Skip to content

chore: upgrade next to ^16.2.11 to address CVE-2026-64646#1495

Draft
linear-code[bot] wants to merge 1 commit into
mainfrom
linear/sou-1575-sourcebot-devsourcebot-cve-2026-64646-nextjs-unbounded-9b27
Draft

chore: upgrade next to ^16.2.11 to address CVE-2026-64646#1495
linear-code[bot] wants to merge 1 commit into
mainfrom
linear/sou-1575-sourcebot-devsourcebot-cve-2026-64646-nextjs-unbounded-9b27

Conversation

@linear-code

@linear-code linear-code Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Fixes SOU-1575

Addresses CVE-2026-64646 (GHSA-4c39-4ccg-62r3): an unbounded Server Action payload in Next.js's Edge runtime can lead to excessive memory consumption.

The root packages/web next range (^16.2.6) already admits the patched 16.2.11, so this just refreshes the lockfile (yarn up -R next) — no package.json or resolutions change needed. The remaining nested next@16.2.6 comes from the @react-email/ui devDependency, which isn't included in the production standalone build that Trivy scans.

Refreshes the lockfile so the top-level next dependency resolves to
16.2.11, which patches the unbounded Server Action payload issue in the
Edge runtime (GHSA-4c39-4ccg-62r3).

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1575/sourcebot-devsourcebot-cve-2026-64646-nextjs-unbounded-server-action#agent-session-d53f6830)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
@linear-code
linear-code Bot force-pushed the linear/sou-1575-sourcebot-devsourcebot-cve-2026-64646-nextjs-unbounded-9b27 branch from 064acde to ae02c20 Compare July 23, 2026 13:41
@github-actions

Copy link
Copy Markdown
Contributor

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants