Skip to content

fix: bump next to 16.1.5 for security fix#78

Merged
cbullinger merged 1 commit into
mainfrom
dependabot-23-main
Jan 28, 2026
Merged

fix: bump next to 16.1.5 for security fix#78
cbullinger merged 1 commit into
mainfrom
dependabot-23-main

Conversation

@cbullinger

@cbullinger cbullinger commented Jan 28, 2026

Copy link
Copy Markdown
Collaborator

Summary

Addresses Dependabot security alert #23 by bumping Next.js.

Changes

Vulnerability Details

  • CVE: CVE-2025-59471
  • GHSA: GHSA-9g9p-9gw9-jx7f
  • Severity: Medium (CVSS 5.9)
  • Description: DoS vulnerability in self-hosted Next.js applications via Image Optimizer remotePatterns configuration

Testing

  • ✅ npm install completes successfully with 0 vulnerabilities
  • ✅ npm run build compiles successfully
  • ✅ npm run start runs correctly with Next.js 16.1.5

@cbullinger
fix: bump next to 16.1.5 for security fix
ce9600a 
CVE fix per Dependabot alert #23
dacharyc
dacharyc approved these changes Jan 28, 2026
View reviewed changes

@dacharyc dacharyc left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅

@cbullinger cbullinger merged commit e4dfe53 into main Jan 28, 2026
1 check passed
@cbullinger cbullinger deleted the dependabot-23-main branch February 9, 2026 20:41
cbullinger added a commit that referenced this pull request Jun 15, 2026
@cbullinger
fix(tanstack): bump esbuild and shell-quote for security advisories
8bfe470 
Add npm overrides to pin vulnerable transitive dependencies:
- esbuild>=0.28.1 (Dependabot #78, #79)
- shell-quote>=1.8.4 (Dependabot #77)
cbullinger added a commit that referenced this pull request Jun 15, 2026
@cbullinger
fix(tanstack): bump esbuild and shell-quote for security advisories
f3ce8d2 
Add npm overrides to pin vulnerable transitive dependencies:
- esbuild>=0.28.1 (Dependabot #78, #79)
- shell-quote>=1.8.4 (Dependabot #77)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dacharyc dacharyc dacharyc approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@cbullinger @dacharyc