v1.38.12 — the scanner findings are cleared - #940
Merged
Conversation
Trivy flags twelve distinct advisories on the lockfile and the image, none in this code: next 16.2.11 (two critical, fixed in 16.3.3), sharp 0.35.3 pulled by next (high), nodemailer 9.0.3 (one high, three medium), js-yaml 4.3.1 (high), hono 4.13.3 under the MCP SDK's node server (three medium), and the vitest mocker and baseline-browser-mapping (medium). Dependabot lists none of them, which is why they sat. next moves to 16.3.4 and nodemailer to 9.1.1 as direct pins; vitest to 4.1.11. js-yaml, hono, baseline-browser-mapping and sharp are transitive and move through pnpm overrides bounded to the vulnerable ranges, so the copies the scanner names change and nothing else does. Typecheck, lint, the unit suite and the production build pass locally; the release gate runs the integration and end-to-end suites on the minor Next bump.
… build next 16.3 type-checks the whole tsconfig program during the build. That reaches the unit tests under src/**/__tests__, their fixtures under tests/, the Playwright config and the e2e tree, none of which is in the image build context — .dockerignore leaves tests/ and e2e/ out on purpose — so the image build stopped at "Cannot find module '../../tests/fixtures/...'" on both architectures. The build now reads tsconfig.build.json, which extends the main tsconfig and excludes the test tree and the test-runner configs. `pnpm typecheck` keeps using tsconfig.json and still covers the full program; the change narrows only what `next build` compiles, which was already the case on 16.2 by omission. Verified by building with tests/ and e2e/ moved away.
Version anchors, the OpenAPI document and the changelog entry for the dependency release.
MBombeck
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trivy reports seventeen findings on
pnpm-lock.yamland the image, twelve distinct advisories, none in this code and none listed by Dependabot:Direct pins: next 16.3.4, nodemailer 9.1.1, vitest ^4.1.11. Transitive: js-yaml, hono, baseline-browser-mapping and sharp move through pnpm overrides bounded to the vulnerable ranges.
pnpm auditis clean at moderate. Typecheck, lint (the three baseline warnings), the full unit suite (22 864 tests) and the production build pass locally; this PR's integration and e2e runs are the gate for the minor Next bump.