Repository navigation
Clear all 4 npm audit findings for SUP-4013 - #39
Merged
KidkArolis merged 1 commit intoSep 15, 2026
Merged
Conversation
All four are patched inside their existing ranges, so a plain `npm update next js-yaml qs sharp` resolves them. No `overrides` and no package.json changes. - next 16.3.1 -> 16.3.5 (critical) GHSA-p293-qw3h-jr36 unauthenticated RCE on windows-hosted servers, and GHSA-2xp9-vwfh-vxw4 unauthenticated RCE in the Image Optimization API when AVIF files are used. The second one is squarely this package's territory -- next-img drives that API and emits AVIF derivatives. - js-yaml 3.15.1 -> 3.15.2 (high) GHSA-2883-xcg3-v3hh. Dev-only, transitive via ava -> supertap -> js-yaml@^3.14.1. Same finding and same fix as humaans/react-space-router#13. - sharp 0.35.3 -> 0.35.4 (high) GHSA-rgj7-g3m4-5g8c, libheif vulnerabilities, which also moves @img/sharp-libvips-* 1.3.2 -> 1.3.3. - qs 6.15.3 -> 6.16.0 (moderate) GHSA-x5fp-wj9c-mxmx array-limit bypass and GHSA-4mjr-xmp4-gh2g DoS via attacker-controlled isBuffer. The 341-line lockfile diff is 40 packages, and every one is a target or a platform-specific sibling of a target: the @img/sharp-* and @next/swc-* binary sets, @next/env, and one added @emnapi/runtime under sharp-wasm32. Nothing unrelated moved. Made with npm 11.11.0. This lockfile is npm 11-generated -- it carries 54 `libc` fields that npm 10 does not understand and silently strips, which would bloat the diff. All 54 survive here. `npm ci` is unaffected either way, so CI on node 22 is fine regardless. Verified: npm audit 4 -> 0; fresh `npm ci` then `npm test` (oxlint + tsc + ava) 49 passed, matching the baseline taken before the change; and `npm run test:integration`, both the turbopack and webpack `next build` runs, green on 16.3.5. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
matt-humaan
marked this pull request as ready for review
September 14, 2026 16:59
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Risk: medium. Left a non-blocking comment and did not approve: this lockfile-only bump of Next.js and sharp native packages is above the low-risk auto-approve limit for this author. Human review is needed; no reviewers were assigned.
Sent by Cursor Approval Agent: Pull Request Router and Approver - Risk Based
KidkArolis
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears every
npm auditfinding in this repo, for SUP-4013.The findings
next16.3.1js-yaml3.15.1sharp0.35.3qs6.15.3Worth calling out that the second
nextadvisory is unauthenticated RCE in the Image Optimization API when AVIF files are used — squarely this package's territory, since next-img drives that API and emits AVIF derivatives.The
js-yamlone is dev-only, reaching us transitively asava@8.0.1 → supertap → js-yaml@^3.14.1. Same finding and same fix as humaans/react-space-router#13.The fix
All four are patched inside their existing ranges, so a plain
npm update next js-yaml qs sharpresolves them. Nooverrides, and nopackage.jsonchanges — the diff ispackage-lock.jsononly.The 341 lines are 40 packages, and every one is a target or a platform-specific sibling of a target: the
@img/sharp-*and@next/swc-*binary sets,@img/sharp-libvips-*1.3.2 → 1.3.3,@next/env, and one added@emnapi/runtimeundersharp-wasm32. Nothing unrelated moved.npm auditnow reports 0 vulnerabilities.Verification
Left to CI. Locally, before handing over: fresh
npm cithennpm test(oxlint + tsc + ava) gave 49 passed, matching the baseline taken before the change, andnpm run test:integrationwas green on 16.3.5 for both the turbopack and webpacknext buildruns.Not run locally: the React 18/19 matrix. CI covers it here.
Note for anyone updating deps here
Per the same note on humaans/react-space-router#13 — this lockfile is npm 11-generated and carries 54
libcfields on the optional platform packages. npm 10 does not understand that field and silently strips it, bloating the diff. This commit was made with npm 11.11.0 and all 54 survive.npm ciis unaffected, so CI on node 22 is fine either way.🤖 Generated with Claude Code