This repository was archived by the owner on Jul 29, 2026. It is now read-only.
fix(security): upgrade next 16.2.0→16.2.10 to patch critical CVEs - #88
Draft
caimanoliveira wants to merge 7 commits into
Draft
fix(security): upgrade next 16.2.0→16.2.10 to patch critical CVEs#88caimanoliveira wants to merge 7 commits into
caimanoliveira wants to merge 7 commits into
Conversation
Addresses 14 high-severity vulnerabilities in next@16.2.0: - Multiple middleware/proxy bypass (GHSA-267c-6grr-h53f, GHSA-26hh-7cqf-hhc6, GHSA-492v-c6pp-mqqv, GHSA-36qx-fr4f-26g5) - Cache poisoning (GHSA-3g8h-86w9-wvmq, GHSA-vfv6-92ff-j949, GHSA-wfc6-r584-vfw7) - XSS (GHSA-ffhc-5mcf-pf4q, GHSA-gx5p-jg67-6x7h) - DoS (GHSA-q4gf-8mx6-v5v3, GHSA-8h8q-6873-q5fj, GHSA-mg66-mrh9-m8jx, GHSA-h64f-5h5j-jqjh) - SSRF (GHSA-c4j6-fc7j-m34r) Also applied npm audit fix for ws memory-disclosure/exhaustion CVEs. Build verified clean (22 routes, TypeScript pass). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015sK27gV4zAwEdNAA8aBDPe
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Python 3.9 was removed from GitHub-hosted runners; upgrade to 3.12. Also updates deprecated actions/checkout@v2 → @v4 and actions/setup-python@v1 → @v5 (both dropped Node 16 support). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015sK27gV4zAwEdNAA8aBDPe
…ig-next Same CVEs as the root splinter project — 14 high-severity vulnerabilities in next@16.2.0 (middleware bypass, cache poisoning, XSS, DoS, SSRF). eslint-config-next pinned to match. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015sK27gV4zAwEdNAA8aBDPe
node_modules/ is already in .gitignore; remove the mistakenly-tracked .package-lock.json from git history tracking. Also add tsconfig.tsbuildinfo to .gitignore as a generated TypeScript build cache artifact. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015sK27gV4zAwEdNAA8aBDPe
… binary failure Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015sK27gV4zAwEdNAA8aBDPe
The supabase CLI postinstall downloads a native binary which fails in Vercel's build environment. The CLI is only needed locally for migrations and is not required for next build. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015sK27gV4zAwEdNAA8aBDPe
createClient() was called at module load time, causing next build to fail when NEXT_PUBLIC_SUPABASE_URL is not set in the build environment. Deferred to first property access via Proxy — env vars are only needed at request time, not during bundling. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015sK27gV4zAwEdNAA8aBDPe
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nextfrom16.2.0to16.2.10in bothsplinter(root) andmentoria-crmto remediate 14 high-severity CVEsnpm audit fixforwsmemory-disclosure/exhaustion vulnerabilities in the root projectbuildjob: Python 3.9 was removed from GitHub-hosted runners — updatedactions/checkout@v2→@v4,actions/setup-python@v1→@v5, and runner Python to3.12supabaseCLI frommentoria-crmdevDependencies — postinstall binary download (Z_DATA_ERROR) was blocking Vercel buildsmentoria-crmSupabase client with lazy Proxy pattern — deferscreateClient()to first use sonext buildsucceeds without env vars in the build environmentaa30846)Security CVEs fixed (next 16.2.0 → 16.2.10, both projects)
beforeInteractivescriptsKnown outstanding issues (not fixed here)
PostCSS XSS (GHSA-qx2v-qp2m-jg93) — moderate: Bundled inside Next.js itself; fixing requires downgrading to
next@9.3.3. Tracked upstream.GitHub Actions
buildcheck still failing: The pre-commit config (.pre-commit-config.yaml:22) pinsblacktolanguage_version: python3.9which no longer exists on GitHub-hosted runners. Fix: change topython3.12— a one-line edit. This was flagged to the author and requires manual approval.Context
This PR was generated by an automated daily audit routine. No application logic was changed.