From a889b289c7e04d6d4fa864532e0964a4f2fdd4d1 Mon Sep 17 00:00:00 2001 From: Austin Turner Date: Fri, 23 Oct 2026 19:20:27 -0700 Subject: [PATCH] build: patch critical next and dompurify advisories plus high-severity deps next 16.4.1 fixes two unauthenticated RCEs (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr); monaco-editor pins dompurify exactly, so the override is the only way onto 3.4.17. Also picks up patched zod, undici, electron, vite, follow-redirects and launch-editor. body-parser and multer patches are still inside minimumReleaseAge and node-forge has no fix yet. Next 16.4 defaults turbopackSharedRuntime on, which inlines a bootstrap script into every exported landing page; the API's nonce-only script-src blocks it, so landing turns it off rather than loosening the CSP. --- apps/landing/next.config.js | 6 + package.json | 10 +- pnpm-lock.yaml | 456 +++++++++++++++++++----------------- pnpm-workspace.yaml | 8 +- 4 files changed, 254 insertions(+), 226 deletions(-) diff --git a/apps/landing/next.config.js b/apps/landing/next.config.js index 2a3d612ee..433e0a22a 100644 --- a/apps/landing/next.config.js +++ b/apps/landing/next.config.js @@ -40,6 +40,12 @@ const nextConfig = { }, ], }), + experimental: { + // Next 16.4 defaults this to true, which inlines a per-route bootstrap