[Snyk] Upgrade next from 12.1.6 to 12.3.7 by q1blue · Pull Request #626 · https-quantumblockchainai-atlassian-net/layer0-startup

q1blue · 2026-02-13T06:43:17Z

Snyk has created this PR to upgrade next from 12.1.6 to 12.3.7.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 158 versions ahead of your current version.
The recommended version was released a year ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Improper Input Validation SNYK-JS-NANOID-8492085	40	No Known Exploit
	Improper Authorization SNYK-JS-NEXT-9508709	40	Mature

Release notes

Package name: next

12.3.7 - 2025-03-28
Note
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
- Lock swc binaries version
12.3.6 - 2025-03-24
Note
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
- Match subrequest handling for edge and node
- Update publish-native
12.3.5 - 2025-03-23
12.3.4 - 2022-11-21
12.3.3 - 2022-11-09
12.3.2 - 2022-10-30
12.3.2-canary.43 - 2022-10-25
12.3.2-canary.42 - 2022-10-25
12.3.2-canary.41 - 2022-10-25
12.3.2-canary.40 - 2022-10-25
12.3.2-canary.39 - 2022-10-24
12.3.2-canary.38 - 2022-10-24
12.3.2-canary.35 - 2022-10-23
12.3.2-canary.34 - 2022-10-23
12.3.2-canary.33 - 2022-10-22
12.3.2-canary.32 - 2022-10-19
12.3.2-canary.31 - 2022-10-19
12.3.2-canary.30 - 2022-10-18
12.3.2-canary.29 - 2022-10-16
12.3.2-canary.28 - 2022-10-13
12.3.2-canary.27 - 2022-10-13
12.3.2-canary.26 - 2022-10-12
12.3.2-canary.25 - 2022-10-11
12.3.2-canary.24 - 2022-10-11
12.3.2-canary.23 - 2022-10-08
12.3.2-canary.22 - 2022-10-07
12.3.2-canary.21 - 2022-10-06
12.3.2-canary.20 - 2022-10-05
12.3.2-canary.19 - 2022-10-04
12.3.2-canary.18 - 2022-10-04
12.3.2-canary.17 - 2022-10-02
12.3.2-canary.16 - 2022-09-30
12.3.2-canary.15 - 2022-09-29
12.3.2-canary.13 - 2022-09-29
12.3.2-canary.12 - 2022-09-28
12.3.2-canary.11 - 2022-09-27
12.3.2-canary.10 - 2022-09-27
12.3.2-canary.9 - 2022-09-26
12.3.2-canary.7 - 2022-09-23
12.3.2-canary.6 - 2022-09-23
12.3.2-canary.3 - 2022-09-22
12.3.2-canary.2 - 2022-09-22
12.3.2-canary.0 - 2022-09-21
12.3.1 - 2022-09-19
12.3.1-canary.5 - 2022-09-19
12.3.1-canary.4 - 2022-09-19
12.3.1-canary.3 - 2022-09-16
12.3.1-canary.2 - 2022-09-14
12.3.1-canary.1 - 2022-09-12
12.3.1-canary.0 - 2022-09-08
12.3.0 - 2022-09-08
12.2.6 - 2022-09-29
12.2.6-canary.13 - 2022-09-08
12.2.6-canary.12 - 2022-09-08
12.2.6-canary.11 - 2022-09-07
12.2.6-canary.10 - 2022-09-05
12.2.6-canary.9 - 2022-09-05
12.2.6-canary.8 - 2022-09-01
12.2.6-canary.7 - 2022-08-30
12.2.6-canary.6 - 2022-08-29
12.2.6-canary.5 - 2022-08-24
12.2.6-canary.4 - 2022-08-24
12.2.6-canary.3 - 2022-08-24
12.2.6-canary.2 - 2022-08-23
12.2.6-canary.1 - 2022-08-17
12.2.6-canary.0 - 2022-08-13
12.2.5 - 2022-08-12
12.2.5-canary.7 - 2022-08-12
12.2.5-canary.6 - 2022-08-11
12.2.5-canary.5 - 2022-08-11
12.2.5-canary.4 - 2022-08-11
12.2.5-canary.3 - 2022-08-11
12.2.5-canary.1 - 2022-08-09
12.2.5-canary.0 - 2022-08-09
12.2.4 - 2022-08-04
12.2.4-canary.12 - 2022-08-04
12.2.4-canary.11 - 2022-08-03
12.2.4-canary.9 - 2022-08-01
12.2.4-canary.8 - 2022-07-29
12.2.4-canary.7 - 2022-07-29
12.2.4-canary.6 - 2022-07-28
12.2.4-canary.5 - 2022-07-28
12.2.4-canary.4 - 2022-07-28
12.2.4-canary.3 - 2022-07-28
12.2.4-canary.2 - 2022-07-26
12.2.4-canary.1 - 2022-07-25
12.2.4-canary.0 - 2022-07-23
12.2.3 - 2022-07-22
12.2.3-canary.17 - 2022-07-21
12.2.3-canary.16 - 2022-07-21
12.2.3-canary.15 - 2022-07-20
12.2.3-canary.14 - 2022-07-19
12.2.3-canary.13 - 2022-07-18
12.2.3-canary.12 - 2022-07-18
12.2.3-canary.10 - 2022-07-15
12.2.3-canary.9 - 2022-07-15
12.2.3-canary.8 - 2022-07-14
12.2.3-canary.7 - 2022-07-14
12.2.3-canary.6 - 2022-07-13
12.2.3-canary.5 - 2022-07-13
12.2.3-canary.4 - 2022-07-13
12.2.3-canary.3 - 2022-07-13
12.2.3-canary.2 - 2022-07-12
12.2.3-canary.1 - 2022-07-12
12.2.3-canary.0 - 2022-07-11
12.2.2 - 2022-07-09
12.2.2-canary.0 - 2022-07-09
12.2.1 - 2022-07-07
12.2.1-canary.5 - 2022-07-07
12.2.1-canary.4 - 2022-07-06
12.2.1-canary.3 - 2022-07-05
12.2.1-canary.2 - 2022-07-02
12.2.1-canary.1 - 2022-06-29
12.2.0 - 2022-06-28
12.1.7-canary.52 - 2022-06-28
12.1.7-canary.51 - 2022-06-28
12.1.7-canary.50 - 2022-06-28
12.1.7-canary.49 - 2022-06-27
12.1.7-canary.48 - 2022-06-25
12.1.7-canary.47 - 2022-06-24
12.1.7-canary.46 - 2022-06-24
12.1.7-canary.45 - 2022-06-22
12.1.7-canary.44 - 2022-06-21
12.1.7-canary.42 - 2022-06-20
12.1.7-canary.41 - 2022-06-17
12.1.7-canary.40 - 2022-06-15
12.1.7-canary.39 - 2022-06-14
12.1.7-canary.38 - 2022-06-14
12.1.7-canary.37 - 2022-06-13
12.1.7-canary.36 - 2022-06-13
12.1.7-canary.35 - 2022-06-11
12.1.7-canary.33 - 2022-06-08
12.1.7-canary.32 - 2022-06-08
12.1.7-canary.31 - 2022-06-06
12.1.7-canary.30 - 2022-06-06
12.1.7-canary.29 - 2022-06-02
12.1.7-canary.28 - 2022-06-02
12.1.7-canary.27 - 2022-06-01
12.1.7-canary.26 - 2022-05-31
12.1.7-canary.24 - 2022-05-30
12.1.7-canary.23 - 2022-05-30
12.1.7-canary.19 - 2022-05-27
12.1.7-canary.18 - 2022-05-27
12.1.7-canary.16 - 2022-05-25
12.1.7-canary.15 - 2022-05-24
12.1.7-canary.12 - 2022-05-24
12.1.7-canary.11 - 2022-05-23
12.1.7-canary.10 - 2022-05-19
12.1.7-canary.9 - 2022-05-19
12.1.7-canary.8 - 2022-05-19
12.1.7-canary.7 - 2022-05-17
12.1.7-canary.6 - 2022-05-13
12.1.7-canary.5 - 2022-05-12
12.1.7-canary.4 - 2022-05-11
12.1.7-canary.3 - 2022-05-06
12.1.7-canary.2 - 2022-05-05
12.1.7-canary.1 - 2022-05-03
12.1.7-canary.0 - 2022-05-03
12.1.6 - 2022-05-02

from next GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade next from 12.1.6 to 12.3.7. See this package in npm: next See this project in Snyk: https://app.snyk.io/org/q1bluequantumblockchainlabs.onmicrosoft.com/project/5835c34a-15ac-4289-83bc-5faf82189fd4?utm_source=github&utm_medium=referral&page=upgrade-pr

gemini-code-assist · 2026-02-13T06:43:38Z

Summary of Changes

Hello @q1blue, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on maintaining dependency hygiene and enhancing the security posture of the project by performing a significant upgrade of the Next.js framework. The update brings the application to a more recent version, thereby resolving known security vulnerabilities and ensuring compatibility with updated underlying packages. This proactive measure helps in mitigating potential risks and keeps the project aligned with current best practices for web development.

Highlights

Next.js Upgrade: Upgraded the next dependency from version 12.1.6 to 12.3.7 to incorporate the latest features and bug fixes.
Security Vulnerability Patches: Addressed two security vulnerabilities: 'Improper Input Validation' (SNYK-JS-NANOID-8492085) and 'Improper Authorization' (SNYK-JS-NEXT-9508709) by updating next and its sub-dependencies.
Dependency Updates: Updated various related dependencies including @next/env, @next/swc-* packages, nanoid, postcss, caniuse-lite, and styled-jsx to their latest compatible versions.
New Dependencies: Introduced new dependencies @next/swc-freebsd-x64, @swc/helpers, and use-sync-external-store as part of the next upgrade.

Changelog

package-lock.json
- Reordered the lockfileVersion and requires properties.
- Updated @next/env from 12.1.6 to 12.3.7.
- Updated multiple @next/swc-* packages (e.g., android-arm-eabi, darwin-x64, linux-x64-gnu) from 12.1.6 to 12.3.4.
- Added a new optional dependency @next/swc-freebsd-x64 at version 12.3.4.
- Added @swc/helpers at version 0.4.11.
- Removed caniuse-lite as a sub-dependency of browserslist.
- Updated caniuse-lite from 1.0.30001342 to 1.0.30001767.
- Updated nanoid from 3.3.4 to 3.3.11.
- Updated next from 12.1.6 to 12.3.7, reflecting changes in its required sub-dependencies.
- Updated postcss from 8.4.5 to 8.4.14 and its internal nanoid and source-map-js requirements.
- Updated source-map-js from 1.0.2 to 1.2.1.
- Relocated the string_decoder dependency entry.
- Removed the dev: true flag from the tslib dependency.
- Added use-sync-external-store at version 1.2.0.
package.json
- Updated the next dependency from latest to 12.3.7.

Activity

This pull request was automatically created by Snyk to upgrade the next dependency.
The upgrade addresses two identified vulnerabilities: 'Improper Input Validation' (SNYK-JS-NANOID-8492085) and 'Improper Authorization' (SNYK-JS-NEXT-9508709).
Snyk recommends this upgrade as the target version is 158 versions ahead and was released approximately a year ago (based on the PR description, though release notes show a future date for 12.3.7).

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request, automatically generated by Snyk, upgrades the next package from version 12.1.6 to 12.3.7 to address security vulnerabilities. While pinning dependencies to a specific version is a good practice compared to using latest, the target version 12.3.7 appears to be problematic as it is not a standard public release and is quite outdated. This could lead to build failures and maintenance issues. I recommend upgrading to a more recent and stable version of next.

gemini-code-assist · 2026-02-13T06:44:40Z

package.json

  },
  "dependencies": {
-    "next": "latest",
+    "next": "12.3.7",


While pinning the next dependency to a specific version is a great improvement over using latest for build reproducibility, the chosen version 12.3.7 is concerning.

Non-standard Version: Version 12.3.7 does not appear to be a public release on npm. This could cause npm install to fail for developers and in CI/CD environments if they don't have access to the private registry where this version might be hosted.

Outdated Version: next.js has evolved significantly. Sticking to an old version means missing out on important performance improvements, features, and security patches that are not covered by this specific upgrade.

Inconsistent Dependencies: The package-lock.json shows that while next is updated to 12.3.7, its @next/swc-* dependencies are only updated to 12.3.4. This version mismatch within the same framework can be a source of subtle bugs.

I recommend upgrading to a more recent, stable version of next. If a major upgrade to v13 or v14 is not feasible right now, please consider at least upgrading to the latest v12 release, which is 12.3.4.

Suggested change

"next": "12.3.7",

"next": "^12.3.4",

gemini-code-assist bot reviewed Feb 13, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade next from 12.1.6 to 12.3.7#626

[Snyk] Upgrade next from 12.1.6 to 12.3.7#626
q1blue wants to merge 1 commit intomainfrom
snyk-upgrade-ccf10262599b5d8852bce0d7149a3eb7

q1blue commented Feb 13, 2026

Core Changes

Core Changes

Uh oh!

gemini-code-assist bot commented Feb 13, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

q1blue commented Feb 13, 2026

Snyk has created this PR to upgrade next from 12.1.6 to 12.3.7.

Issues fixed by the recommended upgrade:

Core Changes

Core Changes

Uh oh!

gemini-code-assist bot commented Feb 13, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants