fix(website): patch Next.js and Mermaid advisories#789
Merged
Conversation
Bump pinned/locked website dependencies to patched releases and refresh the lockfile, clearing the direct-dependency Next.js and Mermaid security advisories reported by `bun audit` (43 -> 26; the remaining 26 are transitive and out of scope per the issue). - next 16.2.4 -> 16.2.9 (exact pin preserved) - mermaid ^11.14.0 -> ^11.15.0 (caret floor raised) - refresh website/bun.lock; mermaid 11.15.0 restructures its parser subtree (drops langium/chevrotain-12/vscode-languageserver-*, adds es-toolkit), so the lockfile net shrinks MermaidBlock securityLevel:"strict" deny-by-default config is unchanged; the production boundary (Vercel deploy, App Router routes, API functions, docs-sourced diagrams) stays explicit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughTwo dependency versions in ChangesDependency Version Bumps
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
Contributor
Suite TimingTest Runner (interpreted: 10,799 passed; bytecode: 10,799 passed)
MemoryGC rows aggregate the main thread plus all worker thread-local GCs. Test runner worker shutdown frees thread-local heaps in bulk; that shutdown reclamation is not counted as GC collections or collected objects.
Benchmarks (interpreted: 430; bytecode: 430)
MemoryGC rows aggregate the main thread plus all worker thread-local GCs. Benchmark runner performs explicit between-file collections, so collection and collected-object counts can be much higher than the test runner.
Measured on ubuntu-latest x64. |
Contributor
Benchmark Results430 benchmarks Interpreted: 🟢 29 improved · 🔴 26 regressed · 375 unchanged · avg +1.0% arraybuffer.js — Interp: 14 unch. · avg +2.0% · Bytecode: 🟢 6, 8 unch. · avg +6.4%
arrays.js — Interp: 🟢 1, 🔴 2, 16 unch. · avg +0.7% · Bytecode: 🟢 15, 4 unch. · avg +11.5%
async-await.js — Interp: 🔴 1, 5 unch. · avg -8.3% · Bytecode: 🟢 3, 3 unch. · avg +14.5%
async-generators.js — Interp: 2 unch. · avg -0.3% · Bytecode: 🟢 1, 1 unch. · avg +22.7%
atomics.js — Interp: 🔴 1, 5 unch. · avg -4.9% · Bytecode: 🟢 5, 1 unch. · avg +12.4%
base64.js — Interp: 10 unch. · avg -1.0% · Bytecode: 🟢 9, 1 unch. · avg +13.8%
classes.js — Interp: 🟢 1, 🔴 2, 28 unch. · avg +0.4% · Bytecode: 🟢 13, 18 unch. · avg +7.5%
closures.js — Interp: 11 unch. · avg +3.4% · Bytecode: 🟢 6, 5 unch. · avg +9.8%
collections.js — Interp: 🔴 1, 11 unch. · avg +2.1% · Bytecode: 🟢 9, 3 unch. · avg +14.6%
csv.js — Interp: 🟢 1, 🔴 1, 11 unch. · avg -1.7% · Bytecode: 🟢 8, 5 unch. · avg +12.5%
destructuring.js — Interp: 🟢 2, 🔴 1, 19 unch. · avg -0.2% · Bytecode: 🟢 7, 15 unch. · avg +7.3%
fibonacci.js — Interp: 🟢 2, 6 unch. · avg +0.2% · Bytecode: 🟢 2, 6 unch. · avg +15.8%
float16array.js — Interp: 🟢 8, 24 unch. · avg +2.0% · Bytecode: 🟢 21, 11 unch. · avg +12.4%
for-of.js — Interp: 🟢 1, 6 unch. · avg +0.5% · Bytecode: 🟢 2, 5 unch. · avg +10.6%
generators.js — Interp: 🔴 2, 2 unch. · avg -3.8% · Bytecode: 🟢 3, 1 unch. · avg +15.8%
intl.js — Interp: 🔴 1, 5 unch. · avg -1.8% · Bytecode: 🟢 4, 2 unch. · avg +14.3%
iterators.js — Interp: 🔴 4, 38 unch. · avg -1.7% · Bytecode: 🟢 15, 27 unch. · avg +6.6%
json.js — Interp: 20 unch. · avg +1.6% · Bytecode: 🟢 13, 7 unch. · avg +11.9%
jsx.jsx — Interp: 🔴 3, 18 unch. · avg -1.8% · Bytecode: 🟢 7, 14 unch. · avg +4.8%
modules.js — Interp: 9 unch. · avg -0.3% · Bytecode: 9 unch. · avg -0.2%
numbers.js — Interp: 11 unch. · avg -0.1% · Bytecode: 🟢 4, 7 unch. · avg +9.8%
objects.js — Interp: 7 unch. · avg -1.8% · Bytecode: 🟢 2, 5 unch. · avg +7.6%
promises.js — Interp: 12 unch. · avg -1.8% · Bytecode: 🟢 5, 7 unch. · avg +8.1%
property-access.js — Interp: 5 unch. · avg +2.0% · Bytecode: 🟢 2, 3 unch. · avg +12.8%
regexp.js — Interp: 11 unch. · avg -0.3% · Bytecode: 🟢 2, 9 unch. · avg +8.0%
strings.js — Interp: 🔴 2, 17 unch. · avg +1.9% · Bytecode: 🟢 9, 10 unch. · avg +10.0%
temporal.js — Interp: 6 unch. · avg +1.1% · Bytecode: 🟢 2, 4 unch. · avg +14.9%
tsv.js — Interp: 🟢 1, 8 unch. · avg +1.4% · Bytecode: 🟢 7, 2 unch. · avg +15.4%
typed-arrays.js — Interp: 🟢 6, 16 unch. · avg +12.8% · Bytecode: 🟢 18, 🔴 2, 2 unch. · avg +13.4%
uint8array-encoding.js — Interp: 🟢 1, 🔴 3, 14 unch. · avg +4.2% · Bytecode: 🟢 11, 7 unch. · avg +13.8%
weak-collections.js — Interp: 🟢 5, 🔴 2, 8 unch. · avg +5.5% · Bytecode: 🟢 7, 🔴 3, 5 unch. · avg -0.0%
Deterministic profile diffDeterministic profile diff: no significant changes. Measured on ubuntu-latest x64. Benchmark ranges compare cached main-branch min/max ops/sec with the PR run; overlapping ranges are treated as unchanged noise. Percentage deltas are secondary context. |
Contributor
test262 Conformance
Areas closest to 100%
Per-test deltas (+36 / -2)Newly failing (2):
Newly passing (36):
Steady-state failures are non-blocking; regressions vs the cached main baseline (lower total pass count, or any PASS → non-PASS transition) fail the conformance gate. Measured on ubuntu-latest x64, bytecode mode. Areas grouped by the first two test262 path components; minimum 25 attempted tests, areas already at 100% excluded. Δ vs main compares against the most recent cached |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
website/bun.lock, clearing the direct-dependency Next.js and Mermaid advisories reported bybun audit.next16.2.4→16.2.9(exact pin preserved, matching thereact/react-domexact pins)mermaid^11.14.0→^11.15.0(caret floor raised so the minimum-safe version is explicit and self-documenting)GHSA-8h8q-6873-q5fj,GHSA-26hh-7cqf-hhc6and the rest of the>=16.0.0 <16.2.5set; MermaidGHSA-ghcm-xqfw-q4vr,GHSA-xcj9-5m2h-648r,GHSA-87f9-hvmw-gh4p,GHSA-6m6c-36f7-fhxh.bun audittotal: 43 → 26, withnext (direct dependency)andmermaid (direct dependency)blocks gone.dompurify,postcss←next,protobufjs/@opentelemetry←posthog-js,undici←@vercel/blob,uuid←mermaid). Per the issue's "do not broaden" directive they are left for separate work.MermaidBlock'ssecurityLevel: "strict"deny-by-default config is unchanged —website/src/components/mermaid-block.tsxwas not modified. The production boundary stays explicit: Vercel deployment, App Router routes, the/api/execute+/api/testfunctions, and docs-sourced diagrams.@mermaid-js/parser1.1.0→1.1.1 swapslangiumfor@chevrotain/types ~11.1.1, addses-toolkit), so the lockfile net shrinks; no unrelated dependency trees were touched.Closes #784
Testing
Commands run (all green, from
website/):bun install --frozen-lockfile— lockfile ↔package.jsonconsistentbun audit— both directnext/mermaidadvisory blocks gone (43 → 26 transitive remaining)bun run lint(biome) — clean, 104 filesbun test— 157 pass / 0 failbun run build(next build) — succeeds, 39 routes incl./docs/[id]Mermaid pages,/playground,/sandboxDocumentation: none required — routine
internalpatch bump. The Mermaid security boundary is documented in the preservedmermaid-block.tsxcomments and in this PR (consistent with ADRs being reserved for engine/language decisions).DoD note: the engine gates (
./build.pas testrunner,./format.pas --check) are N/A — zero Pascal/engine files changed; the website's biome + bun toolchain is the applicable gate and is green.