Repository navigation
fix(deps): next 16.4.3 on both sites; rotate stale audit entries - #427
Merged
Merged
Conversation
Three advisories published against next 16.x, two of them unauthenticated RCEs (Image Optimization with SVG, use cache typed arrays) plus a Server Actions DoS. patched 16.4.1; the pins move to 16.4.3. apps/docs and apps/website both carried 16.3.8, so the lockfile kept the vulnerable resolution until both bumps landed. The braces and sprintf-js allowlist entries now report no advisories and are removed; node-forge stays (still unpatched upstream). audit:deps green; docs and website static exports build clean on 16.4.3. Follows the #282 rotation precedent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three advisories published against next 16.x after the gate last ran: GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr (unauthenticated RCEs: Image Optimization with SVG input,
use cachereturning typed arrays) and GHSA-p3m5-59mp-jv5r (Server Actions DoS). All patched in 16.4.1; both next-pinning sites (apps/website and apps/docs) move to 16.4.3 in one change - bumping only website left the lockfile carrying the vulnerable resolution because docs also pins 16.3.8.Also retires the braces and sprintf-js allowlist entries, which now report no advisories (the audit flags stale entries); node-forge stays (still unpatched upstream). This follows the #282 rotation precedent.
Verified locally on the branch:
bun run audit:depsgreen, docs and website static exports build clean, lint:lockfile clean.This unblocks the Dependency audit check on #426 (that red is this lockfile fact, not that branch).