← all branches

dependabot/npm_and_yarn/apps/platform/next-16.2.11

blockedviewing older commit
47a6951 · fullpre-PRreviewed 2026-07-24 19:51 UTC3H · 2M · 1L · 6I
The branch
Purpose
Dependabot routine dependency maintenance — bump next from 16.0.10 to 16.2.11 in apps/platform
Goal
Apply security patches and bug fixes from Next.js 16.2.11
The changes (whole branch)
What
Single line change in apps/platform/package.json bumping next version pin. No lockfile update included.
Why
Dependabot auto-generated to keep next dependency current with patch/minor releases
Areas
apps/platform+1−1
Blast
1 file, 1 line. No lockfile change, no CDK preview.
missing-lockfile incomplete-bump sibling-pr-338
➖CI (no PR)· No open PR — no CI checks available➖CodeRabbit· No .coderabbit.yaml in repo➖CDK preview· Branch slug >16 chars — skipped

Findings · 15

correctness3

critical

Missing pnpm-lock.yaml update will break all CI jobs

apps/platform/package.json:63

pnpm-lock.yaml still resolves next@16.0.10. Every CI workflow runs `pnpm install --frozen-lockfile`. Mismatch causes a hard exit before any build step runs.

high

Deployed version will not change without lockfile regeneration

apps/platform/package.json:63

Vercel reads the lockfile for reproducible installs. Security/bug fixes in 16.2.11 will not be applied until the lockfile is updated.

info

next-intl@^4.6.1 remains compatible with next@16.2.11

apps/platform/package.json:64

security3

critical

Lockfile not updated — security fixes in 16.2.11 not actually deployed

apps/platform/package.json:63

App continues running 16.0.10 with known vulnerabilities. Security patches in 16.2.11 remain inactive.

high

Multiple security patches in 16.0.10→16.2.11 range remain undeployed

apps/platform/package.json:63

Patches include: DoS via crafted Server Action requests, middleware auth bypass (Turbopack + single i18n locale), SSRF via rewrites/redirects, cache confusion, Image Optimization CPU exhaustion.

medium

Transitive dependency supply-chain gap

apps/platform/package.json:63

Without lockfile update, transitive fixes in the 16.2.11 dep tree are also not applied.

conventions5

critical

Lockfile not regenerated — --frozen-lockfile CI will fail

apps/platform/package.json:63

pnpm-lock.yaml still records next@16.0.10. Hard exit before any build step runs.

high

Three apps pin `next` independently — split Dependabot PRs will conflict on lockfile merge

apps/platform/package.json:63

apps/platform, apps/web, apps/dev-ops each pin next separately. Each PR's lockfile regeneration conflicts. Recommend: close this PR and #338, open one manual PR bumping all three apps with a single lockfile update.

medium

Sibling PR #338 (apps/web) must land in the same lockfile commit

apps/platform/package.json:63

Merging either PR individually creates a mixed-version state and a lockfile conflict for the second PR.

low

Branch name exceeds 16-char CDK preview budget

apps/platform/package.json:63

Expected for Dependabot branches. No CDK preview deployed.

info

apps/dev-ops also pins next@16.0.10 with no corresponding bump PR

apps/platform/package.json:63

A third bump is needed to keep all apps consistent.

tests2

info

No Next.js-specific tests — acceptable for minor bump

apps/platform/package.json:63

info

pnpm test is non-blocking in CI (continue-on-error: true)

apps/platform/package.json:63

improvement2

info

Add .github/dependabot.yml with groups entry for next across all workspaces

apps/platform/package.json:63

Batches platform+web+dev-ops next bumps into one PR with one lockfile update.

info

eslint-config-next pinned at 16.0.7 while next reaches 16.2.11

apps/platform/package.json:63

Add eslint-config-next to the same Dependabot group as next.

History · 2 commits

  1. 490757asafefull0H · 0M · 0L2026-07-24 20:10
  2. 47a6951blockedfull3H · 2M · 1L2026-07-24 19:51current