Skip to content

fix(deps): bump next to 16.4 and clear npm audit findings - #316

Merged
yakew7 merged 1 commit into
StudentSuite:mainfrom
propcgamer20-png:fix/next-security-bump
Oct 27, 2026
Merged

yakew7 merged 1 commit into
StudentSuite:mainfrom
propcgamer20-png:fix/next-security-bump

Conversation

@propcgamer20-png

Copy link
Copy Markdown
Contributor

What this changes

Closes #299. Bumps next and eslint-config-next to ^16.4.2 (the lockfile resolves 16.4.3) and runs npm audit fix to refresh the transitive packages (postcss, nanoid, source-map-js, sharp inside @vercel/og, baseline-browser-mapping).

Type of change

  • New public place(s)
  • New or updated benefit guide
  • New or updated resource link
  • Code or fix
  • Docs

Verification

  • npm audit --omit=dev: before, 6 vulnerabilities (1 critical, 4 high, 1 moderate); after, found 0 vulnerabilities. The sharp devDependency at the top level needed no major bump.
  • npm ls next: 16.4.3 (also deduped under @vercel/analytics).
  • npm run typecheck, npm run lint, npm run test:unit (60 files, 599 tests) and npm run build pass.
  • next start then fetched /city/mumbai/opengraph-image and /competitions/ijso/opengraph-image: both 200 image/png.

The lockfile diff is large because npm install also moved other in-range packages; package.json only changes the two Next lines. The build's docs-meta.generated.json rewrite is not included.

Checklist

  • The site hosts no copyrighted files; resource and paper changes are links only.
  • No em dashes in any copy.

@vercel

vercel Bot commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

@propcgamer20-png is attempting to deploy a commit to the studentsuite Team on Vercel.

A member of the Team first needs to authorize it.

@yakew7
yakew7 merged commit caaad9c into StudentSuite:main Oct 27, 2026
3 of 5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

next 16.2.9 is in the critical range of npm audit

2 participants