mirror of
https://github.com/onyx-dot-app/onyx.git
synced 2026-10-23 03:42:59 -05:00
c8af09ce1c
<!-- claude-slack-attribution -->
_Requested via [Slack
thread](https://onyx-company.slack.com/archives/C0C5SMAM4TT/p1792689234338159?thread_ts=1792689234.338159&cid=C0C5SMAM4TT)_
## Description
**Before:** On release/v4.7, `web` and `examples/widget` pin `next`
16.3.8, which is affected by GHSA-2464-fhr4-w9xw and
GHSA-673q-mjm6-r5xr.
**After:** `next` is pinned to 16.4.1 in `web/package.json` and
`examples/widget/package.json`. `web/bun.lock` and the root `bun.lock`
resolve next/@next/* 16.4.1. No app code changes.
Cherry-pick of #16511 (0429af73f15d6f39c6dad9172d9814dccab98a14)
**Conflict resolution:** Root `bun.lock` conflicted. `web/bun.lock`
auto-merged, but I did not trust a textual lockfile merge, so I restored
both lockfiles from release/v4.7 and regenerated them with bun 1.3.13
using `bun install --lockfile-only` after taking the two package.json
bumps. In the root lockfile, sharp and `@img/*` also move from 0.35.4 to
0.35.5, because next 16.4.1 requires `sharp ^0.35.5`.
**How:** Same dependency pins as #16511, applied on top of release/v4.7,
with the lockfiles regenerated from that branch's own lockfiles.
`web/lib/opal`'s `next >=14.0.0` peer range is unchanged, as in the
source PR.
## How Has This Been Tested?
- `bun install --frozen-lockfile --lockfile-only` passes in `web/` and
at the repo root with bun 1.3.13.
- Checked both lockfiles: no `next`/`@next/*` 16.3.8 entries remain.
- Did not run a full build; relying on CI.
## Additional Options
- [ ] [Optional] Please cherry-pick this PR to the latest release
version.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01SNPR9gorRKGuTzaNNyuqJG)_
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Pins `next` to 16.4.1 in `web/` and `examples/widget` to address
security advisories, and regenerates `web/bun.lock` and the root
`bun.lock` accordingly. The root lockfile also updates `sharp` and
`@img/*` to 0.35.5 because `next` 16.4.1 requires `sharp ^0.35.5`.
<sup>Written for commit cd0c872b07.
Summary will update on new commits.</sup>
<a
href="https://cubic.dev/pr/onyx-dot-app/onyx/pull/16530?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="View guided diff"
src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>
<a
href="https://www.cubic.dev/action/auto-fix/pr/onyx-dot-app/onyx/16530?returnTo=https%3A%2F%2Fgithub.com%2Fonyx-dot-app%2Fonyx%2Fpull%2F16530&source=description"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"><img
alt="Turn on auto-fix"
src="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
Co-authored-by: onyx-cherry-pick[bot] <285052878+onyx-cherry-pick[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
26 lines
512 B
JSON
26 lines
512 B
JSON
{
|
|
"name": "widget",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build",
|
|
"start": "next start"
|
|
},
|
|
"dependencies": {
|
|
"next": "16.4.1",
|
|
"react": "^19",
|
|
"react-dom": "^19",
|
|
"react-markdown": "^10.1.0"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/postcss": "^4.3.3",
|
|
"@types/node": "^26",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"postcss": "^8.5.19",
|
|
"tailwindcss": "^4.1.18",
|
|
"typescript": "^7"
|
|
}
|
|
}
|