chore(deps): bump next from 10.1.2 to 11.1.0

[dependabot]

Bumps next from 10.1.2 to 11.1.0.

Release notes

Sourced from [next's releases](https://github.com/vercel/next.js/releases).

v11.1.0

A security team from one of our partners noticed an issue in Next.js that allowed for an open redirect to occur.

Specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site.

In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.

We recommend upgrading to the latest version of Next.js to improve the overall security of your application.

How to Upgrade

• We have released patch versions for both the stable and canary channels of Next.js.
• To upgrade run npm install nextlatest --save

Impact

• Affected: Users of Next.js between 10.0.5 and 10.2.0
• Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js without getInitialProps
• Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js and next export
• Not affected: Deployments on Vercel ([vercel.com](https://vercel.com)) are not affected
• Not affected: Deployments with pages/404.js

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

How to Assess Impact

If you think sensitive code or data could have been exposed, you can filter logs of affected sites by // (double slash at the start of the url) followed by a domain.

What is Being Done

As Next.js has grown in popularity and usage by enterprises, it has received the attention of security researchers and auditors. We are thankful to Gabriel Benmergui from Robinhood for their investigation and discovery of the original bug and subsequent responsible disclosure.

We've landed a patch that ensures path parsing is handled properly for these paths so that the open redirect can no longer occur.

Regression tests for this attack were added to the [security](https://github.com/zeit/next.js/blob/canary/test/integration/production/test/security.js) integration test suite

• We have notified known Next.js users in advance of this publication.
• A public CVE was released.
• We encourage responsible disclosure of future reports. Please email us at [email protected]. We are actively monitoring this mailbox.

---

Release notes

Core Changes

• Don't test image domains in test env: [#26502](https://github-redirect.dependabot.com/Don't test image domains in test env vercel/next.js#26502)
• Fix props not updating when changing the locale and keeping hash: [#26205](https://github-redirect.dependabot.com/Fix props not updating when changing the locale and keeping hash vercel/next.js#26205)
• Allow user to override next-image-loader: [#26548](https://github-redirect.dependabot.com/Allow user to override next-image-loader vercel/next.js#26548)
• Add logging when a custom babelrc is loaded: [#26570](https://github-redirect.dependabot.com/Add logging when a custom babelrc is loaded vercel/next.js#26570)

... (truncated)

Commits

• ce4adfc v11.1.0
• 092a476 v11.0.2-canary.31
• ebb6a30 Revert "Add warning during next build when sharp is missing ([#27933](https://github-redirect.dependabot.com/Add warning during next build when sharp is missing vercel/next.js#27933))"
• 52486ce v11.0.2-canary.30
• 8ac3254 Revert "Next swc publish flow ([#27932](https://github-redirect.dependabot.com/Next swc publish flow vercel/next.js#27932))"
• 6014b6e v11.0.2-canary.29
• 4cd45aa Add rootDir setting to eslint-plugin-next ([#27918](https://github-redirect.dependabot.com/Add rootDir setting to eslint-plugin-next vercel/next.js#27918))
• e61ea6f Add manifest check step and add missing items ([#27934](https://github-redirect.dependabot.com/Add manifest check step and add missing items vercel/next.js#27934))
• 94fc6f0 Next swc publish flow ([#27932](https://github-redirect.dependabot.com/Next swc publish flow vercel/next.js#27932))
• 51a2a02 Add warning during next build when sharp is missing ([#27933](https://github-redirect.dependabot.com/Add warning during next build when sharp is missing vercel/next.js#27933))
• Additional commits viewable in [compare view](https://github.com/vercel/next.js/compare/v10.1.2...v11.1.0)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)