Skip to content

OpenInterviewer 5.4.3

Choose a tag to compare

View all tags
@linxule linxule released this 07 Nov 19:35
v5.4.3
31b8acd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenInterviewer 5.4.3

A security release. It updates Next.js to 16.4.5, which fixes two critical
vulnerabilities that let an unauthenticated visitor run code on the server.
Nothing changes for researchers or participants.

What changed

  • Next.js 16.4.5. Versions up to 16.4.0 allowed unauthenticated remote code
    execution through use cache functions that return typed arrays
    (GHSA-673q-mjm6-r5xr) and
    through the image optimizer with SVG files
    (GHSA-2464-fhr4-w9xw), and
    could be overloaded through Server Actions
    (GHSA-p3m5-59mp-jv5r).
    No 16.3 release fixes these.
  • OpenNext for Cloudflare 1.20.16. Next.js was held at 16.3 because 16.4.0
    made the Cloudflare Worker answer every page with an error
    (opennextjs-cloudflare#1355).
    That is fixed in this OpenNext release, so the hold is lifted.
  • Dependency fixes. zod 4.6.6 or later and undici 7.30.2 for the local
    Cloudflare runtime, plus vite 8.3.6 in the development toolchain. The
    production dependency audit now reports nothing at high severity or above.

Upgrade and rollback

A code-only release, with no schema, configuration or binding changes. Rolling
back to 5.4.2 is safe, but it brings the vulnerabilities back.

Assets 2
Loading