Repository navigation
Patch the undici, Next.js, sharp and source-map-js advisories - #16
Merged
Merged
Conversation
JSX trims each line of a text block and joins the lines with one space.
The Chinese copy is wrapped across source lines throughout the course, so
it rendered with spaces between Chinese characters and around full-width
punctuation: 1,572 of them in 36 files.
- 1,548 line breaks are joined by a script that walks the TypeScript
syntax tree and touches only JSX text and JSX attribute strings, never
code samples, template literals or comments. Breaks next to Latin
letters, digits, expressions, "——" or operators keep their space.
- 24 more spaces go: 20 after full-width punctuation, 3 between Chinese
text and a tag whose text is Chinese, and one {" "} between a
full-width mark and Chinese text.
- test/zh-copy-spacing.test.ts, the check DataData and AlgoAlgo use,
scans every TSX file and fails on any new stray space; CLAUDE.md states
the rule.
Apart from the one {" "}, the diff changes nothing but whitespace. The
text every edited file renders differs from master only by deleted
spaces, each next to Chinese text, so the English copy is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- undici 7.29.0 → 7.30.0 (GHSA-w293-vg96-wgc3, high: TLS certificate validation bypass in BalancedPool), the open Dependabot alert; it comes in through jsdom, so it is pinned with an override. - next 15.5.25 → 15.5.27 (GHSA-4jqv-mc3x-m676, GHSA-mcj8-r9mp-w47p: SSG/ISR cache poisoning), sharp 0.35.4 → 0.35.5 (GHSA-wq5f-xc86-pv6w, librsvg) and source-map-js 1.2.1 → 1.2.2 (GHSA-68fv-2mgg-jv7q), which npm audit reports and Dependabot has not raised yet. - The declared ranges and overrides now start at the patched versions, so a fresh install cannot fall back below them. npm audit: 0 vulnerabilities. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Branches from #9 (commit
2148ad8). It changes onlypackage.jsonandpackage-lock.json, so it is independent of #10–#15.Summary
GHSA-w293-vg96-wgc3, high): undici 7.29.0 can bypass TLS certificate validation inBalancedPool. undici is a dev dependency, pulled in by jsdom.npm audit, not yet raised by Dependabot:GHSA-4jqv-mc3x-m676andGHSA-mcj8-r9mp-w47p(moderate).GHSA-wq5f-xc86-pv6w(high).GHSA-68fv-2mgg-jv7q(high).Changes
package.jsonnextis^15.5.27.sharp ^0.35.5,source-map-js ^1.2.2andundici ^7.29.1. The postcss override is unchanged.package-lock.json: next 15.5.27, sharp 0.35.5, source-map-js 1.2.2 and undici 7.30.0. Only these packages and their platform sub-packages change.Verification
npm audit: 0 vulnerabilities.npx tsc --noEmit --incremental false: clean.npm test: 6 files, 38 tests pass.npm run buildwith Next.js 15.5.27 succeeds.next/fontwith "Cannot read properties of null (reading '1')". This is the known random Google Fonts failure at build time.next start: all 12 pages return 200 with 0 console errors, and the first compiler lab loadstsc 5.9.3.🤖 Generated with Claude Code