chore(deps): bump next to 15.5.15 (GHSA-q4gf-8mx6-v5v3)#414
Conversation
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughNext.js version constraint is bumped from 15.5.10 to 15.5.15 across both package.json and pnpm-workspace.yaml to synchronize dependency pinning in both npm and pnpm configuration files. ChangesDependency Version Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
coderdan
force-pushed
the
dan/bump-next-15.5.15
branch
from
5c94989 to
a5a52e7
Compare
Patches GHSA-q4gf-8mx6-v5v3 (high): denial of service via Next.js Server Components, affecting next >= 13.0.0 and < 15.5.15. Next.js is a transitive runtime dep here (consumed by packages/nextjs via peer "^14 || ^15", and through @clerk/nextjs). The existing root override "next": ">=15.5.10" allowed the vulnerable 15.5.10; tightened to ">=15.5.15", and bumped the security catalog entry to match. Lockfile changes are a surgical hand-edit (next + @next/env + 8x @next/swc-*) rather than a full regen. Same reason as the lodash bump: a fresh resolve picks the patched version but also drags ~30 unrelated transitive bumps along. Surgical edit keeps the blast radius contained, and `pnpm install --frozen-lockfile` validates cleanly.
coderdan
force-pushed
the
dan/bump-next-15.5.15
branch
from
a5a52e7 to
32c08d4
Compare
2 participants
Summary
Context
Next.js is a transitive runtime dep here — `packages/nextjs` declares it as a peer (`^14 || ^15`), and `@clerk/nextjs` pulls it in too. The existing root override at `>=15.5.10` already targeted next; it just hadn't been bumped past the patched cutoff. Tightened to `>=15.5.15`, and bumped the `security` catalog entry to match.
Why a surgical hand-edit (vs. `pnpm install`)
Same reason as the lodash bump: a fresh resolve correctly picks `next@15.5.15`, but also walks the rest of the tree and pulls in ~30 unrelated transitive bumps (`drizzle-orm`, `@types/node`, `drizzle-kit`, etc.). Outside the scope of a CVE patch.
The lockfile change is contained: `next` (1 def + 4 refs) + `@next/env` (1 def + 2 refs) + `@next/swc-*` (8 platform binaries × 1 def + 1 ref each, all 15.5.7 → 15.5.15). Each integrity hash sourced from `npm view @15.5.15 dist.integrity`.
Note: `next@15.5.15` satisfies `packages/nextjs`'s declared `^14 || ^15` peer range and `@clerk/nextjs@6.39.2`'s peer range, so no API compatibility risk.
Summary by CodeRabbit