fix: upgrade Next.js to 16.3.0 to resolve PostCSS XSS vulnerability (… - #13
Shakeyswings wants to merge 1 commit into
Conversation
…dependabot alert #1)
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 966b004290
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "@supabase/supabase-js": "^2.110.0", | ||
| "lucide-react": "0.383.0", | ||
| "next": "16.2.10", | ||
| "next": "16.3.0", |
There was a problem hiding this comment.
When a deployment or developer uses npm ci, this manifest change makes installation fail because the tracked package-lock.json still declares and resolves both next and eslint-config-next at 16.2.10 (package-lock.json:15,27,3439-3441,5348-5350). npm documents that when the manifest and lockfile disagree, npm ci exits instead of updating the lockfile (npm ci documentation); moreover, lockfile-based vulnerability scanning still sees the vulnerable Next.js version. Regenerate and commit package-lock.json with the 16.3.0 packages.
Useful? React with 👍 / 👎.
1 participant
…dependabot alert #1)