fix(security): upgrade next 14.2.30 -> 15.5.20, clearing 4 high-severity CVEs (Closes #596)#630
Conversation
|
@SakethSumanBathini is attempting to deploy a commit to the sreerevanth's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe frontend upgrades Next.js and ChangesNext.js 15 frontend migration
Estimated code review effort: 2 (Simple) | ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🧪 PR Test Results
Python 3.12 · commit 119e591 |
sreerevanth
left a comment
sreerevanth
left a comment
There was a problem hiding this comment.
This PR upgrades a major framework version (next 14 → 15). While the security motivation is valid, the diff only updates dependencies and the lockfile without demonstrating compatibility beyond successful builds.
Please:
Verify key frontend workflows (dashboard, replay, authentication, API interactions) against Next 15.
Add a short migration note documenting any required follow-up work (such as the ESLint migration mentioned in the PR description).
Confirm there are no runtime regressions introduced by the framework upgrade.
After functional validation is completed, this can be reconsidered for merge.
|
Thanks for the review — all three points addressed. I've added Key frontend workflows verified against Next 15. I ran the production server (
Server ready in ~0.4s. The No runtime regressions.
Migration note added, documenting the above plus the one follow-up: On the checks: the failing one is Vercel (deploy authorization — needs a maintainer to approve, nothing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/NEXT_15_MIGRATION.md`:
- Around line 52-55: Update the Next.js 15 migration note to state that next
lint is deprecated and still available, rather than removed. Preserve the
explanation about the lint script, .eslintrc.json, and pre-existing
pages/replay.tsx errors.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: bb729649-5fad-4af4-95e3-fa4893c06991
⛔ Files ignored due to path filters (1)
frontend/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (3)
frontend/NEXT_15_MIGRATION.mdfrontend/next-env.d.tsfrontend/package.json
|
Quick note on the two red checks, neither of which is from this PR (it only changes
The official |
SHAURYASANYAL3
left a comment
SHAURYASANYAL3
left a comment
There was a problem hiding this comment.
Hi! We'd love to get this merged, but it's currently blocked. Please address the following so we can proceed:
- Review Feedback: Previous review feedback needs addressing.
Let us know once you've updated the PR!
|
Hi! We'd love to get this merged, but it's currently blocked. Please address the following so we can proceed:
Let us know once you've updated the PR! |
Action Required (Update)🔹 Review Feedback: Please address previous review comments. 🔹 CI Failures (fail, fail, fail) - Please check Actions tab. |
|
Hey! Just following up on the requested changes. Please ensure they are addressed within the next 48 hours. If there's no update by then, we'll go ahead and close this PR to keep the queue manageable. |
|
Analysis CompleteGenerated ECC bundle from 4 commits | Confidence: 55% View Pull Request #667Repository Profile
Changed Files (4)
Top hotspots
Top directories
Analysis Depth Readiness (evidence-backed, 36%)ECC Tools uses this to decide whether recommendations should stay at commit-history/setup guidance or expand into CI, security, harness, reference-set, AI-routing, and team backlog work.
Reference Set Readiness (1/7, 14%)
Likely Future Issues (1)
Suggested Follow-up Work (1)
Copy-ready bodies test: add browser coverage for frontend/NEXT_15_MIGRATION.md + frontend/next-env.d.ts ## Summary
- Add browser or end-to-end coverage for the recently changed user-facing surface.
## Why
- Backfill browser coverage before another user-facing UI change lands on the touched surface.
## Touched paths
- `frontend/NEXT_15_MIGRATION.md`
- `frontend/next-env.d.ts`
## Validation
- Add or extend browser / e2e coverage for the changed component, page, or flow.
- Exercise the visible user journey that depends on the touched UI surface.Review Activity (5 reviews, 3 inline comments, 0 unresolved threads)
Latest reviewer states
Review Follow-up Signals (3)
Recommended next actions
Detected Workflows (1)
Generated Instincts (19)
After merging, import with: Files
|
|
CI is green. All 13 checks pass — including What was actually wrong. Both failing jobs run Python, and this PR changes only Correcting myself on one point: I said earlier the ruff failure was red on The one remaining red mark is Vercel's "authorization required to deploy", which needs a maintainer to @sreerevanth your three points were addressed in b9c8328, before either of the follow-ups above, in
@SHAURYASANYAL3 the CI failures your last comment cited are resolved. Both change-request reviews now predate the work that addressed them, so they're blocking on their own |
3 participants
Closes #596
My own issue's recommendation doesn't work
I said to patch within Next 14 rather than jump majors. I tested it. A 14.x bump fixes zero of the
advisories:
Next 14 is two majors behind and no longer receives these patches. Merging that would have closed a
security issue without fixing a single vulnerability, which is worse than leaving it open.
What the advisories actually are
Seven CVEs against
next, not the one warning I described:remotePatternsplus
glob(command injection, 7.5) andpostcss(XSS) transitively.What this does
next 14.2.30 → 15.5.20, and
eslint-config-nextto match.All four HIGH cleared, including the SSRF. The two remaining are moderate: a
nextmoderate and apostcssXSS reached through next, which clears when next bumps its own dependency.Why 15 and not 16
npm's
fixAvailablepoints atnext@16.2.10. I measured both — they're identical: 16 also leaves0 high + 2 moderate. So 16 buys nothing on security, costs a second major, and would collapse the
deliberate two-Next-major separation documented in #602.
React is unchanged at 18.3.1.
next@15declarespeerDependencies.react: ^18.2.0 || ^19.0.0, sothis does not drag in a React 19 migration.
Why the upgrade is low-risk here
Next 15's headline breaking changes — async
params/searchParams, RSC caching defaults — target theApp Router. The dashboard is Pages Router only:
app/directory: nonegetServerSideProps/getStaticProps: 0 usagesnext/font: 0 usagesnext.config.js:reactStrictMode,output,transpilePackages— all still validOne thing I deliberately left out of scope
next lintis removed in Next 15. Thelintscript now launches an interactive codemod.I tried to fix it by adding an
.eslintrc.json— and that broke the build, becausenext buildthenstarted running ESLint and surfaced 7 pre-existing errors in
pages/replay.tsx(unescaped'and"). The build has never linted, because no ESLint config is committed for it to find.So the ESLint migration needs its own PR: a config file plus fixing those 7 errors. Dragging it in here
would mean a security fix stuck behind unrelated lint churn. CI doesn't run lint (
npm ci→type-check→build), so nothing is red today. Happy to file it as a follow-up issue.Verified — the actual CI gates, run on Linux
The lockfile was regenerated on Linux, not Windows. Windows
npm installomits optional platformpeers that Linux CI requires, and
npm cithen hard-fails. Please don't runnpm installon thisbranch on Windows before merging.
next-env.d.tsis included because Next regenerates it on build and it's tracked.Summary by CodeRabbit
Bug Fixes
Documentation