This repository was archived by the owner on Apr 21, 2026. It is now read-only.
fix(deps): bump next to 16.2.3 to patch GHSA-q4gf-8mx6-v5v3 DoS vulnerability#629
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 41 minutes and 3 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (7)
WalkthroughThis PR updates Next.js from v16.2.2 to v16.2.3 across the monorepo, downgrades ESLint in the web application, adds a dependency override for the new Next.js version, and updates the Stripe API version in server configuration. Changes
Possibly related PRs
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsTimed out fetching pipeline failures after 30000ms Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Project Scorecard |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
apps/docs/package.json (1)
18-18: Bumpeslint-config-nexthere as well and verify resolved Next version.Please align
eslint-config-nextto^16.2.3in docs for consistency withnext, and confirm lockfile resolution tonext@16.2.3to ensure the CVE fix is actually applied in this app.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@apps/docs/package.json` at line 18, Update the docs app dependency: in apps/docs package.json set "eslint-config-next" to "^16.2.3" to match the existing "next": "^16.2.3"; then run your package manager install (npm/yarn/pnpm) to update the lockfile and verify that the lockfile resolves "next" to 16.2.3 (check package-lock.json / yarn.lock / pnpm-lock.yaml for next@16.2.3), and commit both the updated package.json and the updated lockfile so the CVE fix is applied for the docs app.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/web/package.json`:
- Line 50: Update the Next ecosystem patch versions so they match next@^16.2.3:
change the dependency entries for `@next/bundle-analyzer` and eslint-config-next
to ^16.2.3 in apps/web/package.json (the same place where "next": "^16.2.3" is
declared), then reinstall/update the lockfile (npm/yarn/pnpm install) so the
lockfile reflects `@next/bundle-analyzer`@16.2.3 and eslint-config-next@16.2.3 to
prevent version drift.
---
Nitpick comments:
In `@apps/docs/package.json`:
- Line 18: Update the docs app dependency: in apps/docs package.json set
"eslint-config-next" to "^16.2.3" to match the existing "next": "^16.2.3"; then
run your package manager install (npm/yarn/pnpm) to update the lockfile and
verify that the lockfile resolves "next" to 16.2.3 (check package-lock.json /
yarn.lock / pnpm-lock.yaml for next@16.2.3), and commit both the updated
package.json and the updated lockfile so the CVE fix is applied for the docs
app.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1641e8e2-c0a4-4638-8254-dfc0d65f561e
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (2)
apps/docs/package.jsonapps/web/package.json
| "marked": "^17.0.6", | ||
| "motion": "^12.38.0", | ||
| "next": "^16.2.2", | ||
| "next": "^16.2.3", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Checking Next ecosystem versions in apps/web/package.json..."
python - <<'PY'
import json
p='apps/web/package.json'
j=json.load(open(p))
deps=j.get('dependencies',{})
dev=j.get('devDependencies',{})
print("next:", deps.get('next'))
print("@next/bundle-analyzer:", dev.get('@next/bundle-analyzer'))
print("eslint-config-next:", dev.get('eslint-config-next'))
PY
echo
echo "Checking lockfiles for resolved next versions..."
fd -HI '^(pnpm-lock\\.yaml|package-lock\\.json|yarn\\.lock)$' -t f | while read -r f; do
echo "--- $f ---"
rg -n 'next(@|":|\\s)' "$f" | head -n 20 || true
rg -n '16\\.2\\.2|16\\.2\\.3' "$f" | head -n 40 || true
doneRepository: Forge-Space/siza
Length of output: 243
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Repository structure (top level) ==="
ls -la | head -30
echo
echo "=== Looking for lockfiles ==="
find . -maxdepth 2 -type f \( -name "pnpm-lock.yaml" -o -name "package-lock.json" -o -name "yarn.lock" \) 2>/dev/null || echo "No lockfiles found in first 2 levels"
echo
echo "=== Checking for lockfiles anywhere ==="
fd -HI 'lock\.(yaml|json|txt)$' -t f 2>/dev/null | head -20
echo
echo "=== Monorepo package manager detection ==="
if [ -f "pnpm-workspace.yaml" ]; then echo "✓ pnpm workspace detected"; fi
if [ -f "lerna.json" ]; then echo "✓ lerna detected"; fi
if [ -f ".npmrc" ]; then echo "✓ .npmrc found"; fi
if [ -f ".pnpmfile.cjs" ]; then echo "✓ .pnpmfile.cjs found"; fi
echo
echo "=== Checking apps/web/package.json for Prettier compliance ==="
head -60 apps/web/package.json | tail -15Repository: Forge-Space/siza
Length of output: 2576
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Checking resolved 'next' versions in package-lock.json ==="
rg -A 5 '"name":\s*"next"' package-lock.json | head -30
echo
echo "=== Searching for specific version patterns ==="
rg '16\.(2\.[2-3]|[3-9]\.0)' package-lock.json | head -40
echo
echo "=== Checking `@next/bundle-analyzer` in package-lock.json ==="
rg -A 5 '"name":\s*"@next/bundle-analyzer"' package-lock.json | head -20
echo
echo "=== Checking eslint-config-next in package-lock.json ==="
rg -A 5 '"name":\s*"eslint-config-next"' package-lock.json | head -20
echo
echo "=== Full apps/web/package.json for Prettier formatting check ==="
cat apps/web/package.json | wc -l
head -70 apps/web/package.jsonRepository: Forge-Space/siza
Length of output: 122
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Package-lock.json file info ==="
wc -l package-lock.json
head -30 package-lock.json
echo
echo "=== Searching for 'next' entries more broadly ==="
grep -n '"next"' package-lock.json | head -20
echo
echo "=== Checking for version patterns in lockfile ==="
grep '16\.2\.[23]' package-lock.json | head -20
echo
echo "=== Looking at apps/web package-lock.json section ==="
grep -A 20 '"apps/web"' package-lock.json | head -40
echo
echo "=== Verifying JSON formatting of apps/web/package.json ==="
python3 << 'EOF'
import json
with open('apps/web/package.json', 'r') as f:
content = f.read()
try:
json.loads(content)
print("✓ Valid JSON")
except json.JSONDecodeError as e:
print(f"✗ JSON Parse Error: {e}")
# Check for Prettier formatting
print("\n=== Checking line endings and indentation ===")
lines = content.split('\n')
for i, line in enumerate(lines[45:55], start=46):
print(f"{i}: {repr(line)}")
EOFRepository: Forge-Space/siza
Length of output: 2860
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Searching for `@next/bundle-analyzer` ==="
grep -n 'bundle-analyzer' package-lock.json | head -20
echo
echo "=== Full context around apps/web package in lockfile ==="
grep -A 150 '"apps/web":\s*{' package-lock.json | grep -E '(next|bundle|eslint)' | head -30
echo
echo "=== Verifying JSON formatting of apps/web/package.json ==="
python3 << 'EOF'
import json
import sys
with open('apps/web/package.json', 'r') as f:
content = f.read()
# Check JSON validity
try:
parsed = json.loads(content)
print("✓ Valid JSON")
except json.JSONDecodeError as e:
print(f"✗ Invalid JSON: {e}")
sys.exit(1)
# Check formatting (2-space indent for Prettier default)
lines = content.split('\n')
print(f"\n✓ Total lines: {len(lines)}")
# Check line 50 (next line)
print(f"\nLine 50 context:")
for i in range(48, 52):
if i < len(lines):
print(f" {i+1}: {repr(lines[i])}")
# Check indentation consistency
print("\n✓ Indentation check (2 spaces):")
for i in range(45, 60):
if i < len(lines):
line = lines[i]
if line and not line.startswith('"'):
leading = len(line) - len(line.lstrip())
if leading > 0 and leading % 2 != 0:
print(f" WARNING: Line {i+1} has odd indentation: {leading} spaces")
print("✓ Indentation appears consistent")
EOFRepository: Forge-Space/siza
Length of output: 2310
Align Next ecosystem patch versions to maintain consistency across CVE updates.
The bump to next@16.2.3 is correct, but @next/bundle-analyzer and eslint-config-next remain at ^16.2.2 in the lockfile. Update both to ^16.2.3 to avoid version drift and ensure CVE remediation is complete across the workspace.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@apps/web/package.json` at line 50, Update the Next ecosystem patch versions
so they match next@^16.2.3: change the dependency entries for
`@next/bundle-analyzer` and eslint-config-next to ^16.2.3 in apps/web/package.json
(the same place where "next": "^16.2.3" is declared), then reinstall/update the
lockfile (npm/yarn/pnpm install) so the lockfile reflects
`@next/bundle-analyzer`@16.2.3 and eslint-config-next@16.2.3 to prevent version
drift.
LucasSantana-Dev
changed the title
LucasSantana-Dev
changed the title
LucasSantana-Dev
force-pushed
the
fix/next-dos-vulnerability
branch
from
e4be953 to
dfe7d73
Compare
LucasSantana-Dev
force-pushed
the
fix/next-dos-vulnerability
branch
from
dfe7d73 to
9b6cbe2
Compare
LucasSantana-Dev
force-pushed
the
fix/next-dos-vulnerability
branch
from
9b6cbe2 to
b128c91
Compare
LucasSantana-Dev
force-pushed
the
fix/next-dos-vulnerability
branch
from
b128c91 to
4a44824
Compare
LucasSantana-Dev
force-pushed
the
fix/next-dos-vulnerability
branch
from
4a44824 to
45efba2
Compare
LucasSantana-Dev
force-pushed
the
fix/next-dos-vulnerability
branch
from
45efba2 to
e4fce47
Compare
…rability - Upgrade next from 16.2.0 to 16.2.3 (direct) - Override transitive next via fumadocs and opennextjs - Bump eslint-plugin-react-hooks to v5 for eslint 9 compat Unblocks the repo-wide trivy scan which flags GHSA-q4gf-8mx6-v5v3 against the current next@16.2.0 pin. Fix is the 16.2.x release line per the advisory.
LucasSantana-Dev
force-pushed
the
fix/next-dos-vulnerability
branch
from
e4fce47 to
147706c
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nextfrom^16.2.2to^16.2.3inapps/webandapps/docsTest plan
apps/webboots locally after mergeWhy one consolidated fix
Dependabot PRs update lockfiles but don't bump
nextitself, so they each inherit the same vulnerable version frompackage.json. One upstream bump unblocks the whole queue.🤖 Generated with Claude Code
Summary by CodeRabbit