This repository was archived by the owner on Jul 29, 2026. It is now read-only.
chore(security): upgrade next 16.2.0→16.2.11, fix ws DoS vulnerability - #94
Draft
caimanoliveira wants to merge 10 commits into
Draft
chore(security): upgrade next 16.2.0→16.2.11, fix ws DoS vulnerability#94caimanoliveira wants to merge 10 commits into
caimanoliveira wants to merge 10 commits into
Conversation
Upgrades Next.js to the latest 16.2.x patch to address known CVEs (DoS, XSS, cache poisoning, middleware bypass, SSRF). Also applies npm audit fix for the ws memory-disclosure/DoS vulnerability (GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p). Remaining 3 high-severity alerts (postcss + sharp) are transitive deps locked inside next itself; npm's only proposed fix is a breaking downgrade to v9 — intentionally skipped. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Zn3JV76NWHmfgFRJEzprt
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…m next - Fix pre-commit CI: actions/setup-python@v1 + Python 3.9 no longer available on GitHub runners (dropped; only 3.10+ exists). Bumps to actions/checkout@v4, actions/setup-python@v5, python-version 3.12. - Upgrade mentoria-crm next 16.2.0→16.2.11 and eslint-config-next to match, same security CVEs as the root package fixed in the prior commit. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Zn3JV76NWHmfgFRJEzprt
The pre-commit workflow now runs on Python 3.12, but the black hook still specified language_version: python3.9, causing pre-commit to fail when it couldn't find a python3.9 interpreter on the runner. Also untracks node_modules/.package-lock.json which was accidentally committed when node_modules/ was nearly empty. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Zn3JV76NWHmfgFRJEzprt
…ild time createClient crashes when NEXT_PUBLIC_SUPABASE_URL is undefined, which happens in Vercel PR preview builds where the env var is only configured for the Production environment. Fall back to placeholder values so the build completes; actual API calls will fail gracefully at runtime if the real credentials aren't injected. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Zn3JV76NWHmfgFRJEzprt
…failure Next.js detected both the repo-root package-lock.json and mentoria-crm's own lockfile and selected the repo root as workspace root. On Vercel only the mentoria-crm subdirectory gets node_modules installed, so prerendering failed when Next.js tried to resolve modules from the non-existent root node_modules. Setting turbopack.root to __dirname tells Next.js to use mentoria-crm as the workspace root. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Zn3JV76NWHmfgFRJEzprt
Next.js 16 dropped Node.js 18 support (requires >=20.9.0 LTS). Vercel was likely defaulting to Node.js 18, causing the build to fail immediately. Adding .nvmrc and engines field so Vercel picks Node.js 20. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Zn3JV76NWHmfgFRJEzprt
…at root __dirname is undefined in ESM module context (tsconfig has "module":"esnext"), causing path.resolve(__dirname) to throw when Next.js 16 loads next.config.ts. Switch to process.cwd() which is always available. Also add .nvmrc at repo root so Vercel picks up Node.js 20 regardless of which directory it uses for version file lookup in monorepo builds. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Zn3JV76NWHmfgFRJEzprt
turbopack.root was speculatively added to work around workspace root detection. The original crash (supabaseUrl is required during prerender) is already fixed by the placeholder fallback in supabase.ts. On Vercel, Turbopack correctly detects mentoria-crm/ as the workspace root from the lockfile, so the explicit root setting is not needed and was causing the build to fail at ~2 minutes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Zn3JV76NWHmfgFRJEzprt
process.cwd() may return the repo root on Vercel's build pipeline
instead of the mentoria-crm/ subdirectory, causing Turbopack to use
the wrong workspace root and fail to resolve node_modules.
import.meta.url always points to next.config.ts itself, so
fileURLToPath(new URL('.', import.meta.url)) gives the correct
absolute path for mentoria-crm/ regardless of Vercel's cwd behavior.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019Zn3JV76NWHmfgFRJEzprt
…e root issue Turbopack's workspace root detection fails on Vercel because it finds the repo-root package-lock.json and resolves modules against the wrong directory. Adding a vercel-build script that passes --webpack bypasses this entirely; webpack uses standard Node.js resolution starting from the nearest node_modules. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Zn3JV76NWHmfgFRJEzprt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nextfrom16.2.0to16.2.11(latest patch), addressing numerous CVEs: DoS via Server Components/Cache/Image API/Server Actions, XSS, cache poisoning, middleware/proxy bypass, and SSRF.npm audit fixto resolve twowsvulnerabilities (uninitialized memory disclosure GHSA-58qx-3vcg-4xpx, memory exhaustion DoS GHSA-96hv-2xvq-fx4p).Known remaining vulnerabilities
Three high-severity alerts for
postcssandsharpremain. Both are transitive dependencies locked insidenextitself — npm's only proposed fix is a destructive downgrade to v9.3.3, which would be a complete breaking change. These are upstream issues that require a fix from the Next.js team.Test plan
npm run buildpasses with zero errors on Next.js 16.2.11Generated by Claude Code