fix: update dependencies to resolve 24 CVEs #52

kdy1 · 2025-12-06T23:58:11Z

Summary

Updated all dependencies with known CVE vulnerabilities to their latest secure versions. This PR resolves all 24 security vulnerabilities that were reported by pnpm audit.

Security Fixes

Critical & High Severity:

next: ^13.5.5 → ^16.0.7
- Fixes Authorization Bypass in Next.js Middleware (Critical)
- Fixes Server-Side Request Forgery in Server Actions (High)
- Fixes Cache Poisoning vulnerabilities (High)
- Fixes Information exposure in dev server (Low)

Moderate Severity:

eslint: ^8.51.0 → ^9.39.1 (ReDoS in cross-spawn and other vulnerabilities)
tsx: ^4.10.4 → ^4.21.0 (fixes esbuild CORS vulnerability)
@chakra-ui/react: ^2.8.1 → ^3.30.0 (babel/runtime ReDoS)
@emotion/react: ^11.11.1 → ^11.14.0 (babel/runtime ReDoS)
@emotion/styled: ^11.11.0 → ^11.14.1 (babel/runtime ReDoS)
eslint-config-next: ^13.5.5 → ^16.0.7 (updated with next)

Low Severity:

undici: ^5.26.3 → ^7.16.0 (integrity and Proxy-Authorization header issues)

Verification

pnpm audit
# Output: No known vulnerabilities found

Breaking Changes

This PR includes major version updates for several packages:

Next.js 13 → 16 may have breaking changes - testing recommended
Chakra UI 2 → 3 has API changes - components may need updates
ESLint 8 → 9 has configuration changes

Test plan

Run pnpm install to verify lockfile
Run pnpm audit to confirm no vulnerabilities
Run pnpm build to ensure build succeeds
Run pnpm dev to test development server
Test core functionality of the playground
Verify Chakra UI components render correctly

🤖 Generated with Claude Code

Updated dependencies to fix security vulnerabilities: - next: ^13.5.5 → ^16.0.7 (fixes critical, high, and moderate CVEs) - eslint: ^8.51.0 → ^9.39.1 (fixes moderate CVEs) - undici: ^5.26.3 → ^7.16.0 (fixes low CVEs) - tsx: ^4.10.4 → ^4.21.0 (fixes esbuild moderate CVE) - @chakra-ui/react: ^2.8.1 → ^3.30.0 (fixes babel/runtime CVE) - @emotion/react: ^11.11.1 → ^11.14.0 (fixes babel/runtime CVE) - @emotion/styled: ^11.11.0 → ^11.14.1 (fixes babel/runtime CVE) - eslint-config-next: ^13.5.5 → ^16.0.7 All 24 security vulnerabilities have been resolved. pnpm audit now reports no known vulnerabilities. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

socket-security · 2025-12-06T23:58:35Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
eslint-config-next@13.5.5 ⏵ 16.0.7	⁺¹		⁺³	⁺¹
tsx@4.10.4 ⏵ 4.21.0			⁺¹	⁺³
@emotion/styled@11.11.0 ⏵ 11.14.1	⁺¹		⁺¹
next@13.5.5 ⏵ 16.0.7	⁺¹	⁺⁷⁵	^-3
@emotion/react@11.11.1 ⏵ 11.14.0	⁺³		⁺¹
undici@5.26.3 ⏵ 7.16.0	⁺²	⁺¹⁶
@chakra-ui/react@2.8.1 ⏵ 3.30.0	⁺³			⁺¹
eslint@8.51.0 ⏵ 9.39.1	⁺¹			⁺⁴⁵

View full report

Copilot

Pull request overview

This PR attempts to update dependencies to resolve 24 CVE vulnerabilities. However, the PR has several critical issues that must be addressed before merging.

Key Changes:

Updates Next.js from 13.5.5 to 16.0.7 (version appears invalid)
Updates Chakra UI from 2.x to 3.x (major breaking changes)
Updates ESLint from 8.x to 9.x (configuration compatibility concerns)

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-07T00:00:54Z

package.json

-    "@chakra-ui/react": "^2.8.1",
-    "@emotion/react": "^11.11.1",
-    "@emotion/styled": "^11.11.0",
+    "@chakra-ui/react": "^3.30.0",


Chakra UI v3 has breaking changes that require updating the application code. The ChakraProvider now requires the system prop to be passed (typically from defaultSystem or a custom theme system). The current usage in src/pages/_app.tsx will not work with Chakra UI v3.

Example fix needed in _app.tsx:

import { ChakraProvider, defaultSystem } from '@chakra-ui/react' <ChakraProvider value={defaultSystem}> {/* content */} </ChakraProvider>

Additionally, many component APIs have changed in v3. Please review the Chakra UI v3 migration guide and update all components accordingly before merging this PR.

Copilot · 2025-12-07T00:00:54Z

package.json

    "dprint": "^0.45.0",
-    "eslint": "^8.51.0",
-    "tsx": "^4.10.4",
+    "eslint": "^9.39.1",


ESLint 9 introduces breaking changes to configuration format. While .eslintrc.json (old format) is still supported with backwards compatibility, ESLint 9 expects the new flat config format (eslint.config.js).

Additionally, eslint-config-next may need updates to be compatible with ESLint 9. Please verify:

That the version of eslint-config-next being installed supports ESLint 9

Consider migrating to the flat config format or verify that the old config format works correctly with this ESLint version

Copilot · 2025-12-07T00:00:54Z

package.json

    "@monaco-editor/react": "^4.6.0",
-    "eslint-config-next": "^13.5.5",
+    "eslint-config-next": "^16.0.7",
    "framer-motion": "^10.16.4",


Chakra UI v3 requires framer-motion v11 or higher. The current version ^10.16.4 is incompatible with Chakra UI v3. Please update to framer-motion: ^11.0.0 or higher to ensure compatibility.

Suggested change

"framer-motion": "^10.16.4",

"framer-motion": "^11.0.0",

Updated all components to use Chakra UI v3 API: - FormControl → Field.Root/Field.Label - Modal → Dialog (Root, Backdrop, Content, etc.) - Select → NativeSelect (Root, Field) - Switch → SwitchRoot - Checkbox → CheckboxRoot with CheckboxControl/CheckboxLabel - NumberInput → NumberInputRoot/NumberInputInput - CircularProgress → Spinner - spacing prop → gap prop - isChecked → checked - isExternal → target="_blank" - useColorMode/useColorModeValue temporarily disabled (TODO: implement with next-themes) - useToast replaced with alert() (TODO: implement with toast snippet) - ChakraProvider now requires defaultSystem 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

kdy1 · 2025-12-07T00:45:57Z

I think the config sidebar is broken, but not sure what should I do

g-plane · 2025-12-07T02:42:37Z

I may update dependencies manually.

g-plane · 2025-12-13T04:02:30Z

Can we update Chakra UI minor only instead of major?

kdy1 · 2025-12-13T04:11:44Z

Yeap of course

Copilot AI review requested due to automatic review settings December 6, 2025 23:58

vercel bot had a problem deploying to Preview December 6, 2025 23:58 Failure

Copilot started reviewing on behalf of kdy1 December 6, 2025 23:58 View session

Copilot AI reviewed Dec 7, 2025

View reviewed changes

vercel bot deployed to Preview December 7, 2025 00:12 View deployment

kdy1 requested a review from g-plane December 7, 2025 00:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: update dependencies to resolve 24 CVEs #52

fix: update dependencies to resolve 24 CVEs #52

kdy1 commented Dec 6, 2025

Uh oh!

socket-security bot commented Dec 6, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Dec 7, 2025

Uh oh!

Copilot AI Dec 7, 2025

Uh oh!

Copilot AI Dec 7, 2025

Uh oh!

kdy1 commented Dec 7, 2025

Uh oh!

g-plane commented Dec 7, 2025

Uh oh!

g-plane commented Dec 13, 2025

Uh oh!

kdy1 commented Dec 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

fix: update dependencies to resolve 24 CVEs #52

Are you sure you want to change the base?

fix: update dependencies to resolve 24 CVEs #52

Conversation

kdy1 commented Dec 6, 2025

Summary

Security Fixes

Verification

Breaking Changes

Test plan

Uh oh!

socket-security bot commented Dec 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 7, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 7, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 7, 2025

Choose a reason for hiding this comment

Uh oh!

kdy1 commented Dec 7, 2025

Uh oh!

g-plane commented Dec 7, 2025

Uh oh!

g-plane commented Dec 13, 2025

Uh oh!

kdy1 commented Dec 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

socket-security bot commented Dec 6, 2025 •

edited

Loading