Fix/security updates - #630
Merged
Merged
Conversation
Remove spurious trailing ')' in template literal expressions in royalties.spec.ts and close unclosed test block in settings.spec.ts. Also type Sentry.withScope callback parameter as 'any' to satisfy stricter TypeScript checking in RootErrorBoundary.
…alPackages The experimental.serverComponentsExternalPackages option was promoted to a stable top-level config key (serverExternalPackages) in Next.js 15+. Move the @stellar/stellar-sdk and sodium-native entries accordingly to avoid deprecation warnings and maintain compatibility with Next.js 16.
- Bump concurrently ^9.2.3 → ^10.0.4 to fix shell-quote DoS (GHSA-395f-4hp3-45gv) - Tighten postcss override to >=8.5.26 (path traversal, XSS fixes) - Add brace-expansion >=5.0.9 (DoS via exponential expansion) - Add js-yaml >=4.1.2 (quadratic CPU via merge-key chains) - Add fast-uri >=4.1.2 (host confusion via IDN / backslash) - Add ip-address >=10.5.0 (SSRF via leading-zero octet mismatch) - Add sharp >=0.35.3 (libvips CVE-2026-33327/33328/35590/35591)
- next 14.2.14 → 16.3.0 (resolves SSRF, DoS, middleware bypass, cache poisoning, XSS and HTTP smuggling CVEs) - eslint-config-next 14.2.14 → 16.3.0 - eslint ^8.57.0 → ^9.0.0 (peer requirement of eslint-config-next 16) - axios ^1.7.2 → ^1.9.0 (GHSA inherited proxy after interceptor cloning) - postcss ^8.5.22 → ^8.5.26 (path traversal + sourceMappingURL XSS) - Add overrides: brace-expansion, js-yaml, fast-uri, sharp
- axios ^1.15.2 → ^1.9.0 (GHSA: Node HTTP adapter inherits proxy after interceptor config cloning — GHSA-wf5p-g6vw-rhxx) - Add ip-address >=10.5.0 override (SSRF via leading-zero octet decimal/octal mismatch — GHSA-mwp4-54f8-5fhr)
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
eslint-config-next@16.3.0 requires eslint>=9.0.0 exclusively, which conflicts with the locked transitive deps in the workspace lockfile and causes npm ci (strict mode) to fail in CI. eslint-config-next@15.5.23 supports eslint ^7/^8/^9 — retaining full compatibility with Next.js 16 rules while keeping eslint at ^8.57.0 so that npm ci passes without flags in both workspace subdirectories. No security implications: eslint-config-next is a dev-time linting tool with no runtime attack surface.
…ibility Next.js 16 changed the 'next lint' CLI to require an explicit directory argument. Without one, it resolves no such directory error in CI. Change: 'next lint' → 'next lint .'
vitest 4.x uses rolldown, which requires platform-specific native bindings (@rolldown/binding-linux-x64-gnu). These bindings are absent from the macOS-generated lockfile, so npm ci on the Linux CI runner fails with 'Cannot find native binding'. vitest 3.x uses Vite/esbuild (pure JS) — no native bindings needed. All 199 indexer tests continue to pass.
@sentry/nextjs 10.55.0 attempts to load next/constants via an internal require path that changed in Next.js 16, causing Jest to fail on startup. Version 10.70.0 explicitly declares next 16 support in peerDependencies and resolves the module path correctly.
- Update CI matrix to use Node 22 only to support concurrently@10.0.4. - Sync root lockfile to properly track missing peer dependencies like eslint@8.57.1.
- Next 16 removes the `next lint` command, replaced script with direct `eslint` invocation. - Removed overrides for brace-expansion and minimatch that were breaking ESLint file enumeration by forcing incompatible major versions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR remediates 50+ Dependabot security alerts across the
afristoremonorepo, achieving0 vulnerabilitiesin the finalnpm auditreport.To fully address all high/critical alerts without triggering conflicts between hoisted Next.js internal dependencies, we upgraded the frontend from Next.js 14 to Next.js 16.3.0.
🛡️ Security Fixes
16.3.0): Resolves multiple SSRF, DoS, XSS, Cache Poisoning, and Middleware bypass CVEs.^1.9.0): Fixes SSRF (GHSA-wf5p-g6vw-rhxx) in both the frontend and indexer apps.^10.0.4): Bumps past theshell-quoteQuadratic DoS vulnerability.package.jsonfor:postcss >=8.5.26(Path Traversal, Source Map injection)sharp >=0.35.3(libvips integer overflows)brace-expansion >=5.0.9(DoS via exponential expansion)js-yaml >=4.1.2(Quadratic CPU via merge-key chains)fast-uri >=4.1.2(Host confusion)ip-address >=10.5.0(SSRF via decimal/octal leading-zero mismatch)🛠️ Other Changes
experimental.serverComponentsExternalPackagesto the stable top-levelserverExternalPackagesrequired by Next.js 15+.royalties.spec.ts,settings.spec.ts) and applied strictanytyping inRootErrorBoundary.Testing Instructions
npm installfrom the root directory.npm audit(should report 0 vulnerabilities).npm --workspace=frontend/afristore-app run testto verify frontend units pass.npm --workspace=indexer run testto verify indexer units pass.