[fsousac]

Summary

Bumps next from 16.3.1 to 16.3.3 and sharp from ^0.35.0 to ^0.35.4 to patch critical RCE vulnerabilities flagged by CI scanners.

• Next.js: Addresses GHSA-p293-qw3h-jr36 (unauthenticated RCE on Windows-hosted servers) and GHSA-2xp9-vwfh-vxw4 (unauthenticated RCE in Image Optimization API / AVIF processing).
• Sharp: Addresses GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 (libheif vulnerabilities).

Both pnpm audit --audit-level=moderate and the Trivy security scanner now pass.

Type of Change

• Bug fix
• Feature
• Documentation
• Security hardening
• Database migration
• Refactor

Testing

• pnpm run lint — passes
• pnpm run build — passes
• pnpm run test — passes
• pnpm run security:audit — 0 critical/high advisories (was 3)
• Manual testing completed

Supabase / Database

• No database changes
• Migration added under supabase/migrations
• RLS impact reviewed

Security Checklist

• No secrets committed
• Server Action inputs are validated
• User-owned records are scoped by authenticated user ID
• user_metadata is not used for authorization decisions

Notes

Patch-level dependency bumps. No API changes expected; existing image optimization and Next.js functionality remains unchanged. CI scanners (Dependency Audit, Trivy Security) verified locally after bump.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
dragg-finance	Ignored	v0	Sep 23, 2026 3:01pm UTC