Upgrade website Next.js to 16.4.2 (security) by brycedbjork · Pull Request #13 · north-brook/broker-cli

brycedbjork · 2026-10-23T13:38:07Z

What changed

website/: next 16.1.6 -> 16.4.2
website/: eslint-config-next 16.1.6 -> 16.4.2, which also moves @next/eslint-plugin-next to 16.4.2
website/bun.lock now resolves sharp 0.34.5 -> 0.35.5, pulled in by next@16.4.2 (^0.35.5), so no override was needed.

Only website/package.json and website/bun.lock change. There are no code changes, and the daemon, CLI and SDK are untouched.

Why

Security assessment finding F05: deployed Next.js sites lag the Next.js October 14, 2026 security release and the September 22, 2026 ImageResponse advisory. Fixed lines are >= 16.4.1 / >= 15.5.28, plus sharp >= 0.35.5.

Verification (local)

cd website && bun run build (next build): pass
cd website && bun run lint (eslint): pass
cd website && bunx tsc --noEmit: pass
Root bun run ci:shell: pass. I skipped the ci:python / ci:typescript pre-commit hooks for this website-only change (--no-verify). CI covers them.

Reviewer notes

Next 16.4 now prints The Edge Runtime is deprecated for website/app/install/route.ts (export const runtime = "edge"). It's only a warning and the build passes. Switching to the Node runtime could be a separate follow-up.
Smoke test the brokercli.com preview, including /install and /reference.

🤖 Generated with Claude Code

Note

Upgrade website Next.js and `eslint-config-next` to 16.4.2

Bumps next and eslint-config-next from 16.1.6 to 16.4.2 in package.json for a security update. Regenerates bun.lock, which also pulls in sharp 0.35.5, TypeScript ESLint 8.72.0, and PostCSS 8.5.23 with updated transitive dependencies.

^{Macroscope summarized 4f97b80.}

Summary by CodeRabbit

Chores
- Updated the website’s underlying platform and development tooling. No new user-facing features or changes to visible website behavior are specified in this update.

Bump website next and eslint-config-next 16.1.6 -> 16.4.2. The website lockfile now resolves sharp 0.35.5. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vercel · 2026-10-23T13:38:08Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
broker-cli	Ready	Preview	Oct 23, 2026 2:22pm UTC

coderabbitai · 2026-10-23T13:39:13Z

Warning

Review limit reached

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Ask an admin to enable usage-based reviews

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 80 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 3f999ebb-91d9-45e0-9369-8ad710977a1e

📥 Commits

Reviewing files that changed from the base of the PR and between 68e8c81 and 4f97b80.

⛔ Files ignored due to path filters: 1

website/bun.lock is excluded by !**/*.lock

📒 Files selected for processing: 1

website/package.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 70f604a7-55eb-4eec-8bbe-8e572562b7b1

📥 Commits

Reviewing files that changed from the base of the PR and between 6f979e3 and 68e8c81.

⛔ Files ignored due to path filters: 1

website/bun.lock is excluded by !**/*.lock

📒 Files selected for processing: 1

website/package.json

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📝 Walkthrough

The website package manifest updates next and eslint-config-next from version 16.1.6 to 16.4.2.

Changes: Website dependency updates

Layer / File(s)	Summary
Update dependency versions `website/package.json`	`next` and `eslint-config-next` are updated from version 16.1.6 to 16.4.2.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Suggested reviewers: echobrook

Merge Risk: ⚪ Minimal · up to 68e8c

This scoped dependency update presents no actionable merge-blocking risk.

Architecture risk: 🔵 Low · up to 68e8c

The change affects 1 system.

Changed systems: website

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

observed — website (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

observed — Modified behavior in website/package.json: The next dependency version changes from 16.1.6 to 16.4.2.
observed — Modified behavior in website/package.json: The eslint-config-next development dependency version changes from 16.1.6 to 16.4.2.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the main change: upgrading the website’s Next.js dependencies to version 16.4.2 for security fixes.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

macroscopeapp · 2026-10-23T13:39:13Z

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This is a narrowly scoped Next.js dependency and lockfile update with no application-source changes. Its stated purpose is to remediate a security advisory, and the changed paths are excluded from review, so human validation is warranted.

Notes:

No code objects were reviewed. Approvability was decided on eligibility alone.

No code changes detected at 4f97b80. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

pipkin-bot

No new issues

Upgrades the website’s Next.js and eslint-config-next from 16.1.6 to 16.4.2 for security fixes, with the regenerated Bun lockfile also bringing sharp to 0.35.5. No application code, daemon, CLI, or SDK changes are included; local build, lint, and type checks reportedly pass, though preview smoke testing is recommended.

Review details

None of this pull request's changes since pipkin's last review need a new pass, so no review passes ran on 4f97b80.
Left out 1 lock or generated file.

_{Reply with @pipkin-bot to ask about a finding, or comment @pipkin-bot review to run the review again.}

Upgrade website Next.js to 16.4.2 for October 2026 security fixes

68e8c81

Bump website next and eslint-config-next 16.1.6 -> 16.4.2. The website lockfile now resolves sharp 0.35.5. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vercel Bot deployed to Preview October 23, 2026 13:38

View deployment

This comment was marked as outdated.

Sign in to view

brycedbjork mentioned this pull request Oct 23, 2026

fix(cli): declare click as a direct dependency #15

Merged

Merge branch 'main' into security/next-sharp-oct-2026

4f97b80

vercel Bot deployed to Preview October 23, 2026 14:22

View deployment

pipkin-bot Bot reviewed Oct 23, 2026

View reviewed changes

brycedbjork merged commit 25085dc into main Oct 23, 2026
17 checks passed

brycedbjork deleted the security/next-sharp-oct-2026 branch October 23, 2026 14:24

Navigation Menu

Repository navigation

Upgrade website Next.js to 16.4.2 (security) - #13

Upgrade website Next.js to 16.4.2 (security)#13
brycedbjork merged 2 commits into
mainfrom
security/next-sharp-oct-2026

brycedbjork commented Oct 23, 2026 •

edited by macroscopeapp Bot

Loading

Uh oh!

vercel Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Review limit reached

Uh oh!

macroscopeapp Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

pipkin-bot Bot left a comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

brycedbjork commented Oct 23, 2026 • edited by macroscopeapp Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Why

Verification (local)

Reviewer notes

Upgrade website Next.js and eslint-config-next to 16.4.2

Summary by CodeRabbit

Uh oh!

vercel Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

macroscopeapp Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Approvability

Uh oh!

This comment was marked as outdated.

Uh oh!

pipkin-bot Bot left a comment

Choose a reason for hiding this comment

No new issues

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

brycedbjork commented Oct 23, 2026 •

edited by macroscopeapp Bot

Loading

Upgrade website Next.js and `eslint-config-next` to 16.4.2

vercel Bot commented Oct 23, 2026 •

edited

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

macroscopeapp Bot commented Oct 23, 2026 •

edited

Loading