Repository navigation
Conversation
16.3.5 carries 3 Critical advisories; two of them are fixed only in 16.4.1 (see plannotator#30), so the 16.3.8 bump in plannotator#28 still leaves them open. Lockfile refreshed with pnpm 10.34.3; the build passes and pnpm audit reports 0 Critical. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
@yotamleo is attempting to deploy a commit to the Effective HTML Team on Vercel. A member of the Team first needs to authorize it. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
nextandeslint-config-nextinsite/from 16.3.5 to 16.4.1 and refreshessite/pnpm-lock.yaml.Fixes #30. #28 targets 16.3.8, which still leaves 2 of the 3 Critical advisories on
nextopen; both are fixed only in 16.4.1. If #28 is updated to >= 16.4.1 first, this PR can be closed in favour of it.16.4.1 is the lowest patched release (16.4.2 and 16.4.3 exist and are newer); it is pinned exactly, no range.
Verification
Run on a clean Ubuntu VM (node 24.20.0, pnpm 10.34.3 from the
packageManagerfield):pnpm install --no-frozen-lockfile: lockfile refreshed, 2 files changed (site/package.json,site/pnpm-lock.yaml).pnpm run build(next build --webpack): exits 0, all routes prerendered.pnpm audit: 0 Critical. 6 high and 2 moderate remain, all transitive and unrelated to this bump (brace-expansionunder eslint,source-map-js,zod).Dependency tree diff
Only these packages change in the lockfile, and no package is added or removed:
next,eslint-config-next,@next/env,@next/eslint-plugin-next,@next/swc-*: 16.3.5 to 16.4.1sharpand@img/sharp-*: 0.35.4 to 0.35.5;@img/sharp-libvips-*: 1.3.3 to 1.3.4 (pulled in bynext)Publisher check (
npm view <pkg>@<v> dist.attestations _npmUser):next@16.4.1,eslint-config-next@16.4.1,@next/*@16.4.1,sharp@0.35.5,@img/sharp-linux-x64@0.35.5and@img/sharp-libvips-linux-x64@1.3.4are published by GitHub Actions (npm OIDC) with SLSA provenance attestations, the same publisher as the versions they replace.next@16.4.1has no install or postinstall script. No new transitive publisher is introduced.🤖 Generated with Claude Code