Skip to content
This repository was archived by the owner on Feb 15, 2026. It is now read-only.

build(package.json): update deps to patch critical next.js exploit#152

Merged
KemingHe merged 2 commits into
mainfrom
build/update-deps/KemingHe
Dec 7, 2025
Merged

build(package.json): update deps to patch critical next.js exploit#152
KemingHe merged 2 commits into
mainfrom
build/update-deps/KemingHe

Conversation

@KemingHe

@KemingHe KemingHe commented Dec 7, 2025

Copy link
Copy Markdown
Owner

also disabled e2e snapshot testing after discovery of GitHub Action Runner env (Linux) diff from new local dev env (MacOS) causing breakage in rendered screenshots

also disabled e2e snapshot testing after discovery of GitHub Action Runner env (Linux) diff from new
local dev env (MacOS) causing breakage in rendered screenshots
@KemingHe KemingHe requested a review from Copilot December 7, 2025 15:22
@KemingHe KemingHe self-assigned this Dec 7, 2025
@KemingHe KemingHe added the dependencies Pull requests that update a dependency file label Dec 7, 2025
@changeset-bot

changeset-bot Bot commented Dec 7, 2025

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: d357d66

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercel Bot commented Dec 7, 2025

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
buckeye-gpt Ready Ready Preview Comment Dec 7, 2025 3:27pm

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR aims to update dependencies to patch a critical Next.js security exploit, while also disabling e2e snapshot testing due to environment differences between local macOS development and Linux-based GitHub Action runners.

Key Changes:

  • Updated multiple dependencies including Next.js, React, TypeScript, and various AI SDK packages
  • Added verify:lite script that excludes e2e tests and modified pre-commit hook to use it
  • Disabled automatic e2e test workflow triggers (push, pull_request, and cron), keeping only manual workflow_dispatch

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
pnpm-workspace.yaml Added '@biomejs/biome' and 'bcrypt' to onlyBuiltDependencies list
package.json Updated 20+ dependency versions, added verify:lite script, updated pnpm package manager version
next-env.d.ts Added reference path to Next.js generated routes types
components/snapshots/github-corner.test.tsx.snap Updated CSS module class name hashes (likely due to dependency updates)
.husky/pre-commit Changed pre-commit hook from 'verify' to 'verify:lite' to skip e2e tests
.github/workflows/e2e-test.yaml Disabled automatic workflow triggers and cron job, added explanatory comments
.changeset/sharp-camels-fetch.md Added changeset entry documenting the dependency update

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/e2e-test.yaml Outdated
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Keming He <keminghe.career@gmail.com>
@codecov

codecov Bot commented Dec 7, 2025

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 12.44%. Comparing base (8c3f006) to head (d357d66).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #152   +/-   ##
=======================================
  Coverage   12.44%   12.44%           
=======================================
  Files         103      103           
  Lines        2210     2210           
  Branches      108      108           
=======================================
  Hits          275      275           
  Misses       1897     1897           
  Partials       38       38           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@KemingHe KemingHe merged commit f364ccb into main Dec 7, 2025
11 checks passed
@KemingHe KemingHe deleted the build/update-deps/KemingHe branch December 7, 2025 15:29
@github-project-automation github-project-automation Bot moved this from Doing to Done in Buckeye GPT DevOps Dec 7, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

dependencies Pull requests that update a dependency file

Projects

No open projects
Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants