Release Next Security Fix #1027

philipbrembeck · 2025-12-12T13:02:09Z

Summary by Sourcery

Update dependencies and CI configuration to incorporate the latest security and maintenance patches.

Build:

Bump Next.js, @types/node, @testing-library/jest-dom, eslint-import-resolver-typescript, eslint-plugin-import, and jest-environment-jsdom to newer patch/minor versions for security and compatibility.
Refresh pnpm lockfile to align with updated dependency versions.

CI:

Upgrade GitHub Actions workflows to use actions/checkout v6 across build and PR pipelines.

Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v5...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) from 2.31.0 to 2.32.0. - [Release notes](https://github.com/import-js/eslint-plugin-import/releases) - [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md) - [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0) --- updated-dependencies: - dependency-name: eslint-plugin-import dependency-version: 2.32.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 22.15.15 to 24.10.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 24.10.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) from 6.6.3 to 6.9.1. - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](testing-library/jest-dom@v6.6.3...v6.9.1) --- updated-dependencies: - dependency-name: "@testing-library/jest-dom" dependency-version: 6.9.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

…ns/actions/checkout-6 build(deps): bump actions/checkout from 5 to 6

…/eslint-plugin-import-2.32.0 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0

…/types/node-24.10.1 build(deps): bump @types/node from 22.15.15 to 24.10.1

Bumps [jest-environment-jsdom](https://github.com/jestjs/jest/tree/HEAD/packages/jest-environment-jsdom) from 29.7.0 to 30.2.0. - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.2.0/packages/jest-environment-jsdom) --- updated-dependencies: - dependency-name: jest-environment-jsdom dependency-version: 30.2.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…/testing-library/jest-dom-6.9.1 build(deps-dev): bump @testing-library/jest-dom from 6.6.3 to 6.9.1

…/jest-environment-jsdom-30.2.0 build(deps-dev): bump jest-environment-jsdom from 29.7.0 to 30.2.0

Bumps [eslint-import-resolver-typescript](https://github.com/import-js/eslint-import-resolver-typescript) from 3.7.0 to 4.4.4. - [Release notes](https://github.com/import-js/eslint-import-resolver-typescript/releases) - [Changelog](https://github.com/import-js/eslint-import-resolver-typescript/blob/master/CHANGELOG.md) - [Commits](import-js/eslint-import-resolver-typescript@v3.7.0...v4.4.4) --- updated-dependencies: - dependency-name: eslint-import-resolver-typescript dependency-version: 4.4.4 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…/eslint-import-resolver-typescript-4.4.4 build(deps-dev): bump eslint-import-resolver-typescript from 3.7.0 to 4.4.4

Bumps [next](https://github.com/vercel/next.js) from 16.0.7 to 16.0.10. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v16.0.7...v16.0.10) --- updated-dependencies: - dependency-name: next dependency-version: 16.0.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…/next-16.0.10 build(deps): bump next from 16.0.7 to 16.0.10

bolt-new-by-stackblitz · 2025-12-12T13:02:12Z

Run & review this pull request in StackBlitz Codeflow.

sourcery-ai · 2025-12-12T13:02:16Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR updates Next.js, Node.js type definitions, several testing/linting-related devDependencies, and GitHub Actions workflow checkout versions to the latest security/patch releases, along with refreshing the pnpm lockfile to match.

File-Level Changes

Change	Details	Files
Update runtime and tooling dependencies to security/patch releases and refresh lockfile.	Bump Next.js from 16.0.7 to 16.0.10 for latest framework fixes, likely including security updates. Update @types/node and other test/lint ecosystem packages (jest-dom, eslint-import-resolver-typescript, eslint-plugin-import, jest-environment-jsdom) to newer versions. Regenerate pnpm-lock.yaml to align with the updated dependency versions.	`package.json` `pnpm-lock.yaml`
Harden CI by upgrading GitHub Actions checkout steps to the latest major version.	Update actions/checkout from v5 to v6 across build workflow jobs. Update actions/checkout from v5 to v6 across PR workflow jobs.	`.github/workflows/build.yml` `.github/workflows/pr.yml`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

sourcery-ai

Hey there - I've reviewed your changes - here's some feedback:

You’ve upgraded jest-environment-jsdom to ^30.2.0 but are still on jest ^29.7.0; consider aligning these major versions to avoid subtle test runner/environment incompatibilities.
With next bumped to 16.0.10, double-check that eslint-config-next and any Next-related tooling still match the recommended version matrix for that Next release to prevent configuration or lint/runtime mismatches.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- You’ve upgraded `jest-environment-jsdom` to `^30.2.0` but are still on `jest` `^29.7.0`; consider aligning these major versions to avoid subtle test runner/environment incompatibilities.
- With `next` bumped to `16.0.10`, double-check that `eslint-config-next` and any Next-related tooling still match the recommended version matrix for that Next release to prevent configuration or lint/runtime mismatches.

## Individual Comments

### Comment 1
<location> `package.json:57` </location>
<code_context>
     "eslint-plugin-react-compiler": "19.0.0-beta-27714ef-20250124",
     "jest": "^29.7.0",
-    "jest-environment-jsdom": "^29.7.0",
+    "jest-environment-jsdom": "^30.2.0",
     "ts-node": "^10.9.2",
     "typescript-eslint": "^8.46.2"
</code_context>

<issue_to_address>
**issue (bug_risk):** Align `jest-environment-jsdom` major version with Jest core to avoid runtime incompatibilities.

`jest` is still on `^29.7.0` but `jest-environment-jsdom` is now `^30.2.0`. The environment package usually matches Jest’s major version and may rely on internals that change between majors, which can cause subtle runtime issues. Please either upgrade Jest to v30 or keep `jest-environment-jsdom` on a 29.x release.
</issue_to_address>

### Comment 2
<location> `.github/workflows/build.yml:31` </location>
<code_context>
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6

       - name: Log in to the Container registry
</code_context>

<issue_to_address>
**🚨 suggestion (security):** Consider pinning `actions/checkout` to a specific commit SHA for supply‑chain hardening.

Using the mutable `v6` tag means the action’s behavior can change without you updating this workflow. For stronger supply‑chain security (as you’ve done with `docker/login-action`), pin `actions/checkout` to the specific commit SHA for the intended version and optionally note the version in a comment.

Suggested implementation:

```
    steps:
      - name: Checkout repository
        # actions/checkout v4.2.2
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Log in to the Container registry
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef

```

```
    steps:
      - name: Checkout repository
        # actions/checkout v4.2.2
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Set up Kubectl
        uses: azure/setup-kubectl@v4

```
</issue_to_address>

### Comment 3
<location> `.github/workflows/pr.yml:7` </location>
<code_context>
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6

       - name: Log in to the Container registry
</code_context>

<issue_to_address>
**🚨 suggestion (security):** Mirror the same SHA pinning strategy for `actions/checkout` in PR workflows.

To keep CI paths consistent and ensure we’re using an immutable version of `actions/checkout`, please pin this to the specific commit SHA, matching the strategy used in the build workflows.
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

sourcery-ai · 2025-12-12T13:03:14Z

package.json

    "eslint-plugin-react-compiler": "19.0.0-beta-27714ef-20250124",
    "jest": "^29.7.0",
-    "jest-environment-jsdom": "^29.7.0",
+    "jest-environment-jsdom": "^30.2.0",


issue (bug_risk): Align jest-environment-jsdom major version with Jest core to avoid runtime incompatibilities.

jest is still on ^29.7.0 but jest-environment-jsdom is now ^30.2.0. The environment package usually matches Jest’s major version and may rely on internals that change between majors, which can cause subtle runtime issues. Please either upgrade Jest to v30 or keep jest-environment-jsdom on a 29.x release.

sourcery-ai · 2025-12-12T13:03:14Z

.github/workflows/build.yml

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6


🚨 suggestion (security): Consider pinning actions/checkout to a specific commit SHA for supply‑chain hardening.

Using the mutable v6 tag means the action’s behavior can change without you updating this workflow. For stronger supply‑chain security (as you’ve done with docker/login-action), pin actions/checkout to the specific commit SHA for the intended version and optionally note the version in a comment.

Suggested implementation:

steps: - name: Checkout repository # actions/checkout v4.2.2 uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - name: Log in to the Container registry uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef

steps: - name: Checkout repository # actions/checkout v4.2.2 uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - name: Set up Kubectl uses: azure/setup-kubectl@v4

sourcery-ai · 2025-12-12T13:03:14Z

.github/workflows/pr.yml

    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6


🚨 suggestion (security): Mirror the same SHA pinning strategy for actions/checkout in PR workflows.

To keep CI paths consistent and ensure we’re using an immutable version of actions/checkout, please pin this to the specific commit SHA, matching the strategy used in the build workflows.

dependabot bot and others added 14 commits November 21, 2025 02:01

Merge pull request #1012 from frontendnetwork/dependabot/github_actio…

bc70b8b

…ns/actions/checkout-6 build(deps): bump actions/checkout from 5 to 6

Merge pull request #1015 from frontendnetwork/dependabot/npm_and_yarn…

3b676b8

…/eslint-plugin-import-2.32.0 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0

Merge pull request #1016 from frontendnetwork/dependabot/npm_and_yarn…

c0701f4

…/types/node-24.10.1 build(deps): bump @types/node from 22.15.15 to 24.10.1

Merge pull request #1019 from frontendnetwork/dependabot/npm_and_yarn…

340b186

…/testing-library/jest-dom-6.9.1 build(deps-dev): bump @testing-library/jest-dom from 6.6.3 to 6.9.1

Merge pull request #1018 from frontendnetwork/dependabot/npm_and_yarn…

9f2441a

…/jest-environment-jsdom-30.2.0 build(deps-dev): bump jest-environment-jsdom from 29.7.0 to 30.2.0

Merge pull request #1017 from frontendnetwork/dependabot/npm_and_yarn…

4cc9a7b

…/eslint-import-resolver-typescript-4.4.4 build(deps-dev): bump eslint-import-resolver-typescript from 3.7.0 to 4.4.4

Merge pull request #1024 from frontendnetwork/dependabot/npm_and_yarn…

6ee056e

…/next-16.0.10 build(deps): bump next from 16.0.7 to 16.0.10

philipbrembeck merged commit 469d5fc into main Dec 12, 2025
8 of 10 checks passed

sourcery-ai bot reviewed Dec 12, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Release Next Security Fix #1027

Release Next Security Fix #1027

Uh oh!

philipbrembeck commented Dec 12, 2025 •

edited by sourcery-ai bot

Loading

Uh oh!

bolt-new-by-stackblitz bot commented Dec 12, 2025

Uh oh!

sourcery-ai bot commented Dec 12, 2025 •

edited

Loading

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

Uh oh!

sourcery-ai bot left a comment

Uh oh!

sourcery-ai bot Dec 12, 2025

Uh oh!

sourcery-ai bot Dec 12, 2025

Uh oh!

sourcery-ai bot Dec 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Release Next Security Fix #1027

Release Next Security Fix #1027

Uh oh!

Conversation

philipbrembeck commented Dec 12, 2025 • edited by sourcery-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Sourcery

Uh oh!

bolt-new-by-stackblitz bot commented Dec 12, 2025

Uh oh!

sourcery-ai bot commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

sourcery-ai bot Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

sourcery-ai bot Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

sourcery-ai bot Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

philipbrembeck commented Dec 12, 2025 •

edited by sourcery-ai bot

Loading

sourcery-ai bot commented Dec 12, 2025 •

edited

Loading