security(deps): bump next → 16.2.11 — patch 9 high CVEs (middleware bypass, SSRF, DoS)#241
Merged
Merged
Conversation
…eware bypass, SSRF, DoS) npm audit --audit-level=high flagged 9 HIGH Next.js advisories in the 16.0.0– 16.2.10 range, incl. GHSA-6gpp-xcg3-4w24 (App Router middleware/proxy bypass — directly relevant to our auth proxy), SSRF + DoS in Server Actions, cache confusion, and unauthenticated Server Function endpoint disclosure. 16.2.11 is the patched release (now outside the vulnerable range). Patch bump, no code change. Verified: npm audit --audit-level=high → 0 high, typecheck clean, next build OK, full suite 1606 green.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
area:security
Contributor
Guide du relecteur (réduit sur les petits PR)Guide du relecteurCe PR met à jour la dépendance Next.js de la version 16.2.6 à 16.2.11 afin de corriger plusieurs avis de sécurité de gravité élevée, sans modification du code de l’application. Modifications par fichier
Conseils et commandesInteragir avec Sourcery
Personnaliser votre expérienceAccédez à votre tableau de bord pour :
Obtenir de l’aide
Original review guide in EnglishReviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR updates the Next.js dependency from 16.2.6 to 16.2.11 to address multiple high‑severity security advisories, with no application code changes. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Salut - j’ai passé en revue tes changements et ils sont excellents !
Problèmes de sécurité corrigés :
- next (link)
Sourcery est gratuit pour l’open source - si tu apprécies nos revues, merci d’envisager de les partager ✨
Original comment in English
Hey - I've reviewed your changes and they look great!
Fixed security issues:
- next (link)
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Le check CI
Security audit(npm audit --audit-level=high) est passé rouge sur toutes les PR — 9 advisories HIGH Next.js publiées, affectant la plage16.0.0 – 16.2.10(on est en 16.2.6) :proxy.tsDérive environnementale — aucun changement de code de notre côté ;
mainest également affecté.Fix
Bump next 16.2.6 → 16.2.11 (patch — 16.2.11 est hors plage vulnérable). Aucun changement de code applicatif.
Evidence
npm audit --audit-level=high→ 0 high (reste 1 low esbuild, sous le seuil)npm run typecheck✅ ·npm run build✅ (next 16.2.11 compile) · 1606 tests vertsDébloque
Merge en amont → #240 (stepper engagements) et toutes les futures PR retrouvent un
Security auditvert.🤖 Generated with Claude Code
Summary by Sourcery
Build:
Original summary in English
Summary by Sourcery
Build: