How to hide the nextjs version from the "build code" in production?

[fallow goblet]

https://github.com/vercel/next.js/discussions/59337

[shrewd light]

Post created!

🔎 This post has been indexed in our web forum and will be seen by search engines so other users can find it outside Discord

🕵️ Your user profile is private by default and won't be visible to users outside Discord, if you want to be visible in the web forum you can add the "Public Profile" role in id:customize

✅ You can mark a message as the answer for your post with Right click -> Apps -> Mark Solution
(if you don't see the option, try refreshing Discord with Ctrl + R)

[mystic hare]

can i ask why you want to do this?

[fallow goblet]

The security team says that if the hacker knows the version of the framework they could exploit vulnerabilities in that particular version

[mystic hare]

1. Keep yourself up to date
2. Even if that version is hidden, the bundles and things will still make it easy to tell the version

Also personal oppinion, I think they are making a bigger deal out of it unless you use old versions (as team is very fast for fixing security things and such)

[noble flower]

hmm, is there any particular reason next needed to embed its version tho? just wondering

[half sable]

If a hacker knows you use nextjs

(Pretty easy to tell even without the version number)

They can just iterate through all versions of nextjs with known vulnerabilities

And try their scripts or whatever against each version

[worthy token]

if a nextjs version has a security vulnerability, it will be listed here. other versions don't have known security vulnerabilities so this argument is no longer applicable.

if you are using a vulnerable nextjs version, upgrade nextjs as soon as possible.

[upbeat imp]

yeah but the idea is to make it harder or at least more inconvenient for a hacker (security standpoint). like yeah it honestly wont make a huge difference but the best security practice is to not make it easy for a hacker to know what software and version you are using.

[worthy token]

no it's impossible to hide the version and/or the fact that you use nextjs

[upbeat imp]

But that can be seen as a security concern. For example, you can easily hide the fact you are using php as long as you dont expose the extension (.php)