Repository navigation
security(deps): high audit advisories on next, sharp, source-map-js; braces has no fix #115
Description
What happened
pnpm verify fails in its last step, pnpm audit --audit-level high: advisories published after 2026-09-28 (10 findings, 4 high). Every code PR is blocked (found while working on #75, PR #114).
| Package | Advisory | Path | Fix |
|---|---|---|---|
next 16.3.6 |
GHSA-cjq9-62q9-8jv4 (SSRF in image optimization) + 5 moderate/low | direct | 16.3.8 |
sharp 0.35.4 |
GHSA-wq5f-xc86-pv6w (librsvg) | next (optional, ^0.35.4) |
0.35.5 – within range |
source-map-js 1.2.1 |
GHSA-68fv-2mgg-jv7q | next → postcss (^1.2.1) |
1.2.2 – within range |
braces ≤3.0.3 |
GHSA-vfj7-8cjw-p6xm | dev only: eslint-config-next → fast-glob → micromatch |
no patched version |
Acceptance criteria
-
nextandeslint-config-nexton 16.3.8 (kept in step) -
sharp≥ 0.35.5 andsource-map-js≥ 1.2.2 in the lockfile, without overrides -
braces: dated exception in the exceptions register (dev-only path, not in the production tree, no fix available) and an audit ignore limited to this one advisory -
pnpm audit --audit-level highexits 0;pnpm verifygreen
Not part of this task
- moderate/low findings without a high one (
esbuildviadrizzle-kit)
Security/Privacy affected?
Yes – dependency security patches; no behaviour change intended.
Activity
Fluory commentedon Oct 8, 2026
Claimed by @Fluory on branch
claude/fix-deps-audit-115.Merge pull request #116 from Fluory/claude/fix-deps-audit-115