[ExcelDsigN-tech]

Overview

Deploy Staging failed on main at 29bedee in the frontend image's critical-severity Trivy scan. The frontend runs next 16.3.6 and @sentry/nextjs 10.73.0, which have critical advisories:

• GHSA-2464-fhr4-w9xw: unauthenticated RCE in the Next.js Image Optimization API with SVGs (fixed in 16.4.1)
• GHSA-673q-mjm6-r5xr: unauthenticated RCE in use cache functions returning typed arrays (fixed in 16.4.1)
• GHSA-mchm-gjx6-7h55: Sentry middleware bypass via the tunnel route (fixed in 10.75.2)

Refs #880

Feature Summary

• next ^16.4.2, @sentry/nextjs ^10.76.2, @next/bundle-analyzer ^16.4.2
• Lockfile regenerated with npm install; eslint-config-next and eslint-plugin-react-hooks stay as they are (bumping them turns on new hooks lint rules, which is a separate refactor)

Technical Implementation

Dependency-only change. No code, config or env changes.

Test Coverage

• ./scripts/ci-local.sh frontend passes: lint, typecheck, build, 293 tests
• npm audit --omit=dev (what the runtime image installs): 0 critical, down from 3
• Trivy 0.70.0 on a runtime-equivalent npm ci --omit=dev tree: the next and sentry criticals are gone. The only remaining critical is concurrent-ruby in @stellar/js-xdr/Gemfile.lock, which Trivy's image mode doesn't scan (the backend image ships the same file and passes) and which is already tracked under Baseline existing dependency findings, then make npm audit, Trivy and cargo audit block PRs (follow-up to #839) #880

Checklists

General

• Ran ./scripts/ci-local.sh frontend and it passes
• Tests added or updated for the change (dependency bump only)
• No skipped tests, removed assertions or raised limits
• Docs updated if behaviour changed (no behaviour change)
• Conventional Commits title and messages
• Security-sensitive change: .github/THREAT_MODEL.md attached (dependency security patch, no change to the threat model)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ff573211-b026-4a1c-8fcc-cb815fbb5518

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}