Resolve high npm audit advisories: next 14→16 + eslint 8→9 (flat config) - #10
Merged
Conversation
…upgrade Bumps next 14.2.29→16.3.0 and eslint 8→9 with eslint-config-next 16, clearing every high-severity advisory (next, transitive postcss, and the transitive glob command-injection via @next/eslint-plugin-next). `npm audit` now reports 0 vulnerabilities. React stays on 18.3.1 — Next 16 still supports it — and no other deps moved (Sentry 10.69 already declares Next 16 support). Next 15/16 async migration: - createClient() (supabase/server) is now async (await cookies()); all server call sites updated to await it - params typed as Promise and awaited in the 5 dynamic routes + [id] report page - api/ocr: req.ip (removed in Next 15) -> x-forwarded-for/x-real-ip pattern - drop obsolete experimental.instrumentationHook from next.config.mjs ESLint flat config (next lint was removed in Next 16): - delete .eslintrc.json, add eslint.config.mjs, lint script -> `eslint .` - new eslint-plugin-react-hooks@7 rules (set-state-in-effect, refs) kept as warnings rather than refactoring working components in a security patch - lint scope matched to the old `next lint` (excludes tests/scripts/scratch, which run in their own runtimes) CI: restore the high audit gate as blocking (remove continue-on-error), subsuming the now-redundant separate critical step. tsconfig.json (jsx: react-jsx) and next-env.d.ts changes are Next 16 auto-reconfiguration. Verified locally: type-check, lint (0 errors), test:coverage (340 tests), and next build all pass; dev smoke test confirms pages render and the async dynamic route resolves correctly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…eme hydration Follow-up to the next 14->16 / eslint 8->9 upgrade so the tree is deploy-clean (npm run lint is now 0 errors / 0 warnings). - react-hooks/set-state-in-effect (new in eslint-plugin-react-hooks@7): disabled in eslint.config.mjs with rationale. Every flagged site is the app's intentional SSR-safe pattern — render a server-safe default, then sync a client-only value (matchMedia / cookie / data-theme / session) after mount to avoid a hydration mismatch — so the components are left untouched. - react-hooks/refs (useTypedPlaceholder): move the ref write out of render into an effect; behavior preserved (content-keyed effect still reads the latest examples without restarting the animation). - no-location-assign-relative-destination (auth-utils signOut, AuthPanel account deletion): scoped eslint-disable — the full-page reload is deliberate, to tear down all client + Supabase state, not a missed router navigation. - layout: suppressHydrationWarning on <html> — the head THEME_SCRIPT sets data-theme before hydration by design, so that attribute legitimately differs between server and client. Clears the dev hydration-mismatch console error. - middleware.ts -> proxy.ts: Next 16 renamed the file convention and the export (middleware() -> proxy()); the deprecation warning is gone from dev/build. Verified: type-check, lint (0/0), test:coverage (340 tests), next build, and a dev smoke test (pages render, dynamic route resolves, hydration error gone). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Seby2005
changed the title
CI injects the external-provider API keys (GOOGLE_*, GEMINI, TAVILY, NEWS) as "placeholder" at the job level for the build step. Three provider tests — layer2-news, layer3-official, vision — assert the "not configured" behavior and so relied on those keys being ABSENT, as they are locally. That made them fail only in CI; test-and-lint was already red on dev before this branch for the same reason. Add a jest setupFiles script (jest.setup.env.cjs) that clears those provider keys before each test file, giving a deterministic "not configured" baseline that matches local runs. Tests that need a key set it explicitly. Runs the jest process only — the build step keeps the workflow env. Verified with the full CI env applied: 340/340 tests pass, coverage gate met; type-check and lint remain clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Descriere
Rezolvă definitiv toate avertismentele
highdinnpm audit --audit-level=high, care erau marcate ca „informational, non-blocking" în.github/workflows/ci.yml. Cele high veneau exclusiv din dependențe tranzitive alenext14 șieslint8, remediabile doar printr-un upgrade major (amânat deliberat până acum).npm auditraportează acum 0 vulnerabilități, iar gate-ul de audithighdin CI blochează din nou (s-a scoscontinue-on-error).React rămâne pe 18.3.1 (Next 16 încă îl suportă), deci nu a fost nevoie de migrare la React 19; nicio altă dependență nu s-a mișcat (
@sentry/nextjs10.69 declară deja suport pentru Next 16).Tip modificare
feat— Funcționalitate nouăfix— Corectare bugdocs— Documentațietest— Adăugare/modificare testerefactor— Refactorizare cod (fără schimbare funcționalitate)chore— Actualizare dependențe, configurăriTask asociat
N/A
Modificări făcute
next14.2.29 → 16.3.0,eslint8 → 9,eslint-config-next→ 16.createClient()(supabase/server) devine async —await cookies(); toate call-site-urile server actualizate cuawait.paramstipat caPromiseșiawait-uit în cele 5 rute dinamice + pagina de raport[id].api/ocr:req.ip(eliminat în Next 15) →x-forwarded-for/x-real-ip.next.config.mjs: eliminatexperimental.instrumentationHook(stabil din Next 15).next linta fost eliminat în Next 16 → șters.eslintrc.json, adăugateslint.config.mjs,lint=eslint .. Rezolvat și avertismentul tranzitivglob(command injection) prin bump-uleslint-config-next.middleware.ts→proxy.ts: Next 16 a redenumit convenția (middleware()→proxy()); avertismentul de deprecare a dispărut.layout.tsx:suppressHydrationWarningpe<html>pentru scriptul de temă care seteazădata-themeînainte de hidratare.highblochează din nou (scoscontinue-on-error; pasulcriticalseparat, acum redundant, a fost consolidat).Screenshot-uri
N/A — fără schimbări UI.
Checklist
TODO,FIXME,console.logsau placeholder rămasany) —npm run type-checktrecenpm test) — 340/340, prag de acoperire respectatnpm run buildtrece fără erorinpm run linttrece fără erori — 0 erori / 0 warnings🤖 Generated with Claude Code