chore(deps): fix brace-expansion, js-yaml, and adm-zip vulnerabilities - #2493
Merged
Conversation
- Root: pin js-yaml to 4.3.1 (was 4.2.0, CVE GHSA-52cp-r559-cp3m); update brace-expansion to 1.1.18/2.1.4/5.0.9 across workspace packages - block-support: pin js-yaml >=4.3.1, adm-zip >=0.6.0 (GHSA-xcpc-8h2w-3j85); regenerate lockfile - tutorial: pin js-yaml >=4.3.1; regenerate lockfile Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
theodesp
requested review from
a team,
colinmurphy and
josephfusco
as code owners
August 12, 2026 16:42
|
Contributor
📦 Next.js Bundle Analysis for @faustwp/getting-started-exampleThis analysis was generated by the Next.js Bundle Analysis action. 🤖 This PR introduced no changes to the JavaScript bundle! 🙌 |
- Root: tighten postcss override to ^8.5.23 (was ^8.5.10); add nested next override to force postcss ^8.5.23 inside next (was exact-pinned 8.4.31); regenerate lockfile via npm audit fix - block-support: tighten postcss override to ^8.5.23 (was >=8.5.10); regenerate lockfile Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…compat next/config is removed in Next.js 16. The setConfig import was dead code (Faust uses its own config store, not Next.js runtime config), so mocking the module is the minimal fix that keeps the test working across versions. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The nested "next": {"postcss": "^8.5.23"} override caused npm to hoist
next from 15.5.19 to 16.3.0, breaking tests that depend on next/config
(removed in Next.js 16). Restoring root lockfile from canary baseline
and re-applying only js-yaml and brace-expansion fixes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
theodesp
enabled auto-merge (squash)
August 12, 2026 17:56
colinmurphy
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes high-severity vulnerabilities in
brace-expansion,js-yaml, andadm-zipacross the root workspace and supported examples (block-support,tutorial). Also fixes test compatibility with Next.js 16.custom-toolbar(deprecated) andfaustwp-getting-started(no lockfile) are not touched.Root workspace (
package.json/package-lock.json)4.3.1(was>=4.2.0, resolved to4.2.0) — fixes GHSA-52cp-r559-cp3m1.1.18(1.x),2.1.4(2.x),5.0.9(5.x) — across all workspace packages — fixes GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895examples/next/block-support>=0.6.0(was0.5.17) — fixes GHSA-xcpc-8h2w-3j85>=4.3.1(was^4.1.1)examples/next/tutorial>=4.3.1(was^4.1.1)packages/faustwp-core— Next.js 16 test compatibilityjest.config.js: addmoduleNameMapperentry fornext/config— next 16 removednext/configfrom itsexportsmap so Jest's resolver throws before anyjest.mock()factory runs; the mapper short-circuits resolution to a local stub__mocks__/next-config.js: stub providingsetConfig/defaultas no-ops (the realsetConfigwas always dead code in the test — Faust uses its own config store)tests/hooks/useLogout.test.ts: importactfromreactinstead of deprecatedreact-dom/test-utilsTest plan
npm auditin repo root shows nobrace-expansionorjs-yamlfindingsnpm auditinexamples/next/block-supportshows noadm-ziporjs-yamlfindingsnpm auditinexamples/next/tutorialshows nojs-yamlfindingsnpx jestinpackages/faustwp-corepasses on both Next.js 15 and 16🤖 Generated with Claude Code