[ralyodio]

Fleet dependency upgrade (2026-10-26). Driver: Next.js unauthenticated RCE (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr; 15.5.x affected).

• next 15.5.27 -> 16.4.3 (major), react/react-dom 19.3.1
• Majors taken: next 16, typescript 5 -> 7, @types/node 22 -> 26, @libsql/client 0.15 -> 0.18
• @profullstack/profile 0.1.3 -> 0.1.6 (exact), libsql-pg 0.1.4, footer stays latest (0.2.6 in lock)
• Code: next lint was removed in Next 16, so lint now runs tsc --noEmit; socket data chunks typed as Buffer for @types/node 26
• Held: none
• Audit (bun audit) crit/high: 1 / 9 -> 0 / 0

Gate (local): tsc clean, 261/261 tests, next build OK. Dockerfile already on oven/bun:1.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​15.5.27 ⏵ 16.4.3	-3	+75
	@​types/​react-dom@​19.2.3 ⏵ 19.3.0	+1		+1
	@​profullstack/​profile@​0.1.3 ⏵ 0.1.6	+1		+1
	@​profullstack/​libsql-pg@​0.1.3 ⏵ 0.1.4	+1		+1
	@​profullstack/​footer@​0.2.4 ⏵ 0.2.6	+4		+1	+1
	@​types/​react@​19.2.17 ⏵ 19.3.0	+1		+1
	@​types/​node@​22.20.1 ⏵ 26.6.5	+1		+1
	react@​19.2.7 ⏵ 19.3.1	+1		+1
	@​libsql/​client@​0.18.0
	typescript@​5.9.3 ⏵ 7.0.2			-1		+10
	react-dom@​19.2.7 ⏵ 19.3.1			+1

View full report

[github-actions]

ThreatCrush Security Scan

22 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 14 | LOW: 6

Severity	Rule	Location
HIGH	sh-remote-script-execution	public/install.sh:302
HIGH	sh-remote-script-execution	public/install.sh:305
MEDIUM	js-open-redirect	app/dashboard/[[...tab]]/page.tsx:67
MEDIUM	js-open-redirect	app/signup/page.tsx:46
MEDIUM	js-unescaped-html-sink	components/PitFooter.tsx:30
MEDIUM	js-open-redirect	components/PitSearch.tsx:118
MEDIUM	js-unescaped-html-sink	components/Tenant.tsx:29
MEDIUM	js-unescaped-html-sink	components/Tenant.tsx:30
MEDIUM	js-unescaped-html-sink	components/Tenant.tsx:78
MEDIUM	js-unescaped-html-sink	components/Tenant.tsx:150
MEDIUM	sql-template-interpolation	lib/db.ts:1133
MEDIUM	sql-template-interpolation	lib/db.ts:1163
MEDIUM	redos-nested-quantifier	lib/markdown.ts:109
MEDIUM	sh-remote-script-execution	public/install.sh:123
MEDIUM	sh-remote-script-execution	public/install.sh:127
MEDIUM	sh-remote-script-execution	public/install.sh:146
LOW	secret-generic-credential	tests/domain-webhook-active.test.mjs:18
LOW	secret-generic-credential	tests/domain-webhook-active.test.mjs:25
LOW	secret-generic-credential	tests/domain-webhook-active.test.mjs:30
LOW	secret-generic-credential	tests/project-webhook-management.test.mjs:53
LOW	secret-generic-credential	tests/signup-profile.test.mjs:28
LOW	secret-generic-credential	tests/signup-profile.test.mjs:39

Snippets are redacted; ThreatCrush never prints matched credential material.