Repository navigation
security: patch Next.js RCE + all advisories; unpublish Postgres - #118
Merged
Merged
Conversation
Next 16.3.7 fixes an unauthenticated image-optimizer RCE (GHSA-2xp9). nodemailer 10 (9.x has no ReDoS fix); shadcn is build-only, so devDeps. npm audit: 0 vulnerabilities, prod and dev.
Compose merges port lists, so the prod `ports: []` never unpublished 5432; only the cloud firewall kept it off the internet.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Two months of advisories had accumulated since #106, including a critical unauthenticated RCE in the Next.js image optimizer (GHSA-2xp9-vwfh-vxw4). The optimizer is live on akritos.com (
/_next/image→ 200, used by the blog) and we were on 16.2.12.Dependencies —
npm audit: 0 vulnerabilities (prod and dev, all severities)eslint-config-nextin lockstep): both critical RCEs@types/nodemailer(v10 ships its own types) and removed the Dependabot rules that pinned nodemailer's major, which is how it fell behindnpm audit fix/npm updatecrash on the$nodemaileroverride; noted in CLAUDE.md)shadcn→ devDependencies: it's a CLI plus one build-time CSS import, and only.next/standaloneships, so its MCP SDK tree (hono, express, ip-address) never runs on the serverInfra — Postgres was published on the VPS's public interface
docker-compose.prod.ymlsetdb.ports: [], but Compose merges port lists, sodocker compose configshowed5432published on all interfaces. The DB password is the dev default hardcoded in this public repo. The DreamCompute security group (only 22/80/443 reachable, verified externally) was the only thing in the way. Postgres and Mailpit are now bound to127.0.0.1; the app port is unchanged because the host reverse proxy needs it.Verified
prisma generate,tsc, 85 tests,npm run build: cleannpm cifrom lockfile + audit gate: pass (empty allowlist)db→127.0.0.1:5432Deploy note
CI auto-deploy is off, so this needs a manual
deploy.sh. The port-binding change recreates thedbcontainer (brief restart; data is in the named volume).🤖 Generated with Claude Code