Skip to content

fix(security): bump next to 16.4.3 and pin node 22.23.4 #135 - #136

Merged
yashiels merged 1 commit into
mainfrom
agent/cve-next-node
Oct 23, 2026
Merged

yashiels merged 1 commit into
mainfrom
agent/cve-next-node

Conversation

@yashiels

Copy link
Copy Markdown
Owner

Closes #135

  • next 16.3.4 -> 16.4.3, sharp 0.35.4 -> 0.35.5 (lockfile)
  • Dockerfile NODE_VERSION pinned to node:22.23.4-alpine by index digest
  • .nvmrc and setup-node composite pinned to 22.23.4
  • deploy-prod docker build uses --pull
  • poweredByHeader: false

Local: frozen install, lint, format:check, 366 tests, build all pass. Dry run on launchpad: real image built with fake TMDB key, node v22.23.4, next 16.4.3, sharp 0.35.5, / and /offline 200, /_next/image TMDB jpeg 200, no x-powered-by.

@yashiels
yashiels merged commit d748a9c into main Oct 23, 2026
4 checks passed
@yashiels
yashiels deleted the agent/cve-next-node branch October 23, 2026 22:27

@sentinel-skyner sentinel-skyner Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛡️ Sentinel review

Missing required deploy docs update for the deploy workflow change.

1 inline comment below.

Automated review via deepseek:deepseek-v4-pro + deepseek:deepseek-v4-pro verifier. Findings only — not an approval. Push new commits to re-review.

cd ~/apps/skystream/src/skystream
git fetch -q origin main && git reset -q --hard origin/main
DOCKER_BUILDKIT=1 docker build --build-arg NEXT_PUBLIC_TMDB_API_KEY="$TMDB_KEY" -t skystream:local .
DOCKER_BUILDKIT=1 docker build --pull --build-arg NEXT_PUBLIC_TMDB_API_KEY="$TMDB_KEY" -t skystream:local .

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛡️ Low This PR modifies .github/workflows/deploy-prod.yml by adding --pull to the remote docker build, but the diff does not update deploy/README.md or the AGENTS.md deploy section as required by REVIEW.md for deploy workflow changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(security): bump next to 16.4.3 and pin node 22.23.4 for CVE sweep

1 participant