Skip to content

Commit 047ee0d

Browse files
authored
Update Next.js/React Flight packages for RCE advisory (#29)
# React Flight / Next.js RCE Advisory Fix ## Summary Updated the repository to address the React Flight / Next.js RCE advisory by upgrading Next.js to a patched version. ## Analysis Scanned all workspace package.json files to identify affected packages: - **apps/website/package.json**: Contains `next@16.0.3` (VULNERABLE) - **apps/app/package.json**: Does not use Next.js or React Flight packages - **packages/agent-cli-sdk/package.json**: No Next.js or React Flight packages - **packages/agentcmd-workflows/package.json**: No Next.js or React Flight packages No React Flight packages (`react-server-dom-webpack`, `react-server-dom-parcel`, `react-server-dom-turbopack`) were found in the project. ## Changes Made ### Modified Files - **apps/website/package.json**: Upgraded `next` from `16.0.3` to `16.0.7` - React and React DOM were not modified as they are already at safe versions (19.2.0) - Next.js version 16.0.7 includes the security fix for the RCE vulnerability ### Updated Lockfiles - **pnpm-lock.yaml**: Updated to reflect the new Next.js 16.0.7 dependency and all transitive dependencies ## Verification ✅ Successfully ran `pnpm install` to update lockfiles ✅ Verified that `next@16.0.7` is correctly resolved in pnpm-lock.yaml ✅ Successfully built the website app with `pnpm build` to confirm no regressions ## Implementation Details - Only the affected package (Next.js in the website app) was upgraded to the patched version - No changes were made to React or React DOM as per the advisory instructions (Next.js handles these automatically) - All peer dependency warnings are pre-existing and unrelated to this fix - The build completed successfully with no errors ## Security Impact The upgrade from Next.js 16.0.3 to 16.0.7 addresses the React Flight / Next.js RCE advisory by including security patches that prevent remote code execution attacks through the React Flight protocol. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
1 parent 87a9140 commit 047ee0d

2 files changed

Lines changed: 75 additions & 75 deletions

File tree

apps/website/package.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
"lucide-react": "^0.544.0",
3232
"mermaid": "^11.12.1",
3333
"motion": "^12.23.24",
34-
"next": "16.0.3",
34+
"next": "16.0.7",
3535
"next-themes": "^0.4.6",
3636
"react": "19.2.0",
3737
"react-dom": "19.2.0",
@@ -48,7 +48,7 @@
4848
"@types/react": "^19",
4949
"@types/react-dom": "^19",
5050
"eslint": "^9",
51-
"eslint-config-next": "16.0.3",
51+
"eslint-config-next": "16.0.7",
5252
"tailwindcss": "^4",
5353
"typescript": "^5"
5454
}

0 commit comments

Comments
 (0)