fix(ui): bump next to 16.3.0 - #3691
Conversation
next@16.2.6 bundles vulnerable postcss (<=8.5.22) and sharp (<0.35.0), causing npm audit to flag 4 high-severity advisories on install. 16.3.0 bundles patched versions of both. Also widens a mock-callback param type in run-bundled-code.spec.ts so 16.3.0's build-time typecheck doesn't fail on a pre-existing tuple destructure that was already invalid per @types/node's inferred type. Fixes #3689 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: 7b51431 The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
commit: |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 1 file (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
klotty
left a comment
klotty
left a comment
There was a problem hiding this comment.
0 issues found across 1 file (changes from recent commits).
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Auto-approved: Dependency bump to fix high-severity vulnerabilities in bundled postcss/sharp, plus a test type fix. No behavioral, contract, or operational tradeoff changes.
Re-trigger cubic
gabrielmfern
left a comment
gabrielmfern
left a comment
There was a problem hiding this comment.
since this update is causing vercel toolbar to break deploys, we should investigate why, and push a fix if we can, or get in touch with Vercel if that makes sense
@gabrielmfern I tested here: https://github.com/dielduarte/react-email-ui-vercel-test (my personal account) I think we are safe to move on. |
dielduarte
changed the title
4 participants
Summary
next16.2.6 → 16.3.0 in the pnpm catalog. 16.2.6 bundles vulnerablepostcss(<=8.5.22) andsharp(<0.35.0), whichnpm auditflags as 4 high-severity advisories on a fresh install. 16.3.0 bundles patched versions of both.run-bundled-code.spec.tsthat 16.3.0's build-time typecheck now catches (test behavior unchanged, 105/105 tests pass).NOTES:
supportsImmutableAssets, which Vercel's adapter auto-enables once detected, that collides with Vercel's own preview-comments patching step and fails the deploy. Disabling the toolbar for Preview sidesteps it; Production is untouched.Fixes #3689
Verification
create-emailproject +npm install+npm audit→ 4 high severity vulnerabilities, all fromnext.nextoverridden to 16.3.0 →npm audit→ 0 vulnerabilities.pnpm buildandpnpm testpass inpackages/ui(105/105 tests).Test plan
npm auditclean on a fresh install once publishedSummary by cubic
Bumped
nextto 16.3.0 to remove high‑severity advisories from bundledpostcssandsharp, and fixed a test type error surfaced by 16.3.0’s stricter typecheck. Fixes #3689.next16.2.6 → 16.3.0 (bundlespostcss@8.5.23andsharp@0.35.3); updated pnpm catalog/workspace and lockfile.@react-email/ui.run-bundled-code.spec.tsso build-time typecheck passes; test behavior unchanged.Written for commit 7b51431. Summary will update on new commits.