Repository: vercel/next.js
Pull request: Update send to v0.18.0

### Why?
Currently, Next.js uses a precompiled version of send under `next/dist/compiled/send`, which is based on an outdated version. This older version omits headers like Content-Security-Policy (CSP) when returning a 304, even if those headers were present in the initial 200 response.

As a result, CSP headers are either missing entirely or fallback to default CDN-level policies in cached responses. This behavior causes security issues or inconsistent enforcement in strict CSP environments.

### What?

This PR upgrades the internal `send` package used in static asset serving to the latest official version (v1.2.0), which includes proper handling of headers in 304 Not Modified responses.


Fixes #78815 




Changed files:
filename: packages/next/package.json
patch: @@ -309,7 +309,7 @@
     "schema-utils2": "npm:schema-utils@2.7.1",
     "schema-utils3": "npm:schema-utils@3.0.0",
     "semver": "7.3.2",
-    "send": "0.17.1",
+    "send": "0.18.0",
     "server-only": "0.0.1",
     "setimmediate": "1.0.5",
     "shell-quote": "1.7.3",

filename: packages/next/src/compiled/send/LICENSE
patch: @@ -1,7 +1,7 @@
 (The MIT License)
 
 Copyright (c) 2012 TJ Holowaychuk
-Copyright (c) 2014-2016 Douglas Christopher Wilson
+Copyright (c) 2014-2022 Douglas Christopher Wilson
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

filename: pnpm-lock.yaml
patch: @@ -1448,8 +1448,8 @@ importers:
         specifier: 7.3.2
         version: 7.3.2
       send:
-        specifier: 0.17.1
-        version: 0.17.1
+        specifier: 0.18.0
+        version: 0.18.0
       server-only:
         specifier: 0.0.1
         version: 0.0.1
@@ -11722,10 +11722,6 @@ packages:
     resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
     engines: {node: '>= 0.6'}
 
-  mime-types@2.1.30:
-    resolution: {integrity: sha512-crmjA4bLtR8m9qLpHvgxSChT+XoSlZi8J4n/aIdn3z92e/U47Z0V/yl+Wh9W046GgFVAmoNR/fmdbZYcSSIUeg==}
-    engines: {node: '>= 0.6'}
-
   mime-types@2.1.35:
     resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
     engines: {node: '>= 0.6'}
@@ -14535,6 +14531,10 @@ packages:
     resolution: {integrity: sha512-BsVKsiGcQMFwT8UxypobUKyv7irCNRHk1T0G680vk88yf6LBByGcZJOTJCrTP2xVN6yI+XjPJcNuE3V4fT9sAg==}
     engines: {node: '>= 0.8.0'}
 
+  send@0.18.0:
+    resolution: {integrity: sha512-qqWzuOjSFOuqPjFe4NOsMLafToQQwBSOEpS+FwEt3A2V3vKubTquT3vmLTQpFgMXp8AlFWFuP1qKaJZOtPpVXg==}
+    engines: {node: '>= 0.8.0'}
+
   send@0.19.0:
     resolution: {integrity: sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw==}
     engines: {node: '>= 0.8.0'}
@@ -21729,7 +21729,7 @@ snapshots:
 
   accepts@1.3.7:
     dependencies:
-      mime-types: 2.1.30
+      mime-types: 2.1.35
       negotiator: 0.6.2
 
   accepts@1.3.8:
@@ -25815,13 +25815,13 @@ snapshots:
     dependencies:
       asynckit: 0.4.0
       combined-stream: 1.0.8
-      mime-types: 2.1.30
+      mime-types: 2.1.35
 
   form-data@4.0.0:
     dependencies:
       asynckit: 0.4.0
       combined-stream: 1.0.8
-      mime-types: 2.1.30
+      mime-types: 2.1.35
 
   format@0.2.2: {}
 
@@ -29412,10 +29412,6 @@ snapshots:
 
   mime-db@1.52.0: {}
 
-  mime-types@2.1.30:
-    dependencies:
-      mime-db: 1.47.0
-
   mime-types@2.1.35:
     dependencies:
       mime-db: 1.52.0
@@ -32177,7 +32173,7 @@ snapshots:
       is-typedarray: 1.0.0
       isstream: 0.1.2
       json-stringify-safe: 5.0.1
-      mime-types: 2.1.30
+      mime-types: 2.1.35
       oauth-sign: 0.9.0
       performance-now: 2.1.0
       qs: 6.5.2
@@ -32585,6 +32581,24 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  send@0.18.0:
+    dependencies:
+      debug: 2.6.9
+      depd: 2.0.0
+      destroy: 1.2.0
+      encodeurl: 1.0.2
+      escape-html: 1.0.3
+      etag: 1.8.1
+      fresh: 0.5.2
+      http-errors: 2.0.0
+      mime: 1.6.0
+      ms: 2.1.3
+      on-finished: 2.4.1
+      range-parser: 1.2.1
+      statuses: 2.0.1
+    transitivePeerDependencies:
+      - supports-color
+
   send@0.19.0:
     dependencies:
       debug: 2.6.9