Repository navigation
build(deps): Next 16.4.5 with OpenNext 1.20.16; clear security alerts - #112
Merged
Merged
Conversation
Next <=16.4.0 carries two critical unauthenticated RCEs (GHSA-673q-mjm6-r5xr `use cache` typed arrays; GHSA-2464-fhr4-w9xw Image Optimization with SVG) and a Server Actions DoS (GHSA-p3m5-59mp-jv5r). No 16.3.x backport exists. Next was held at 16.3 (65af40c) because 16.4.0 made the OpenNext Worker answer every route with 500 (opennextjs/opennextjs-cloudflare#1355). That issue closed 2026-10-15; OpenNext 1.20.16 declares next >=16.4.5 as its peer, and the artifact lane now passes, so the Dependabot ignore is lifted. Also: zod override ^4.6.6 (@cloudflare/vitest-plugin 1.4.0 pins 4.6.5, which held the shared copy back; the prod audit gate failed on main), and the miniflare undici override 7.29.1 -> 7.30.2. Verified locally: lint, typecheck, test (3745), test:cloudflare (511), build:cloudflare, test:cloudflare:artifact (51), test:cloudflare:restart, npm audit --omit=dev --audit-level=high. Not run: e2e browser lanes, redis lanes (CI covers them). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The toolchain audit blocked on vite GHSA-587h-7wmj-h5pm (Dependabot #107) and flagged the braces exception as unused now that its path is gone. audit-toolchain and the prod audit both pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Next ≤16.4.0 has two critical unauthenticated RCEs and one high DoS. No 16.3.x backport exists, so the 16.3 hold has to end:
use cachefunctions returning typed arraysThe hold (65af40c) existed because Next 16.4.0 made the OpenNext Worker return 500 on every route (opennextjs/opennextjs-cloudflare#1355). That issue closed on 2026-10-15. OpenNext 1.20.16 declares
next >=16.4.5as its peer, and the artifact lane passes, so the Dependabotnext >=16.4.0ignore is removed.Changes
next/eslint-config-next^16.3.8 → ^16.4.5;@opennextjs/cloudflare1.20.10 → 1.20.16overrides.zod^4.6.6:@cloudflare/vitest-plugin1.4.0 pins zod 4.6.5, which held the shared copy back, sonpm audit --omit=dev --audit-level=highwas failing on mainoverrides.miniflare.undici7.29.1 → 7.30.2; every undici copy is now outside the advisory rangesnext >=16.4.0Verified locally
lint · typecheck ·
test(3745) ·test:cloudflare(511) ·build:cloudflare·test:cloudflare:artifact(51) ·test:cloudflare:restart· prod audit at highNot run locally: e2e browser lanes and redis lanes; CI covers them.
After merge
Pushing to main deploys nothing. Release through the installer:
npm run check:cloudflareon a clean checkout, thensetup:cloudflare -- updatefor staging and then production. The 500 regression would show up on staging first.Overlaps the next/OpenNext/zod parts of Dependabot #111 and supersedes #107 (vite 8.3.6). The braces audit exception is removed; the toolchain audit reports it unused.
🤖 Generated with Claude Code