Skip to content

Upgrade Next.js to 16.2.11 security release #1091

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BigSimmo merged 2 commits into from
Jul 23, 2026
+57 −45
Merged

Upgrade Next.js to 16.2.11 security release #1091

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2cf82e4
fix: upgrade Next.js security patch
BigSimmo Jul 23, 2026
73889fa
docs: align Next.js runtime target
BigSimmo Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/outstanding-issues.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,6 @@ Durable, cross-session memory of everything still outstanding for this repo: ope
| #039 | P3 | rec | Consolidate catalogue toolbar patterns | Catalogue/search pages have independently evolved filter, sort, result-count and mobile toolbar behavior. Inventory the existing implementations and converge only the repeated interaction contract; do not flatten mode-specific search semantics. | design audit reconciliation; session 2026-07-22 | 2026-07-22 |
| #040 | P3 | rec | Add targeted visual-regression baselines | Keep a small approved baseline set for high-value desktop/mobile surfaces and accessibility modes instead of screenshotting every route. Start with account/settings, document viewer, mode homes and bottom-composer interactions; define an intentional-update workflow before enabling blocking comparisons. | design audit reconciliation; session 2026-07-22 | 2026-07-22 |
| #041 | P3 | rec | Extend the existing Factsheets reading model | Do not add a second patient-facing Factsheets mode. Future patient-content work should extend the existing Easy Read/Standard presentation and its accessibility/content contracts. Revisit only with a concrete user need and source-governance plan. | design audit reconciliation; session 2026-07-22 | 2026-07-22 |
| #050 | P1 | issue | Upgrade Next.js past the 16.2.10 security range | The blocking dependency audit on PR #1089 reports one high-severity `next` vulnerability covering 16.0.0–16.2.10 and says a fix is available. Handle this in an isolated dependency/security PR: read the installed Next.js migration guidance, update to the patched stable release without `npm audit fix --force`, run the focused framework checks plus `verify:cheap`, `verify:pr-local`, and browser/UI verification, then confirm `npm audit --omit=dev --audit-level=high` is clean. | PR #1089 CI run 29991217061, `Safety and config checks` | 2026-07-23 |

## Resolved / archive

Expand All @@ -90,3 +89,4 @@ Move resolved rows here with the resolution date and a one-line outcome. Keep th
| #047 | issue | XLSX extraction could construct unbounded results | PR #1086 bounds worksheets, non-empty rows, rendered cells and UTF-8 output while preserving sparse-column rendering. | 2026-07-22 |
| #048 | issue | Account copy overstated sync/privacy and enabled unavailable SSO | PR #1087 now maps copy to actual favourites/preferences persistence, identifies browser-session recents, removes the contradictory "never shared" claim and clearly disables unavailable providers using the accessible placeholder contract. | 2026-07-22 |
| #049 | issue | Process diagnostic exposed a Cursor worker API key | The exact worker was stopped, the key was revoked server-side, both local encrypted worker-secret records were removed, and authorized repository/backup scans found no plaintext copy. Follow-up guardrails now prevent repository process inventory from serializing command lines and redact heavyweight-lock command text before persistence or errors. | 2026-07-23 |
| #050 | issue | Next.js 16.2.10 remained in a high-severity security range | Upgraded `next` and `@next/env` to 16.2.11, regenerated the npm lockfile, confirmed the production dependency audit is clean, and passed focused framework checks, `verify:cheap`, and the full Chromium UI gate. | 2026-07-23 |
2 changes: 1 addition & 1 deletion docs/production-readiness-checklist.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ This is the runbook to make the app publishable in one focused pass.

Last reviewed: 2026-07-10. Applies to any feature branch or release candidate.

- Runtime target: Next.js 16.2.10, Node 24.x, npm 11.x.
- Runtime target: Next.js 16.2.11, Node 24.x, npm 11.x.
- Supabase target: `sjrfecxgysukkwxsowpy` (`Clinical KB Database`).

## Immediate completion targets
Expand Down
94 changes: 53 additions & 41 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,14 +181,14 @@
"drift:manifest": "node scripts/run-tsx.mjs scripts/generate-drift-manifest.ts"
},
"dependencies": {
"@next/env": "16.2.10",
"@next/env": "16.2.11",
"@supabase/ssr": "^0.12.3",
"@supabase/supabase-js": "^2.110.7",
"exceljs": "^4.4.0",
"jszip": "^3.10.1",
"lucide-react": "^1.25.0",
"mammoth": "^1.12.0",
"next": "^16.2.10",
"next": "^16.2.11",
Comment thread
coderabbitai[bot] marked this conversation as resolved.
"openai": "^6.48.0",
"pdf-parse": "^2.4.5",
"pdfjs-dist": "^6.1.200",
Expand Down
Loading