Skip to content

chore(security): bump next to 15.5.28 (root lockfile) - #34

Closed
cdbartholomew wants to merge 1 commit into
mainfrom
chore/sec-med-next
Closed

cdbartholomew wants to merge 1 commit into
mainfrom
chore/sec-med-next

Conversation

@cdbartholomew

Copy link
Copy Markdown
Contributor

MEDIUM Dependabot sweep — vectorize-connect-sdk package-lock.json

Human-authored bundle so CI runs with full secrets.

Closes:

  • #56, #57 next (15.5.24 -> 15.5.28; vulnerable >=15.0.0 <15.5.27)

Within-range npm@11 update next --package-lock-only. Diff limited to next + @next/* swc binaries.

NOT in this PR (no clean fix — needs-review):

  • #61 minimatch (<11.0.1): only patched at 11.0.1; consumed transitively by the ESLint toolchain pinned to minimatch ^3.1.x (default-export API removed in v5+) and by glob. A scoped override to 11.0.1 is a breaking major jump. Dev-only ReDoS (GHSA-g3hv-75wg-m249). Recommend accept/justify or an ESLint-toolchain upgrade.

https://claude.ai/code/session_014J7s5yzoVEqoZ8LmnD8bQd

Addresses MEDIUM Dependabot alerts #56 #57 (next, vulnerable
>=15.0.0 <15.5.27). Within-range (^15.5.18) --package-lock-only
bump; diff limited to next + @next/* swc binaries.

Claude-Session: https://claude.ai/code/session_014J7s5yzoVEqoZ8LmnD8bQd
@cdbartholomew cdbartholomew added security p2 Priority: medium labels Nov 2, 2026
@cdbartholomew cdbartholomew self-assigned this Nov 2, 2026
@cdbartholomew cdbartholomew added security p2 Priority: medium labels Nov 2, 2026
@cdbartholomew

Copy link
Copy Markdown
Contributor Author

Superseded by #33 (full medium bundle; this was a next-only subset).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

p2 Priority: medium security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant