feature/Webapp-js-next-1635-advisory · L-261001-8540e1

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [Unreleased]
+
+### Security
+
+- **Next.js 16.3.8**: the web app template requires `next` and `eslint-config-next` at `^16.3.8` and locks 16.3.8, past the critical remote-code-execution advisory in `next/og`'s `ImageResponse` that affects Next.js 16.2.0 through 16.3.5 (GHSA-vcvr-r3jv-pc5j). The template does not import `next/og`, but a project made from it inherits the lock and could. The lock also takes the patched `brace-expansion` and `fast-uri`, so `npm audit` reports nothing.
+
 ## [v0.5.6] - 2026-09-27
 
 ### Changed

webapp-js/package.json

@@ -28,7 +28,7 @@
   "dependencies": {
     "@pipelex/mthds-form": "^0.10.0",
     "@pipelex/sdk": "^0.26.0",
-    "next": "^16.3.5",
+    "next": "^16.3.8",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "server-only": "^0.0.1",
@@ -45,7 +45,7 @@
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.1.4",
     "eslint": "^9.39.2",
-    "eslint-config-next": "^16.3.5",
+    "eslint-config-next": "^16.3.8",
     "happy-dom": "^20.6.1",
     "husky": "^9.1.7",
     "lint-staged": "^16.2.7",