diff options
| author | Leitwolf11 | 2026-10-23 05:57:26 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-10-23 05:57:26 +0300 |
| commit | 8e4f376c19a05c3a7ac73576515f4baa62ed206d (patch) | |
| tree | 21d4a4d60a5cf31366051be5036d5c3a54fecb8b /apps/api | |
| parent | 46e526f91e805319e0b0b65bae8d09dc4fabfa0c (diff) | |
| download | progmaweb-8e4f376c19a05c3a7ac73576515f4baa62ed206d.tar.gz | |
Update Next.js to 16.4.2 for an unauthenticated RCEsecurity/next-16.4.2
pnpm audit reports a critical advisory for next >=16.0.0 <=16.4.0:
unauthenticated remote code execution through the Image Optimization
API when SVG files are used. progmasoft.com runs 16.3.8. The site sets
no images option and the optimizer refused an SVG request in a check
from outside, but the version is in the affected range, so it moves to
16.4.2, the latest patch release; eslint-config-next follows.
Verified: pnpm check, pnpm test:coverage, pnpm lint and pnpm build
pass; pnpm audit --audit-level high reports nothing beyond the one
advisory already ignored.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'apps/api')
0 files changed, 0 insertions, 0 deletions