E528 [dd] update the nextjs and axios package to the most stable version by dacdao1 · Pull Request #5942 · mage-ai/mage-ai · GitHub
[go: up one dir, main page]
Skip to content

[dd] update the nextjs and axios package to the most stable version#5942

Open
dacdao1 wants to merge 2 commits intomage-ai:masterfrom
dacdao1:enhancement/update-nextjs-package
Open

[dd] update the nextjs and axios package to the most stable version#5942
dacdao1 wants to merge 2 commits intomage-ai:masterfrom
dacdao1:enhancement/update-nextjs-package

Conversation

@dacdao1
Copy link
Contributor
@dacdao1 dacdao1 commented Nov 10, 2025

Description

With Mage-AI's current version (0.9.78), it utilizes the Next.js package version 12.3.4, which has some vulnerability issues, primarily GHSA-c59h-r6p8-q9wc (https://nvd.nist.gov/vuln/detail/CVE-2023-46298), #5785. I updated the package to 14.2.33, which has solved the CE-2023-46298 issue, and it is also backward compatible. Unlike version 13 of Next.js, which has a different routing method (using /api instead of /pages) and other issues. I know we were not planning to update the Next.js package last year (#5226), but I don't know if the team would still like to upgrade the package

Axios version 0.27.2 has several vulnerability issues here (https://security.snyk.io/package/npm/axios/0.27.2), and updating to 0.30.2 is the bare minimum to mitigate some of the vulnerabilities on the list.

How Has This Been Tested?

  • Manually run the Docker image. Start the local environment. Creating pipelines.
  1. Update the package.json file within mage_ai/frontend with Next.js version 14.2.33 and axios 0.30.2.
  2. Initialize the Docker image since the packages have been changed.
  3. Start the local environment of the front end and back end of the application. ( I used the Docker images to start my local environment.
  4. Creating a new pipeline, running the pipeline once, and deleting the pipeline run.
  • Clicking through different routes of the application
  1. Clicking on different pages of the application.
  2. Trying to change the settings with the application.

Checklist

  • The PR is tagged with proper labels (bug, enhancement, feature, documentation)
  • I have performed a self-review of my own code
  • I have added unit tests that prove my fix is effective or that my feature works
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation

cc:

Hi @johnson-mage , I would like to know if we can update the Next.js and Axios packages to a more secure version. I don't want to update Next.js to version 13 because I would have to change the codebase to match the new routing pattern, which might break other parts of the application. The safest version is 14.2.33, and I didn't want to update to version 15 since I haven't had a chance to build with that version yet. Axios also has some vulnerabilities, and the current package indication, ^0.27.2, might still download either version 0.27 or 0.28 (which might still have some vulnerabilities). By having version ^0.30.2, we would at least be on a safer version while not breaking anything else in the current codebase.

@johnson-mage
Copy link
Member
johnson-mage commented Nov 11, 2025 •
edited
Loading

@dacdao1 Upgrading NextJS (and Axios) is certainly welcome. Thank you for creating this PR. Since this is a significant upgrade for NextJS (that may cause some breaking changes), it might make sense to upgrade to the latest stable version of NextJS available, which would be v16.0.1, though that is very recent and just released last month. Otherwise, we may have to do another major upgrade for NextJS pretty soon, which could save some effort/time.

Do you think you'd be able to upgrade NextJS in Mage to v16? Or does it make sense to just upgrade to v14?

Regardless of whether it's v14 or v16, some things to keep in mind:

  1. The github "Build and test / test_backend (3.10)" check should be successful. It is currently failing. Refer to error in #2 below.
  2. In addition to testing Mage with the updated version of Next in your development environment (e.g. with ./scripts/dev.sh), you should also be testing a fresh build locally. Delete your local node_modules and .next folders, run yarn and then yarn build. We'll need to resolve these errors during the build. I was able to recreate the error from #1:
image

  1. A big change in NextJS v14 is "The next export command has been removed in favor of output: 'export' config.".. An important part of our build process is creating a static export with the yarn export_prod_base_path command (see the package.json file scripts section). Since next export is no longer supported, we'll need to make the appropriate change. Refer to NextJS docs on static exports.

  2. When you are running Mage in your dev env, are you coming across this "NextRouter was not mounted" error when trying to open a file from the file browser on the Pipeline Editor page?
    nextrouter not mounted

  3. Also check for any minimum version requirements for other dependencies like react, react-dom, and typescript.

@dacdao1
Copy link
Contributor Author
dacdao1 commented Nov 11, 2025

Hi, yes, I didn't know how far ahead the team wanted to update the NextJS version, since both issues had been out there for a while. However, I would look into version 16 versus 14 before providing an update, as I am unsure of the significance of such an update for the current frontend codebase. Let me conduct further research and then perform additional code updates to improve performance and address any non-backward-compatible issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@johnson-mage johnson-mage Awaiting requested review from johnson-mage

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dacdao1 @johnson-mage
0