[brunomenezes]

Summary

Next.js 16.3.5 carries three critical remote code execution advisories, fixed in 16.4.1+. The rest is patch/minor drift, framer-motion 14, Node.js 24.22.1 in CI and GitHub Actions pinned to commit SHAs.

pnpm audit: 163 → 131 advisories (33 closed, 5 critical). Every remaining critical comes through the dev-only @cartesi/* contract packages used for ABI codegen, which never ship.

No user-facing changes.

Changes:

Security — advisories closed in the production runtime:

Package	Before → After	Closes
next	16.3.5 → 16.4.2	Critical RCE: Image Optimization with SVG (GHSA-2464-fhr4-w9xw), use cache typed arrays (GHSA-673q-mjm6-r5xr), next/og ImageResponse (GHSA-vcvr-r3jv-pc5j). High: Image Optimization SSRF (CVE-2026-94483), Server Actions DoS (CVE-2026-94482). Moderate: SSG/ISR cache poisoning (CVE-2026-94484, CVE-2026-94543), use cache leaks (CVE-2026-94544, CVE-2026-103004), metadata image route disclosure (CVE-2026-94485)
sharp (via next)	0.35.4 → 0.35.5	High: librsvg (CVE-2026-114111)

None is exploitable with our current feature set (no next/image, next/og, use cache, Server Actions, ISR or catch-all routes, and image optimization runs on Vercel, not in our server), but the bump clears them from scanners.

Dependencies (patch/minor unless noted)

Package	Before	After
@next/third-parties	16.4.1	16.4.2
react, react-dom, react-is	19.3.0	19.3.1
viem	2.57.2	2.57.7
@apollo/client	4.3.0	4.3.5
@tanstack/react-query	5.104.0	5.104.5
react-hook-form	7.88.0	7.90.0
jotai	3.0.0	3.0.1
drizzle-orm / drizzle-kit	0.45.2 / 0.31.10	0.45.4 / 0.31.11
framer-motion (major)	13.3.0	14.4.0
storybook, @storybook/*, eslint-plugin-storybook	10.6.0	10.6.3
@chromatic-com/storybook	5.3.1	5.6.0
chromatic	18.8.1	18.13.0
vite	8.3.0	8.3.4
eslint	10.10.0	10.13.0
@typescript-eslint/*	8.70.0	8.72.0
eslint-plugin-prettier	5.5.6	5.5.7
prettier	3.9.6	3.9.10
@babel/core	8.0.5	8.0.7
jest, babel-jest, jest-environment-jsdom	30.5.1	30.5.2
jest-mock-extended	4.0.1	4.0.2
@testing-library/user-event	14.6.7	14.6.8
@types/node	24.13.4	24.19.2
@types/lodash	4.17.25	4.17.26

Indirect dev-tooling packages (shell-quote, undici, js-yaml, source-map-js, @humanfs/node, brace-expansion) are refreshed within their existing ranges.

Toolchain and CI

Item	Before	After
Node.js (CI)	24.21.0	24.22.1
pnpm	11.27.1	11.28.6
actions/checkout	@v7	@3d3c42e (v7.0.1)
actions/setup-node	@v7	@949feb2 (v7.1.0)
pnpm/action-setup	@v6.1.0	@ea17c68 (v6.1.0)
coverallsapp/github-action	@v2.3.8	@8d6379e (v2.3.8)
chromaui/action	@v18.9.4	@e50abd5 (v18.13.0)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
staking	Ready	Preview	Oct 27, 2026 6:15pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.3.5 ⏵ 16.4.2		+75	+1
	jest-environment-jsdom@​30.5.1 ⏵ 30.5.2	+1			-1
	jest@​30.5.1 ⏵ 30.5.2	+1			-1
	@​typescript-eslint/​parser@​8.70.0 ⏵ 8.72.0
	@​storybook/​react@​10.6.0 ⏵ 10.6.3
	@​babel/​core@​8.0.5 ⏵ 8.0.7	+1			-1
	@​storybook/​nextjs-vite@​10.6.0 ⏵ 10.6.3	+1		+1	-1
	@​types/​lodash@​4.17.25 ⏵ 4.17.26
	@​typescript-eslint/​eslint-plugin@​8.70.0 ⏵ 8.72.0
	@​types/​node@​24.19.2
	@​next/​third-parties@​16.4.1 ⏵ 16.4.2
	babel-jest@​30.5.1 ⏵ 30.5.2	+1			-1
	vite@​8.3.0 ⏵ 8.3.4	+1	+22	+1
	react@​19.3.0 ⏵ 19.3.1
	jest-mock-extended@​4.0.1 ⏵ 4.0.2	+1			+7
	chromatic@​18.8.1 ⏵ 18.13.0	+1
	storybook@​10.6.0 ⏵ 10.6.3	+1	+75	+1
	drizzle-orm@​0.45.2 ⏵ 0.45.4			+1
	eslint-plugin-prettier@​5.5.6 ⏵ 5.5.7	+1		+1
	@​tanstack/​react-query@​5.104.0 ⏵ 5.104.5			+1
	@​chromatic-com/​storybook@​5.3.1 ⏵ 5.6.0			+1
	react-dom@​19.3.0 ⏵ 19.3.1			+1
	@​testing-library/​user-event@​14.6.7 ⏵ 14.6.8	+1		+1
	react-hook-form@​7.88.0 ⏵ 7.90.0			+1
	eslint@​10.10.0 ⏵ 10.13.0	+1			-1
	jotai@​3.0.0 ⏵ 3.0.1	+1			+2
	drizzle-kit@​0.31.10 ⏵ 0.31.11	+1		+1
	prettier@​3.9.6 ⏵ 3.9.10			+1
	viem@​2.57.2 ⏵ 2.57.7			+1	+1
	framer-motion@​13.3.0 ⏵ 14.4.0			+1
	react-is@​19.3.0 ⏵ 19.3.1
	@​apollo/​client@​4.3.0 ⏵ 4.3.5			+1
See 2 more rows in the dashboard

View full report

[github-actions]

Coverage Report for CI Build 40557976891

Coverage remained the same at 68.641%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	3727
Covered Lines:	2678
Line Coverage:	71.85%
Relevant Branches:	1962
Covered Branches:	1227
Branch Coverage:	62.54%
Branches in Coverage %:	Yes
Coverage Strength:	30.0 hits per line

---

💛 - Coveralls