fix(deps): patch two critical Next.js RCEs and eight other advisories - #3514
Conversation
`pnpm audit --prod` on main reports 11 vulnerabilities, including two criticals: critical next >=16.0.0 <16.3.3 Unauthenticated Remote Code Execution critical next >=16.0.0 <16.3.3 Unauthenticated Remote Code Execution main sits on next ~16.2.11, which is inside that range. These advisories were published after the dependency pass in #3499, so the tree was clean when it landed and has since gone red without anything changing here. Bumps next to ~16.3.5. That crosses a minor, which a routine bump would not justify — the fix for both RCEs first ships in 16.3.3, so there is no patch release on the 16.2 line to take instead. eslint-config-next follows to match. Also refreshes the transitive overrides against newly published advisories: fast-uri ^3.1.5 -> ^3.1.7 SSRF + host confusion via percent-encoding js-yaml ^4.3.1 -> ^4.3.2 maxTotalMergeKeys does not limit CPU use sharp ^0.35.0 -> ^0.35.4 libheif vulnerabilities browserslist (new) -> ^4.28.9 unbounded memory growth, prototype write baseline-browser-mapping (new) -> ^2.11.0 termination on invalid input and vitest/@vitest/coverage-v8 to ^4.1.11 for the two dev-tree advisories. Every range stays caret-bounded inside its current major, for the same reason recorded in pnpm-workspace.yaml: an open ">=" drags dependents onto the newest major rather than the patched release. pnpm audit: 2 critical / 8 high / 1 moderate -> 0, prod and dev. Type-check clean, 2387 tests passing, production build green on 16.3.5.
github-actions
Bot
added
gssoc26
GSSoC Label Checklist 🏷️@Priyanshu-byte-coder — please apply the appropriate labels before merging: Difficulty (pick one):
Quality (optional):
Validation (required to score):
|
|
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Secrets |  |
Sep 12, 2026 11:10a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
|
🎉 Merged! Thanks for contributing to DevTrack. If the project has been useful to you, a ⭐ star on the repo is the easiest way to support it — it helps DevTrack get discovered by more developers. Keep an eye on open issues for your next contribution! |
1 participant
mainis currently reporting 11 vulnerabilities, two of them critical:mainsits onnext ~16.2.11, which is inside the vulnerable range. Nothing in the repo changed to cause this — these advisories were published after the dependency pass in #3499, so the tree was clean when that landed and has gone red since.The Next bump crosses a minor, deliberately
~16.2.11→~16.3.5. I've avoided minor bumps of Next in routine dependency work, but the fix for both RCEs first ships in 16.3.3 — there is no patch release on the 16.2 line to take instead.eslint-config-nextfollows to match.Worth noting for #3504: dependabot proposes
~16.3.2, which is still inside<16.3.3and therefore still vulnerable. That PR does not resolve these two advisories.Other advisories refreshed
fast-uri^3.1.5^3.1.7js-yaml^4.3.1^4.3.2maxTotalMergeKeysdoes not limit CPU usesharp^0.35.0^0.35.4browserslist^4.28.9baseline-browser-mapping^2.11.0vitest,@vitest/coverage-v8^4.1.8^4.1.11Every range stays caret-bounded inside its current major, for the reason already recorded in
pnpm-workspace.yaml: an open>=drags dependents onto the newest major (js-yaml 5, nanoid 6, undici 8) rather than the patched release.fast-uriandjs-yamlboth have patched releases inside their current majors, so no major move is needed.Verification
pnpm audit --prod: No known vulnerabilities (was 2 critical / 8 high / 1 moderate)pnpm audit(incl. dev): No known vulnerabilitiespnpm run type-check: cleanpnpm test: 2387 passingpnpm run build: green on 16.3.5