1

Compare Source

Patch Changes

v1.15.0

Compare Source

Minor Changes
Patch Changes

v1.14.10

Compare Source

Patch Changes

v1.14.9

Compare Source

Patch Changes

v1.14.8

Compare Source

Patch Changes

v1.14.7

Compare Source

Patch Changes

v1.14.6

Compare Source

Patch Changes

v1.14.5

Compare Source

Patch Changes

v1.14.4

Compare Source

Patch Changes

v1.14.3

Compare Source

Patch Changes

v1.14.2

Compare Source

Patch Changes

v1.14.1

Compare Source

Patch Changes

v1.14.0

Compare Source

Minor Changes

v1.13.1

Compare Source

Patch Changes

v1.13.0

Compare Source

Minor Changes
Patch Changes

v1.12.0

Compare Source

Minor Changes

v1.11.1

Compare Source

Patch Changes

v1.11.0

Compare Source

Minor Changes

  • #​925 62fee71 Thanks @​krzysztof-palka-monogo! - feature: optional batch upload for faster R2 cache population

    This update adds optional batch upload support for R2 cache population, significantly improving upload performance for large caches when enabled via .env or environment variables.

    Key Changes:

    1. Optional Batch Upload: Configure R2 credentials via .env or environment variables to enable faster batch uploads:

      • R2_ACCESS_KEY_ID
      • R2_SECRET_ACCESS_KEY
      • CF_ACCOUNT_ID

    2. Automatic Detection: When credentials are detected, batch upload is automatically used for better performance

    3. Smart Fallback: If credentials are not configured, the CLI falls back to standard Wrangler uploads with a helpful message about enabling batch upload for better performance

    All deployment commands support batch upload:

    • populateCache - Explicit cache population
    • deploy - Deploy with cache population
    • upload - Upload version with cache population
    • preview - Preview with cache population

    Performance Benefits (when batch upload is enabled):

    • Parallel transfer capabilities (32 concurrent transfers)
    • Significantly faster for large caches
    • Reduced API calls to Cloudflare

    Usage:

    Add the credentials in a .env/.dev.vars file in your project root:

    R2_ACCESS_KEY_ID=your_key
R2_SECRET_ACCESS_KEY=your_secret
CF_ACCOUNT_ID=your_account

    You can also set the environment variables for CI builds.

    Note:

    You can follow documentation https://developers.cloudflare.com/r2/api/tokens/ for creating API tokens with appropriate permissions for R2 access.

Patch Changes

v1.10.1

Compare Source

Patch Changes

v1.10.0

Compare Source

Minor Changes

  • #​937 32ba91a Thanks @​vicb! - feat: retrieve CLI environment variables from process.env and .env* files

    Recommended usage on CI:

    • Add your secrets to process.env (i.e. CF_ACCOUNT_ID)
    • Add public values to the wrangler config wrangler.jsonc (i.e. R2_CACHE_PREFIX_ENV_NAME)

    Recommended usage for local dev:

    • Add your secrets to either a .dev.vars* or .env* file (i.e. CF_ACCOUNT_ID)
    • Add public values to the wrangler config wrangler.jsonc (i.e. R2_CACHE_PREFIX_ENV_NAME)
Patch Changes

v1.9.2

Compare Source

Patch Changes

v1.9.1

Compare Source

Patch Changes

v1.9.0

Compare Source

Minor Changes
Patch Changes

v1.8.5

Compare Source

Patch Changes

  • #​901 17a4bea Thanks @​vicb! - chore: bump wrangler to ^4.38.0

  • #​903 7fced0f Thanks @​vicb! - fix: enable using workerd process v2

    process v2 is an updated version of node:process active by default after 2025-09-15

v1.8.4

Compare Source

Patch Changes

  • #​888 51322a8 Thanks @​james-elicx! - fix: remote flag not working for preview command's cache population

    Previously, passing the --remote flag when running opennextjs-cloudflare preview --remote would not result in the remote preview binding being populated, and would throw errors due to a missing preview flag when populating Workers KV. The remote flag is now supported for the cache popoulation step when running the preview command.

    • opennextjs-cloudflare preview --remote will populate the remote binding for the preview ID specified in your Wrangler config.
    • opennextjs-cloudflare preview will continue to populate the local binding in your Wrangler config.

v1.8.3

Compare Source

Patch Changes

v1.8.2

Compare Source

Patch Changes

v1.8.1

Compare Source

Patch Changes

v1.8.0

Compare Source

Minor Changes
Patch Changes

v1.7.1

Compare Source

Patch Changes

v1.7.0

Compare Source

Minor Changes

  • #​848 f80c801 Thanks @​sommeeeer! - Ensure that the initial request.signal is passed to the wrapper

    request.signal.onabort is now supported in route handlers. It requires that the signal from the original worker's request is passed to the handler. It will then pass along that AbortSignal through the streamCreator in the wrapper. This signal will destroy the response sent to NextServer when a client aborts, thus triggering the signal in the route handler.

    See the changelog in Cloudflare here.

    Note:
    If you have a custom worker, you must update your code to pass the original request.signal to the handler. You also need to enable the compatibility flag enable_request_signal to use this feature.

    For example:

    // Before:
return handler(reqOrResp, env, ctx);

// After:
return handler(reqOrResp, env, ctx, request.signal);

  • #​850 ce5c7b4 Thanks @​dario-piotrowicz! - Add option for regional cache to skip tagCache on cache hits

    When the tag regional cache finds a value in the incremental cache, checking such value in the tagCache can be skipped, this helps reducing response times at the tradeoff that the user needs to either use the automatic cache purging or manually purge the cache when appropriate. For this the bypassTagCacheOnCacheHit option is being added to the RegionalCache class.

    Example:

    import { defineCloudflareConfig } from "@​opennextjs/cloudflare";
import d1NextTagCache from "@​opennextjs/cloudflare/overrides/tag-cache/d1-next-tag-cache";
import memoryQueue from "@​opennextjs/cloudflare/overrides/queue/memory-queue";
import r2IncrementalCache from "@​opennextjs/cloudflare/overrides/incremental-cache/r2-incremental-cache";
import { withRegionalCache } from "@​opennextjs/cloudflare/overrides/incremental-cache/regional-cache";

export default defineCloudflareConfig({
	incrementalCache: withRegionalCache(r2IncrementalCache, {
		mode: "long-lived",
		bypassTagCacheOnCacheHit: true,
	}),
	tagCache: d1NextTagCache,
	queue: memoryQueue,
});
Patch Changes

v1.6.5

Compare Source

Patch Changes

v1.6.4

Compare Source

Patch Changes

v1.6.3

Compare Source

Patch Changes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (squash) March 5, 2026 05:13
@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 5, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​opennextjs/​cloudflare@​1.6.2 ⏵ 1.17.198100 +1690 +295100

View full report

@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 5, 2026 •
edited
Loading

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
Trivial package: npm is-arrayish has 8 lines of code

Location: Package overview

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/is-arrayish@0.2.1

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/is-arrayish@0.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm is-arrayish has 8 lines of code

Location: Package overview

From: ? → npm/sharp@0.34.3 → npm/wrangler@4.26.1 → npm/is-arrayish@0.3.4

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/is-arrayish@0.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm real-require has 10 lines of code

Location: Package overview

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/@payloadcms/sdk@3.68.5 → npm/real-require@0.2.0

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/real-require@0.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm miniflare is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/miniflare@4.20260317.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/miniflare@4.20260317.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
High CVE: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

CVE: GHSA-f269-vfmq-vjvj Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client (HIGH)

Affected versions: >= 6.0.0 < 6.24.0; >= 7.0.0 < 7.24.0

Patched version: 7.24.0

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/@payloadcms/sdk@3.68.5 → npm/undici@7.10.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@7.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
High CVE: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

CVE: GHSA-v9p9-hfj2-hcw8 Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation (HIGH)

Affected versions: < 6.24.0; >= 7.0.0 < 7.24.0

Patched version: 7.24.0

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/@payloadcms/sdk@3.68.5 → npm/undici@7.10.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@7.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
High CVE: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

CVE: GHSA-vrm6-8vpv-qv8q Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression (HIGH)

Affected versions: < 6.24.0; >= 7.0.0 < 7.24.0

Patched version: 7.24.0

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/@payloadcms/sdk@3.68.5 → npm/undici@7.10.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@7.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
System shell access: npm miniflare in module child_process

Module: child_process

Location: Package overview

From: ? → npm/wrangler@4.26.1 → npm/miniflare@4.20250726.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/miniflare@4.20250726.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Deprecated by its maintainer: npm scmp

Reason: Just use Node.js's crypto.timingSafeEqual()

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/@payloadcms/sdk@3.68.5 → npm/scmp@2.1.0

ℹ Read more on: This package | This alert | What is a deprecated package?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/scmp@2.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
System shell access: npm workerd in module child_process

Module: child_process

Location: Package overview

From: ? → npm/wrangler@4.26.1 → npm/workerd@1.20250726.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/workerd@1.20250726.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm @jsdevtools/ono was last published 6 years ago

Last Publish: 7/15/2020, 10:29:27 AM

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/@payloadcms/sdk@3.68.5 → npm/@jsdevtools/ono@7.1.3

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@jsdevtools/ono@7.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm @protobufjs/aspromise was last published 9 years ago

Last Publish: 4/24/2017, 10:38:32 AM

From: ? → npm/posthog-js@1.363.6 → npm/@protobufjs/aspromise@1.1.2

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/aspromise@1.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm @protobufjs/base64 was last published 9 years ago

Last Publish: 6/9/2017, 9:32:02 AM

From: ? → npm/posthog-js@1.363.6 → npm/@protobufjs/base64@1.1.2

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/base64@1.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm @protobufjs/codegen was last published 9 years ago

Last Publish: 6/9/2017, 8:56:18 PM

From: ? → npm/posthog-js@1.363.6 → npm/@protobufjs/codegen@2.0.4

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/codegen@2.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm @protobufjs/eventemitter was last published 9 years ago

Last Publish: 1/25/2017, 6:12:24 PM

From: ? → npm/posthog-js@1.363.6 → npm/@protobufjs/eventemitter@1.1.0

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/eventemitter@1.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm @protobufjs/fetch was last published 9 years ago

Last Publish: 1/27/2017, 3:50:55 PM

From: ? → npm/posthog-js@1.363.6 → npm/@protobufjs/fetch@1.1.0

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/fetch@1.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm @protobufjs/float was last published 9 years ago

Last Publish: 4/2/2017, 10:45:42 AM

From: ? → npm/posthog-js@1.363.6 → npm/@protobufjs/float@1.0.2

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/float@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm @protobufjs/inquire was last published 9 years ago

Last Publish: 1/25/2017, 6:13:02 PM

From: ? → npm/posthog-js@1.363.6 → npm/@protobufjs/inquire@1.1.0

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/inquire@1.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm @protobufjs/path was last published 9 years ago

Last Publish: 2/23/2017, 4:54:18 PM

From: ? → npm/posthog-js@1.363.6 → npm/@protobufjs/path@1.1.2

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/path@1.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm @protobufjs/pool was last published 9 years ago

Last Publish: 1/25/2017, 6:13:19 PM

From: ? → npm/posthog-js@1.363.6 → npm/@protobufjs/pool@1.1.0

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/pool@1.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm @protobufjs/utf8 was last published 9 years ago

Last Publish: 1/25/2017, 6:15:35 PM

From: ? → npm/posthog-js@1.363.6 → npm/@protobufjs/utf8@1.1.0

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/utf8@1.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Publisher changed: npm anymatch is now published by phated instead of paulmillr

New Author: phated

Previous Author: paulmillr

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/@opennextjs/cloudflare@1.17.1 → npm/next@15.3.5 → npm/anymatch@3.1.3

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/anymatch@3.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm argparse was last published 6 years ago

Last Publish: 8/28/2020, 9:14:26 PM

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/@payloadcms/sdk@3.68.5 → npm/argparse@2.0.1

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/argparse@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm atomic-sleep was last published 6 years ago

Last Publish: 3/9/2020, 6:56:01 PM

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/@payloadcms/sdk@3.68.5 → npm/atomic-sleep@1.0.0

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/atomic-sleep@1.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Publisher changed: npm cosmiconfig is now published by d-fischer instead of davidtheclark

New Author: d-fischer

Previous Author: davidtheclark

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/cosmiconfig@7.1.0

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cosmiconfig@7.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm cssesc was last published 7 years ago

Last Publish: 2/4/2019, 4:34:20 PM

From: ? → npm/@tailwindcss/typography@0.5.16 → npm/cssesc@3.0.0

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cssesc@3.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm ee-first was last published 11 years ago

Last Publish: 5/25/2015, 7:18:28 PM

From: ? → npm/@opennextjs/cloudflare@1.17.1 → npm/ee-first@1.1.1

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ee-first@1.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Unmaintained: npm fast-deep-equal was last published 6 years ago

Last Publish: 6/8/2020, 7:27:28 AM

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/@payloadcms/sdk@3.68.5 → npm/fast-deep-equal@3.1.3

ℹ Read more on: This package | This alert | What are unmaintained packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-deep-equal@3.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Publisher changed: npm find-root is now published by jsdnxx instead of jden

New Author: jsdnxx

Previous Author: jden

From: ? → npm/@payloadcms/richtext-lexical@3.68.5 → npm/find-root@1.1.0

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/find-root@1.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 26 more rows in the dashboard

View full report

@renovate renovate bot force-pushed the renovate/npm-opennextjs-cloudflare-vulnerability branch from 01d9d6c to e6f3535 Compare March 13, 2026 17:02
@renovate renovate bot force-pushed the renovate/npm-opennextjs-cloudflare-vulnerability branch from e6f3535 to 33a8327 Compare March 22, 2026 18:56
@renovate renovate bot changed the title Update dependency @opennextjs/cloudflare to v1.17.1 [SECURITY] chore(deps): update dependency @opennextjs/cloudflare to v1.17.1 [security] Mar 22, 2026
@renovate renovate bot force-pushed the renovate/npm-opennextjs-cloudflare-vulnerability branch from 33a8327 to 22cefa6 Compare March 26, 2026 18:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants