Repository navigation
Update dependencies and fix Next.js RCE advisories - #114
Merged
Merged
Conversation
Run `bun update --latest` under the 14-day cooldown, then regenerate bun.lock from scratch. Every direct dependency is on its latest major. Direct changes: - next 16.3.8 -> 16.4.1 (exact pin). Fixes GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr (critical RCE) and GHSA-p3m5-59mp-jv5r (high DoS). 16.4.2 and 16.4.3 are bug-fix backports only and are 12 and 4 days old, so they wait for Renovate. - react, react-dom ^19.2.8 -> ^19.3.1. 19.3.1 hardens the RSC transport protocol; React shipped it to every supported line on the same day. - resend ^6.19.0 -> ^6.32.1. 6.33.0+ is inside the window (6.35.0 is 0 days old). - @biomejs/biome ^2.5.8 -> ^2.5.15. 2.6.x is 3-6 days old. biome.json schema migrated with `biome migrate`. - @playwright/test ^1.62.1 -> ^1.64.0. 1.64.1 is 13 days old. - @types/react, @types/react-dom -> ^19.3.0. - @types/node ^24.13.3 -> ^24.19.2. Held on 24 to match .nvmrc, engines.node and the newest Node major Vercel deploys. - overrides.sharp ^0.35.3 -> ^0.35.5 (GHSA-wq5f-xc86-pv6w, librsvg). Still needed: velite 0.4.0 declares sharp ^0.34.5. Already latest: typescript 7.0.2, tailwindcss and @tailwindcss/postcss 4.3.3, velite 0.4.0, @lhci/cli 0.15.1, feed, ogl, next-plausible, @vercel/analytics, rehype-pretty-code, @tailwindcss/typography. Cooldown exemptions (bunfig.toml minimumReleaseAgeExcludes): - next + @next/env + @next/swc-*: next 16.4.1 (13 days) carries the critical RCE fixes; next pins its @next/* packages to the same version. - react, react-dom: 19.3.1 (13 days) RSC transport hardening. All entries expire after 2026-10-29, when both versions pass 14 days. Vetting: no GitHub malware advisory matches any of the 611 resolved package versions (checked with the GitHub advisories API, type=malware). `bun audit` reports no advisory in next, react, sharp or any other runtime dependency. Verified: bun run build, typecheck, check:ci, verify (17/17) and Playwright (18/18, desktop + mobile). Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Will Manning <[email protected]>
Renovate keeps opening @types/node 25.x and 26.x PRs (#92, #94). Node 26 is not deployable on Vercel, and CLAUDE.md requires @types/node to match .nvmrc and engines.node, so those PRs can never merge. Add allowedVersions "<25" so Renovate only proposes 24.x updates. Raise the cap together with .nvmrc and engines.node. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Will Manning <[email protected]>
Record the `bun audit` state after the dependency update (10 advisories, none in the client bundle or server runtime): - sharp override now targets ^0.35.5 for GHSA-wq5f-xc86-pv6w. - New, fix inside the cooldown: body-parser GHSA-27r3-jxmh-p828 and qs GHSA-6pq8-jhm2-2vcw (via @lhci/cli > express, lhci server never runs); postcss-selector-parser GHSA-rj75-hqrm-r3gf (build-only, via @tailwindcss/typography's exact pin; add an override after 2026-11-03). - New, upstream-blocked via @lhci/cli: extract-zip GHSA-7pqw-9j4j-h8q3, zod GHSA-mrhx-c7xc-m3w5 (no 3.x fix), basic-ftp GHSA-c475-qrg2-pj4r (fix only on the 6.x major). - Document the minimumReleaseAgeExcludes entries and their expiry, and the Renovate cap on @types/node. - Drop the "cleared, for the record" note on postcss and mdast-util-to-hast; it is in git history. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Will Manning <[email protected]>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🔦 Lighthouse audit
Run |
lwwmanning
marked this pull request as ready for review
October 28, 2026 06:08
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the open Renovate PRs #79, #92, #94 and #108 with one update. Bun updates all dependencies to their latest major versions under the 14-day cooldown and regenerates
bun.lock. Next goes to 16.4.1 because that release fixes two critical RCE advisories. React goes to 19.3.1. Both are 13 days old, sobunfig.tomlexempts them from the cooldown until 2026-10-29. Thesharpoverride moves to ^0.35.5 for a librsvg advisory.@types/nodestays on 24 to match the Node version that Vercel can deploy, and a Renovate rule stops 25.x and 26.x PRs.CLAUDE.mdrecords the remainingbun auditadvisories. All of them are dev-only or build-only. The commit messages give the version choices and the checks.Renovate closes its own PRs when this merges. If it does not, close them by hand.
🤖 Generated with Claude Code