From 33cbd93d355dd38dc3a8c027a3c45f402eb8f071 Mon Sep 17 00:00:00 2001 From: Louis Choquel Date: Tue, 29 Sep 2026 09:34:20 +0200 Subject: [PATCH 1/3] =?UTF-8?q?feature/Wip-to-root=20=C2=B7=20L-260928-dc3?= =?UTF-8?q?ffc=20(#47)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The notes pipelex-method-apps' ignored wip/ held now live in the workspace's own wip repository, so the .gitignore line goes. Campaign documents never land in this repo, and the workspace guard refuses a write into a wip/ here. Closes L-260928-dc3ffc 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01D8etyChjSew3E5gJtojj8M --- ## Summary by cubic Removes the `/wip/` entry from `.gitignore` since the planning notes it protected now live in the workspace's own wip repository. Campaign documents never land in this repo, and the workspace guard already prevents writes into a `wip/` directory here. Closes L-260928-dc3ffc. Written for commit 4f9cf5b688c5db65c3f6a3bdbd340d633b7da6b3. Summary will update on new commits. Review in cubic Co-authored-by: Claude Opus 5.5 --- .gitignore | 3 --- 1 file changed, 3 deletions(-) diff --git a/.gitignore b/.gitignore index 9308280..9e84d89 100644 --- a/.gitignore +++ b/.gitignore @@ -14,6 +14,3 @@ node_modules/ # claude code local settings (per-user, never commit) .claude/settings.local.json - -# internal planning notes — kept local, never shipped -/wip/ From 50b30da3349be9d6f19c8378b5658a93e9ab782b Mon Sep 17 00:00:00 2001 From: Louis Choquel Date: Thu, 1 Oct 2026 23:27:20 +0200 Subject: [PATCH 2/3] =?UTF-8?q?feature/Webapp-js-next-1635-advisory=20?= =?UTF-8?q?=C2=B7=20L-261001-8540e1=20(#48)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The web app template's lock resolved next 16.3.5, inside the range of the critical Next.js advisory GHSA-vcvr-r3jv-pc5j (remote code execution in `next/og`'s `ImageResponse`, fixed in 16.3.6). The template does not import `next/og`, but every project made from it inherits the lock, so `next` and `eslint-config-next` move to `^16.3.8` and `npm audit fix` re-locks the transitive `brace-expansion` and `fast-uri` advisories, leaving `npm audit` clean. Closes L-261001-8540e1 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01PCf9tysTErgWaFcPZW1vPY --- ## Summary by cubic Bumps the web app template's `next` and `eslint-config-next` from 16.3.5 to `^16.3.8` to move past the critical advisory GHSA-vcvr-r3jv-pc5j (remote code execution in `next/og`'s `ImageResponse`, fixed in 16.3.6). The template does not import `next/og`, but projects created from it inherit the lock and could. Also re-locks the transitive `brace-expansion` and `fast-uri` advisories so `npm audit` stays clean. Closes L-261001-8540e1. Written for commit 7948bb64782e0df2b3153b3250c57376e13a45f1. Summary will update on new commits. Review in cubic Co-authored-by: Claude Opus 5.5 --- CHANGELOG.md | 6 ++ webapp-js/package-lock.json | 114 ++++++++++++++++++------------------ webapp-js/package.json | 4 +- 3 files changed, 65 insertions(+), 59 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 50d78a5..98379cc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## [Unreleased] + +### Security + +- **Next.js 16.3.8**: the web app template requires `next` and `eslint-config-next` at `^16.3.8` and locks 16.3.8, past the critical remote-code-execution advisory in `next/og`'s `ImageResponse` that affects Next.js 16.2.0 through 16.3.5 (GHSA-vcvr-r3jv-pc5j). The template does not import `next/og`, but a project made from it inherits the lock and could. The lock also takes the patched `brace-expansion` and `fast-uri`, so `npm audit` reports nothing. + ## [v0.5.6] - 2026-09-27 ### Changed diff --git a/webapp-js/package-lock.json b/webapp-js/package-lock.json index e43b9d1..c35d622 100644 --- a/webapp-js/package-lock.json +++ b/webapp-js/package-lock.json @@ -10,7 +10,7 @@ "dependencies": { "@pipelex/mthds-form": "^0.10.0", "@pipelex/sdk": "^0.26.0", - "next": "^16.3.5", + "next": "^16.3.8", "react": "^19.2.4", "react-dom": "^19.2.4", "server-only": "^0.0.1", @@ -27,7 +27,7 @@ "@types/react-dom": "^19.2.3", "@vitejs/plugin-react": "^5.1.4", "eslint": "^9.39.2", - "eslint-config-next": "^16.3.5", + "eslint-config-next": "^16.3.8", "happy-dom": "^20.6.1", "husky": "^9.1.7", "lint-staged": "^16.2.7", @@ -1310,15 +1310,15 @@ } }, "node_modules/@next/env": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/@next/env/-/env-16.3.5.tgz", - "integrity": "sha512-NWEXVDMqoEo0ktmU6u0sE2Vg0LOcsD7NnOTJNo3/fEaTfsg+F1bMIxuDmQbda4e3yTIQwVdUREF2yIuMOusKtg==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/@next/env/-/env-16.3.8.tgz", + "integrity": "sha512-Al9zqHVV7TJv0eFuOU4U7Lvv74PTih4Ch63sk2xCIpSTkE3udFnaOcnzP2lQVymiL7yS9Cj2iClUXlR3EQ5sEw==", "license": "MIT" }, "node_modules/@next/eslint-plugin-next": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.3.5.tgz", - "integrity": "sha512-PGfSeItHJ12DH8t+6sEbuMe59NE5rAhCfgk06QKTH2ne9VUL1JlaXdYXY3B8RaiF2SO50rDYvd39TulP6A6xZQ==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.3.8.tgz", + "integrity": "sha512-eCR9RcLTZrVS+K3+VOhi0xMdUUGNuriCHHhU1ZoABC/QQ/Gp0OWbLKQxV2/9DkmihYdYRcQWFmZXW8M1AMUXYw==", "dev": true, "license": "MIT", "dependencies": { @@ -1327,9 +1327,9 @@ } }, "node_modules/@next/swc-darwin-arm64": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.3.5.tgz", - "integrity": "sha512-pMmGgETfKvElucLHtVaeiMRbp2zUbvKx7b1yGko0liBz3cw1mKSggWN/Rp/wPz8z+E1O82u3r4L1Co+ZS5hokQ==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.3.8.tgz", + "integrity": "sha512-2JPRMh2nmQG5CiL7cXGL9AGwnPWJQ//cTtAUCT+w511QHk79SYz3LGv/pc5X643B/WEO0rvu3Yww0hqwt3kgeA==", "cpu": [ "arm64" ], @@ -1343,9 +1343,9 @@ } }, "node_modules/@next/swc-darwin-x64": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.3.5.tgz", - "integrity": "sha512-76VaGYvf6HPa5/w12yLkE3dXTn9AfdEviI79oEL3aZoAmRLc9rWitjWqyjViVysK/ht/y9YKzFkBrUdi/wGkow==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.3.8.tgz", + "integrity": "sha512-GZtCCOBKJ4leVIT/Th0llWKhD1ca92lzbQiS5R5ON9QkoiFnilFsebDae1JU2a3HWoKMEmEZWGs1AGLavVM72Q==", "cpu": [ "x64" ], @@ -1359,9 +1359,9 @@ } }, "node_modules/@next/swc-linux-arm64-gnu": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.3.5.tgz", - "integrity": "sha512-zKDELJ5jSQMHeO/hmXUQsAzagX4bQD4OiMi3pQ5FbUj+yK506oLVHnKA2YXMlbg1EHHqJYtyePOgByIDXD1lqw==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.3.8.tgz", + "integrity": "sha512-O659ygeQYqneJ1fBKMpFxIFqYkYswu8IAS1OCKK/4f3ZgJJm1dRz4fVJZRi/kLLWjnBKnebOePA4WNv+sV1pVA==", "cpu": [ "arm64" ], @@ -1378,9 +1378,9 @@ } }, "node_modules/@next/swc-linux-arm64-musl": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.3.5.tgz", - "integrity": "sha512-7Vql0pgzCoHagv6+FNOZoqmJqA52c6zeVbhtS/47qFozO1MSx4ms7x7GHiciY8R5CDsSMKMQjJEryoJLcsBIbA==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.3.8.tgz", + "integrity": "sha512-dSjKSyWpzxoO1d3DIZZcP4XJcNaKeLmxQMFOiYl5vuBRMmweIqnAhty8tAmRsvTss779cK1FtYnDMj40e4TQlg==", "cpu": [ "arm64" ], @@ -1397,9 +1397,9 @@ } }, "node_modules/@next/swc-linux-x64-gnu": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.3.5.tgz", - "integrity": "sha512-NH/xzehyHEFWE2nlcZon7TB/0+H4shfWCi7S1zka815XCOhJDYZhoeJtOYy0dh0WVRWACVXSyGNFFytoMxUhRg==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.3.8.tgz", + "integrity": "sha512-lbqOuz3RPRcv+o9msNsJw5x4+Y1ZwPTs6vmL6DCf7i0fZfvng/F59wyeDwqHIvV0mK//RBy/jJkZ+nCKsSMXjQ==", "cpu": [ "x64" ], @@ -1416,9 +1416,9 @@ } }, "node_modules/@next/swc-linux-x64-musl": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.3.5.tgz", - "integrity": "sha512-lV4+EhWMfS8jcC+EH2nn/Cm5cn6XsgbE07bU9tMH8fCo0tNAqhyzi1b5wQ/Tn6NGFTvKDY65w3ZH95EjwBRAnQ==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.3.8.tgz", + "integrity": "sha512-+316WswI8ScVgZeUd+1KGaXkHhaYQzCjvH/05TZSpJ8zBizb1a4G7DtO7F12jcBIqMOtsz9ji1t48fmKtzqsGA==", "cpu": [ "x64" ], @@ -1435,9 +1435,9 @@ } }, "node_modules/@next/swc-win32-arm64-msvc": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.3.5.tgz", - "integrity": "sha512-/wKzAREX2RF++MhicjDbg8tGn2AiBIM0+EFeTFKoUEUbW5D6amCJehd5Z5G1H5/gxNdgnwoXMcHz24H/c2tGkQ==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.3.8.tgz", + "integrity": "sha512-ji0gd4kMYUxO+1fJBIbiBVRCjzG/lloiyCccnlebvb1ZJ5qXCPZqYg4Jl1DrrixnWNMKylzgpmMWx0yNDYXlzw==", "cpu": [ "arm64" ], @@ -1451,9 +1451,9 @@ } }, "node_modules/@next/swc-win32-x64-msvc": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.3.5.tgz", - "integrity": "sha512-LNdCHzgLFc+UeqMS84LzXPaeBRKyqDN9OMyFAr1OrB0XrNw78IRrEVtZvvA7245W/HsaoeVOQX9jPjPk8jojwA==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.3.8.tgz", + "integrity": "sha512-WcTlaKt/TWkh5kUjdJcUmB1XgZ+1c6fz4Y9fDHL73YNSdGaUWjceeWrrlwF0nv19iABYWC4iAq1oX1w4Bn0vfg==", "cpu": [ "x64" ], @@ -3828,9 +3828,9 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { @@ -4760,9 +4760,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { @@ -5595,13 +5595,13 @@ } }, "node_modules/eslint-config-next": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.3.5.tgz", - "integrity": "sha512-wPjq9MLQuWykHs8tsm2gH6OJThk6N27L8Te2JatlaGZ7jT1gtgGmJKukygL28xOlWsg5J1a1bGy/PvLyQC8OYA==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.3.8.tgz", + "integrity": "sha512-81vovwMe6NGnoFsl0KUJWzlS+y239i3fdsxs49gSEX3pDQW2cuKy+fxUPXNkQqqx6OCPheYPtBlSufc9aZ0k+w==", "dev": true, "license": "MIT", "dependencies": { - "@next/eslint-plugin-next": "16.3.5", + "@next/eslint-plugin-next": "16.3.8", "eslint-import-resolver-node": "^0.3.6", "eslint-import-resolver-typescript": "^3.5.2", "eslint-plugin-import": "^2.32.0", @@ -6043,9 +6043,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.6", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz", - "integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==", + "version": "3.1.8", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", + "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", "funding": [ { "type": "github", @@ -8005,12 +8005,12 @@ "license": "MIT" }, "node_modules/next": { - "version": "16.3.5", - "resolved": "https://registry.npmjs.org/next/-/next-16.3.5.tgz", - "integrity": "sha512-MdtsTgzyfCPRLC6uJ1mN8ao7lyJ4BB0U6Inhnx3gta1UcCIdHK3yxLG0E8OWQteWD8/Q0qb8A5o7wJaL8M9y2w==", + "version": "16.3.8", + "resolved": "https://registry.npmjs.org/next/-/next-16.3.8.tgz", + "integrity": "sha512-U7QEZaTini6wKrb8A8hqLLqYQyCetegKjCpJOyxk642vWoMoU1x5PyZCJFvgYgiptA8xc5j/9xYlZFO7w9Sjmw==", "license": "MIT", "dependencies": { - "@next/env": "16.3.5", + "@next/env": "16.3.8", "@swc/helpers": "0.5.23", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", @@ -8024,14 +8024,14 @@ "node": ">=20.9.0" }, "optionalDependencies": { - "@next/swc-darwin-arm64": "16.3.5", - "@next/swc-darwin-x64": "16.3.5", - "@next/swc-linux-arm64-gnu": "16.3.5", - "@next/swc-linux-arm64-musl": "16.3.5", - "@next/swc-linux-x64-gnu": "16.3.5", - "@next/swc-linux-x64-musl": "16.3.5", - "@next/swc-win32-arm64-msvc": "16.3.5", - "@next/swc-win32-x64-msvc": "16.3.5", + "@next/swc-darwin-arm64": "16.3.8", + "@next/swc-darwin-x64": "16.3.8", + "@next/swc-linux-arm64-gnu": "16.3.8", + "@next/swc-linux-arm64-musl": "16.3.8", + "@next/swc-linux-x64-gnu": "16.3.8", + "@next/swc-linux-x64-musl": "16.3.8", + "@next/swc-win32-arm64-msvc": "16.3.8", + "@next/swc-win32-x64-msvc": "16.3.8", "sharp": "^0.35.4" }, "peerDependencies": { diff --git a/webapp-js/package.json b/webapp-js/package.json index 0e3f588..c0bc078 100644 --- a/webapp-js/package.json +++ b/webapp-js/package.json @@ -28,7 +28,7 @@ "dependencies": { "@pipelex/mthds-form": "^0.10.0", "@pipelex/sdk": "^0.26.0", - "next": "^16.3.5", + "next": "^16.3.8", "react": "^19.2.4", "react-dom": "^19.2.4", "server-only": "^0.0.1", @@ -45,7 +45,7 @@ "@types/react-dom": "^19.2.3", "@vitejs/plugin-react": "^5.1.4", "eslint": "^9.39.2", - "eslint-config-next": "^16.3.5", + "eslint-config-next": "^16.3.8", "happy-dom": "^20.6.1", "husky": "^9.1.7", "lint-staged": "^16.2.7", From 3a7d87779ef918d5edac386b2739cacb85072ccd Mon Sep 17 00:00:00 2001 From: Louis Choquel Date: Thu, 1 Oct 2026 23:35:01 +0200 Subject: [PATCH 3/3] Release v0.5.7 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01PCf9tysTErgWaFcPZW1vPY --- CHANGELOG.md | 2 +- VERSION | 2 +- initializers/js/package.json | 2 +- webapp-js/package-lock.json | 4 ++-- webapp-js/package.json | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 98379cc..9f085c8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## [Unreleased] +## [v0.5.7] - 2026-10-01 ### Security diff --git a/VERSION b/VERSION index b49b253..d3532a1 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.5.6 +0.5.7 diff --git a/initializers/js/package.json b/initializers/js/package.json index 5707247..0f04e9b 100644 --- a/initializers/js/package.json +++ b/initializers/js/package.json @@ -1,6 +1,6 @@ { "name": "@pipelex/create-method-app", - "version": "0.5.6", + "version": "0.5.7", "description": "Start a Pipelex method app: npm create @pipelex/method-app@latest my-app -- --method ", "keywords": [ "pipelex", diff --git a/webapp-js/package-lock.json b/webapp-js/package-lock.json index c35d622..8642e33 100644 --- a/webapp-js/package-lock.json +++ b/webapp-js/package-lock.json @@ -1,12 +1,12 @@ { "name": "pipelex-method-webapp-js", - "version": "0.5.6", + "version": "0.5.7", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "pipelex-method-webapp-js", - "version": "0.5.6", + "version": "0.5.7", "dependencies": { "@pipelex/mthds-form": "^0.10.0", "@pipelex/sdk": "^0.26.0", diff --git a/webapp-js/package.json b/webapp-js/package.json index c0bc078..5353527 100644 --- a/webapp-js/package.json +++ b/webapp-js/package.json @@ -1,6 +1,6 @@ { "name": "pipelex-method-webapp-js", - "version": "0.5.6", + "version": "0.5.7", "private": true, "description": "A Next.js app that runs MTHDS methods through the Pipelex API, with each method's input form and result view generated from its own contract.", "scripts": {