5 ms·

Timeline is interesting Timeline: 02/27/2025: vulnerability reported to the maintainers (specifying that only versions between 12.0.0 and 12.0.7 were vulnerab

by kfarr 2y ago

Timeline is interesting Timeline: 02/27/2025: vulnerability reported to the maintainers (specifying that only versions between 12.0.0 and 12.0.7 were vulnerable, which was our understanding at the time) 03/01/2025: second email sent explaining that all versions were ultimately vulnerable, including the latest stable releases 03/05/2025: initial response received from the Vercel team explaining that versions 12.x were no longer supported/maintained (probably hadn’t read the second email/security advisory template indicating that all were vulnerable) 03/05/2025: another email sent so that the team could quickly take a look at the second email/security advisory template 03/11/2025: another email sent to find out whether or not the new information had been taken into account 03/17/2025: email received from the Vercel team confirming that the information had been taken into account 03/18/2025: email received from the Vercel team: the report had been accepted, and the patch was implemented. Version 15.2.3 was released a few hours later, containing the fix (+backports) 03/21/2025: publication of the security advisory

johnnyAghands 2y ago
What is intersting?
- edoceo 2y ago
  The lag & missing key details
  - johnnyAghands 2y ago
    Ah ok, yeah.. unfortnutely this type of lag/mismgmt is pretty common once a company gets big enough. Often times the right people don't get involved on first-pass... even at tech-first companies like this -- though at that point perhaps you're no longer tech-first :/
    - simonw 2y ago
      Companies that get large enough to have a dedicated security team can often reverse this trend.
simonw 2y ago
"initial response received from the Vercel team explaining that versions 12.x were no longer supported/maintained" That doesn't mean they shouldn't issue an alert to developers still running those versions advising them to upgrade ASAP.
nine_k 2y ago
OK, tangentially: let's assume that Next is poorly maintained; what are some good alternatives? Of course everything that Next does can be assembled by hand from various smaller modules on top of Express, or similar. What are some more cohesive sets?
- solardev 2y ago
  I don't think there's anything quite as featureful. For basic sites, Astro is fine, but it's not as powerful. Vite can be used for basic client or server side renders. Nuxt and SvelteKit have some of the basic features. But I don't think there is a drop-in replacement for ALL that Next does. The strength of Next is in packaging together what would otherwise be like twenty different packages and servers (especially if you make use of all the Vercel specific features). And then it adds incredibly powerful (but often complex) hybrid caching strategies that combine what would traditionally be done by different daemons altogether (a KV store, a memory cache, a HTTP cache, CDN. etc.). And then it adds a bunch of additional features like the middleware layer, image processing and caching, etc. I don't know of any other frontend-focused JS framework with such features in one package. These are more common in the full-stack world. Next takes some of those traditional backend concerns and puts them in the hands of frontend devs, for better or worse. If you know a bit of both, it can be a great shortcut. If you overestimate your ability/knowledge, it can be a great footgun.
  - the_mitsuhiko 2y ago
    > But I don't think there is a drop-in replacement for ALL that Next does. The entirety of vite + tanstack (in particular the upcoming tanstack-start) is getting quite close. For quite a few uses that folks currently use next fork, I would argue that much of what tanstack does is a better fit. Eg: non marketing sites, but SaaS style dashboards.
    - solardev 2y ago
      Does that put you in a situation where the builder/bundler is made by a different vendor than the router & cache management layer? That was one of the nice benefits of Next when it first came out, vs Frankensteining these basic concerns together on top of React with a bunch of different libs that don't always track each other in terms of upgrade compatibility, often resulting in dependency hell. Is that still the case today?

by kfarr 2y ago

johnnyAghands 2y ago

What is intersting?

edoceo 2y ago
The lag & missing key details
- johnnyAghands 2y ago
  Ah ok, yeah.. unfortnutely this type of lag/mismgmt is pretty common once a company gets big enough. Often times the right people don't get involved on first-pass... even at tech-first companies like this -- though at that point perhaps you're no longer tech-first :/
  - simonw 2y ago
    Companies that get large enough to have a dedicated security team can often reverse this trend.

simonw 2y ago

"initial response received from the Vercel team explaining that versions 12.x were no longer supported/maintained" That doesn't mean they shouldn't issue an alert to developers still running those versions advising them to upgrade ASAP.

nine_k 2y ago

OK, tangentially: let's assume that Next is poorly maintained; what are some good alternatives? Of course everything that Next does can be assembled by hand from various smaller modules on top of Express, or similar. What are some more cohesive sets?

solardev 2y ago
I don't think there's anything quite as featureful. For basic sites, Astro is fine, but it's not as powerful. Vite can be used for basic client or server side renders. Nuxt and SvelteKit have some of the basic features. But I don't think there is a drop-in replacement for ALL that Next does. The strength of Next is in packaging together what would otherwise be like twenty different packages and servers (especially if you make use of all the Vercel specific features). And then it adds incredibly powerful (but often complex) hybrid caching strategies that combine what would traditionally be done by different daemons altogether (a KV store, a memory cache, a HTTP cache, CDN. etc.). And then it adds a bunch of additional features like the middleware layer, image processing and caching, etc. I don't know of any other frontend-focused JS framework with such features in one package. These are more common in the full-stack world. Next takes some of those traditional backend concerns and puts them in the hands of frontend devs, for better or worse. If you know a bit of both, it can be a great shortcut. If you overestimate your ability/knowledge, it can be a great footgun.
- the_mitsuhiko 2y ago
  > But I don't think there is a drop-in replacement for ALL that Next does. The entirety of vite + tanstack (in particular the upcoming tanstack-start) is getting quite close. For quite a few uses that folks currently use next fork, I would argue that much of what tanstack does is a better fit. Eg: non marketing sites, but SaaS style dashboards.
  - solardev 2y ago
    Does that put you in a situation where the builder/bundler is made by a different vendor than the router & cache management layer? That was one of the nice benefits of Next when it first came out, vs Frankensteining these basic concerns together on top of React with a bunch of different libs that don't always track each other in terms of upgrade compatibility, often resulting in dependency hell. Is that still the case today?