chore(deps): bump next to 16.2.12 to clear 8 open security advisories - #441
Merged
Conversation
16.2.6 is in the vulnerable range for eight advisories, all patched in 16.2.11: SSRF in rewrites via an attacker-controlled destination hostname, SSRF in Server Actions on custom servers, middleware/proxy bypass in App Router, DoS in App Router Server Actions, DoS in the image optimizer via SVG, unauthenticated disclosure of internal Server Function endpoints, and two response-body cache-confusion issues. `eslint-config-next` moves with it to keep the pair on one version. Lockfile regenerated with npm 10 to match CI's Node 20 — the default npm 11 drops next-intl's nested optional-peer `@swc/helpers` entry and breaks `npm ci`. Verified: lint (39 warnings, unchanged from main), typecheck, 645 tests, and `next build` all pass on 16.2.12. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
ArnasDon
added a commit
that referenced
this pull request
Jul 29, 2026
`main` moved next 16.2.6 → 16.2.12 (#441) and applied transitive audit fixes (#442) since this branch was cut, so both manifests conflicted. Resolved by keeping main's `next` and this branch's `next-intl`, then regenerating package-lock.json from the merged package.json with npm 10 — the version CI's Node 20 ships, so the nested optional-peer @swc/helpers entry `npm ci` needs is preserved. Verified next 16.2.12, next-intl 4.13.4, and every audit-fixed transitive version from #442 survive, and `npm ci` succeeds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ArnasDon
added a commit
that referenced
this pull request
Jul 29, 2026
`main` moved next 16.2.6 → 16.2.12 (#441) and applied transitive audit fixes (#442) since this branch was cut, so both manifests conflicted. Resolved by taking main's manifests and re-applying only this branch's `lucide-react` bump, then regenerating package-lock.json with npm 10 — the version CI's Node 20 ships, so the nested optional-peer @swc/helpers entry `npm ci` needs is preserved. Verified next 16.2.12, lucide-react 1.27.0, and #442's transitive versions all hold, and `npm ci` succeeds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ArnasDon
added a commit
that referenced
this pull request
Jul 29, 2026
`main` moved next 16.2.6 → 16.2.12 (#441) and applied transitive audit fixes (#442) since this branch was cut, so both manifests conflicted. Resolved by taking main's manifests and re-applying the group's bumps on top: prettier ^3.9.6 and prettier-plugin-tailwindcss ^0.8.1 in package.json, plus tailwindcss and @tailwindcss/postcss 4.3.2 → 4.3.3, which are lockfile-only here because both are specced as `^4`. Lockfile regenerated with npm 10 — the version CI's Node 20 ships, so the nested optional-peer @swc/helpers entry `npm ci` needs is preserved. Verified next 16.2.12 and #442's transitive versions all hold, and `npm ci` succeeds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
next16.2.6 sits in the vulnerable range for eight open Dependabot advisories, all patched in 16.2.11. Bumps to 16.2.12.What changed
nextandeslint-config-next16.2.6 → 16.2.12 (kept on one version).package-lock.jsonregenerated with npm 10, matching CI's Node 20. The local npm 11 dropsnext-intl's nested optional-peer@swc/helpersentry, which is what makes every Dependabot PR here fail atnpm ci.The eight advisories, four high: SSRF in rewrites via an attacker-controlled destination hostname; SSRF in Server Actions on custom servers; middleware/proxy bypass in App Router; DoS in App Router Server Actions; DoS in the image optimizer via SVG; unauthenticated disclosure of internal Server Function endpoints; and two response-body cache-confusion issues.
No source changes were needed — nothing in the 16.2.6 → 16.2.12 range touches an API this repo uses.
Test plan
npm cisucceeds on the regenerated lockfile (this is the step that usually breaks).npm run typecheckclean.npm run lint— 39 warnings, identical tomain.npm test— 645 tests pass.npm run buildsucceeds; route table unchanged.The build still prints the pre-existing
"middleware" file convention is deprecatedwarning. Unrelated to this bump, left alone.Related
Closes 8 Dependabot alerts.
sharpand a dev-only nestedbrace-expansionstay open; the remaining transitive ones are in a separate lockfile-only PR.