Repository navigation
build(deps): patch next, dompurify and sharp security advisories - #72
Conversation
- build(deps): raise next to ^16.4.3 (Image Optimization SSRF, SSG/ISR cache poisoning) - build(deps): refresh dompurify 3.4.17 via posthog-js, sharp 0.35.5, source-map-js 1.2.2, baseline-browser-mapping 2.11.32, fflate 0.6.11
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update Next.js version range frontend/package.json |
The Next.js dependency range changes from ^16.2.11 to ^16.4.3. |
Priority:
Estimated code review effort: 1 (Trivial) | ~3 minutes
Change: Other
Merge Risk: 
8ef1e
-
The dependency update is ready to merge with no identified blocking risk.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title accurately describes the dependency security updates. It names Next.js, DOMPurify, and Sharp advisories covered by the pull request objectives. Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Some tools did not complete. Review the errors below.
🔧 Biome (2.5.15)
-
frontend/package.json
-
Biome could not lint this file: nested root configuration. Check the repository's Biome configuration and plugins.
-
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
|
@coderabbitai review |
✅ Action performed
|
) Publishes #72 (Next 16.4.3, dompurify 3.4.17, sharp 0.35.5; clears the 20 open Dependabot alerts) and #73 (verify hardening, stray-file removal, roadmap refresh). The dev tree matched the reviewed #73 head exactly; verify passed on the dev push for e422e9a and this PR's own run was skipped as the internal-promotion duplicate. Both source PRs had CodeRabbit passes with no actionable comments; CodeRabbit was rate limited on this promotion, as on #70.
- test(analytics): resolve posthog-core by package specifier and fail clearly if an upgrade drops PostHog#_runBeforeSend - test(analytics): replace the stale body check in the production browser contract; require real Flight scripts before excluding them - docs(deploy): run the browser contract after each promotion - docs(roadmap): record the #72 and #73 promotion to production Two CodeRabbit passes: one finding on the first (Flight-script filter too loose), fixed in 2801dc4; none on the second. verify and Vercel green on 2801dc4. Browser contract 1/1 against https://codeswhat.com.
Patches the production dependency advisories that turned up in the local Qlty/osv pass.
npm audit --omit=devconfirms them.next^16.2.11 → ^16.4.3 (resolved 16.4.3). Fixes the critical Image Optimization SSRF and SSG/ISR cache poisoning advisories that affect 16.0.0 through 16.4.0. We servenext/image.dompurify3.4.13 → 3.4.17, pulled in throughposthog-js(critical).posthog-jsitself stays pinned at 1.417.0.sharp0.35.5,source-map-js1.2.2,baseline-browser-mapping2.11.32 andfflate0.6.11 come from the same lockfile refresh.Only
frontend/package.jsonand the lockfile change. Locally afternpm ci: lint, tsc, scene 12/12, PostHog contracts 30/30, support 9/9,next buildand the browser boundary tests 9/9 all pass, andnpm audit --omit=devreports 0.This goes to dev only. Promoting to main is a separate step.
Summary by CodeRabbit