42 lines
2.3 KiB
Markdown
42 lines
2.3 KiB
Markdown
# Publication dependency patch — 1 October 2026
|
|
|
|
## Finding and scope
|
|
|
|
The protected README-publication PR failed its production dependency audit on
|
|
Next.js 16.3.3, reported as critical advisory
|
|
[GHSA-vcvr-r3jv-pc5j](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j).
|
|
The maintainer advisory identifies 16.3.6 as the patched version. Its affected
|
|
path is attacker-controlled SVG input passed to Node.js `next/og` ImageResponse.
|
|
An inspection of `apps` and `packages` found no ImageResponse, `next/og` or
|
|
`@vercel/og` usage; this patch removes the vulnerable framework dependency
|
|
without claiming an observed exploitable application route.
|
|
|
|
The owner authorized fixing security blockers in this documentation round.
|
|
The web manifest now pins Next.js 16.3.6. The pnpm 10.33.0 lockfile changes only
|
|
the matching Next.js, environment and platform compiler packages, their
|
|
integrities and dependent peer references. Authentication, application code,
|
|
schemas, migrations, deployment configuration and audit thresholds are unchanged.
|
|
|
|
## Verification
|
|
|
|
Local environment: Windows, Node.js 24.18.1, pnpm 10.33.0 and Python 3.13.
|
|
|
|
- Frozen workspace installation and the runtime preflight passed.
|
|
- Both Python contract checks passed: 28 P0 packages, six normative examples,
|
|
72 catalog entries, nine schemas and 28 unchanged golden prompts.
|
|
- `pnpm test:security` passed both files and all 11 tests, including hostile
|
|
inputs and authorization/origin/dependency boundaries.
|
|
- `pnpm audit --prod --audit-level high` passed. The critical Next.js finding
|
|
is gone; the audit reports zero high and zero critical findings. Its three
|
|
pre-existing moderate findings remain below the unchanged release threshold.
|
|
- `pnpm verify` passed: formatting, all 14 workspace lint/typecheck/build tasks,
|
|
681 tests and both specification checks. The web suite passed 55 files and
|
|
247 tests. The ordinary unit invocation skipped 32 database integration tests
|
|
because no disposable PostgreSQL instance was configured locally; this is
|
|
not evidence for the separate mandatory integration gate.
|
|
|
|
Fresh PostgreSQL integration validation is provided by the existing exact-head
|
|
Linux CI gate. No application instance or production data is changed by the
|
|
local checks. Public source export must follow the protected merge and retain
|
|
the existing sanitation and manifest verification.
|