fix: upgrade next to 16.2.11 to address CVE-2026-64641#3071
Conversation
🦋 Changeset detectedLatest commit: c7fdb39 The changes in this PR will be included in the next version bump. This PR includes changesets to release 16 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
🧪 E2E Test Results✅ All tests passed Summary
Details by Category✅ ▲ Vercel Production
✅ 💻 Local Development
✅ 📦 Local Production
✅ 🐘 Local Postgres
✅ 🪟 Windows
✅ 📋 Other
✅ vercel-multi-region
|
📊 Workflow Benchmarkscommit Backend:
Best/P75/P90/P99 deltas compare against the most recent benchmark run on Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt) Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt) 🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · STSO (1-20) 20/30/60 · STSO (101-120) 30/45/90 · STSO (1001-1020) 40/60/120 All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor ( Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the |
There was a problem hiding this comment.
Pull request overview
Upgrades Next.js to 16.2.11 across the repo to remediate CVE-2026-64641 (DoS affecting App Router + Server Actions), ensuring all declared versions and the lockfile resolve to the patched release.
Changes:
- Bump
nextto16.2.11in all workbenches/docs that previously pinned vulnerable16.2.xversions. - Update
packages/nextdevDependency to16.2.11(peer range unchanged). - Regenerate
pnpm-lock.yamlto remove oldernext@16.2.{1,6,10}resolutions and converge on16.2.11.
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| workbench/swc-playground/package.json | Pins next to 16.2.11 for the swc playground app. |
| workbench/nextjs-webpack/package.json | Pins next to 16.2.11 for the webpack workbench app. |
| workbench/nextjs-turbopack/package.json | Pins next to 16.2.11 for the turbopack workbench app. |
| docs/package.json | Pins next to 16.2.11 for the docs site workspace. |
| packages/next/package.json | Updates next devDependency to 16.2.11 for @workflow/next. |
| pnpm-lock.yaml | Removes older Next.js resolutions and updates the dependency graph to next@16.2.11. |
| .changeset/hip-onions-refuse.md | Adds a patch changeset for @workflow/next reflecting the devDependency bump. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Nathan Rajlich <n@n8.io>
|
Backport PR opened against |
#3073) Co-authored-by: Nathan Rajlich <n@n8.io> Co-authored-by: VaguelySerious <mittgfu@gmail.com>
Fixes VULN-13454
Summary
Socket.dev flagged
next@16.2.1(CVE-2026-64641, CVSS 8.2 High) — DoS via crafted requests to App Router apps using Server Actions. Affected versions:>= 13.0.0 < 15.5.21; >= 16.0.0 < 16.2.11.Changes
Bumped
nextto16.2.11everywhere a vulnerable version was declared:workbench/swc-playground:16.2.1→16.2.11(the manifest the alert was filed against)docs:16.2.6→16.2.11workbench/nextjs-turbopack/workbench/nextjs-webpack:16.2.10→16.2.11packages/next(devDependency):16.2.10→16.2.11— peer range (>13) unchangednext@16.2.11(previous16.2.1/16.2.6/16.2.10entries removed)postcss override (CVE-2026-45623) — kept
Checked whether the
postcss@<8.5.12: 8.5.16override from #3067 could be removed: it cannot.next@16.2.11still declarespostcss: 8.4.31upstream, which is inside that CVE's affected range, so the override remains and continues to map it to8.5.16(verified in the lockfile).Verification
pnpm install+pnpm build(27/27 tasks) passworkbench/nextjs-turbopackproduction build succeeds onnext@16.2.11@workflow/next(patch);pnpm changeset status --since=mainpasses