chore(deps): security updates for next, vite, vitest - #16
Conversation
Bump next 15.4.10 → 15.5.21 (apps/demo) — patches 4 HIGH + 5 MODERATE CVEs - DoS via Server Actions, middleware bypass, SSRF in rewrites/actions - Cache confusion, SVG DoS, unauthenticated endpoint disclosure Also bump eslint-config-next to 15.5.21 to match. Vite resolves 7.3.0 → 7.3.6 (lockfile, caret range) — path traversal fixes Vitest resolves 3.2.4 → 3.2.7 (lockfile, caret range) — vite-node pin fix Closes dependabot PRs #11, #12, #14, #15
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
shawnmuggle
left a comment
shawnmuggle
left a comment
There was a problem hiding this comment.
Two-pass review (deep read + independent second-opinion pass on the code diff): no P0, no P1, no P2.
Scope is purely dependency bumps — next 15.4.10 → 15.5.21 + matching eslint-config-next, vite ^7.0.6 → ^7.3.6, vitest ^3.2.4 → ^3.2.7, plus lockfile. All minor/patch within the same majors, no API surface touched, no source files changed. The security rationale checks out (next 15.5.x patches the Server Actions DoS / middleware bypass / SSRF set; vite 7.3.6 patches the launch-editor-middleware path traversal).
Note on CI: the review check shows red only because the AI PR Review job was auto-canceled by a higher-priority concurrent run for the same PR ("Canceling since a higher priority waiting request for ai-pr-review-16 exists") — not a real failure. Vercel build/preview passed.
LGTM.
2 participants
Summary
Consolidates 4 Dependabot PRs (#11, #12, #14, #15) into a single update.
Changes
nexteslint-config-nextvitevitestSecurity Fixes
next 15.5.21 — patches 4 HIGH + 5 MODERATE CVEs:
vite 7.3.6 — rejects Windows alternate paths and UNC paths in launch-editor-middleware (path traversal fix)
vitest 3.2.7 — pins last supported vite-node version
Testing