Repository navigation
security: upgrade Next.js to 16.4.3 - #252
khaliqgant wants to merge 2 commits into
Conversation
Install the security-fixed Next.js patch release and keep future agent upgrade reminders on the security policy.
Walkthrough
Merge Risk:
|
Composal Verify · PR #252
Cleanup: Blocked. Preview: https://b4a23c20-agentrelay-web.agent-workforce.workers.dev/ Findings
8 more findings in the run results. ScenariosRun a scenario againSelected for this commit
126 more scenarios in Composal. Why these 146 scenarios were selected
Recent verification history
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f345a48153
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Preview deployed!
This is a Cloudflare Workers preview version of this PR's build. |
Summary
16.4.0to the security-fixed16.4.3patch release selected bynext upgrade --agent=securityexperimental.agentUpgradetosecurityso future builds retain security upgrade remindersVerification
npm ci— passed from the workspace rootnpx --workspace web next --version—Next.js v16.4.3npm run typecheck— passednpm run lint— passed with two pre-existing warningsnpm test— 50 web files / 568 tests and 11 router files / 118 tests passednpm run build— passed; 244 static pages generatednpm audit --json— no finding fornext; 20 unrelated existing dependency findings remainDuplicate-work check
Checked local and remote branches, commit history, upgrade markers, and all open pull requests before and after the change. No equivalent Next.js
16.4.3security upgrade was in progress.Need help on this PR? Tag
@codesmith-botwith what you need.Summary by cubic
Upgrades Next.js in the
webworkspace from 16.4.0 to the security-fixed 16.4.3 patch release and relaxes the OpenNext version assertion so the upgrade builds in Cloudflare.nextto16.4.3inweb/package.jsonand updates the OpenNext compatibility check inweb/scripts/prepare-opennext.mjs.experimental.agentUpgradetosecurityinweb/next.config.mjsso future builds keep security upgrade reminders.sharp0.35.5 and its wasm32 packages, and the previous 0.35.4sharpbecomes dev-only.Typecheck, lint, tests, and a production build all pass; no
nextfinding innpm audit.Written for commit 036bb5b. Summary will update on new commits.
Agent Relay sessions
codexsession01a18883· opened viagh pr create· last active 2026-10-30