chore(deps): patch simple-git and Next.js for Dependabot alerts#4504
Conversation
16.2.6 patches every flagged Next.js Dependabot CVE, including the proxy/middleware bypass advisories (GHSA-26hh-7cqf-hhc6, etc.) that matter most given web/admin/api enforce auth via proxy.ts. Patch-level bump, no breaking changes in the 16.2.x range.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (7)
📝 WalkthroughWalkthroughThe pull request updates dependency versions across multiple application and package manifests. Next.js is bumped to ChangesDependency Version Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Capy auto-review is paused for this organization because the monthly auto-review limit has been reached. Increase the limit or turn it off in billing settings to resume automatic reviews. |
Greptile SummaryThis is a security-patch dependency bump PR that upgrades
Confidence Score: 5/5Safe to merge — all changes are version bumps on pinned patch releases with no API surface changes, and the lockfile is fully consistent with every package.json. Every package.json pin is reflected correctly in bun.lock, including the two new transitive packages introduced by simple-git 3.36.0. The Next.js upgrade is patch-only (no middleware/proxy API changes across 16.2.2–16.2.6) and directly closes the auth-bypass advisories applicable to this repo's proxy pattern. The remaining open smoke-test checkbox is a reasonable pre-merge gate noted by the author. No files require special attention. The bun.lock update is the most mechanically complex change but is internally consistent.
|
| Filename | Overview |
|---|---|
| apps/web/package.json | next bumped from 16.2.1 to 16.2.6 — directly mitigates proxy/middleware bypass CVEs that affect auth-gated routes |
| apps/admin/package.json | next bumped from 16.2.1 to 16.2.6; no other changes |
| apps/api/package.json | next bumped from 16.2.1 to 16.2.6; no other changes |
| apps/docs/package.json | next bumped from 16.2.1 to 16.2.6; no other changes |
| apps/marketing/package.json | next bumped from 16.2.1 to 16.2.6; no other changes |
| apps/desktop/package.json | simple-git bumped from 3.33.0 to 3.36.0; no other changes |
| packages/host-service/package.json | simple-git bumped from 3.33.0 to 3.36.0; no other changes |
| bun.lock | Lockfile updated consistently: next 16.2.6 with all SWC platform binaries, simple-git 3.36.0 with two new transitive packages (@simple-git/args-pathspec, @simple-git/argv-parser) all present at correct versions |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Dependabot Alerts] --> B{Package}
B --> C[next 16.2.1]
B --> D[simple-git 3.33.0]
C -->|bump to 16.2.6| E[apps/web]
C -->|bump to 16.2.6| F[apps/admin]
C -->|bump to 16.2.6| G[apps/api]
C -->|bump to 16.2.6| H[apps/docs]
C -->|bump to 16.2.6| I[apps/marketing]
D -->|bump to 3.36.0| J[apps/desktop]
D -->|bump to 3.36.0| K[packages/host-service]
E & F & G --> L[Auth-gated proxy.ts routes\nProxy bypass CVEs mitigated]
J & K --> M[GHSA-hffm-xvc3-vprc\nRCE alert closed]
L --> N[bun.lock updated]
M --> N
N --> O[New transitive deps captured\n@simple-git/args-pathspec\n@simple-git/argv-parser]
Reviews (1): Last reviewed commit: "chore(deps): bump next 16.2.1 -> 16.2.6 ..." | Re-trigger Greptile
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 8 files
You’re at about 94% of the monthly review limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.
🚀 Preview Deployment🔗 Preview Links
Preview updates automatically with new commits |
1 participant
Summary
simple-git3.33.0 → 3.36.0 inapps/desktopandpackages/host-serviceto close GHSA-hffm-xvc3-vprc (alerts format #65, fix active tab #139)next16.2.1 → 16.2.6 acrossapps/web,apps/admin,apps/api,apps/marketing,apps/docsto close all flagged Next.js CVEs, most importantly the proxy/middleware bypass advisories that matter given web/admin/api enforce auth viaproxy.tsA follow-up PR will handle the remaining Hono, Vite, lodash, and PostCSS alerts.
Exposure assessment
["--depth=1"]inresolve-repo.ts:235) or no options. Bump is defense-in-depth.apps/web/src/proxy.ts,apps/admin/src/proxy.ts,apps/api/src/proxy.tsall gate routes on session, and apps use App Router + RSC throughout.Test plan
bun installsucceeds, lockfile updatedbun run typecheckpasses for all 5 Next.js apps + host-service + desktopbun run lintpasses (no Biome output)Summary by cubic
Patches dependencies to resolve security alerts and harden auth-protected routes. Updates
simple-gitfor RCE hardening andnextto fix proxy/middleware bypass CVEs; no breaking changes expected.simple-git3.33.0 → 3.36.0 inapps/desktopandpackages/host-service(closes alerts format #65, fix active tab #139).next16.2.1 → 16.2.6 inapps/web,apps/admin,apps/api,apps/marketing,apps/docs(patches all flagged Next.js CVEs).Written for commit 2271b76. Summary will update on new commits.
Summary by CodeRabbit