chore: pnpm security audit dependency upgrades (2026-07-24)

[cursor]

Summary

Scheduled pnpm audit run on latest main. Found 16 vulnerabilities (11 high, 5 moderate). pnpm audit fix did not resolve any issues.

Upgraded direct dependencies to fix 10 vulnerabilities. 6 remain and require pnpm.overrides (not applied per policy).

Verified with pnpm run build:next (passes). Lockfile is up to date (pnpm install --frozen-lockfile).

Vulnerability fixes

Package	Severity	Advisory	Fix applied	How it was fixed
next	High	GHSA-6gpp-xcg3-4w24 — Middleware/Proxy bypass (Turbopack, single locale)	✅ Fixed	Upgraded next, @next/mdx, eslint-config-next from 16.2.9 → 16.2.11
next	High	GHSA-m99w-x7hq-7vfj — DoS in App Router Server Actions	✅ Fixed	Same Next.js upgrade to 16.2.11
next	High	GHSA-89xv-2m56-2m9x — SSRF in Server Actions on custom servers	✅ Fixed	Same Next.js upgrade to 16.2.11
next	High	GHSA-p9j2-gv94-2wf4 — SSRF in rewrites via attacker-controlled hostname	✅ Fixed	Same Next.js upgrade to 16.2.11
next	Moderate	GHSA-68g3-v927-f742 — Cache confusion of response bodies	✅ Fixed	Same Next.js upgrade to 16.2.11
next	Moderate	GHSA-4633-3j49-mh5q — Cache confusion with invalid UTF-8	✅ Fixed	Same Next.js upgrade to 16.2.11
next	Moderate	GHSA-4c39-4ccg-62r3 — Unbounded Server Action payload in Edge	✅ Fixed	Same Next.js upgrade to 16.2.11
next	Moderate	GHSA-q8wf-6r8g-63ch — DoS in Image Optimization API (SVGs)	✅ Fixed	Same Next.js upgrade to 16.2.11
next	Moderate	GHSA-955p-x3mx-jcvp — Unauthenticated disclosure of Server Function endpoints	✅ Fixed	Same Next.js upgrade to 16.2.11
sharp (direct)	High	GHSA-f88m-g3jw-g9cj — libvips CVEs	✅ Fixed	Upgraded direct sharp dependency from ^0.33.4 → ^0.35.3
brace-expansion	High	GHSA-3jxr-9vmj-r5cp — DoS via brace expansion	❌ Not fixed	Transitive via eslint-plugin-mdx → eslint-mdx → unified-engine → glob → minimatch → brace-expansion@2.1.0
brace-expansion	High	GHSA-3jxr-9vmj-r5cp — DoS via brace expansion	❌ Not fixed	Transitive via eslint-config-next → eslint-plugin-jsx-a11y → minimatch → brace-expansion@1.1.13
brace-expansion	High	GHSA-3jxr-9vmj-r5cp — DoS via brace expansion	❌ Not fixed	Transitive via eslint → minimatch → brace-expansion@5.0.6 (needs ≥5.0.7)
linkify-it	High	GHSA-v245-v573-v5vm — Quadratic-complexity DoS	❌ Not fixed	Transitive via @tiptap/extension-focus → @tiptap/pm → prosemirror-markdown → markdown-it → linkify-it@5.0.1
svgo	High	GHSA-2p49-hgcm-8545 — removeScripts plugin bypass	❌ Not fixed	Transitive via @svgr/webpack → @svgr/plugin-svgo → svgo@3.3.3 (already at latest @svgr/webpack@8.1.0)
sharp (via next)	High	GHSA-f88m-g3jw-g9cj — libvips CVEs	❌ Not fixed	Transitive via next@16.2.11 → sharp@0.34.5 (direct dep upgraded to 0.35.3 but Next bundles its own copy)

Unfixed vulnerabilities (require overrides or upstream updates)

brace-expansion (3 instances)

Why not fixed: No parent dependency publishes a version that pulls patched brace-expansion across all three version lines (1.x, 2.x, 5.x). Upgrading eslint to 10.7.0 and eslint-plugin-mdx to 3.8.1 reduced but did not eliminate all instances.

How to fix: Add pnpm.overrides:

"brace-expansion@1": "1.1.16",
"brace-expansion@2": "2.1.2",
"brace-expansion@5": "5.0.7"

Alternatively, wait for upstream releases from eslint-plugin-jsx-a11y, eslint-mdx/unified-engine, and eslint/minimatch.

linkify-it

Why not fixed: Vulnerability is deep in @tiptap/pm → prosemirror-markdown → markdown-it → linkify-it. Upgrading @tiptap/extension-focus within v2 does not change this chain.

How to fix: Add override "linkify-it": "5.0.2", or upgrade to Tiptap v3 when feasible (may require code changes).

svgo

Why not fixed: @svgr/webpack@8.1.0 (latest stable) pins @svgr/plugin-svgo which depends on svgo@3.3.3 (<3.3.4).

How to fix: Add override "svgo": "3.3.4", or wait for @svgr/webpack to release with updated svgo.

sharp (via next)

Why not fixed: Next.js 16.2.11 bundles sharp@0.34.5 as an optional dependency. Direct sharp was upgraded to 0.35.3 but does not affect Next's nested copy.

How to fix: Add override "sharp": "$sharp" to force all consumers to use the project's sharp@^0.35.3, or wait for a Next.js release that bumps its bundled sharp.

Overrides review

• postcss: $postcss — Still required. Without it, next@16.2.11 resolves postcss@8.4.31 (vulnerable). The override forces the project's postcss@^8.5.15 devDependency. Tested removal: reintroduces 2 moderate PostCSS advisories.
• No other overrides exist. Overrides for the 6 remaining vulnerabilities were not added per policy.

Verification

• pnpm install --frozen-lockfile — lockfile up to date
• pnpm run build:next — passes on Next.js 16.2.11
• pnpm dlx --config.minimumReleaseAge=0 pnpm@11.0.0 --config.manage-package-manager-versions=false audit — 6 high vulnerabilities remain (down from 16)

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tiptap-docs	Ready	Preview, Comment	Jul 24, 2026 7:05am