Repository navigation
fix(security): next 16.4.1 for GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr - #746
Open
aldoruizluna wants to merge 2 commits into
Open
aldoruizluna wants to merge 2 commits into
aldoruizluna wants to merge 2 commits into
Conversation
…-r5xr - next 16.3.8 -> 16.4.1 in apps/admin, apps/dashboard, apps/docs, apps/website, packages/nextjs-sdk (devDependency), examples/nextjs-app and the root pnpm.overrides pin - @next/mdx ^16.3.8 -> ^16.4.1 (resolves 16.4.2) - @next/eslint-plugin-next ^16.3.8 -> ^16.4.1 (resolves 16.4.2) - packages/monitoring peer floor next >=16.3.8 -> >=16.4.1 - sharp already 0.35.5 everywhere (GHSA-wq5f-xc86-pv6w) Lockfile regenerated with pnpm 10.25.0 --lockfile-only; 39 unrelated rollup libc: lines dropped by the relock were restored from main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
📚 Documentation checks found issues. Please review the maintenance script output. |
Contributor
|
|
Contributor
Security Scan SummaryDate: Thu Oct 22 22:04:08 UTC 2026 Scan Results
|
Contributor
🎭 Playwright E2E Test Results
|
The PR Quality "Security Scan" (pnpm audit --audit-level=critical) went red on three advisories published 2026-10-21/22, not on the next bump: - storybook / @storybook/core 8.6.17 -> 8.6.19 (GHSA-f2ph-cmg5-wxc8): root pnpm.overrides storybook 8.6.17 -> 8.6.19 - @sentry/nextjs 10.51.0 -> 10.76.2 (GHSA-mchm-gjx6-7h55): packages/monitoring ^10.51.0 -> ^10.75.2 - dompurify 3.4.16 -> 3.4.17 (GHSA-cg2g-xh64-v4q7): root pnpm.overrides dompurify >=3.4.16 -> >=3.4.17 Lockfile-only relock with pnpm 10.25.0; dropped rollup libc: lines on surviving entries restored. `pnpm audit --audit-level=critical` now reports 0 critical. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
📚 Documentation checks found issues. Please review the maintenance script output. |
Contributor
|
|
Contributor
Security Scan SummaryDate: Thu Oct 22 23:31:05 UTC 2026 Scan Results
|
Contributor
🎭 Playwright E2E Test Results
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Two critical Next.js advisories published 2026-10-22:
use cachefunctions returning typed arrays. Fixed in 16.4.1.What
>=16.3.8→>=16.4.1pnpm.overrides.nextsharp: 0.35.5override unchanged@next/mdx^16.3.8→^16.4.1and@next/eslint-plugin-next^16.3.8→^16.4.1(both resolve to 16.4.2, the newest patch of the caret range).examples/nextjs-appkeepseslint-config-next@14.1.0(it is not on 16.x; left alone).pnpm@10.25.0 install --lockfile-only --ignore-scripts. That relock also dropped 39 unrelatedlibc:lines on@rollup/rollup-linux-*entries; they were restored from main so the diff is only next / @next/*. Lockfile diff: 148 lines (74+/74-). Every resolvedsharpis 0.35.5.Second commit (same-day advisories, CI gate): the first run's PR Quality "Security Scan" (
pnpm audit --audit-level=critical) was red on three advisories published 2026-10-21/22, not on the next bump. These are now fixed in range:storybook/@storybook/core8.6.17 → 8.6.19 (GHSA-f2ph-cmg5-wxc8): rootpnpm.overrides.storybook8.6.17 → 8.6.19.@sentry/nextjs10.51.0 → 10.76.2 (GHSA-mchm-gjx6-7h55): packages/monitoring^10.51.0→^10.75.2.dompurify3.4.16 → 3.4.17 (GHSA-cg2g-xh64-v4q7): rootpnpm.overrides.dompurify>=3.4.16→>=3.4.17.libc:lines restored): +337/-1067, mostly@sentry/*/@opentelemetry/*and their removed old trees.pnpm audit --audit-level=critical→ 0 critical.Exposure (before this PR)
/_next/image→ 400 at 2026-10-22).images.unoptimizednot set;remotePatternsset on admin/docs/website;dangerouslyAllowSVGnot set.use cache/ cacheComponents: not used.node:22-alpine(musl) for all four frontends, which is outside the glibc condition of GHSA-2464, but the version is still in the advisory range.Merging deploys to production
staging-only:
docker-publish.yml(push to main, pathsapps/**,packages/**,pnpm-lock.yaml) rebuilds the changed services and commits their digests tok8s/overlays/staging/kustomization.yaml; Argo syncs janua-staging.Owner attention: since #739 (10-19),
promote-to-prod.ymlonly acceptscomponent: apiand refuses every other component ("Only api is deployed by the isolated staging profile"). The production digests of janua-admin, janua-dashboard, janua-docs and janua-website were last changed on 10-14 (f07ec28, still next 16.3.8). So this PR has no workflow path that carries the fix to the four production frontends. To ship it, the owner needs to move those four digests ink8s/overlays/production/kustomization.yamlto the new staging-built digests (or re-enable frontend promotion), then sync (sync-prod-gitops.yml/ Argo).Verification
pnpm install --frozen-lockfile --ignore-scripts(pnpm 10.25.0) ✅pnpm audit --prod: next advisories before 3 (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr, GHSA-p3m5-59mp-jv5r) → after 0; sharp 0 → 0.next buildwere not run locally: the build host ran out of disk during this sweep, so this PR relies on CI for build and tests.madfam-runners-blue, which is saturated tonight). On main it takes 10–15 min (runs 39549517257, 39547872088). This PR changes no Python. A rerun once the runner pool is free should clear it.Prepare-only: not merged. The owner merges.
🤖 Generated with Claude Code