test(deps): update next to 16.0.7#1600
Conversation
Update react to 19.2.1 react-down to 19.2.1
|
Zarthus
left a comment
Zarthus
left a comment
There was a problem hiding this comment.
(Thank you for being on top of this :), not an official reviewer just wanted to express gratitude)
Thank you! It doesn't actually affect the action itself, and the vulnerability alert only occurs if you have a clone of the repo. It would probably also be difficult to exploit in this environment as well. That being said, I try to contribute updates to this repo to remove any vulnerability warnings, whether they are in the core action or just in the examples, and whether they appear exploitable or not, just to keep the repo clean and up-to-date. |
|
🎉 This PR is included in version 6.10.5 🎉 The release is available on: Your semantic-release bot 📦🚀 |
4 participants
Situation
Dependabot and
npm auditreport a critical vulnerability CVE-2025-66478 (GHSA-9qr9-h5gf-34mp) in the npm package next used in examples/nextjs.Change
Update next-related dependencies in examples/nextjs:
next16.0.6react&react-dom19.2.0Verification
Execute:
cd examples/nextjs npm ci npm auditand confirm no vulnerabilities are reported. Then execute:
and then in a separate terminal, execute:
npm testconfirming that the Cypress test passes.