Skip to content

chore(deps): bump next to 16.2.11 to clear security advisories#5890

Merged
waleedlatif1 merged 2 commits into
stagingfrom
worktree-next-security-bump
Jul 23, 2026
Merged

chore(deps): bump next to 16.2.11 to clear security advisories#5890
waleedlatif1 merged 2 commits into
stagingfrom
worktree-next-security-bump

Conversation

@waleedlatif1

@waleedlatif1 waleedlatif1 commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Bump next and @next/env from 16.2.6 to 16.2.11 across apps/sim, apps/docs, packages/emcn, and the root override — clears all 27 open Dependabot alerts (SSRF in Server Actions/rewrites, cache confusion, image-optimization DoS, Server-Action DoS, middleware/proxy bypass, etc.; GHSA-89xv-2m56-2m9x and related)
  • Add next + @next/env to minimumReleaseAgeExcludes in bunfig.toml since 16.2.11 (published 2026-07-21) is younger than the 7-day supply-chain gate — vetted as the official Vercel patch; entries age out 2026-07-28 and should be dropped then
  • Regenerate bun.lock; no lingering 16.2.6 resolutions

Type of Change

  • Bug fix (security)

Testing

bun install resolves both packages to 16.2.11; bun run lint clean. Patch-level bump, no app code touched.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

@waleedlatif1
chore(deps): bump next to 16.2.11 to clear security advisories
bc90352 
Patches SSRF, cache confusion, DoS, and middleware-bypass advisories
(GHSA-89xv-2m56-2m9x et al.) affecting next < 16.2.11 across apps/sim,
apps/docs, and packages/emcn. Excludes next/@next/env from the
minimum-release-age gate until the 7-day window elapses on 2026-07-28.
@waleedlatif1
waleedlatif1 requested a review from a team as a code owner July 23, 2026 17:33
@vercel

vercel Bot commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs Ready Ready Preview, Comment Jul 23, 2026 5:45pm

Request Review

@cursor

cursor Bot commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown

PR Summary

Low Risk
Dependency-only security patch with no app code changes; standard framework patch risk is limited to Next.js runtime behavior in sim/docs.

Overview
Bumps next and @next/env from 16.2.6 to 16.2.11 across the monorepo (apps/docs, apps/sim, packages/emcn, root and app-level overrides, and bun.lock). This is a patch-level framework update to address Vercel’s July 2026 security advisories (e.g. SSRF, cache confusion, DoS, middleware bypass — GHSA-89xv-2m56-2m9x and related); no application source changes.

bunfig.toml adds next and @next/env to minimumReleaseAgeExcludes so install can succeed under the 7-day release-age gate (with a note to remove those entries after 2026-07-28). The diff also drops the prior typescript / @typescript/typescript6 exclude entries and related comments from that list.

Reviewed by Cursor Bugbot for commit ff0c7a5. Configure here.

@greptile-apps

greptile-apps Bot commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Greptile Summary

Updates Next.js dependencies to 16.2.11 across the monorepo.

  • Aligns next and @next/env overrides and regenerates the Bun lockfile.
  • Temporarily exempts both packages from Bun’s seven-day minimum-release-age gate.

Confidence Score: 5/5

The PR appears safe to merge with no additional blocking failures identified in the follow-up scope.

No blocking failure remains beyond the issue already covered by the previous review thread.

Important Files Changed

Filename Overview
apps/docs/package.json Pins the documentation application to Next.js 16.2.11.
apps/sim/package.json Pins the main application and its local overrides to Next.js 16.2.11.
packages/emcn/package.json Pins the EMCN package to Next.js 16.2.11.
package.json Updates the root next and @next/env overrides to 16.2.11.
bun.lock Regenerates dependency resolutions and platform-specific Next.js packages for 16.2.11.
bunfig.toml Adds temporary release-age exclusions for the newly published security-patch packages.

Reviews (2): Last reviewed commit: "chore(deps): drop aged-out typescript en..." | Re-trigger Greptile

greptile-apps[bot]
greptile-apps Bot reviewed Jul 23, 2026
View reviewed changes
Comment thread bunfig.toml
@waleedlatif1
chore(deps): drop aged-out typescript entries from release-age excludes
ff0c7a5 
typescript and @typescript/typescript6 passed the 7-day minimum-release-age
gate (aged out 2026-07-15 and 2026-07-13), so their exclusions are no longer
needed. Keeps @typescript/native-preview (permanent nightly builds) and the
Pi packages (age out 2026-07-24).
@waleedlatif1

waleedlatif1 commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@waleedlatif1

waleedlatif1 commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator Author

@cursor review

cursor[bot]
cursor Bot reviewed Jul 23, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit ff0c7a5. Configure here.

@waleedlatif1
waleedlatif1 merged commit 78fb2c0 into staging Jul 23, 2026
20 checks passed
@waleedlatif1
waleedlatif1 deleted the worktree-next-security-bump branch July 23, 2026 17:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
@cursor cursor[bot] cursor[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@waleedlatif1