mirror of
https://github.com/onyx-dot-app/onyx.git
synced 2026-10-23 03:42:59 -05:00
onyx-cherry-pick[bot]
6b59a0a512
Pins `next` to `16.4.1` in every manifest and lockfile for [GHSA-2464-fhr4-w9xw](https://osv.dev/vulnerability/GHSA-2464-fhr4-w9xw), [GHSA-673q-mjm6-r5xr](https://osv.dev/vulnerability/GHSA-673q-mjm6-r5xr). Opened by the [CVE Alerts run](https://github.com/onyx-dot-app/onyx/actions/runs/39827750691). Closes #16509 I moved `next` from 16.3.8 to 16.4.1 in `web/package.json` and `examples/widget/package.json`. 16.4.1 is the lowest 16.x release that fixes both GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr. The opal peer range `>=14.0.0` already allows it, so I left it alone. The image-optimizer RCE (a bug in `sharp`, reached through Next's image optimizer) does not reach the production web app: `web/next.config.js` sets `images.unoptimized: true`, and `web/package.json` already requires `sharp` `^0.35.5`, the fixed version the advisory names. The `use cache` RCE needs Cache Components, and neither `web/next.config.js` nor `examples/widget/next.config.mjs` turns on `cacheComponents` or `useCache`. I had no code-search tool in this run, so I checked the config files and every `package.json` I could find by reading them directly, but I could not search all source files for a `"use cache"` directive. My verdict is not affected in production, and the upgrade is worth merging anyway because both advisories are critical. Co-authored-by: onyx-cherry-pick[bot] <285052878+onyx-cherry-pick[bot]@users.noreply.github.com>
26 lines
512 B
JSON
26 lines
512 B
JSON
{
|
|
"name": "widget",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build",
|
|
"start": "next start"
|
|
},
|
|
"dependencies": {
|
|
"next": "16.4.1",
|
|
"react": "^19",
|
|
"react-dom": "^19",
|
|
"react-markdown": "^10.1.0"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/postcss": "^4.3.3",
|
|
"@types/node": "^26",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"postcss": "^8.5.26",
|
|
"tailwindcss": "^4.1.18",
|
|
"typescript": "^7"
|
|
}
|
|
}
|