chore(frontend): modernize, fix vulns, retire deprecated config - #36
Merged
Conversation
- Bump next 16.1.5 -> 16.2.6 (closes Dependabot PR #35; fixes 12 advisories incl. proxy bypass, RSC DoS, SSRF, XSS). - Pin all deps to current minors: - bootstrap 5.3.2 -> 5.3.8 - react / react-dom 18.x -> 18.3.1 (stay on 18 for react-bootstrap 2.x peer compat) - react-bootstrap 2.10.0 -> 2.10.10 - react-use-websocket 4.5.0 -> 4.13.0 - Add 'overrides: { postcss: ^8.5.10 }' to dedupe transitive postcss (GHSA-qx2v-qp2m-jg93 XSS via unescaped </style>). This is the CI gate ('npm audit --omit=dev'); without the override, individual Dependabot PRs cannot pass because each only fixes one of the two findings. - Drop swcMinify from next.config.mjs (removed in Next 15+; SWC minify is the default and the option is now invalid). - Drop 'lint': 'next lint' (the 'next lint' subcommand was removed in Next 16). Not used by CI. - Bump actions/checkout v3 -> v4 (v3 reaches EOL; runs on the deprecated Node 16 runner image). Verified locally on Node 22: - npm audit --omit=dev -> 0 vulnerabilities - npm run build -> success (Next 16.2.6 Turbopack, static export, 3/3 pages) - npm run dev -> HTTP 200 on /, no warnings
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the open Dependabot PR (#35) and gets the frontend onto current minors with a clean
npm audit.Why CI was failing
The audit gate (
npm audit --omit=dev) flags two findings onnext@16.1.5:next@16.2.6(proxy bypass, RSC DoS, SSRF via WS upgrade, XSS via CSP nonces, etc.).postcss < 8.5.10(GHSA-qx2v-qp2m-jg93, XSS via unescaped</style>).Dependabot's PR #35 only fixes #1, so audit still fails on #2 -- which is why the bot keeps re-opening it without ever going green. The fix is a
package.jsonoverridesblock that dedupespostcssto a patched version. Same pattern that unblocked websocket-sessions-management.Changes
next16.1.5 -> 16.2.6bootstrap5.3.2 -> 5.3.8react/react-dom^18-> ^18.3.1 (staying on 18 forreact-bootstrap@2.xpeer compat; v3 is still alpha)react-bootstrap2.10.0 -> 2.10.10react-use-websocket4.5.0 -> 4.13.0overrides: { postcss: "^8.5.10" }swcMinify: truefromnext.config.mjs(removed in Next 15+; option is now invalid -- SWC minify is the default).lint: "next lint"script (thenext lintsubcommand was removed in Next 16; not referenced by CI).actions/checkout@v3 -> @v4in CI (v3 runs on the EOL Node 16 runner).Verified locally (Node 22.22.2)
npm audit --omit=dev-> 0 vulnerabilitiesnpm run build-> Next 16.2.6 Turbopack, static export, 3/3 pagesnpm run dev-> HTTP 200 on/, no warnings, ready in 288 msOut of scope
None -- backend (
template.yml,handlers/) is untouched.