chore(deps): pin node 24 and update dependencies flagged by security advisories - #256
chore(deps): pin node 24 and update dependencies flagged by security advisories#256ganymedio wants to merge 3 commits into
Conversation
Add engines.node 24.x so Vercel builds and runs the site on Node 24 regardless of the Project Settings value; Node 20 is disabled on Vercel from 2026-10-01. packageManager (pnpm@10.33.0) and the 14-day minimum-release-age cooldown in .npmrc were already in place and are unchanged.
Refresh pnpm-lock.yaml with `pnpm update --depth Infinity` so every transitive dependency moves to the newest version its dependents allow. No direct dependency crosses a major version; the caret ranges in package.json are raised to the versions now resolved. fumadocs-openapi is constrained to ~9.1.8 because 9.6+ depends on fumadocs-ui 16, which needs a React 19.2 runtime that Next 15.5 does not provide, and 9.2-9.5 pull in a fumadocs-core whose page-tree types no longer match the pinned fumadocs-core 15.6.1. Audit: 45 high / 2 critical / 19 moderate / 2 low -> 5 high / 1 critical / 3 moderate / 0 low. The remainder is pinned by next@15.5.21 (postcss 8.4.31, sharp ^0.34, image-size with no fix), by the exact next pin itself, or by @scalar/openapi-parser (yaml 2.8.0).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
ganymedio
changed the title
Primata
left a comment
Primata
left a comment
There was a problem hiding this comment.
Blocking on the next version. This PR is titled as an advisory-driven dependency update but leaves next on 15.5.21, which carries two critical unauthenticated RCEs fixed in 15.5.24. The fix is available and past the install cooldown. Two lower-priority notes on transitive postcss and the fumadocs-openapi range change.
| "lottie-react": "^2.4.1", | ||
| "lottie-react": "^2.4.2", | ||
| "lucide-react": "^0.525.0", | ||
| "next": "15.5.21", |
There was a problem hiding this comment.
P0. This PR says it updates dependencies flagged by security advisories, but next stays on 15.5.21. Two critical advisories published 2026-09-08 cover that version:
- GHSA-2xp9-vwfh-vxw4: unauthenticated RCE in the Image Optimization API via AVIF (
>= 10.0.0, < 15.5.24) - GHSA-p293-qw3h-jr36: unauthenticated RCE on Windows-hosted servers, CVSS 9.0 (
>= 13.4.0, < 15.5.24)
Both are fixed in 15.5.24, published 2026-08-25, which is old enough to clear the 14-day minimum-release-age in .npmrc. bridge-interface#142 and movement-network-website#120 already took this bump in the same batch; this repo and faucet-rebrand#10 did not.
Please bump to 15.5.24.
Related: the lockfile still resolves sharp@0.34.5, which is what GHSA-2xp9 traces back to. GHSA-rgj7-g3m4-5g8c (high, libheif) is fixed in 0.35.4 and GHSA-f88m-g3jw-g9cj (high, libvips) in 0.35.0. sharp@0.35.4 published 2026-08-26 and is now past the cooldown, so a pnpm.overrides entry would close the root cause as well as the Next.js mitigation.
| "tailwindcss": "^4.1.11", | ||
| "typescript": "^5.8.3", | ||
| "vitest": "^4.1.10" | ||
| "postcss": "^8.5.26", |
There was a problem hiding this comment.
P2. The direct spec now resolves to 8.5.26, but the lockfile still carries a second postcss@8.4.31 in the graph. It is affected by GHSA-6g55-p6wh-862q (high, arbitrary file read, fixed 8.5.12) and GHSA-r28c-9q8g-f849 (high, path traversal in source-map auto-loading, fixed 8.5.18).
Bumping the direct dependency does not dedupe the transitive one. A pnpm.overrides entry ("postcss": "^8.5.26") would collapse both. Exposure here is build-time rather than request-time, hence P2 rather than P1.
| "fumadocs-core": "15.6.1", | ||
| "fumadocs-mdx": "11.6.10", | ||
| "fumadocs-openapi": "^9.1.8", | ||
| "fumadocs-openapi": "~9.1.13", |
There was a problem hiding this comment.
P3. This is the only spec in the file that moved from ^ to ~. It restricts updates to 9.1.x patches, so a future 9.2.x security patch will not be picked up by a routine pnpm update, and it diverges from the convention every other entry here follows.
If the narrowing is deliberate (a known break in 9.2), a short note in the PR body would help. If it is incidental, ^9.1.13 matches the rest of the file.
next was pinned exactly at 15.5.21, which two critical advisories cover; 15.5.24 is the first fixed release that clears the 14-day release-age cooldown. 15.5.25 is 8 days old and pnpm refuses it. postcss resolved to two copies: 8.5.26 from the direct devDependency and 8.4.31 pinned exactly by next (plus a stray 8.5.6). sharp resolved to 0.34.5. Neither has a direct spec that can move them, so both are raised through pnpm.overrides, collapsing each to a single installed version.
2 participants
Pins the project to Node 24 for Vercel builds and refreshes the dependencies flagged by open security advisories.
Configuration
Both of those settings are the mitigation for the Shai-Hulud npm worm. The worm propagates by publishing malicious releases of legitimate packages from stolen maintainer tokens, and its payload runs from a package's install lifecycle script. pnpm 10 does not run dependency install scripts unless a package is explicitly allowlisted, which removes that execution path, and
minimum-release-age=20160refuses to resolve any version published in the last 14 days, so a compromised release cannot enter the lockfile inside the window where it is typically detected and pulled.package.json: add"engines": { "node": "24.x" }.Why
Vercel reads
engines.nodeto select the build and runtime Node version, overriding the Project Settings value. Node 20 is disabled on Vercel from 2026-10-01, so pinning 24.x here makes the deployed Node version explicit and version-controlled.packageManageris alreadypnpm@10.33.0and.npmrcalready enforcesminimum-release-age=20160(14-day install cooldown); both are unchanged.Dependency updates
pnpm-lock.yamlis refreshed withpnpm update --depth Infinity(pnpm 10.33.0, with the 14-dayminimum-release-agecooldown from.npmrcin effect), so every transitive dependency moves to the newest version its dependents' declared ranges allow. No direct dependency crosses a major version. pnpm raised the caret ranges inpackage.jsonto the versions now resolved (react 19.2.8, shiki 3.23.0, tailwindcss 4.3.3, typescript 5.9.3, vitest 4.1.11, ...); exact pins (next,fumadocs-core,fumadocs-ui,fumadocs-mdx,eslint-config-next,@types/node) are untouched.fumadocs-openapiis constrained from^9.1.8to~9.1.8(resolves 9.1.13). Newer 9.x releases break the build:fumadocs-ui@16, which importsuseEffectEventfrom React; the React that Next 15.5 bundles for the App Router does not export it (Attempted import error: 'useEffectEvent' is not exported from 'react').fumadocs-core@15.7/15.8, whose page-treeattachFiletype no longer matches the pinnedfumadocs-core@15.6.1used insrc/lib/source.ts(type error duringnext build).Audit
pnpm auditbefore -> after: critical 2 -> 1, high 45 -> 5, moderate 19 -> 3, low 2 -> 0.Flagged packages, resolved versions before -> after:
Not fixed in this PR
nextis pinned exactly inpackage.json; bumping it is a deliberate framework update, not a transitive refresh. 15.5.24 was published 2026-08-25 and is past the cooldown, sonext@15.5.24can be taken in a follow-up.next@15.5.21depends onpostcss@8.4.31exactly. The project's ownpostcssis at 8.5.26.next@15.5.21declaressharp@^0.34.3; 0.35.0 is outside that range.patched_versions: <0.0.0). Pulled in byfumadocs-core.@scalar/openapi-parser@0.18.3(viafumadocs-openapi) depends onyaml@2.8.0exactly.Advisories addressed
46 GitHub advisories across 12 packages are no longer reported after this change, grouped by the package whose version moved:
Verification
pnpm install --frozen-lockfileon the result: succeeds. pnpm 10 reportsIgnored build scripts: esbuild@0.25.12, sharp@0.34.5, unrs-resolver@1.12.2; the build does not need them, so noonlyBuiltDependenciesentry was added.pnpm build(next build): succeeds, full route table emitted.pnpm test(vitest): 1 file, 11 tests passed.