From 52f3b95e1a8c3a061ebe235c0e13eb177fa4c585 Mon Sep 17 00:00:00 2001 From: Maximiliano <40447063+msalvatti@users.noreply.github.com> Date: Sun, 2 Aug 2026 10:54:49 -0300 Subject: [PATCH 1/4] fix(deps): raise the Next peer floor above the middleware-bypass advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `peerDependencies.next` was `^16.2.10`, so a consumer could satisfy it with the exact version carrying eight open advisories fixed in 16.2.11. Three are high, and one of them is a middleware/proxy authentication bypass in App Router: crafted requests against an app built with Turbopack and a single `config.i18n.locales` entry skip middleware-based auth entirely. That one is not a generic dependency issue for this package. The `./nextjs` surface IS middleware — the proxy is the authorization boundary a consumer installs it for — and the advisory's own workaround says not to rely on middleware alone. A peer range that admits the vulnerable version hands that bypass to anyone who installs this library and takes the resolver's default. The floor is a range, not a pin: `^16.2.11` accepts every later 16.x, so nobody already on a newer Next is affected or held back. The dev dependency and the two example apps move with it so what is built and tested is a version the peer range permits. Verified against 16.2.12: install, wasm, bundle, `tsc`, lint, TypeDoc, the Vitest suite, and the `nextjs` example's production build — which compiles the middleware, the surface the advisory is about. The remaining alerts on this repo (`postcss`, `sharp`, `esbuild`, `brace-expansion`) are build-time transitives pinned by their parents; none ship in the published `dist/`, and they are Dependabot's to carry rather than something to force with an `overrides` block. --- examples/nextjs/package-lock.json | 94 ++++++++++++------------- examples/nextjs/package.json | 2 +- examples/smoke-npm/package-lock.json | 100 +++++++++++++-------------- examples/smoke-npm/package.json | 2 +- packages/rust-auth/package-lock.json | 82 +++++++++++----------- packages/rust-auth/package.json | 4 +- 6 files changed, 142 insertions(+), 142 deletions(-) diff --git a/examples/nextjs/package-lock.json b/examples/nextjs/package-lock.json index 2e25132..084348f 100644 --- a/examples/nextjs/package-lock.json +++ b/examples/nextjs/package-lock.json @@ -9,7 +9,7 @@ "version": "0.0.0", "dependencies": { "@bymax-one/rust-auth": "file:../../packages/rust-auth", - "next": "^16.0.0", + "next": "^16.2.11", "react": "^19.0.0", "react-dom": "^19.0.0" }, @@ -31,27 +31,27 @@ "@eslint/js": "^9.17.0", "@testing-library/dom": "^10.4.0", "@testing-library/react": "^16.1.0", - "@types/node": "^26.1.1", + "@types/node": "^26.1.2", "@types/react": "^19.0.2", "@types/react-dom": "^19.0.2", - "eslint": "^10.6.0", + "eslint": "^10.8.0", "eslint-plugin-security": "^4.0.1", - "jsdom": "^29.1.1", - "next": "^16.2.10", - "prettier": "^3.9.4", + "jsdom": "^30.0.1", + "next": "^16.2.11", + "prettier": "^3.9.6", "react": "^19.0.0", "react-dom": "^19.0.0", "tsup": "^8.3.5", "typedoc": "^0.28.20", "typescript": "^5.7.2", - "typescript-eslint": "^8.63.0", + "typescript-eslint": "^8.65.0", "vitest": "^4.1.10" }, "engines": { "node": ">=18.0.0" }, "peerDependencies": { - "next": "^16.2.10", + "next": "^16.2.11", "react": "^19.0.0" }, "peerDependenciesMeta": { @@ -592,15 +592,15 @@ } }, "node_modules/@next/env": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.10.tgz", - "integrity": "sha512-zLPxg9M0MEHmygpj5OuxjQ+vHMiy/K7cSp74G8ecYolmgUWw0RwN02tF56npup/+qaI8JB97hQgS/r2Hb6QwVA==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.12.tgz", + "integrity": "sha512-d0Z5Bc13Fa4nR8pFAKx2jay2yhJM16vlfHbTzYnUQAxlNb6B6lmn4hjt69lYNt4kRtyYP6gEM49lPRHNbIyneg==", "license": "MIT" }, "node_modules/@next/swc-darwin-arm64": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.10.tgz", - "integrity": "sha512-v9IdJCa0H0mbo+8z5zwUpOk1Vj7RjkcI5uNYf5Ws1y6szf/p3Mzl9hLaST8SCt6L9h8NGnruZcd2+o0NTNwDhA==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.12.tgz", + "integrity": "sha512-0W1R0teHWJrqKX0FH20IzzIWAOuGtBxPGuObrxy1lE8hQvCFj49KE8a3WUg0D7sq6rn6zkM4c7YGUnhudBS6oA==", "cpu": [ "arm64" ], @@ -614,9 +614,9 @@ } }, "node_modules/@next/swc-darwin-x64": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.10.tgz", - "integrity": "sha512-17IS0jJRViROGmA9uGdNR8VPJpfbnaVG7E9qhso5jDLkmyd0lSDORWxbcKINzcFqzZqGwGtMSnrFRxBpuUYjLQ==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.12.tgz", + "integrity": "sha512-Hy5Ls099+aFUmOLmIgPfLqNi6iCwhL3uQCssz5rWk+5Nkc6TUKCE83DY5BbNylfm3+mfwcSFnLRfrZDJhVxdtw==", "cpu": [ "x64" ], @@ -630,9 +630,9 @@ } }, "node_modules/@next/swc-linux-arm64-gnu": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.10.tgz", - "integrity": "sha512-GRQRsRtuciNJvB54AvvuQTiq0oZtFwa1owQqtZD8wwnGpM2L39MV22kpI72YSXLKIyY40LC66EiLFv4PiicXxg==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.12.tgz", + "integrity": "sha512-+YqU2h1cQkHsGfvjAsrSmst8UIFBibBGm5x3Xgel8NLMiDQtNOM4sM2GOEMvG5YiOBNeN/Ykk8cQC2S0Xrqljg==", "cpu": [ "arm64" ], @@ -649,9 +649,9 @@ } }, "node_modules/@next/swc-linux-arm64-musl": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.10.tgz", - "integrity": "sha512-zkN9MQYS7UQBro+FnISUq1itaQjXI9xqISzuQ+2bc921NcJ1x4yPCqrn77tVN6/dOOXaaWVX3k6/bR07pPwK+A==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.12.tgz", + "integrity": "sha512-0qjhiYBaKAqF63LA1ZWAAnKTzFUguAaZiRa5etMLGGPj/B6uEVjtIZldIzFEp3wHlB0koK6aTzqPtSdplTCjoA==", "cpu": [ "arm64" ], @@ -668,9 +668,9 @@ } }, "node_modules/@next/swc-linux-x64-gnu": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.10.tgz", - "integrity": "sha512-iCVJnwvrPYECvA6WM/7+oo+OiTvedIKLxtCLAZP4xZR3nXa1zmzZyLPbYCmWvpd4CvMYF1EMTafd0ii3DygLvA==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.12.tgz", + "integrity": "sha512-7A3q26W+h7gnA15uqBToNuDqBEFZZcqh0mW2mn4AJh/G5pdg2RVE3n4slzLEliASZFG3NmsbEzng/x2Sh09mBg==", "cpu": [ "x64" ], @@ -687,9 +687,9 @@ } }, "node_modules/@next/swc-linux-x64-musl": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.10.tgz", - "integrity": "sha512-ov2g4H0dHY9bPoOU83m91hWT7Iq5qy13bUnyyshLU3HGR1Ownn0X9QpmDPc5iIUaahTp7f7LeGAhV4DSFtackw==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.12.tgz", + "integrity": "sha512-qSjL/uppm+cbh21s72Ss8gkiOhQ4dExWHNGOWy6eZV7STj5WsKehgxT61beSsOj+YYQuTplL376lOCdMQU5T8w==", "cpu": [ "x64" ], @@ -706,9 +706,9 @@ } }, "node_modules/@next/swc-win32-arm64-msvc": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.10.tgz", - "integrity": "sha512-DwAnhLX76HQiFFQNgWlcK+JzlnD1rZ+UK/WY0ZMI/deXpvgnesjNYrqcfo1JzBuz4Kf7o3brIBL0glI1junatA==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.12.tgz", + "integrity": "sha512-X6hzsOUJac/e7AWSbn9gQ9nzHld1xWP5iyjHpYWvud8pufB679O1xg4JDyKr8Xd69Jvd+kM2Der6uftiZCmjYA==", "cpu": [ "arm64" ], @@ -722,9 +722,9 @@ } }, "node_modules/@next/swc-win32-x64-msvc": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.10.tgz", - "integrity": "sha512-0JXq3b85Jk9Jg4ntLUbXSPvoDw3gpZou7twuKdoFG2jOw635v7+IiXfTaa0TxVMyx78pUjnrVYwLgjKfX4e6/A==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.12.tgz", + "integrity": "sha512-F6fakeHuFTLOPt0bslQJdf+xtT+WIP9DVn/m4y1w1mRnVPyh3D/cNvzlRkxM444xfm+IvvYNSOrKiA2CDJ0Uxw==", "cpu": [ "x64" ], @@ -850,12 +850,12 @@ } }, "node_modules/next": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/next/-/next-16.2.10.tgz", - "integrity": "sha512-2som5AVXb3kE6Yjine3/mNbBayYF58eguBWIVVUdr1y/L426xyVEgYxgBG+1QC34P2x5E+tcDup6XkuOAX3dCA==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/next/-/next-16.2.12.tgz", + "integrity": "sha512-iD59eYQWmbFcEbX7v/acG5DRym9iw1DdaPoD0WTA920naWsE25wShzJW4+UvAs8MK9EC2kBfIH6vtto1H1PHGw==", "license": "MIT", "dependencies": { - "@next/env": "16.2.10", + "@next/env": "16.2.12", "@swc/helpers": "0.5.15", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", @@ -869,14 +869,14 @@ "node": ">=20.9.0" }, "optionalDependencies": { - "@next/swc-darwin-arm64": "16.2.10", - "@next/swc-darwin-x64": "16.2.10", - "@next/swc-linux-arm64-gnu": "16.2.10", - "@next/swc-linux-arm64-musl": "16.2.10", - "@next/swc-linux-x64-gnu": "16.2.10", - "@next/swc-linux-x64-musl": "16.2.10", - "@next/swc-win32-arm64-msvc": "16.2.10", - "@next/swc-win32-x64-msvc": "16.2.10", + "@next/swc-darwin-arm64": "16.2.12", + "@next/swc-darwin-x64": "16.2.12", + "@next/swc-linux-arm64-gnu": "16.2.12", + "@next/swc-linux-arm64-musl": "16.2.12", + "@next/swc-linux-x64-gnu": "16.2.12", + "@next/swc-linux-x64-musl": "16.2.12", + "@next/swc-win32-arm64-msvc": "16.2.12", + "@next/swc-win32-x64-msvc": "16.2.12", "sharp": "^0.34.5" }, "peerDependencies": { diff --git a/examples/nextjs/package.json b/examples/nextjs/package.json index f547445..c9c9bf9 100644 --- a/examples/nextjs/package.json +++ b/examples/nextjs/package.json @@ -11,7 +11,7 @@ }, "dependencies": { "@bymax-one/rust-auth": "file:../../packages/rust-auth", - "next": "^16.0.0", + "next": "^16.2.11", "react": "^19.0.0", "react-dom": "^19.0.0" }, diff --git a/examples/smoke-npm/package-lock.json b/examples/smoke-npm/package-lock.json index e405189..fc35d66 100644 --- a/examples/smoke-npm/package-lock.json +++ b/examples/smoke-npm/package-lock.json @@ -9,7 +9,7 @@ "version": "0.0.0", "dependencies": { "@bymax-one/rust-auth": "file:../../packages/rust-auth", - "next": "^16.0.0", + "next": "^16.2.11", "react": "^19.0.0", "react-dom": "^19.0.0" }, @@ -31,27 +31,27 @@ "@eslint/js": "^9.17.0", "@testing-library/dom": "^10.4.0", "@testing-library/react": "^16.1.0", - "@types/node": "^22.10.2", + "@types/node": "^26.1.2", "@types/react": "^19.0.2", "@types/react-dom": "^19.0.2", - "eslint": "^9.17.0", - "eslint-plugin-security": "^3.0.1", - "jsdom": "^25.0.1", - "next": "^16.0.0", - "prettier": "^3.4.2", + "eslint": "^10.8.0", + "eslint-plugin-security": "^4.0.1", + "jsdom": "^30.0.1", + "next": "^16.2.11", + "prettier": "^3.9.6", "react": "^19.0.0", "react-dom": "^19.0.0", "tsup": "^8.3.5", - "typedoc": "^0.27.6", + "typedoc": "^0.28.20", "typescript": "^5.7.2", - "typescript-eslint": "^8.18.2", - "vitest": "^2.1.8" + "typescript-eslint": "^8.65.0", + "vitest": "^4.1.10" }, "engines": { "node": ">=18.0.0" }, "peerDependencies": { - "next": "^16.0.0", + "next": "^16.2.11", "react": "^19.0.0" }, "peerDependenciesMeta": { @@ -1034,15 +1034,15 @@ } }, "node_modules/@next/env": { - "version": "16.2.9", - "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.9.tgz", - "integrity": "sha512-ki5VxxXfzD/9TDe13wyeTKIjQTAwBVpnr8KhRDUr8ltMUq1/NBpWNT5tiPoxiGl+PHM4X2ahSOiPk6iAimIzPg==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.12.tgz", + "integrity": "sha512-d0Z5Bc13Fa4nR8pFAKx2jay2yhJM16vlfHbTzYnUQAxlNb6B6lmn4hjt69lYNt4kRtyYP6gEM49lPRHNbIyneg==", "license": "MIT" }, "node_modules/@next/swc-darwin-arm64": { - "version": "16.2.9", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.9.tgz", - "integrity": "sha512-HkfxNYUCmcct0Xsqib5KxqMSHV4AHJq857BNRchyBDs4YS19aHzVfn1kDuBYKqLLQBjXgnkIsjV2Kd4d2wzYhw==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.12.tgz", + "integrity": "sha512-0W1R0teHWJrqKX0FH20IzzIWAOuGtBxPGuObrxy1lE8hQvCFj49KE8a3WUg0D7sq6rn6zkM4c7YGUnhudBS6oA==", "cpu": [ "arm64" ], @@ -1056,9 +1056,9 @@ } }, "node_modules/@next/swc-darwin-x64": { - "version": "16.2.9", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.9.tgz", - "integrity": "sha512-7IAtK4MeybpqRV9GRABWEhJ62mOS+rzWOzOTFie4cSEtm12xsoOMJRcECoZx3FHPzFAqN/IJtHqWAFOLfl152w==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.12.tgz", + "integrity": "sha512-Hy5Ls099+aFUmOLmIgPfLqNi6iCwhL3uQCssz5rWk+5Nkc6TUKCE83DY5BbNylfm3+mfwcSFnLRfrZDJhVxdtw==", "cpu": [ "x64" ], @@ -1072,9 +1072,9 @@ } }, "node_modules/@next/swc-linux-arm64-gnu": { - "version": "16.2.9", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.9.tgz", - "integrity": "sha512-hBD75iWpUtkL9SmQmcRhmLomn9jgkPzCEkbOcLgHymPEKzv+6ONy13RRiIEz/iEObjkS2Jlb5gYS2XGoS3X4rw==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.12.tgz", + "integrity": "sha512-+YqU2h1cQkHsGfvjAsrSmst8UIFBibBGm5x3Xgel8NLMiDQtNOM4sM2GOEMvG5YiOBNeN/Ykk8cQC2S0Xrqljg==", "cpu": [ "arm64" ], @@ -1091,9 +1091,9 @@ } }, "node_modules/@next/swc-linux-arm64-musl": { - "version": "16.2.9", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.9.tgz", - "integrity": "sha512-qZTI3pf9SGc/obr8NkQAekBxmp1QK+kVm+VAf3BALLfFAj+1kUhkTxmrWpVos9R/UYIA8AWX2p6cGI5WdwzVUA==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.12.tgz", + "integrity": "sha512-0qjhiYBaKAqF63LA1ZWAAnKTzFUguAaZiRa5etMLGGPj/B6uEVjtIZldIzFEp3wHlB0koK6aTzqPtSdplTCjoA==", "cpu": [ "arm64" ], @@ -1110,9 +1110,9 @@ } }, "node_modules/@next/swc-linux-x64-gnu": { - "version": "16.2.9", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.9.tgz", - "integrity": "sha512-xm0HfRNX+UkH4R3c18ynswjj5o5uEj/7iI9p9omdtTSIsRCzQqkGMA+10nzJ4EHnYC3as65IMhbbl5fWRUWHYg==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.12.tgz", + "integrity": "sha512-7A3q26W+h7gnA15uqBToNuDqBEFZZcqh0mW2mn4AJh/G5pdg2RVE3n4slzLEliASZFG3NmsbEzng/x2Sh09mBg==", "cpu": [ "x64" ], @@ -1129,9 +1129,9 @@ } }, "node_modules/@next/swc-linux-x64-musl": { - "version": "16.2.9", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.9.tgz", - "integrity": "sha512-QumimHkGEG6vM3PfEDWKyKen03NcqLOkeKB1EfcPe7VxzmEiCa4jNnMyBn/US5zcd/VE1CI+O8Ovb3lfjVHfGw==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.12.tgz", + "integrity": "sha512-qSjL/uppm+cbh21s72Ss8gkiOhQ4dExWHNGOWy6eZV7STj5WsKehgxT61beSsOj+YYQuTplL376lOCdMQU5T8w==", "cpu": [ "x64" ], @@ -1148,9 +1148,9 @@ } }, "node_modules/@next/swc-win32-arm64-msvc": { - "version": "16.2.9", - "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.9.tgz", - "integrity": "sha512-hzQpKZvw8rAwI6A2uQh6SacCSvNAXaIkPNsWwzqqfRiIMiXMfH936skDhz1OO6KpvdKkJrgHHtqQOq5PIXOvdQ==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.12.tgz", + "integrity": "sha512-X6hzsOUJac/e7AWSbn9gQ9nzHld1xWP5iyjHpYWvud8pufB679O1xg4JDyKr8Xd69Jvd+kM2Der6uftiZCmjYA==", "cpu": [ "arm64" ], @@ -1164,9 +1164,9 @@ } }, "node_modules/@next/swc-win32-x64-msvc": { - "version": "16.2.9", - "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.9.tgz", - "integrity": "sha512-qr2VL3Ce5QrwgO2yh1ujSBawrimjVKX8FGF/cOynmdYKJY0BdHpGVNIRK1tqONB10Vkm25Ub1BD2bkjWs4+96w==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.12.tgz", + "integrity": "sha512-F6fakeHuFTLOPt0bslQJdf+xtT+WIP9DVn/m4y1w1mRnVPyh3D/cNvzlRkxM444xfm+IvvYNSOrKiA2CDJ0Uxw==", "cpu": [ "x64" ], @@ -1339,12 +1339,12 @@ } }, "node_modules/next": { - "version": "16.2.9", - "resolved": "https://registry.npmjs.org/next/-/next-16.2.9.tgz", - "integrity": "sha512-MEOJiq/UvuezAdqVSceHbqDgZt1kDw2tpGVOlsdIoJsQdbN2JY2hpVG4xnXGkbdJUOEWhnRfiu/O4Hpc9Juwww==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/next/-/next-16.2.12.tgz", + "integrity": "sha512-iD59eYQWmbFcEbX7v/acG5DRym9iw1DdaPoD0WTA920naWsE25wShzJW4+UvAs8MK9EC2kBfIH6vtto1H1PHGw==", "license": "MIT", "dependencies": { - "@next/env": "16.2.9", + "@next/env": "16.2.12", "@swc/helpers": "0.5.15", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", @@ -1358,14 +1358,14 @@ "node": ">=20.9.0" }, "optionalDependencies": { - "@next/swc-darwin-arm64": "16.2.9", - "@next/swc-darwin-x64": "16.2.9", - "@next/swc-linux-arm64-gnu": "16.2.9", - "@next/swc-linux-arm64-musl": "16.2.9", - "@next/swc-linux-x64-gnu": "16.2.9", - "@next/swc-linux-x64-musl": "16.2.9", - "@next/swc-win32-arm64-msvc": "16.2.9", - "@next/swc-win32-x64-msvc": "16.2.9", + "@next/swc-darwin-arm64": "16.2.12", + "@next/swc-darwin-x64": "16.2.12", + "@next/swc-linux-arm64-gnu": "16.2.12", + "@next/swc-linux-arm64-musl": "16.2.12", + "@next/swc-linux-x64-gnu": "16.2.12", + "@next/swc-linux-x64-musl": "16.2.12", + "@next/swc-win32-arm64-msvc": "16.2.12", + "@next/swc-win32-x64-msvc": "16.2.12", "sharp": "^0.34.5" }, "peerDependencies": { diff --git a/examples/smoke-npm/package.json b/examples/smoke-npm/package.json index 2ff911e..d693276 100644 --- a/examples/smoke-npm/package.json +++ b/examples/smoke-npm/package.json @@ -10,7 +10,7 @@ }, "dependencies": { "@bymax-one/rust-auth": "file:../../packages/rust-auth", - "next": "^16.0.0", + "next": "^16.2.11", "react": "^19.0.0", "react-dom": "^19.0.0" }, diff --git a/packages/rust-auth/package-lock.json b/packages/rust-auth/package-lock.json index 0b3bcf6..777dad7 100644 --- a/packages/rust-auth/package-lock.json +++ b/packages/rust-auth/package-lock.json @@ -21,7 +21,7 @@ "eslint": "^10.8.0", "eslint-plugin-security": "^4.0.1", "jsdom": "^30.0.1", - "next": "^16.2.10", + "next": "^16.2.11", "prettier": "^3.9.6", "react": "^19.0.0", "react-dom": "^19.0.0", @@ -35,7 +35,7 @@ "node": ">=18.0.0" }, "peerDependencies": { - "next": "^16.2.10", + "next": "^16.2.11", "react": "^19.0.0" }, "peerDependenciesMeta": { @@ -1560,16 +1560,16 @@ } }, "node_modules/@next/env": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.10.tgz", - "integrity": "sha512-zLPxg9M0MEHmygpj5OuxjQ+vHMiy/K7cSp74G8ecYolmgUWw0RwN02tF56npup/+qaI8JB97hQgS/r2Hb6QwVA==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.12.tgz", + "integrity": "sha512-d0Z5Bc13Fa4nR8pFAKx2jay2yhJM16vlfHbTzYnUQAxlNb6B6lmn4hjt69lYNt4kRtyYP6gEM49lPRHNbIyneg==", "dev": true, "license": "MIT" }, "node_modules/@next/swc-darwin-arm64": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.10.tgz", - "integrity": "sha512-v9IdJCa0H0mbo+8z5zwUpOk1Vj7RjkcI5uNYf5Ws1y6szf/p3Mzl9hLaST8SCt6L9h8NGnruZcd2+o0NTNwDhA==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.12.tgz", + "integrity": "sha512-0W1R0teHWJrqKX0FH20IzzIWAOuGtBxPGuObrxy1lE8hQvCFj49KE8a3WUg0D7sq6rn6zkM4c7YGUnhudBS6oA==", "cpu": [ "arm64" ], @@ -1584,9 +1584,9 @@ } }, "node_modules/@next/swc-darwin-x64": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.10.tgz", - "integrity": "sha512-17IS0jJRViROGmA9uGdNR8VPJpfbnaVG7E9qhso5jDLkmyd0lSDORWxbcKINzcFqzZqGwGtMSnrFRxBpuUYjLQ==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.12.tgz", + "integrity": "sha512-Hy5Ls099+aFUmOLmIgPfLqNi6iCwhL3uQCssz5rWk+5Nkc6TUKCE83DY5BbNylfm3+mfwcSFnLRfrZDJhVxdtw==", "cpu": [ "x64" ], @@ -1601,9 +1601,9 @@ } }, "node_modules/@next/swc-linux-arm64-gnu": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.10.tgz", - "integrity": "sha512-GRQRsRtuciNJvB54AvvuQTiq0oZtFwa1owQqtZD8wwnGpM2L39MV22kpI72YSXLKIyY40LC66EiLFv4PiicXxg==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.12.tgz", + "integrity": "sha512-+YqU2h1cQkHsGfvjAsrSmst8UIFBibBGm5x3Xgel8NLMiDQtNOM4sM2GOEMvG5YiOBNeN/Ykk8cQC2S0Xrqljg==", "cpu": [ "arm64" ], @@ -1621,9 +1621,9 @@ } }, "node_modules/@next/swc-linux-arm64-musl": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.10.tgz", - "integrity": "sha512-zkN9MQYS7UQBro+FnISUq1itaQjXI9xqISzuQ+2bc921NcJ1x4yPCqrn77tVN6/dOOXaaWVX3k6/bR07pPwK+A==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.12.tgz", + "integrity": "sha512-0qjhiYBaKAqF63LA1ZWAAnKTzFUguAaZiRa5etMLGGPj/B6uEVjtIZldIzFEp3wHlB0koK6aTzqPtSdplTCjoA==", "cpu": [ "arm64" ], @@ -1641,9 +1641,9 @@ } }, "node_modules/@next/swc-linux-x64-gnu": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.10.tgz", - "integrity": "sha512-iCVJnwvrPYECvA6WM/7+oo+OiTvedIKLxtCLAZP4xZR3nXa1zmzZyLPbYCmWvpd4CvMYF1EMTafd0ii3DygLvA==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.12.tgz", + "integrity": "sha512-7A3q26W+h7gnA15uqBToNuDqBEFZZcqh0mW2mn4AJh/G5pdg2RVE3n4slzLEliASZFG3NmsbEzng/x2Sh09mBg==", "cpu": [ "x64" ], @@ -1661,9 +1661,9 @@ } }, "node_modules/@next/swc-linux-x64-musl": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.10.tgz", - "integrity": "sha512-ov2g4H0dHY9bPoOU83m91hWT7Iq5qy13bUnyyshLU3HGR1Ownn0X9QpmDPc5iIUaahTp7f7LeGAhV4DSFtackw==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.12.tgz", + "integrity": "sha512-qSjL/uppm+cbh21s72Ss8gkiOhQ4dExWHNGOWy6eZV7STj5WsKehgxT61beSsOj+YYQuTplL376lOCdMQU5T8w==", "cpu": [ "x64" ], @@ -1681,9 +1681,9 @@ } }, "node_modules/@next/swc-win32-arm64-msvc": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.10.tgz", - "integrity": "sha512-DwAnhLX76HQiFFQNgWlcK+JzlnD1rZ+UK/WY0ZMI/deXpvgnesjNYrqcfo1JzBuz4Kf7o3brIBL0glI1junatA==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.12.tgz", + "integrity": "sha512-X6hzsOUJac/e7AWSbn9gQ9nzHld1xWP5iyjHpYWvud8pufB679O1xg4JDyKr8Xd69Jvd+kM2Der6uftiZCmjYA==", "cpu": [ "arm64" ], @@ -1698,9 +1698,9 @@ } }, "node_modules/@next/swc-win32-x64-msvc": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.10.tgz", - "integrity": "sha512-0JXq3b85Jk9Jg4ntLUbXSPvoDw3gpZou7twuKdoFG2jOw635v7+IiXfTaa0TxVMyx78pUjnrVYwLgjKfX4e6/A==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.12.tgz", + "integrity": "sha512-F6fakeHuFTLOPt0bslQJdf+xtT+WIP9DVn/m4y1w1mRnVPyh3D/cNvzlRkxM444xfm+IvvYNSOrKiA2CDJ0Uxw==", "cpu": [ "x64" ], @@ -4412,13 +4412,13 @@ "license": "MIT" }, "node_modules/next": { - "version": "16.2.10", - "resolved": "https://registry.npmjs.org/next/-/next-16.2.10.tgz", - "integrity": "sha512-2som5AVXb3kE6Yjine3/mNbBayYF58eguBWIVVUdr1y/L426xyVEgYxgBG+1QC34P2x5E+tcDup6XkuOAX3dCA==", + "version": "16.2.12", + "resolved": "https://registry.npmjs.org/next/-/next-16.2.12.tgz", + "integrity": "sha512-iD59eYQWmbFcEbX7v/acG5DRym9iw1DdaPoD0WTA920naWsE25wShzJW4+UvAs8MK9EC2kBfIH6vtto1H1PHGw==", "dev": true, "license": "MIT", "dependencies": { - "@next/env": "16.2.10", + "@next/env": "16.2.12", "@swc/helpers": "0.5.15", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", @@ -4432,14 +4432,14 @@ "node": ">=20.9.0" }, "optionalDependencies": { - "@next/swc-darwin-arm64": "16.2.10", - "@next/swc-darwin-x64": "16.2.10", - "@next/swc-linux-arm64-gnu": "16.2.10", - "@next/swc-linux-arm64-musl": "16.2.10", - "@next/swc-linux-x64-gnu": "16.2.10", - "@next/swc-linux-x64-musl": "16.2.10", - "@next/swc-win32-arm64-msvc": "16.2.10", - "@next/swc-win32-x64-msvc": "16.2.10", + "@next/swc-darwin-arm64": "16.2.12", + "@next/swc-darwin-x64": "16.2.12", + "@next/swc-linux-arm64-gnu": "16.2.12", + "@next/swc-linux-arm64-musl": "16.2.12", + "@next/swc-linux-x64-gnu": "16.2.12", + "@next/swc-linux-x64-musl": "16.2.12", + "@next/swc-win32-arm64-msvc": "16.2.12", + "@next/swc-win32-x64-msvc": "16.2.12", "sharp": "^0.34.5" }, "peerDependencies": { diff --git a/packages/rust-auth/package.json b/packages/rust-auth/package.json index a0a26b4..afcb103 100644 --- a/packages/rust-auth/package.json +++ b/packages/rust-auth/package.json @@ -56,7 +56,7 @@ "server-only": "^0.0.1" }, "peerDependencies": { - "next": "^16.2.10", + "next": "^16.2.11", "react": "^19.0.0" }, "peerDependenciesMeta": { @@ -77,7 +77,7 @@ "eslint": "^10.8.0", "eslint-plugin-security": "^4.0.1", "jsdom": "^30.0.1", - "next": "^16.2.10", + "next": "^16.2.11", "prettier": "^3.9.6", "react": "^19.0.0", "react-dom": "^19.0.0", From e5ae1f53f832fd37d75fbc22c193dd564d8932d4 Mon Sep 17 00:00:00 2001 From: Maximiliano <40447063+msalvatti@users.noreply.github.com> Date: Sun, 2 Aug 2026 11:00:40 -0300 Subject: [PATCH 2/4] chore(deps): move react and react-dom to 19.2.8, without narrowing the peer range MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Takes the react half of the grouped bump #114 opened, and leaves out the part that would cost consumers something. Dependabot raises the peer range alongside the dev dependency, which would have moved `peerDependencies.react` from `^19.0.0` to `^19.2.8` — every consumer on an earlier 19.x forced to upgrade for no reason. A peer range states what the library SUPPORTS, not what it was last tested against, and nothing here stops working on react 19.0. `next` is the opposite case and keeps its raised floor: there the range is what decides whether a consumer can end up on a version carrying the middleware bypass. Verified under react 19.2.8 and next 16.2.12: install, bundle, `tsc`, lint, the Vitest suite, and the `react-vite` example's production build. --- packages/rust-auth/package-lock.json | 18 +++++++++--------- packages/rust-auth/package.json | 4 ++-- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/packages/rust-auth/package-lock.json b/packages/rust-auth/package-lock.json index 777dad7..495d560 100644 --- a/packages/rust-auth/package-lock.json +++ b/packages/rust-auth/package-lock.json @@ -23,8 +23,8 @@ "jsdom": "^30.0.1", "next": "^16.2.11", "prettier": "^3.9.6", - "react": "^19.0.0", - "react-dom": "^19.0.0", + "react": "^19.2.8", + "react-dom": "^19.2.8", "tsup": "^8.3.5", "typedoc": "^0.28.20", "typescript": "^5.7.2", @@ -4755,9 +4755,9 @@ } }, "node_modules/react": { - "version": "19.2.7", - "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz", - "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==", + "version": "19.2.8", + "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz", + "integrity": "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==", "dev": true, "license": "MIT", "engines": { @@ -4765,16 +4765,16 @@ } }, "node_modules/react-dom": { - "version": "19.2.7", - "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz", - "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==", + "version": "19.2.8", + "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.8.tgz", + "integrity": "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==", "dev": true, "license": "MIT", "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { - "react": "^19.2.7" + "react": "^19.2.8" } }, "node_modules/react-is": { diff --git a/packages/rust-auth/package.json b/packages/rust-auth/package.json index afcb103..5bf5134 100644 --- a/packages/rust-auth/package.json +++ b/packages/rust-auth/package.json @@ -79,8 +79,8 @@ "jsdom": "^30.0.1", "next": "^16.2.11", "prettier": "^3.9.6", - "react": "^19.0.0", - "react-dom": "^19.0.0", + "react": "^19.2.8", + "react-dom": "^19.2.8", "tsup": "^8.3.5", "typedoc": "^0.28.20", "typescript": "^5.7.2", From 1c9c3da40a783eb629490f68b6017905ea53823c Mon Sep 17 00:00:00 2001 From: Maximiliano <40447063+msalvatti@users.noreply.github.com> Date: Sun, 2 Aug 2026 11:08:47 -0300 Subject: [PATCH 3/4] fix(examples): resolve a single Next in the examples that consume the package by path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Next 16.2.11 gave `NextURL` a `[Internal]` property keyed by a unique symbol. TypeScript treats a unique symbol as distinct per declaration file, so two INSTALLS of Next — even at the identical version — stopped being assignable to one another: Property '[Internal]' is missing in type examples/nextjs/node_modules/next/.../NextURL but required in type packages/rust-auth/node_modules/next/.../NextURL The examples consume the package as `file:../../packages/rust-auth`, so the package's own dev dependency on Next sits beside the example's, and the built `.d.ts` resolves `NextRequest` from a different copy than the route handler does. `next build` then rejects a handler this package exported. A consumer never sees this: Next is a peer dependency, so a registry install leaves exactly one copy and both sides resolve to it. The duplicate is an artifact of the local-path harness, and mapping `next` to the example's own copy is what makes the example's tree resemble the tree a consumer actually gets — which is the only tree the example is evidence about. Found because the peer floor moved to 16.2.11; the same trap is waiting for any future Next bump, and it is now closed in both examples that consume the package this way. An earlier local run of this build passed and should not have: `.next` had a cached type-check and the failure only appears after `rm -rf .next`. Verified here from a clean state. --- examples/nextjs/tsconfig.json | 11 ++++++++++- examples/smoke-npm/tsconfig.json | 22 +++++++++++++++++++--- 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/examples/nextjs/tsconfig.json b/examples/nextjs/tsconfig.json index 17b6df0..10e9bbb 100644 --- a/examples/nextjs/tsconfig.json +++ b/examples/nextjs/tsconfig.json @@ -26,7 +26,16 @@ ], "types": [ "node" - ] + ], + "baseUrl": ".", + "paths": { + "next": [ + "./node_modules/next" + ], + "next/*": [ + "./node_modules/next/*" + ] + } }, "include": [ "next-env.d.ts", diff --git a/examples/smoke-npm/tsconfig.json b/examples/smoke-npm/tsconfig.json index 4d165e6..55828db 100644 --- a/examples/smoke-npm/tsconfig.json +++ b/examples/smoke-npm/tsconfig.json @@ -3,14 +3,30 @@ "target": "ES2022", "module": "ESNext", "moduleResolution": "Bundler", - "lib": ["ES2022", "DOM"], + "lib": [ + "ES2022", + "DOM" + ], "strict": true, "noUncheckedIndexedAccess": true, "esModuleInterop": true, "skipLibCheck": true, "forceConsistentCasingInFileNames": true, "noEmit": true, - "types": ["node"] + "types": [ + "node" + ], + "baseUrl": ".", + "paths": { + "next": [ + "./node_modules/next" + ], + "next/*": [ + "./node_modules/next/*" + ] + } }, - "include": ["smoke.ts"] + "include": [ + "smoke.ts" + ] } From e4febbbe287fe642413c88392151ab52218bb91b Mon Sep 17 00:00:00 2001 From: Maximiliano <40447063+msalvatti@users.noreply.github.com> Date: Sun, 2 Aug 2026 11:13:22 -0300 Subject: [PATCH 4/4] fix(deps): stop advertising a Node the declared peers cannot run on MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `engines.node` said `>=18.0.0` while `peerDependencies.next` requires Node 20.9.0 or newer. The package therefore promised a floor at which its own declared peer set cannot be installed — a contributor or a consumer reading `engines` would be told Node 18 works, and find out otherwise from a resolver error. Node 18 has been end-of-life since April 2025; CI has been on 24 throughout. `examples/react-vite/package-lock.json` also still embedded the pre-bump peer range for the linked package (`next: ^16.2.10`), because it was installed with `npm ci` — which reads the lockfile rather than rewriting it — after the peer range moved. The other two example lockfiles had been regenerated and were already current. Verified from a clean state after both: install, bundle, `tsc`, the Vitest suite, and the `react-vite` and `nextjs` production builds. --- examples/react-vite/package-lock.json | 8 ++++---- packages/rust-auth/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/examples/react-vite/package-lock.json b/examples/react-vite/package-lock.json index f354917..7f471cb 100644 --- a/examples/react-vite/package-lock.json +++ b/examples/react-vite/package-lock.json @@ -37,10 +37,10 @@ "eslint": "^10.8.0", "eslint-plugin-security": "^4.0.1", "jsdom": "^30.0.1", - "next": "^16.2.10", + "next": "^16.2.11", "prettier": "^3.9.6", - "react": "^19.0.0", - "react-dom": "^19.0.0", + "react": "^19.2.8", + "react-dom": "^19.2.8", "tsup": "^8.3.5", "typedoc": "^0.28.20", "typescript": "^5.7.2", @@ -51,7 +51,7 @@ "node": ">=18.0.0" }, "peerDependencies": { - "next": "^16.2.10", + "next": "^16.2.11", "react": "^19.0.0" }, "peerDependenciesMeta": { diff --git a/packages/rust-auth/package.json b/packages/rust-auth/package.json index 5bf5134..d2d1a28 100644 --- a/packages/rust-auth/package.json +++ b/packages/rust-auth/package.json @@ -88,7 +88,7 @@ "vitest": "^4.1.10" }, "engines": { - "node": ">=18.0.0" + "node": ">=20.9.0" }, "publishConfig": { "access": "public",