[Snyk] Security upgrade next from 15.5.9 to 16.1.5#37
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-NEXT-15104645 - https://snyk.io/vuln/SNYK-JS-NEXT-15105315
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedIgnore keyword(s) in the title. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR upgrades Next.js from version 15.5.9 to 16.1.5 to fix two high-severity security vulnerabilities (SNYK-JS-NEXT-15104645 and SNYK-JS-NEXT-15105315), both related to "Allocation of Resources Without Limits or Throttling" with a severity score of 696/1000. This is a Snyk-automated security upgrade addressing critical security issues.
Changes:
- Upgrade Next.js from 15.5.9 to 16.1.5 (major version upgrade)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "input-otp": "latest", | ||
| "lucide-react": "^0.562.0", | ||
| "next": "15.5.9", | ||
| "next": "16.1.5", |
There was a problem hiding this comment.
This is a major version upgrade from Next.js 15.5.9 to 16.1.5, which may introduce breaking changes. According to the PR description, the pnpm-lock.yaml failed to update automatically and needs to be updated manually before merging. Without updating the lock file, the installation may fail or result in inconsistent dependency versions across environments.
Additionally, Next.js 16 may have different compatibility requirements with React 19.2.3 that should be verified. The major version jump warrants careful testing of all application features, especially App Router functionality and Server Actions which are actively used in this project.
Snyk has created this PR to fix 2 vulnerabilities in the pnpm dependencies of this project.
Snyk changed the following file(s):
package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-NEXT-15104645
SNYK-JS-NEXT-15105315
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Allocation of Resources Without Limits or Throttling