fix(deps): close 12 Dependabot alerts — Next.js, postcss, sharp - #177
Conversation
All twelve open alerts traced to one root cause: next 16.2.10. postcss and sharp are Next's own dependencies. - next 16.2.10 -> 16.2.12 (patched at 16.2.11) - postcss 8.5.16 / 8.4.31 -> 8.5.25 (patched at 8.5.18) - sharp 0.34.5 -> 0.35.3 (patched at 0.35.0) Two of the four high-severity Next advisories are live against this app: SSRF and denial of service in Server Actions, which web/src/lib/*-actions.ts uses. The other two do not apply — the middleware bypass needs Turbopack, and the rewrite SSRF needs rewrites; this app uses neither, and next.config.mjs has no image configuration, which rules out the SVG image-optimization advisory as well. Neither transitive package moves on the version bump alone. Next pins postcss to exactly 8.4.31 in a nested tree and declares sharp as an optional dependency at ^0.34.5, so both needed the existing overrides block tightened: postcss from ^8.5.10, which was too loose to catch either advisory, and sharp added. The lockfile churn is larger than the three lines suggest — 102 top-level entries — because the overrides only take effect on a clean resolve. Most of it is sharp's per-platform binaries moving in step with 0.35.3. Note two optional dev entries now resolve to @emnapi 2.0.0-alpha.3, pulled by @rolldown's wasm32-wasi binding; they are lock entries for a platform this project never installs on, not installed code, and sharp's own emnapi stays at stable 1.11.3. Verified: next build succeeds, which is what actually exercises postcss and sharp. tsc 0, biome 0, vitest 87 files / 1742 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 41 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
1 participant
🟡 NEEDS YOUR DECISION
No new decisions of yours are encoded — but no bot has reviewed this yet, so it cannot be 🟢. Gates green locally:
next build0, tsc 0, biome 0, vitest 87 files / 1742 tests. Verdict updates once review lands and is adjudicated.Closes all 12 open Dependabot alerts.
What was actually vulnerable
All twelve alerts trace to one root cause:
next16.2.10.postcssandsharpare Next's own dependencies.Which advisories actually reach this app
Checked against the code rather than taken at face value:
web/src/lib/{actions,auth-actions,agent-actions,mailbox-actions}.tsnext.config.mjsScope is the Agent Inbox (
web/) only. The engine's own dependencies were already clean.Why the diff is bigger than three lines
Neither transitive package moves on the version bump alone. Next pins postcss to exactly
8.4.31in a nested tree, and declares sharp as an optional dependency at^0.34.5. Both needed the existingoverridesblock tightened — postcss was at^8.5.10, too loose to catch either advisory, and sharp was absent.Overrides also only take effect on a clean resolve.
npm installagainst an existingnode_modulesleft both packages at their vulnerable versions with no warning; three attempts looked like they had worked and had not. The fix requiredrm -rf node_modules package-lock.jsonbefore install, which is why 102 top-level lockfile entries moved. Most of that is sharp's per-platform binaries tracking 0.35.3.One thing worth seeing rather than discovering later: two optional dev entries now resolve to
@emnapi2.0.0-alpha.3, pulled by@rolldown/binding-wasm32-wasi. They are lock entries for a wasm32-wasi platform this project never installs on — not installed code — and sharp's own emnapi stays at stable 1.11.3. Flagged because an alpha version appearing in a lockfile should never pass without an explanation.Verification
next build— exit 0. This is the one that matters: postcss and sharp are build-time, so a passing production build is the real proof the bumps are safe. All 14 routes compiled.tsc --noEmit— exit 0biome check .— exit 0, 316 filesvitest run— 87 files, 1742 tests, exit 0🤖 Generated with Claude Code