[Snyk] Security upgrade next from 14.2.35 to 15.5.10 by catomean · Pull Request #90 · bitbaum/botsmann

catomean · 2026-01-28T14:59:29Z

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

package.json
package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Allocation of Resources Without Limits or Throttling SNYK-JS-NEXT-15104645

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

Co-Authored-By: G <butaeff@gmail.com>

@ts-expect-error

- Remove unused @ts-expect-error directive in jest.setup.ts - Fix useCallback dependency in custom bot page (remove unused 'messages') - Fix useEffect/useCallback pattern in ConversationList Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

The migration commit referenced @supabase/ssr but didn't include it in package.json. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add next/server mock for Jest to handle NextRequest/NextResponse imports - Fix api-responses tests to match actual function signatures: - jsonSuccess wraps data in response.data property - jsonValidationError expects ValidationError[] not object - formatZodErrors returns array not object with field properties Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add auto-detection of best available LLM provider - Priority: Ollama (local) > Groq (cloud) > OpenRouter (paid) - Add isOllamaAvailable() check with 2s timeout - Add generateWithBestProvider() for automatic provider selection - Add 60s timeout to Ollama requests for model loading - Update demo chat API to use unified LLM client - Provider info now shown in API responses Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

DRY improvements: - Add LoadingSpinner component (PageLoading, InlineLoading variants) - Add centralized color config (ACCENT_BORDER_CLASSES, helpers) - Add shared icons (CheckIcon, ClockIcon, EditIcon, etc.) Updated files to use shared components: - All auth pages now use PageLoading instead of inline spinners - Profile page uses InlineLoading and centralized accent colors - Settings page uses shared icons (CheckIcon, ChevronRightIcon) This reduces code duplication across 17+ files for spinners and 15+ files for accent color mappings. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Replace inline loading spinners with PageLoading, InlineLoading, and LoadingSpinner components across 10 more files: - app/dashboard/page.tsx - app/documents/page.tsx - app/bots/mine/page.tsx - app/bots/custom/[slug]/page.tsx - app/bots/custom/[slug]/edit/page.tsx - app/infrastructure/page.tsx - app/my-data/page.tsx - app/auth/callback/page.tsx - components/conversations/ConversationList.tsx - components/documents/AddToBotModal.tsx This completes the DRY refactoring for loading spinners. The LoadingSpinner component is now the SSOT for all loading states. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Extended colors.ts with ACCENT_COLOR_OPTIONS and COLOR_CLASSES - Updated colors from purple/orange/yellow to indigo/amber to match usage - Added composite color classes for themed UI components - Removed duplicated color definitions from: - app/bots/custom/[slug]/page.tsx - app/bots/custom/[slug]/edit/page.tsx - components/bot-builder/StepPersonality.tsx - components/bot-builder/StepReview.tsx Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

…SSOT) - Added DOCUMENT_STATUS constant to lib/constants.ts - Added DocumentStatusType derived from constant - Added DOCUMENT_STATUS_CONFIG for display (labels, colors) - Created DocumentStatusBadge shared component - Updated types/document.ts to use DocumentStatusType - Updated app/documents/page.tsx to use shared component and constants Changes to add a new status now require only 1 file (lib/constants.ts). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

…usBadge - Created useDashboardStats hook for data fetching logic - Simplified dashboard page by extracting state management - Updated dashboard to use DocumentStatusBadge component - Updated my-data page to use DocumentStatusBadge component - Replaced magic status strings with DOCUMENT_STATUS constants Benefits: - Dashboard page reduced from ~100 lines of state logic to ~10 lines - Status badge logic now in single location (SSOT) - Data loading logic is now testable in isolation - Consistent status display across all pages Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Create lib/config/colors.ts as single source of truth for all colors - AccentColor (16 colors) for bot templates - CustomBotAccentColor (5 colors) for custom bots (matches DB constraint) - Remove hardcoded color maps from QuickChat.tsx - Derive types from Zod schemas instead of separate definitions - Add justification comment for any type in supabase mock - Remove console.error from production code Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

## Broken Links Fixed - Fix /projects/governance/build link to /contact in HeroSection.tsx ## Console Statements Removed (production code) - Remove console.log/error from client components - Replace with silent error handling or UI feedback - Files: documents/page.tsx, try/page.tsx, settings/page.tsx, ConversationList.tsx, ProfessionalDemo.tsx, and more ## Inline Styles Converted to Tailwind - Replace animation-delay inline styles with Tailwind arbitrary values - Files: DemoMessage.tsx, DemoChat.tsx, ProfessionalDemo.tsx, QuickChat.tsx, demo/page.tsx, HeroSection.tsx ## Governance Types Consolidated (SSOT) - Create app/projects/governance/types.ts as single source of truth - Create app/projects/governance/utils.ts for formatting functions - Remove duplicate EnhancedTransaction from TransactionWithTraceability.tsx - Update component type files to re-export from SSOT ## Colors Config Extended - Extend COLOR_CLASSES to support all 16 accent colors - Fix type mismatch in custom bot pages ## Magic Numbers Extracted - Add formatBytes utility to lib/format.ts (DRY) - Add DEMO_MAX_FILE_SIZE to VALIDATION constants - Update try/page.tsx to use centralized constants ## Minor Fixes - Fix unused variable warning in CollaborationForm.tsx Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Remove unused workspace-dashboard/ folder (duplicate of workspace/) - Remove unused ClientPortalProps and LawyerPortalProps from types.ts DRY cleanup: workspace/ folder is the active one used by WorkspaceDashboard.tsx and DemoSection.tsx Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Remove duplicate MAX_FILE_SIZE constant, use VALIDATION.MAX_FILE_SIZE (SSOT) - Refactor CustomBotPage sendMessage logic to eliminate code duplication (DRY) - Convert inline animation-delay styles to Tailwind arbitrary values - Add development-only check to ErrorBoundary console.error - Remove deprecated MAX_FILE_SIZE export from types/document.ts Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Delete lib/groq.ts (replaced by lib/llm-client.ts) - Delete tests/api.test.js.bak (orphaned backup file) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Delete example-section/ folder (duplicate of parent components) - Delete unused ClientErrorBoundary wrapper component Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add toDateString() to lib/format.ts for YYYY-MM-DD date strings - Update lib/blog.ts to use shared toDateString (removed getCurrentDate) - Update lib/knowledge.ts to use shared toDateString (4 usages) DRY: Eliminates duplicate date formatting pattern Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- TeamTab.tsx: member.imageUrl is dynamic external URL - ProfileHeader.tsx: citizen.avatarUrl is dynamic external URL These use <img> because Next.js Image requires explicit domain config for external URLs, which isn't practical for user-provided data. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Delete lib/hooks/useFormSubmit.ts (never imported) - Delete lib/utils/error.ts (never imported) - Remove unused exports from lib/hooks/index.ts: - NAV_COLOR_CLASSES (only used internally) - NavColorClasses type (never imported) - useFormSubmit exports Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Update app/documents/page.tsx to use formatBytes from lib/format - Update app/my-data/page.tsx to use formatBytes from lib/format - Update components/shared/demo/DemoFileUpload.tsx to use formatBytes - Update workspaceUtils.ts to re-export formatBytes as formatFileSize DRY: 4 duplicate formatFileSize implementations → 1 SSOT (lib/format.ts) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Remove swiss-german-teacher/components/shared/ (unused DemoModeOverlay, DemoPopup, Navigation) - Remove swiss-german-teacher/components/navigation/ (unused Navigation) - Remove medical-expert/components/navigation/ (unused Navigation) - Remove product-manager/components/navigation/ (unused Navigation) - Remove research-assistant/components/navigation/ (unused Navigation) - Fix test to use valid ErrorCode type All bots now use BotPageTemplate's shared navigation. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Remove unused InfoBox.tsx (140 lines) - Remove unused ProfileTabs.tsx (40 lines) - Update governance/index.ts to only export ProfileHeader (which is used) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Remove packages that were installed but never imported: - @heroicons/react (using custom Icons instead) - framer-motion (no animations used) - nodemailer (email handled differently) - @mdx-js/loader, @mdx-js/react, @next/mdx (using next-mdx-remote) - @eslint/eslintrc, @eslint/js (using old .eslintrc.json format) - @testing-library/react (tests use Jest only) Reduces bundle size and maintenance surface. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Remove empty stub files (mdx-provider.tsx, events.ts, route.d.ts) - Remove orphaned components/auth/ folder (EmailVerificationBanner never imported) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-NEXT-15104645

vercel · 2026-01-28T14:59:32Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
botsmann	Error		Jan 28, 2026 3:01pm

catomean · 2026-02-26T07:20:56Z

Closing stale automated PR — cleaning up repo.

devin-ai-integration Bot and others added 30 commits February 15, 2025 12:01

fix: add proper type imports for MouseEvent

c97372a

Co-Authored-By: G <butaeff@gmail.com>

fix: use correct React.MouseEvent type

bfdc2db

Co-Authored-By: G <butaeff@gmail.com>

chore: remove Netlify configuration and migrate to Next.js API routes

e8c3d4f

Co-Authored-By: G <butaeff@gmail.com>

fix: use correct MouseEvent type for click outside handler

3972d4c

Co-Authored-By: G <butaeff@gmail.com>

fix: use proper React event types

baf624e

Co-Authored-By: G <butaeff@gmail.com>

fix: update TypeScript configuration and React types

4bf2a8e

Co-Authored-By: G <butaeff@gmail.com>

chore: update package-lock.json

9ac362a

Co-Authored-By: G <butaeff@gmail.com>

fix: simplify React type imports

14beaa0

Co-Authored-By: G <butaeff@gmail.com>

chore: remove remaining Netlify references

81c2da0

Co-Authored-By: G <butaeff@gmail.com>

fix: use absolute import path for ConsultationForm

e8aa20e

Co-Authored-By: G <butaeff@gmail.com>

fix: remove client directive from page component

389f815

Co-Authored-By: G <butaeff@gmail.com>

fix: use dynamic import for client component

2b9d061

Co-Authored-By: G <butaeff@gmail.com>

fix: remove static export to support API routes

d2271db

Co-Authored-By: G <butaeff@gmail.com>

fix: improve build-time API validation handling

3df8b1e

Co-Authored-By: G <butaeff@gmail.com>

fix: improve client/server boundary handling in MDX setup

10fb462

Co-Authored-By: G <butaeff@gmail.com>

fix: resolve circular dependency in MDX setup

019d14e

Co-Authored-By: G <butaeff@gmail.com>

fix: use dynamic imports for layout components

6a2fecb

Co-Authored-By: G <butaeff@gmail.com>

fix: split mobile menu into separate client component

1758a3e

Co-Authored-By: G <butaeff@gmail.com>

fix: use absolute import path for MobileMenu

f72cc91

Co-Authored-By: G <butaeff@gmail.com>

fix: resolve React fragment TypeScript errors

22a8d95

Co-Authored-By: G <butaeff@gmail.com>

fix: remove duplicate mobile menu code

9c51ed5

Co-Authored-By: G <butaeff@gmail.com>

fix: simplify component imports to resolve infinite loop

1b53c59

Co-Authored-By: G <butaeff@gmail.com>

fix: split menu button into separate client component

b2734a1

Co-Authored-By: G <butaeff@gmail.com>

fix: resolve TypeScript errors in MobileMenu component

5f44127

Co-Authored-By: G <butaeff@gmail.com>

fix: make MobileMenu a server component

357ac5a

Co-Authored-By: G <butaeff@gmail.com>

fix: improve type handling in menu components

b1a7c8a

Co-Authored-By: G <butaeff@gmail.com>

fix: handle menu visibility in client component

6590437

Co-Authored-By: G <butaeff@gmail.com>

fix: improve state management in menu components

5c873c8

Co-Authored-By: G <butaeff@gmail.com>

fix: resolve circular dependencies in component imports

b3c386b

Co-Authored-By: G <butaeff@gmail.com>

fix: improve dynamic import loading state

6aa0258

Co-Authored-By: G <butaeff@gmail.com>

catomean and others added 24 commits January 23, 2026 15:22

fix: add missing @supabase/ssr dependency

4907fc4

The migration commit referenced @supabase/ssr but didn't include it in package.json. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

chore: remove dead code files

36b5652

- Delete lib/groq.ts (replaced by lib/llm-client.ts) - Delete tests/api.test.js.bak (orphaned backup file) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

chore: remove unused duplicate components

5e1da5c

- Delete example-section/ folder (duplicate of parent components) - Delete unused ClientErrorBoundary wrapper component Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

chore: remove orphaned governance components

b2aa340

- Remove unused InfoBox.tsx (140 lines) - Remove unused ProfileTabs.tsx (40 lines) - Update governance/index.ts to only export ProfileHeader (which is used) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

chore: remove empty/orphaned files

4160f98

- Remove empty stub files (mdx-provider.tsx, events.ts, route.d.ts) - Remove orphaned components/auth/ folder (EmailVerificationBanner never imported) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

fix: package.json & package-lock.json to reduce vulnerabilities

5ac1387

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-NEXT-15104645

vercel Bot had a problem deploying to Preview January 28, 2026 15:01 Failure

catomean force-pushed the main branch from 8ef6070 to 6cc2196 Compare February 25, 2026 12:56

catomean closed this Feb 26, 2026

catomean deleted the snyk-fix-d9b67b985fef3de165ded7fe0d57ec8b branch June 16, 2026 21:08

Navigation Menu

Uh oh!

[Snyk] Security upgrade next from 14.2.35 to 15.5.10 - #90

[Snyk] Security upgrade next from 14.2.35 to 15.5.10#90
catomean wants to merge 405 commits into
mainfrom
snyk-fix-d9b67b985fef3de165ded7fe0d57ec8b

catomean commented Jan 28, 2026

Uh oh!

vercel Bot commented Jan 28, 2026 •

edited

Loading

Uh oh!

catomean commented Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

catomean commented Jan 28, 2026

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

Vulnerabilities that will be fixed with an upgrade:

Uh oh!

vercel Bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

catomean commented Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Jan 28, 2026 •

edited

Loading