Bump Next.js to 16.3.5 to clear the critical audit finding - #249
Merged
Merged
Conversation
`npm audit --audit-level=critical --omit=dev` failed on master because next 16.2.6 carries GHSA-6gpp-xcg3-4w24 (proxy bypass), GHSA-m99w-x7hq-7vfj (Server Actions DoS) and GHSA-89xv-2m56-2m9x (Server Actions SSRF), all patched at 16.2.11. That turned the `npm audit` CI job red on every PR. - next ^16.0.0 -> ^16.3.5 (16.2.6 -> 16.3.5, latest in the major) - `npm audit fix` (no --force) for the transitive prod findings: sharp 0.34.5 -> 0.35.4, undici 7.25.0 -> 7.29.1, qs 6.15.3 -> 6.16.0, postcss 8.5.14 -> 8.5.23, nanoid, hono, @hono/node-server, fast-uri, ip-address, dompurify, brace-expansion. All semver-compatible. - next-env.d.ts regenerated by 16.3 (adds the root-params import); Next rewrites it on every build, so committing it keeps checkouts clean. Left alone: nodemailer (8 -> 10 is a major; the remaining high finding). Verified locally: `npm audit --audit-level=critical --omit=dev` exits 0 (15 -> 2 findings; the two left are nodemailer), `tsc --noEmit` clean, vitest 171 files / 2238 tests pass, `next build` exits 0 with the Proxy (Middleware) line present. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QuUkTrofSjQ15j79mRuy4f
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
ThreatCrush Security Scan39 finding(s) HIGH/CRITICAL: 2 | MEDIUM: 28 | LOW: 9
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
npm audit --audit-level=critical --omit=devfails on master because next 16.2.6 carries three advisories (GHSA-6gpp-xcg3-4w24 proxy bypass, GHSA-m99w-x7hq-7vfj Server Actions DoS, GHSA-89xv-2m56-2m9x Server Actions SSRF), all patched at 16.2.11. That turned thenpm auditCI job red on every PR.What
next^16.0.0 -> ^16.3.5 (installed 16.2.6 -> 16.3.5, latest in the major)npm audit fixwithout--forcefor the transitive prod findings: sharp 0.34.5 -> 0.35.4, undici 7.25.0 -> 7.29.1, qs 6.15.3 -> 6.16.0, postcss 8.5.14 -> 8.5.23, plus nanoid, hono, @hono/node-server, fast-uri, ip-address, dompurify, brace-expansion. All semver-compatible.next-env.d.tsregenerated by 16.3 (adds theroot-params.d.tsimport). Next rewrites it on every build, so committing it keeps checkouts clean.Left alone:
nodemailer8 -> 10 is a major and the only remaining high finding.Verified locally
npm audit --audit-level=critical --omit=devexits 0 (15 findings -> 2, both nodemailer)tsc --noEmitcleannext buildexits 0,ƒ Proxy (Middleware)present, 105 static pages generated🤖 Generated with Claude Code
https://claude.ai/code/session_01QuUkTrofSjQ15j79mRuy4f