Before the next.js 15 upgrade, running grype on a repo would show installed versions for all components. Since upgrading next.js to 15, we now see file paths in the output instead, and FIXED-IN showing older versions than we have installed.
What’s the best way to go about diagnosing this behaviour and returning to our previous output?
The changes I can see to package.json and yarn.lock were version number changes - there were no changes to how we source dependencies.
This is using Grype 0.85.0
After the upgrade
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
@auth0/nextjs-auth0 file:../.. 1.4.2 npm GHSA-954c-jjx6-cxv7 High
@auth0/nextjs-auth0 file:../.. 1.6.2 npm GHSA-2mqv-4j3r-vjvp Medium
@eslint/plugin-kit 0.2.2 0.2.3 npm GHSA-7q7g-4xm8-89cq Low
cross-spawn 7.0.3 7.0.5 npm GHSA-3xgq-45jj-v275 High
next file:../../node_modules/next 5.1.0 npm GHSA-5vj8-3v2h-h38v High
next file:../../node_modules/next 11.1.3 npm GHSA-25mp-g6fv-mqxx High
next file:../../node_modules/next 11.1.0 npm GHSA-vxf5-wxwp-m7g9 Medium
next file:../../node_modules/next 9.3.2 npm GHSA-fq77-7p7r-83rj Medium
next file:../../node_modules/next 13.4.20-canary.13 npm GHSA-c59h-r6p8-q9wc Low
Before the upgrade
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
cross-spawn 7.0.3 7.0.5 npm GHSA-3xgq-45jj-v275 High
Hi @WTP! Thanks for the report. What version of nextjs are you running? I used create-next-app@15.0.3 to create a next app and ran Grype and Syft on the directory, and all my versions look OK. I’m going to ask a few differences to try and figure out why we’re getting different results.
Are you using nextjs 15.0.3, or maybe an earlier 15? (I also tried 15.0.0 with the same result though.)
Do you have anything non-default in your Grype config? (a diff of grype config and grype config --load should tell you this).
Is there a step I’m missing? Maybe I need to make a non-default choice in create-next-app or install some particular package?
Is there a public artifact (maybe some repo that’s already open source) that exhibits the bug already when you run Grype on it?
Thanks again for the report! It sounds like something changed in NextJS between versions, but we’d still like to adjust our tools to detect these artifacts correctly.
It looks like this is triggered by the addition of the nextjs-auth0 dep to package.json as "@auth0/nextjs-auth0": "^4.0.0-beta.7",
Why are we using a beta you ask? Auth0 chose not to support next.js 15 in their stable branch.
To reproduce this manually, you can simply do
yarn create next-app grypetest --no-install
cd grypetest
corepack enable
yarn set version stable
yarn install
grype . # all good at this point
# add `"@auth0/nextjs-auth0": "^4.0.0-beta.7",` to package.json
yarn install
grype . # unexpected output now