This repository was archived by the owner on Jul 29, 2026. It is now read-only.
fix(deps): upgrade next 16.2.0 → 16.2.11 to patch security vulnerabilities - #92
Draft
caimanoliveira wants to merge 10 commits into
Draft
fix(deps): upgrade next 16.2.0 → 16.2.11 to patch security vulnerabilities#92caimanoliveira wants to merge 10 commits into
caimanoliveira wants to merge 10 commits into
Conversation
…erabilities Resolves high-severity CVEs: DoS via Server Components, cache poisoning in RSC responses, middleware/proxy bypasses (GHSA-267c, GHSA-492v, GHSA-26hh), XSS in CSP nonces and beforeInteractive scripts, SSRF via WebSocket upgrades, and ws memory disclosure. Fixes ws to safe version as well. Remaining postcss/sharp advisories are bundled transitive deps inside Next.js itself — independent remediation requires a breaking downgrade to v9 (infeasible). Co-Authored-By: Claude <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…pgrade next Three changes to get mentoria-crm deploying on Vercel: 1. Remove `supabase` devDependency — its postinstall script downloads the CLI binary from GitHub releases (403s in restricted envs, blocking npm install). The CLI is a local dev tool; install globally or via npx when needed. 2. Guard Supabase createClient() with env-var fallbacks in src/lib/supabase.ts so Next.js build-time SSR doesn't throw "supabaseUrl is required" when NEXT_PUBLIC_SUPABASE_URL hasn't been embedded yet. 3. Upgrade next 16.2.0 → 16.2.11 in mentoria-crm (same CVE set as the main splinter app). Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Turbopack auto-detects the workspace root by looking for lockfiles and was selecting the parent splinter/ directory (which has its own package-lock.json) instead of mentoria-crm/. Locally the parent node_modules happen to be installed, so the build passes. On Vercel only the subdirectory node_modules are present, causing every module import to fail silently. Setting turbopack.root = __dirname forces Turbopack to use the correct package root and eliminates the "multiple lockfiles detected" warning. Co-Authored-By: Claude <noreply@anthropic.com>
…dirname __dirname is a CJS global not available in ESM module context. When Next.js loads next.config.ts through jiti in ESM mode on Vercel, __dirname is undefined and turbopack.root silently falls back to auto-detection, which selects the parent splinter/ directory (finding its package-lock.json first). Vercel only installs mentoria-crm/node_modules, so module resolution from the parent root fails at build time. process.cwd() is always available in Node.js (CJS and ESM alike) and resolves to mentoria-crm/ when next build runs from the Vercel rootDirectory. Co-Authored-By: Claude <noreply@anthropic.com>
next@16.2.11 requires Node.js >=20.9.0. Without an engines field, Vercel may run the build with Node.js 18 (the project's configured default), causing the build to fail. This explicitly tells Vercel to select Node.js 20 or 22. Co-Authored-By: Claude <noreply@anthropic.com>
Overrides any stale Vercel project-level settings that may be causing the persistent build failure. Explicitly sets next build + npm install so Vercel uses the correct commands from the mentoria-crm rootDirectory. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Rps3biMKthxMansv3vyyd
…work key outputDirectory: ".next" was bypassing Vercel's Next.js adapter that converts the .next/ build output into the .vercel/output/ serverless deployment format. Adding framework: "nextjs" ensures the adapter is explicitly selected. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Rps3biMKthxMansv3vyyd
Bare `next build` may not have node_modules/.bin in PATH on Vercel. `npm run build` is the canonical form and ensures npm's PATH injection is active, so the Next.js binary in mentoria-crm/node_modules/.bin is found regardless of how Vercel invokes the command. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Rps3biMKthxMansv3vyyd
Turbopack's workspace-root detection walks up from mentoria-crm/ and finds the parent splinter/package-lock.json, selecting splinter/ as the project root. On Vercel (rootDirectory: mentoria-crm) only mentoria-crm/node_modules is installed, so Turbopack cannot resolve any module from the parent root → build fails. Switching to webpack avoids Turbopack's root detection entirely. turbopack.root in next.config.ts is kept in case Turbopack is re-enabled later, but is not used by webpack. Also: reflects engines field in package-lock.json after npm install. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Rps3biMKthxMansv3vyyd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nextfrom16.2.0to16.2.11(latest patch release) to resolve 14 high/moderate CVEswspackage to patch uninitialized memory disclosure and memory exhaustion DoSCVEs patched by this upgrade
Remaining known issues
postcss <8.5.10andsharp <0.35.0remain flagged as they are transitive bundled deps insidenextitself. The only npm-proposed remediation is a destructive downgrade tonext@9.3.3, which is not feasible.Test plan
next buildsucceeds with 0 errors and 0 TypeScript warningsGenerated by Claude Code