Skip to content

fix(website): override next-mdx-remote to v6 for CVE-2026-0969#24

Merged
AmElmo merged 1 commit intomainfrom
AmElmo/fix-mdx-remote-vuln
Feb 23, 2026
Merged

fix(website): override next-mdx-remote to v6 for CVE-2026-0969#24
AmElmo merged 1 commit intomainfrom
AmElmo/fix-mdx-remote-vuln

Conversation

@AmElmo
Copy link
Copy Markdown
Owner

@AmElmo AmElmo commented Feb 23, 2026

Summary

  • Vercel blocks deploys when next-mdx-remote < 6.0.0 due to CVE-2026-0969
  • Added npm overrides in website/package.json to force next-mdx-remote@^6.0.0
  • The API surface is identical between v4.4.1 and v6.0.0, so nextra 2.x works without changes
  • Local build verified successfully

Test plan

  • Vercel preview deploy passes
  • Website pages render correctly

Vercel blocks deploys with next-mdx-remote <6.0.0 due to a security
vulnerability. Added npm overrides to force the updated version while
staying on nextra 2.x.
@vercel
Copy link
Copy Markdown

vercel Bot commented Feb 23, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
spec-wright Ready Ready Preview, Comment Feb 23, 2026 8:51am

@AmElmo AmElmo merged commit 17530dc into main Feb 23, 2026
10 checks passed
github-actions Bot pushed a commit that referenced this pull request Feb 23, 2026
## [3.4.1](v3.4.0...v3.4.1) (2026-02-23)

### Bug Fixes

* **website:** override next-mdx-remote to v6 for CVE-2026-0969 ([#24](#24)) ([17530dc](17530dc))
@github-actions
Copy link
Copy Markdown

🎉 This PR is included in version 3.4.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant