From 31f3bf47ef668e4b315192fb4f0cececc3450a5a Mon Sep 17 00:00:00 2001 From: Michael van Tellingen Date: Sun, 25 Oct 2026 09:14:16 +0100 Subject: [PATCH 1/4] ci: remove pinact and zizmor workflows enforced at org level These checks now run via the org-wide required workflows in labd/.github-workflows. --- .github/workflows/security.yaml | 38 --------------------------------- 1 file changed, 38 deletions(-) delete mode 100644 .github/workflows/security.yaml diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml deleted file mode 100644 index b16754a..0000000 --- a/.github/workflows/security.yaml +++ /dev/null @@ -1,38 +0,0 @@ -name: Security Checks - -on: - push: - branches: ["main"] - pull_request: - branches: ["**"] - paths: - - ".github/workflows/**" - - ".github/actions/**" - -permissions: {} - -jobs: - workflows: - # Only run on pull requests from the same repository - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - - name: Pin actions - if: github.event.pull_request.head.repo.full_name == github.repository - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0 - with: - skip_push: true - verify: true - - - name: Run zizmor - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 - with: - advanced-security: false - annotations: true - min-severity: high \ No newline at end of file From 7ccaf7a29bed79048c5e11360d7261943d00d2de Mon Sep 17 00:00:00 2001 From: Michael van Tellingen Date: Sun, 25 Oct 2026 09:52:35 +0100 Subject: [PATCH 2/4] chore(deps): bump next dev dependency to 16.4.2 next 16.4.0 is affected by two critical advisories (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr), which makes the pnpm audit step in CI fail. --- package.json | 2 +- pnpm-lock.yaml | 111 ++++++++++++++++++++++--------------------------- 2 files changed, 50 insertions(+), 63 deletions(-) diff --git a/package.json b/package.json index 00be399..562540d 100644 --- a/package.json +++ b/package.json @@ -45,7 +45,7 @@ "@changesets/cli": "3.0.3", "@types/node": "26.6.4", "@vitest/coverage-v8": "5.0.3", - "next": "16.4.0", + "next": "16.4.2", "tsdown": "0.23.0", "typescript": "7.0.2", "vitest": "5.0.3" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8fd6cab..0d0f1d8 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -179,8 +179,8 @@ importers: specifier: 5.0.3 version: 5.0.3(vitest@5.0.3) next: - specifier: 16.4.0 - version: 16.4.0(@types/node@26.6.4)(react-dom@19.2.5(react@19.2.5))(react@19.2.5) + specifier: 16.4.2 + version: 16.4.2(@types/node@26.6.4)(react-dom@19.2.5(react@19.2.5))(react@19.2.5) tsdown: specifier: 0.23.0 version: 0.23.0(typescript@7.0.2) @@ -694,57 +694,57 @@ packages: resolution: {integrity: sha512-6QEf6yqFbETdwGITKq57aYoPfX/3K8XFNwsAlx0C1M7o8cb79sv1M3w+tWuWvIcSbNqrLF7OD7YpZMVVz335hQ==} engines: {node: '>=20.0.0'} - '@next/env@16.4.0': - resolution: {integrity: sha512-pyLlT5oafGlX8X7xjgGNXz5dNIDSxREm+qD6i9VLSZiZFopA/XWl8NM/KPmLx/8EG/++c49iid3gNWSQW1+2dQ==} + '@next/env@16.4.2': + resolution: {integrity: sha512-nTUTFH7G5/J/fmpkjVLegOkqyKOP0CEsJcMsyO4UCYeN1su+YMW/MfaSErnJskL7XM+UDK6aTvslxsRCyya/sA==} - '@next/swc-darwin-arm64@16.4.0': - resolution: {integrity: sha512-yyZ+9MgViAKLLb5l1gPBGjRwnq3teNLb5Zx6JEw8LzNSTjlsnp+baUHFxTgl7PpjCmKf48VQfyipG1eBflb48Q==} + '@next/swc-darwin-arm64@16.4.2': + resolution: {integrity: sha512-ONkhFvZNFWlsEHOM/81AtxdyuJP2KRYKYR0JxPwvcu1AuPMMMgcL+wW2luldJvMtZwKtUxoSkCychW5wIeoYSw==} engines: {node: '>= 10'} cpu: [arm64] os: [darwin] - '@next/swc-darwin-x64@16.4.0': - resolution: {integrity: sha512-RePEEejEj1Auf5s9qEcG0JbcDP3ceNUS/ofNX8AhxzgIjTVlZIHMatlp16YplcSMpsVo/ZMQHJTjbMYJznjGUg==} + '@next/swc-darwin-x64@16.4.2': + resolution: {integrity: sha512-luPCMbOsCoaF+kXJEUjmjmOZg1lC3BflhmUu+ZmW4tBu2vW/4AXak8JBFvePizGkxVmNiAw/r9ra+6UviCWtWQ==} engines: {node: '>= 10'} cpu: [x64] os: [darwin] - '@next/swc-linux-arm64-gnu@16.4.0': - resolution: {integrity: sha512-HhsyCqd+NpmvDDVY/LqkAN24f+QVvXh3ie+PfcwKinWL2Mu826JymQxJXGjAIfmJ4VlHjp4Pe/nZtXtUoEMAqw==} + '@next/swc-linux-arm64-gnu@16.4.2': + resolution: {integrity: sha512-xhwFTAncJyaCNy5KqKKuKaIIdCy1/1ZV1s5S1G0hhT7wGMkDTlfJ6aQbfRFnIG/s3/kDrxQ8aycVe+c5QnP8ow==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] libc: [glibc] - '@next/swc-linux-arm64-musl@16.4.0': - resolution: {integrity: sha512-sN9Pf+Zh+RpZAOmbR7d8KAA8T61CVhawtbEJ2Bk6QrRzx6Z/6haaF4UiwBzytM96GRRRWZh9/WALIEO3npMamA==} + '@next/swc-linux-arm64-musl@16.4.2': + resolution: {integrity: sha512-T1PNmfbPcxr5ndtWUL/3wQtLXsz808lq6sc2GrNT5k2oquF7UyqZddHSuAewHVsWsGXe6nsl9HoN1YNriVjuSg==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] libc: [musl] - '@next/swc-linux-x64-gnu@16.4.0': - resolution: {integrity: sha512-D5M5xLWQVd1CvR+L7BickM1weRfmM41x3L1NWcnKY/oyJJqr1qwaCgmu3dMAhLBOMdZwSuDCRV6DJRRpiUkbDQ==} + '@next/swc-linux-x64-gnu@16.4.2': + resolution: {integrity: sha512-N9cDUOCGtkJG5PNKDFZUF3xXndrJJcpLp121uAGjIGvO/U2p9tfdNOM9htj7+5f72l0m8rMw/cvYacUJBQoudg==} engines: {node: '>= 10'} cpu: [x64] os: [linux] libc: [glibc] - '@next/swc-linux-x64-musl@16.4.0': - resolution: {integrity: sha512-8d5WLS6a9YalqpOgXdlbvonFu+sIgjA+CO6tGzetrpPVcUL56foa7B7664h41rAlbLi5fJwK4vWji3zf4QDy+w==} + '@next/swc-linux-x64-musl@16.4.2': + resolution: {integrity: sha512-yY2uh1YhX6ufuYy2FCbw1dqblbhI57GLYAJfCkqD9auTv6pLrH67Uccjc3QMKBeCYAG6lkgu08ExmX1bbjejjQ==} engines: {node: '>= 10'} cpu: [x64] os: [linux] libc: [musl] - '@next/swc-win32-arm64-msvc@16.4.0': - resolution: {integrity: sha512-sQuOIiW3snb48UwrBcDMvFA/u03qtw2LeuSIxFIQ9AJuW9UG/4Ddsfo+eV73PnZwBhyncMtsKVh7PrzMol2/fA==} + '@next/swc-win32-arm64-msvc@16.4.2': + resolution: {integrity: sha512-j/ArWRIHpMMB6wYLMhr2puTguBt70lNU/Cmjl9p6dTDE8DGknYJMP9PdwPk2dqpCNL/KIX9yfngDvIesxJPmsg==} engines: {node: '>= 10'} cpu: [arm64] os: [win32] - '@next/swc-win32-x64-msvc@16.4.0': - resolution: {integrity: sha512-6/33lCuxpdHUy27RegyGM/5uTpF7YZd3UR4D0gpkOA/tWY5YR7msbQjqPgCZmSmxrrTLGCXYA4A8vT2H5DPGTQ==} + '@next/swc-win32-x64-msvc@16.4.2': + resolution: {integrity: sha512-AA4edyWHDko3NCSo0x6GomsdgFb0oR1J3MXU1b5xt6FRFg4AucrMPW3S0hCe/9onU0O1BbpGQBsqo1r0Gneu1g==} engines: {node: '>= 10'} cpu: [x64] os: [win32] @@ -1445,18 +1445,13 @@ packages: magicast@0.5.5: resolution: {integrity: sha512-UicdXN8zQ3JHlxVq+28afMXPr1z7WNY6+7EJnzTdQWkTAlMLF5fNCCKxJHBQwGaNGR11581EiQmQzx73+MvszA==} - nanoid@3.3.11: - resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==} - engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} - hasBin: true - nanoid@3.3.20: resolution: {integrity: sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true - next@16.4.0: - resolution: {integrity: sha512-N2C+9q89Z/oLrsepSRS4jRMtwmUZAoZuAHU0e9T6+sAB5DdhADmrnOW+zjYijlrYFmVfmQhGVGy9eMFoB7UgKg==} + next@16.4.2: + resolution: {integrity: sha512-r+oBJojfefUjOiWkBhXgLS+igxX/7BWyK59uHnyOyplMSLtBZ+QLP3okrdYTbrfrbrmNTVWLBPaHDX9KRaIt3w==} engines: {node: '>=20.9.0'} hasBin: true peerDependencies: @@ -1498,10 +1493,6 @@ packages: resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==} engines: {node: '>=12'} - postcss@8.5.10: - resolution: {integrity: sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==} - engines: {node: ^10 || ^12 || >=14} - postcss@8.5.23: resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==} engines: {node: ^10 || ^12 || >=14} @@ -2165,30 +2156,30 @@ snapshots: tinyglobby: 0.2.16 yaml: 2.9.1 - '@next/env@16.4.0': {} + '@next/env@16.4.2': {} - '@next/swc-darwin-arm64@16.4.0': + '@next/swc-darwin-arm64@16.4.2': optional: true - '@next/swc-darwin-x64@16.4.0': + '@next/swc-darwin-x64@16.4.2': optional: true - '@next/swc-linux-arm64-gnu@16.4.0': + '@next/swc-linux-arm64-gnu@16.4.2': optional: true - '@next/swc-linux-arm64-musl@16.4.0': + '@next/swc-linux-arm64-musl@16.4.2': optional: true - '@next/swc-linux-x64-gnu@16.4.0': + '@next/swc-linux-x64-gnu@16.4.2': optional: true - '@next/swc-linux-x64-musl@16.4.0': + '@next/swc-linux-x64-musl@16.4.2': optional: true - '@next/swc-win32-arm64-msvc@16.4.0': + '@next/swc-win32-arm64-msvc@16.4.2': optional: true - '@next/swc-win32-x64-msvc@16.4.0': + '@next/swc-win32-x64-msvc@16.4.2': optional: true '@oxc-project/types@0.153.0': {} @@ -2579,6 +2570,10 @@ snapshots: optionalDependencies: picomatch: 4.0.4 + fdir@6.5.0(picomatch@4.0.7): + optionalDependencies: + picomatch: 4.0.7 + fsevents@2.3.3: optional: true @@ -2618,13 +2613,11 @@ snapshots: '@babel/types': 7.29.8 source-map-js: 1.2.1 - nanoid@3.3.11: {} - nanoid@3.3.20: {} - next@16.4.0(@types/node@26.6.4)(react-dom@19.2.5(react@19.2.5))(react@19.2.5): + next@16.4.2(@types/node@26.6.4)(react-dom@19.2.5(react@19.2.5))(react@19.2.5): dependencies: - '@next/env': 16.4.0 + '@next/env': 16.4.2 '@swc/helpers': 0.5.23 baseline-browser-mapping: 2.11.27 caniuse-lite: 1.0.30001788 @@ -2633,14 +2626,14 @@ snapshots: react-dom: 19.2.5(react@19.2.5) styled-jsx: 5.1.6(react@19.2.5) optionalDependencies: - '@next/swc-darwin-arm64': 16.4.0 - '@next/swc-darwin-x64': 16.4.0 - '@next/swc-linux-arm64-gnu': 16.4.0 - '@next/swc-linux-arm64-musl': 16.4.0 - '@next/swc-linux-x64-gnu': 16.4.0 - '@next/swc-linux-x64-musl': 16.4.0 - '@next/swc-win32-arm64-msvc': 16.4.0 - '@next/swc-win32-x64-msvc': 16.4.0 + '@next/swc-darwin-arm64': 16.4.2 + '@next/swc-darwin-x64': 16.4.2 + '@next/swc-linux-arm64-gnu': 16.4.2 + '@next/swc-linux-arm64-musl': 16.4.2 + '@next/swc-linux-x64-gnu': 16.4.2 + '@next/swc-linux-x64-musl': 16.4.2 + '@next/swc-win32-arm64-msvc': 16.4.2 + '@next/swc-win32-x64-msvc': 16.4.2 sharp: 0.35.5(@types/node@26.6.4) transitivePeerDependencies: - '@babel/core' @@ -2659,12 +2652,6 @@ snapshots: picomatch@4.0.7: {} - postcss@8.5.10: - dependencies: - nanoid: 3.3.11 - picocolors: 1.1.1 - source-map-js: 1.2.1 - postcss@8.5.23: dependencies: nanoid: 3.3.20 @@ -2879,11 +2866,11 @@ snapshots: vite@7.3.2(@types/node@26.6.4)(jiti@2.6.1)(yaml@2.9.1): dependencies: esbuild: 0.27.7 - fdir: 6.5.0(picomatch@4.0.4) - picomatch: 4.0.4 - postcss: 8.5.10 + fdir: 6.5.0(picomatch@4.0.7) + picomatch: 4.0.7 + postcss: 8.5.23 rollup: 4.60.1 - tinyglobby: 0.2.16 + tinyglobby: 0.2.17 optionalDependencies: '@types/node': 26.6.4 fsevents: 2.3.3 From 6c4c00b4b748312913fa53b0262acbade3fa112b Mon Sep 17 00:00:00 2001 From: Michael van Tellingen Date: Sun, 25 Oct 2026 10:27:13 +0100 Subject: [PATCH 3/4] ci: publish to npm with trusted publishing (OIDC) --- .github/workflows/release.yaml | 3 +++ package.json | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index bb894b7..6a89315 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -99,6 +99,9 @@ jobs: pr-title: "Release new version" commit-message: "update version" publish-script: pnpm publish:ci + # v2 pushes the release commit and tags through the GitHub API; the + # git CLI path keeps the previous behaviour. + push-with-git-cli: true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} NPM_CONFIG_PROVENANCE: true diff --git a/package.json b/package.json index 562540d..751963f 100644 --- a/package.json +++ b/package.json @@ -4,13 +4,14 @@ "author": "Boris Besemer", "publishConfig": { "access": "public", - "registry": "https://registry.npmjs.org/" + "registry": "https://registry.npmjs.org/", + "provenance": true }, "module": "dist/index.js", "homepage": "https://github.com/labd/nextjs-basic-auth-middleware#readme", "repository": { "type": "git", - "url": "https://github.com/labd/nextjs-basic-auth-middleware" + "url": "git+https://github.com/labd/nextjs-basic-auth-middleware.git" }, "license": "MIT", "main": "dist/index.cjs", From 49677c370dd46a5ebc16706177d6bdb7760623ab Mon Sep 17 00:00:00 2001 From: Michael van Tellingen Date: Sun, 25 Oct 2026 10:28:30 +0100 Subject: [PATCH 4/4] build: update to pnpm 12 Move the .npmrc settings to pnpm-workspace.yaml. --- .github/workflows/release.yaml | 11 ++++++----- .npmrc | 3 --- pnpm-workspace.yaml | 4 ++++ 3 files changed, 10 insertions(+), 8 deletions(-) delete mode 100644 .npmrc diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 6a89315..a96bf71 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -15,7 +15,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: labd/gh-actions-typescript/pnpm-install@a43f95146e7e81612083238af16f503de7f614a8 # v1.0.3 + uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0 - name: Lint run: pnpm lint @@ -28,7 +28,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: labd/gh-actions-typescript/pnpm-install@a43f95146e7e81612083238af16f503de7f614a8 # v1.0.3 + uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0 - name: Check types run: pnpm tsc @@ -41,7 +41,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: labd/gh-actions-typescript/pnpm-install@a43f95146e7e81612083238af16f503de7f614a8 # v1.0.3 + uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0 - name: Test run: pnpm test @@ -59,7 +59,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: labd/gh-actions-typescript/pnpm-install@a43f95146e7e81612083238af16f503de7f614a8 # v1.0.3 + uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0 with: node-version: ${{ matrix.node }} @@ -83,9 +83,10 @@ jobs: fetch-depth: 0 - name: Set up Node.js - uses: labd/gh-actions-typescript/pnpm-install@a43f95146e7e81612083238af16f503de7f614a8 # v1.0.3 + uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0 with: node-version: 24.x + cache: false - name: Build run: pnpm build diff --git a/.npmrc b/.npmrc deleted file mode 100644 index 3dbd5d0..0000000 --- a/.npmrc +++ /dev/null @@ -1,3 +0,0 @@ -save-prefix="" -auto-install-peers=true -strict-peer-dependencies=false diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 015b0bb..62a6c3a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -4,3 +4,7 @@ allowBuilds: # Require packages to be at least 7 days old before being allowed to be installed minimumReleaseAge: 10080 trustPolicy: no-downgrade + +savePrefix: "" +autoInstallPeers: true +strictPeerDependencies: false