chore(deps): upgrade all dependencies; next 16.4.3 (RCE GHSA-2464-fhr4-w9xw) by ralyodio · Pull Request #299 · profullstack/media-streamer

ralyodio · 2026-10-26T13:42:00Z

Fleet dependency upgrade (2026-10-26). Driver: Next.js unauthenticated RCE advisories GHSA-2464-fhr4-w9xw / GHSA-673q-mjm6-r5xr.

Security

next 16.4.2 -> 16.4.3 (+ eslint-config-next)
pnpm audit --prod: critical 0 -> 0, high 15 -> 1, moderate 6 -> 0. The one left is ip (<=2.0.1, no patched release) under webtorrent > bittorrent-tracker.
New override epubjs>@xmldom/xmldom: ^0.8.15 (epubjs pins the vulnerable 0.7 line).

Majors taken

eslint 10, @vitejs/plugin-react 6 (vite 8 added as an explicit devDependency: without it the plugin's peer resolved vite 7 and vitest could not load its config). Everything else to latest in range: @profullstack/stack 0.5, x402-gateway 0.13, player 0.16, openai, puppeteer, pg 8.23, imapflow, mailparser, posthog-js.

Held

typescript 6.0.3 (7.x is the native compiler with no JS API for typescript-eslint / next build).

Gate

typecheck clean; lint 0 errors; vitest 240 files / 3108 tests pass; next build succeeds.

🤖 Generated with Claude Code

…4-w9xw) next 16.4.2 -> 16.4.3, eslint 10, @vitejs/plugin-react 6 (+ vite 8 as an explicit devDependency so the peer stops resolving vite 7), @profullstack stack 0.5 / x402-gateway 0.13 / player 0.16; epubjs xmldom 0.7 -> 0.8.15 via override. Held: typescript 6 (7 has no JS API). Co-Authored-By: Claude Opus 5.5 <[email protected]>

socket-security · 2026-10-26T13:42:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
next@16.4.2 ⏵ 16.4.3	⁺¹		⁺¹
eslint-config-next@16.4.2 ⏵ 16.4.3
node-datachannel@0.33.4 ⏵ 0.33.5			⁺¹	^-4
@noriginmedia/norigin-spatial-navigation@3.3.0 ⏵ 3.4.0	⁺³			^-1
openai@7.34.0 ⏵ 7.43.0	⁺¹		⁺¹	⁺¹
@profullstack/footer@0.2.5 ⏵ 0.2.6	⁺¹		⁺¹	⁺¹
@profullstack/player@0.15.0 ⏵ 0.16.0	⁺¹		⁺¹
@profullstack/stack@0.4.0 ⏵ 0.5.0			⁺¹	⁺¹
lucide-react@1.58.0 ⏵ 1.61.0	⁺¹		⁺¹
vite@7.3.1 ⏵ 8.3.5	⁺¹	⁺⁴⁰	⁺¹
posthog-js@1.438.12 ⏵ 1.438.23	⁺¹
linkedom@0.18.13 ⏵ 0.18.14	⁺¹		⁺¹	⁺⁷
@profullstack/x402-gateway@0.11.0 ⏵ 0.13.1			⁺¹	⁺¹
undici@8.12.2 ⏵ 8.12.3			⁺¹
puppeteer@25.14.0 ⏵ 25.16.0				⁺¹
@vitejs/plugin-react@5.2.0 ⏵ 6.1.2	⁺¹
mailparser@3.9.40 ⏵ 3.12.4	⁺¹		⁺¹²	⁺¹
eslint@9.39.5 ⏵ 10.13.0	⁺¹			⁺⁴⁵
dotenv@18.0.8 ⏵ 18.0.9				^-1
imapflow@2.5.2 ⏵ 2.9.1	⁺¹			⁺¹
framer-motion@14.3.0 ⏵ 14.6.0				⁺¹
resend@6.34.0 ⏵ 6.34.1

View full report

socket-security · 2026-10-26T13:42:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	License policy violation: npm `@zone-eu/mailsplit` under EUPL-1.2 License: EUPL-1.2 - The applicable license policy does not permit this license (5) (package/LICENSE.EUPL-1.2) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.EUPL-1.2) License: EUPL-1.1+ - This license classifier is not allowed by the applicable policy (package/package.json) From: pnpm-lock.yaml → `npm/[email protected]` → `npm/[email protected]` → `npm/@zone-eu/[email protected]` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@zone-eu/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

github-actions · 2026-10-26T13:42:36Z

ThreatCrush Security Scan

97 finding(s)

HIGH/CRITICAL: 11 | MEDIUM: 30 | LOW: 56

Severity	Rule	Location
HIGH	`secret-private-key`	`src/app/settings/seedbox-section.tsx`:412
HIGH	`secret-generic-api-key`	`docs/incidents/2026-05-okshanaby-supply-chain.md`:18
HIGH	`tls-verification-disabled`	`src/app/api/iptv-proxy/route.ts`:39
HIGH	`tls-verification-disabled`	`src/app/api/iptv/channels/route.ts`:35
HIGH	`tls-verification-disabled`	`src/app/api/iptv/playlists/[id]/route.ts`:73
HIGH	`tls-verification-disabled`	`src/app/api/iptv/playlists/route.ts`:64
HIGH	`js-cors-origin-reflected`	`src/app/api/public/shares/[slug]/checkout/route.ts`:40
HIGH	`js-cors-origin-reflected`	`src/app/api/public/vod/[slug]/checkout/route.ts`:34
HIGH	`tls-verification-disabled`	`src/lib/iptv/shares/upstream.ts`:37
HIGH	`tls-verification-disabled`	`workers/iptv-cache/epg-fetcher.ts`:25
HIGH	`tls-verification-disabled`	`workers/iptv-cache/playlist-fetcher.ts`:62
MEDIUM	`secret-jwt`	`.github/workflows/ci.yml`:120
MEDIUM	`secret-jwt`	`.github/workflows/ci.yml`:121
MEDIUM	`secret-jwt`	`.github/workflows/ci.yml`:123
MEDIUM	`secret-jwt`	`.github/workflows/ci.yml`:162
MEDIUM	`secret-jwt`	`.github/workflows/ci.yml`:164
MEDIUM	`secret-jwt`	`docs/tunein (2).py`:9
MEDIUM	`secret-jwt`	`docs/tunein.py`:9
MEDIUM	`sh-remote-script-execution`	`scripts/setup-server.sh`:182
MEDIUM	`sh-remote-script-execution`	`scripts/setup-server.sh`:419
MEDIUM	`sh-remote-script-execution`	`scripts/setup-server.sh`:428
MEDIUM	`sh-unquoted-expansion-destructive`	`scripts/setup-server.sh`:1096
MEDIUM	`sh-unquoted-expansion-destructive`	`scripts/setup-server.sh`:1106
MEDIUM	`js-unescaped-html-sink`	`src/app/api/player/route.ts`:127
MEDIUM	`js-unescaped-html-sink`	`src/app/api/player/route.ts`:281
MEDIUM	`js-unescaped-html-sink`	`src/app/blog/[slug]/page.tsx`:40
MEDIUM	`js-unescaped-html-sink`	`src/app/blog/[slug]/page.tsx`:66
MEDIUM	`js-unescaped-html-sink`	`src/app/email/email-content.tsx`:566
MEDIUM	`js-open-redirect`	`src/app/login/page.tsx`:68
MEDIUM	`js-open-redirect`	`src/app/pricing/page.tsx`:148
MEDIUM	`js-open-redirect`	`src/app/rent/[slug]/rent-client.tsx`:170
MEDIUM	`js-unescaped-html-sink`	`src/app/rss/rss-content.tsx`:615
MEDIUM	`js-open-redirect`	`src/app/vod/[slug]/vod-client.tsx`:138
MEDIUM	`js-open-redirect`	`src/app/watch/[slug]/watch-client.tsx`:131
MEDIUM	`js-unescaped-html-sink`	`src/app/youtube/youtube-content.tsx`:546
MEDIUM	`js-open-redirect`	`src/components/account/iptv-subscription-section.tsx`:121
MEDIUM	`js-open-redirect`	`src/components/account/iptv-subscription-section.tsx`:151
MEDIUM	`js-unescaped-html-sink`	`src/components/layout/pit-footer.tsx`:25
MEDIUM	`js-unescaped-html-sink`	`src/components/news/news-section.tsx`:358
MEDIUM	`js-unescaped-html-sink`	`src/components/news/news-section.tsx`:731
MEDIUM	`redos-nested-quantifier`	`src/lib/metadata-enrichment/metadata-enrichment.ts`:317
LOW	`tls-verification-disabled`	`docs/tunein (2).py`:34
LOW	`tls-verification-disabled`	`docs/tunein (2).py`:37
LOW	`tls-verification-disabled`	`docs/tunein (2).py`:47
LOW	`tls-verification-disabled`	`docs/tunein.py`:34
LOW	`tls-verification-disabled`	`docs/tunein.py`:37
LOW	`tls-verification-disabled`	`docs/tunein.py`:47
LOW	`tls-verification-disabled`	`src/app/api/iptv-proxy/route.test.ts`:457
LOW	`secret-generic-credential`	`src/app/api/iptv/subscription/route.test.ts`:66
LOW	`secret-generic-credential`	`src/lib/argontv/client.test.ts`:54

…and 47 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

ralyodio merged commit 27b2d56 into master Oct 26, 2026
9 checks passed

ralyodio deleted the chore/deps-2026-10-26 branch October 26, 2026 13:51

Navigation Menu

Repository navigation

chore(deps): upgrade all dependencies; next 16.4.3 (RCE GHSA-2464-fhr4-w9xw) - #299

chore(deps): upgrade all dependencies; next 16.4.3 (RCE GHSA-2464-fhr4-w9xw)#299
ralyodio merged 1 commit into
masterfrom
chore/deps-2026-10-26

ralyodio commented Oct 26, 2026

Uh oh!

socket-security Bot commented Oct 26, 2026

Uh oh!

socket-security Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ralyodio commented Oct 26, 2026

Security

Majors taken

Held

Gate

Uh oh!

socket-security Bot commented Oct 26, 2026

Uh oh!

socket-security Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

ThreatCrush Security Scan

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant