[Snyk] Security upgrade next from 16.1.5 to 16.1.7#46
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-NEXT-15674556 - https://snyk.io/vuln/SNYK-JS-NEXT-15674557 - https://snyk.io/vuln/SNYK-JS-NEXT-15674558 - https://snyk.io/vuln/SNYK-JS-NEXT-15674559 - https://snyk.io/vuln/SNYK-JS-NEXT-15674560
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedIgnore keyword(s) in the title. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR is a Snyk-driven dependency security update intended to remediate known vulnerabilities in Next.js by upgrading the project’s Next.js version.
Changes:
- Bump
nextfrom16.1.5to16.1.7inpackage.json. - Update
package-lock.jsonto reflect the new dependency graph fornext@16.1.7. - Update
pnpm-lock.yamlentries related to Next.js (but currently appears out of sync withpackage.json).
Reviewed changes
Copilot reviewed 1 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Updates next to 16.1.7 (the intended vulnerability remediation). |
| package-lock.json | Updates npm lockfile dependency resolutions for the Next.js upgrade. |
| pnpm-lock.yaml | Should reflect the Next.js upgrade for pnpm installs, but currently still pins next@16.1.5 in multiple places. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| geist: | ||
| specifier: latest | ||
| version: 1.5.1(next@16.1.5(react-dom@19.2.5(react@19.2.5))(react@19.2.5)) | ||
| version: 1.5.1(next@16.1.7(react-dom@19.2.5(react@19.2.5))(react@19.2.5)) | ||
| input-otp: | ||
| specifier: latest | ||
| version: 1.4.2(react-dom@19.2.5(react@19.2.5))(react@19.2.5) | ||
| lucide-react: | ||
| specifier: ^0.562.0 | ||
| version: 0.562.0(react@19.2.5) | ||
| next: | ||
| specifier: 16.1.5 | ||
| version: 16.1.5(react-dom@19.2.5(react@19.2.5))(react@19.2.5) | ||
| specifier: 16.1.7 | ||
| version: 16.1.7(react-dom@19.2.5(react@19.2.5))(react@19.2.5) |
There was a problem hiding this comment.
pnpm-lock.yaml still pins next (and dependent entries like geist) to 16.1.5, while package.json has been upgraded to 16.1.7. This will cause pnpm installs to continue using the vulnerable Next version; regenerate/update the pnpm lockfile so all next@16.1.5 references are updated to 16.1.7 (including snapshots/packages sections).
Snyk has created this PR to fix 5 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonpackage-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-NEXT-15674556
SNYK-JS-NEXT-15674557
SNYK-JS-NEXT-15674558
SNYK-JS-NEXT-15674559
SNYK-JS-NEXT-15674560
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Allocation of Resources Without Limits or Throttling
🦉 Cross-site Request Forgery (CSRF)