8000 Update next to 16.4.5 by gominimal-pkgmgr-mgr[bot] · Pull Request #1358 · gominimal/pkgs · GitHub
[go: up one dir, main page]
Skip to content

Update next to 16.4.5 - #1358

Queued
gominimal-pkgmgr-mgr[bot] wants to merge 1 commit into
mainfrom
update-next-16.4.5
Queued

Update next to 16.4.5#1358
gominimal-pkgmgr-mgr[bot] wants to merge 1 commit into
mainfrom
update-next-16.4.5

Conversation

@gominimal-pkgmgr-mgr
@gominimal-pkgmgr-mgr gominimal-pkgmgr-mgr Bot commented Nov 6, 2026
Copy link
Copy Markdown
Contributor

Update next 16.4.1 → 16.4.5

Source: github:vercel/next.js:operator-pinned
Release: https://github.com/vercel/next.js/releases/tag/v16.4.5
Changelog: vercel/next.js@v16.4.1...v16.4.5
Released: 3 days ago (2026-11-03)

Warning

⚠ Additional pinned sources not updated — verify. This bump rewrote only the primary source. These Sources keep their pinned url + sha256; confirm each still matches the new release:

  • gs://minimal-staging-archives/undici-6.28.0.tar.gz (sha256 555a14624f66628d…)

License

  • Upstream 16.4.1 → 16.4.5: couldn't determine: multi-arch artifacts are not extracted
  • Declared license_spdx: MIT agrees with the new release (MIT)
Pkgscan: 2 below-threshold signals (all Info severity, risk score 0.2). Demoted in benign contexts (test fixtures, CI workflow setup); expand for details.
Severity File Line Capability (MBC) Pattern
INFO Amd64/next-swc.linux-x64-gnu.node 0 anti-static-analysis/embedded-blob ELF executable in source (x86-64 — host arch)
INFO Arm64/next-swc.linux-arm64-gnu.node 0 anti-static-analysis/embedded-blob ELF executable in source (aarch64 — host arch)

Vulnerability impact

Partition analysis at 16.4.5 (uses each advisory's fixed-version, vulnerable-range, affected-ranges, and fix-commit ancestry to decide):

  • 4 cleared — the new version is outside the advisory's affected range, OR the tag's lineage includes a known fix-commit. These will drop off the next scan.
  • 3 still affecting — the new version matches the advisory's range, the fix hasn't been published, OR the advisory lacks structured range data so partition defaulted to still-affecting (the conservative pick). Rows marked ⚠ unverified are the latter case.

Vulnerabilities fixed (4)

This update clears 4 vulnerabilities affecting 16.4.1:

CVE / GHSA Severity Fixed in
GHSA-7qx7-33qx-rqx2 MEDIUM via range: >= 16.0.0, <= 16.4.2; >= 15.0.0, <= 15.5.28
GHSA-f3mh-rxg3-f5g2 MEDIUM via range: >= 16.0.0, <= 16.4.2; >= 15.0.0, <= 15.5.28
GHSA-rhh4-g77r-r9qj MEDIUM via range: >= 16.0.0, <= 16.4.2
GHSA-vc7v-qv4w-wrv8 MEDIUM 16.4.2
Advisory summaries
  • GHSA-7qx7-33qx-rqx2 — SVG rejection bypass in Next.js image optimization (Published 2026-11-03)
  • GHSA-f3mh-rxg3-f5g2 — HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes (Published 2026-11-03)
  • GHSA-rhh4-g77r-r9qj — Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments (Published 2026-11-03)
  • GHSA-vc7v-qv4w-wrv8 — Cache leak across root param values in nested 'use cache' functions via delayed inner stream metadata (Published 2026-11-03)

Warning

3 known vulnerabilities still affect 16.4.5 after this update.

CVE / GHSA Severity Fixed in
GHSA-mfr8-8qww-v76h MEDIUM via range: >= 16.3.0
GHSA-pc58-hwjq-p385 MEDIUM 16.0.0
GHSA-vvgp-ww4w-46vf MEDIUM via range: >= 16.4.0
Advisory summaries
  • GHSA-mfr8-8qww-v76h — Information disclosure across root params in Next.js when a 'use cache' function is called through unstable_cache() (Published 2026-11-03)
  • GHSA-pc58-hwjq-p385 — Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses (Published 2026-11-03)
  • GHSA-vvgp-ww4w-46vf — Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params (Published 2026-11-03)

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
Component Old New
~ next 16.4.1 16.4.5
~ next-upstream 16.4.1 16.4.5

Changes

Old New
Version 16.4.1 16.4.5
SHA256 aa5bc85844ca8100... 01e56b1d3607d068...
Size 35.2 MB
Source https://github.com/vercel/next.js/archive/refs/tags/v16.4.1.tar.gz https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.4.5.tgz
  • License: MIT (source: GitHub + tarball)

Upstream digests: Amd64 ✓ matches the npm registry's dist.integrity for @next/swc-linux-x64-gnu@16.4.5; Arm64 ✓ matches the npm registry's dist.integrity for @next/swc-linux-arm64-gnu@16.4.5; source has no upstream digest to check.

🔒 TLS: [Amd64] registry.npmjs.org — WE1 → GTS Root R4 (root 349dfa4058c5e263…) · TLSv1_2
🔒 TLS: [Arm64] registry.npmjs.org — WE1 → GTS Root R4 (root 349dfa4058c5e263…) · TLSv1_2
🔒 TLS: github.com — Sectigo Public Server Authentication CA DV E36 → Sectigo Public Server Authentication Root E46 (root c90f26f0fb1b4018…) · TLSv1_3 · TLS13_AES_128_GCM_SHA256 · X25519 ⇒ codeload.github.com — Sectigo Public Server Authentication CA DV E36 → Sectigo Public Server Authentication Root E46 (root c90f26f0fb1b4018…) · TLSv1_3 · TLS13_AES_128_GCM_SHA256 · X25519

Per-arch sources

Arch New SHA256 Size URL
Amd64 01e56b1d3607d068... (was 78a7aa9334cfcb3b...) 35.2 MB https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.4.5.tgz
Arm64 072340019c1fcaa0... (was ea6ca74538e44799...) 32.8 MB https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.4.5.tgz

Created by pkgmgr

@gominimal-pkgmgr-mgr
gominimal-pkgmgr-mgr Bot requested a review from a team as a code owner November 6, 2026 19:26
@coderabbitai
coderabbitai Bot commented Nov 6, 2026
Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

@bryan-minimal
bryan-minimal added this pull request to the merge queue Nov 7, 2026
Any commits made after this event will not be merged.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bryan-minimal bryan-minimal bryan-minimal approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bryan-minimal
0