Repository navigation
Upgrade Next.js to 16.4.3 (security) - #1
Conversation
16.3.8 is affected by GHSA-673q-mjm6-r5xr and GHSA-2464-fhr4-w9xw (critical: unauthenticated remote code execution) and GHSA-p3m5-59mp-jv5r (high: denial of service).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f1c6f0b107
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "lucide-react": "^1.16.0", | ||
| "negotiator": "^1.0.0", | ||
| "next": "16.3.8", | ||
| "next": "16.4.3", |
There was a problem hiding this comment.
The checked-in package-lock.json still specifies and resolves both next and eslint-config-next at 16.3.8, while this change requires 16.4.3. Both .github/workflows/ci.yml:17 and the Dockerfile's build stage run npm ci --ignore-scripts, so updating only the pnpm lockfile breaks those installation paths before checks or builds run. The locally installed npm documentation (docs/content/commands/npm-ci.md) explicitly states that when lockfile dependencies do not match package.json, “npm ci will exit with an error, instead of updating the package lock.” Regenerate and commit the npm lockfile for the upgraded versions as well.
Useful? React with 👍 / 👎.
Upgrade Next.js to 16.4.3 (security)
Upgrade Next.js to 16.4.3 (security)
Next.js 16.3.8 is affected by GHSA-673q-mjm6-r5xr and GHSA-2464-fhr4-w9xw (critical: unauthenticated remote code execution) and GHSA-p3m5-59mp-jv5r (high: denial of service), fixed in 16.4.1 (15.5.28 for 15.x). This moves
next(andeslint-config-next/@next/*where they follow it) to 16.4.3 and refreshes the lockfile (pnpm@10). Nothing else changes.