✅ test(security): make the Next.js guard a 16.x floor instead of an exact pin - #664
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 50 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
## Summary rc.12 release prep: renames `[Unreleased]` to `[1.6.0-rc.12] — 2026-08-04` and rolls the release identity forward across README (badge + highlights), site config/content, quickstart tag matrix, demo mocks, API docs, the updates highlights page, and the identity/changelog-link tests. Adds the routine dependency-maintenance rollup (#653, #654, #655, #656, #664) and the Crowdin sync note (#665) to the changelog entry. Version files stay at `1.6.0` (base version, set at rc.1 — the release-cut workflow validates base version, full-tag changelog heading). ## rc.12 contents - 🔒 #659 security pins: brace-expansion 5.0.9 (app/ui/e2e), ip-address 10.3.1 (app runtime), fast-uri 4.1.2 (app/ui) - 🐛 #604 maturity badge/gate threshold agreement + surfaced publish-date auth failures - 🐛 #605 agent-mismatch grace during component (re)registration (display only, admission fail-closed) - 🐛 #636 WS log streams accept anonymous-auth sessions - 🐛 #637 explicit 501 for agent containers without controller lifecycle transport After merge: dev→main wholesale-tree sync, then dispatch `release-cut.yml --ref main -f release_tag=v1.6.0-rc.12`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Changelog 🔧 **Changed** - Updated release identity from `1.6.0-rc.11` to `1.6.0-rc.12` across documentation, site content, quickstart materials, API examples, demo mocks, and tests. - Added `v1.6.0-rc.12` release highlights dated August 4, 2026. - Updated changelog links and release metadata expectations. - Kept version files at `1.6.0`. 🔒 **Security** - Added security dependency updates for `#653`, `#654`, `#655`, `#656`, and `#664`. - Added the Crowdin synchronization note for `#665`. - Documented security dependency pins from `#659`. ✨ **Added** - Maturity badge and publish-date authentication updates from `#604`. - Agent-mismatch grace during component registration from `#605`. - Anonymous authentication support for WebSocket log streams from `#636`. - Explicit `501` responses when agent containers lack controller lifecycle transport from `#637`. ## Concerns - Verify all `1.6.0-rc.11` references are intentionally replaced or retained. - Verify the August 4, 2026 release date matches the release workflow. - Run changelog and release-identity tests after the updates. - Confirm the planned `dev` to `main` sync and release-cut workflow occur after merge. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Wholesale-tree sync ahead of the v1.6.0-rc.12 cut: the head commit's tree is `origin/dev/v1.6`'s tree verbatim (`630c64ec`), parented on main's current head (`67f23419`). Squash-merging makes main tree-identical to `dev/v1.6`, satisfying the release-cut drift guard (`git diff --quiet origin/main origin/dev/v1.6`). Brings in since rc.11: #659 security pins, #662/#660/#661/#663 runtime fixes (#636/#604/#605/#637), #664 guard floor, #653–#656 deps, #665 Crowdin, #666 rc.12 prep. After merge: dispatch `release-cut.yml --ref main -f release_tag=v1.6.0-rc.12`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Changelog - 🔒 Updated dependency security pins and security-version tests. - ✨ Added anonymous-authenticated WebSocket log streams with IP-based rate limits. - ✨ Added agent component-registration state tracking. - 🔧 Downgraded selected update blockers during agent registration. - 🔧 Added controller-Docker transport detection. - 🐛 Added HTTP `501` responses for unsupported agent lifecycle actions. - 🐛 Fixed maturity filtering to use per-container thresholds. - 🐛 Changed Docker publish-date lookup failures to warning logs. - 🔧 Updated dependency versions, release metadata, documentation, mocks, and changelog links from `v1.6.0-rc.11` to `v1.6.0-rc.12`. - ✨ Added release highlights for `v1.6.0-rc.12`. ## Concerns - Fix the French `containerLogs.stderr` value if `"sdterr"` is not intentional. - Verify the release date `August 4, 2026`. - Dispatch the release-cut workflow for `main` with `release_tag=v1.6.0-rc.12` after merging. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
1 participant
Renovate's apps/web minor/patch group (#656) fails the
Next.js is pinned past the 16.2.9 security advisory batchguard because it assertsnext === '16.2.11'exactly — every legitimate bump past the floor breaks CI. Same disease as the fast-uri allowlist fixed in #659.Now:
>= 16.2.11with an explicit 16.x-line assertion so a new major still fails until deliberately vetted. Lockfile assertion was already a floor. Unblocks #656 and every future next bump.