Repository navigation
Steven/ga - #74
Merged
Merged
Steven/ga#74
Conversation
Next.js 16.4.0 is affected by three published advisories, all fixed in 16.4.3: - GHSA-2464-fhr4-w9xw (critical): unauthenticated RCE in the Image Optimization API when SVG files are used - GHSA-673q-mjm6-r5xr (critical): unauthenticated RCE in `use cache` functions returning typed arrays - GHSA-p3m5-59mp-jv5r (high): denial of service in the App Router via Server Actions This is a same-major patch bump, so no codemod or migration guide applies. The webapp pins next exactly at 16.4.3, and the lockfile only moves next, @next/env and the @next/swc-* binaries. 16.4.3 was published on 2026-10-23, less than 7 days ago. CLAUDE.md §9 allows that exception for a security fix, which this is. Also set `experimental.agentUpgrade: "security"`, which 16.4.3 supports, so coding agents only nudge about Next.js security upgrades. Verified with pnpm lint, pnpm typecheck, the node test suites (webapp, db, ingest) and a full `next build`.
Load gtag.js through @next/third-parties' GoogleAnalytics component in the root layout, so every page reports a page view. The measurement ID is public (it ships in every page), so it lives in code, not .env. It loads in dev as well as production; filter localhost out by hostname in the GA reports. The report-only CSP now allows gtag.js from www.googletagmanager.com and hits to *.google-analytics.com and *.analytics.google.com.
posthog-js pulled in DOMPurify 3.4.16, which is affected by GHSA-cg2g-xh64-v4q7 (SAFE_FOR_TEMPLATES bypass) and failed the `pnpm audit --audit-level=critical` CI step. posthog-js allows ^3.4.13, so only the lockfile changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.