Repository navigation
Backport #4737: [deps] Upgrade next to 16.3.8 for CVE-2026-94483 - #4766
Merged
Merged
Conversation
Bumps every `next` pin in the repo from 16.3.6 to 16.3.8 to fix **CVE-2026-94483** / GHSA-cjq9-62q9-8jv4 (SSRF in Image Optimization, affects `>= 16.0.0 < 16.3.8`): - `docs` - `packages/next` (devDependency only; the published `next: ">13"` peer range is unchanged) - `workbench/nextjs-turbopack` - `workbench/nextjs-webpack` - `workbench/swc-playground` The changeset is empty because no published package's runtime dependencies change. Most of the lockfile churn comes from `fumadocs-*` and `radix-ui` in `docs`. `fumadocs-core` peers on `next`, so pnpm re-resolved that subtree. - `pnpm turbo run build --filter @workflow/next...` passes - `workbench/nextjs-turbopack` `pnpm build` passes - `@workflow/next` unit tests: 102/103 pass. The one failure is `watch-scope.test.ts`, which compares macOS `/var` symlink paths on my machine and doesn't involve `next`. Signed-off-by: Nathan Rajlich <n@n8.io>
🦋 Changeset detectedLatest commit: 830c88e The changes in this PR will be included in the next version bump. This PR includes changesets to release 0 packagesWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
TooTallNate
approved these changes
Oct 8, 2026
Backports the workspace override from main (#2901). stable resolved @opentelemetry/api to both 1.9.0 and 1.9.1, so pnpm installed one next copy per otel version. As of next 16.3 those copies' NextConfig types are incompatible, breaking withWorkflow() typechecks in the nextjs workbenches.
Contributor
Author
🧪 E2E Test Results❌ Some tests failed Summary
❌ Failed Tests🌍 Community Worlds (85 failed)turso (85 failed):
Details by Category✅ ▲ Vercel Production
✅ 💻 Local Development
✅ 📦 Local Production
✅ 🐘 Local Postgres
✅ 🪟 Windows
❌ 🌍 Community Worlds
✅ 📋 Other
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated backport of #4737 to
stable(backport job run).AI recommendation: This is a pure security dependency bump for CVE-2026-94483 (SSRF in Next.js Image Optimization, affecting
>= 16.0.0 < 16.3.8), which the backport criteria explicitly admit. I verified thatstablestill pinsnext: 16.2.11inpackages/next(devDependency),workbench/nextjs-turbopack,workbench/nextjs-webpack,workbench/swc-playground, anddocs— all within the vulnerable range — so the maintenance line is affected. Note the cherry-pick will need adapting sincestableis on the 16.2.x line and its lockfile differs, and thedocs/package.jsonportion can be resolved howeverstable's placeholder docs app requires.Merge conflicts were resolved by AI (opencode with
anthropic/claude-opus-5). Please review the conflict resolution carefully before merging.Follow-up fix (Vercel deploy failures):
stableresolved@opentelemetry/apito both 1.9.0 (the workbenches'^1.9.0) and 1.9.1, so pnpm installed onenext@16.3.8copy per otel version. With 16.3.x those copies'NextConfigtypes are incompatible, sowithWorkflow(nextConfig)failed to typecheck innextjs-webpack/nextjs-turbopack. Backportedmain's'@opentelemetry/api': 1.9.1workspace override (#2901), which collapses everything to one copy. Overrides only affect this workspace's resolution, not published packages. Verified both workbenches build locally.Vercel – workbench-python-workflowfails onstableitself (workbench/pythondoesn't exist on this branch) and is unrelated.