chore: Upgrade factory Next.js to 16.3.3 - #14254
Merged
anthonyshew merged 1 commit intoSep 26, 2026
Merged
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
anthonyshew
deleted the
shew/vuln-14141-dependency-vulnerability-next1630-in
branch
September 26, 2026 02:26
github-actions Bot
added a commit
that referenced
this pull request
Sep 27, 2026
## Release v2.11.5-canary.3 > [!CAUTION] > Versioned docs aliasing FAILED. [View logs](https://github.com/vercel/turborepo/actions/runs/36332810937) ### Changes - chore: Release Turborepo 2.11.5-canary.2 (#14249) (`ce88467`) - fix: Stabilize pnpm per-workspace lockfile hashes (#14253) (`c42dc53`) - chore: Upgrade factory Next.js to 16.3.3 (#14254) (`1015b29`) - fix: Update js-yaml to address CVE-2026-84375 (#14255) (`2d4ce79`) - chore: Upgrade Next.js in docs and factory for CVE-2026-94545 (#14256) (`47eacd0`) - fix: Remove unmaintained proc-macro-error2 (#14257) (`8881df1`) - refactor: Replace clap in production CLIs with usage-rs (#14259) (`7c5e794`) - chore: Remove tiny-gradient dependency (#14260) (`79d6521`) - refactor: Replace human-panic with local crash reporting (#14261) (`629fb03`) - chore: Remove unused struct_iterable dependency (#14258) (`26080f2`) - fix: Sign complete on-disk artifacts after local cache writes (#14265) (`f21a507`) - chore: Remove `derive_setters` dependency (#14266) (`0dd88c1`) - chore: Remove port_scanner dependency (#14267) (`275ac3e`) - chore: Remove unused Rust dependency declarations (#14268) (`40beaa7`) - refactor: Remove unused public Rust APIs (#14269) (`4228cf1`) - refactor: Use workspace Rust edition across crates (#14270) (`ba06e40`) - chore: Clean up Rust Clippy exceptions (#14271) (`d839f58`) - refactor: Group task-hash and uv generation context (#14279) (`937abd5`) - refactor: Remove unused global hash wrapper (#14281) (`dc04225`) - refactor: Remove unused file-hash telemetry argument (#14282) (`14ef7dd`) - refactor: Remove dead CLI code and crate-wide allowance (#14283) (`71f5689`) - refactor: Remove dead Microfrontends config code (#14284) (`f175cd9`) - refactor: Remove unused UI task types and dead-code allowance (#14286) (`0c74400`) - refactor: Remove unused Cache archive test helper and dead code allowance (#14287) (`0ec6610`) - chore: Narrow Run dead-code allowances (#14285) (`91d2df2`) - chore: Remove resolved TODO markers (#14288) (`ed9a3e9`) - fix: Use map_while for invariant text prefixes (#14289) (`7c37556`) - test: Cover globwalk parent traversal (#14290) (`81d92e0`) - fix: Wait for watcher setup with Tokio wait_for (#14292) (`3e7b084`) - test: Exercise SCM package hashing for symlinks (#14291) (`355fd86`) - fix: Reject empty tokens when reading token files (#14293) (`9b91670`) - test: Verify Yarn transparent workspace handling (#14294) (`4bbb6a9`) - fix: Format pnpm v5 package names (#14295) (`0cf7ad3`) - fix: Report package manager error source paths (#14296) (`6f7a147`) - fix: Resolve LSP task references with JSONC AST (#14298) (`06ffea4`) - chore: Remove stale package watcher TODO (#14299) (`007bd7e`) - fix: Validate scope selector glob bases (#14300) (`cc7adf0`) - fix: Add path context to globwatch errors (#14301) (`e4cfcaa`) - docs: Document wax pattern and walk semantics (#14302) (`9b16351`) - chore: Remove resolved filewatch input-set TODO (#14303) (`dbf46c4`) - docs: Document FSEvents event translation (#14305) (`504c6d3`) - refactor: Group run-cache task context (#14304) (`e0d8d5d`) - chore: Document package watcher task-input filtering (#14306) (`4df5a4f`) - chore: Remove stale const_format lint workaround (#14307) (`6d4cda1`) - refactor: Route regex groups through Grouping (#14308) (`6af1efe`) - perf: Parse character classes without compiling regex (#14310) (`6ee40f9`) - chore: Drop unused Biome dependencies from turbopath (#14311) (`2950a60`) - chore: Unify jsonc-parser versions (#14312) (`9e48922`) - chore: Remove error-only dependency edges (#14313) (`5d22e3e`) - perf: Emit casing flags only when they change (#14309) (`b571578`) - perf: Avoid formatting Bun lockfiles during parsing (#14314) (`9277ef3`) - test: Assert process manager stop postconditions (#14297) (`b06334b`) - perf: Serve a static GraphiQL page (#14315) (`14ddc92`) - perf: Upgrade serde_json to reduce CLI size (#14316) (`dc15bd0`) - perf: Upgrade Ratatui to reduce TUI allocations (#14317) (`1f0308d`) - fix: Restore TUI log streaming after Ratatui upgrade (#14318) (`9c53011`) - feat: Add version-matched agent guidance (#14250) (`1405272`) - fix: Restore Rust builds after agent guidance changes (#14319) (`956a35b`) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
github-actions Bot
added a commit
that referenced
this pull request
Sep 28, 2026
## Release v2.11.5 > [!CAUTION] > Versioned docs aliasing FAILED. [View logs](https://github.com/vercel/turborepo/actions/runs/36361927571) ### Changes - chore: Release Turborepo 2.11.4 (#14231) (`5d2e55f`) - test: Move Python opt-in hint into filter contracts (#14228) (`f5b6fea`) - test: Move dependency-output summary assertion into contract (#14230) (`3ee0227`) - test: Move dependency-output selection and validation cases to engine contracts (#14232) (`9bd011f`) - test: Move Cargo exclude-only scope coverage (#14238) (`c99ad87`) - test: Move Cargo cache-authority cases to contracts (#14240) (`1ad8190`) - test: Move JIT dependency graph scenario into engine contract (#14235) (`e427a23`) - test: Move dependency-output hash cases into task-hash contracts (#14233) (`c17b62c`) - test: Move Cargo task-filter cases into crate contracts (#14239) (`fa6b8db`) - test: Move JIT input hash timing cases into task-hash contracts (#14234) (`c928e42`) - test: Move package input normalization cases into engine contracts (#14236) (`e6c6d77`) - test: Move structured startup and JIT input cases into contracts (#14237) (`a29c843`) - fix: Back off remote artifact requests during outages (#14222) (`103d81c`) - chore: Release Turborepo 2.11.5-canary.1 (#14245) (`d5e648b`) - test: Make new-package lockfile filter deterministic (#14241) (`9eb77e6`) - test: Trim redundant Go cache builds (#14242) (`02e8359`) - test: Reduce Go versioned-name test matrix (#14243) (`98282b7`) - test: Move Go binary checks into contracts (#14246) (`16a3157`) - test: Consolidate Go format smokes (#14244) (`b92aa7e`) - test: Reuse Cargo build artifacts safely (#14247) (`b46920c`) - test: Separate prune planning matrix from buildability smoke (#14248) (`5911e14`) - feat: Bundle docs in `turbo` npm package (#14108) (`b19f6a5`) - chore: Release Turborepo 2.11.5-canary.2 (#14249) (`ce88467`) - fix: Stabilize pnpm per-workspace lockfile hashes (#14253) (`c42dc53`) - chore: Upgrade factory Next.js to 16.3.3 (#14254) (`1015b29`) - fix: Update js-yaml to address CVE-2026-84375 (#14255) (`2d4ce79`) - chore: Upgrade Next.js in docs and factory for CVE-2026-94545 (#14256) (`47eacd0`) - fix: Remove unmaintained proc-macro-error2 (#14257) (`8881df1`) - refactor: Replace clap in production CLIs with usage-rs (#14259) (`7c5e794`) - chore: Remove tiny-gradient dependency (#14260) (`79d6521`) - refactor: Replace human-panic with local crash reporting (#14261) (`629fb03`) - chore: Remove unused struct_iterable dependency (#14258) (`26080f2`) - fix: Sign complete on-disk artifacts after local cache writes (#14265) (`f21a507`) - chore: Remove `derive_setters` dependency (#14266) (`0dd88c1`) - chore: Remove port_scanner dependency (#14267) (`275ac3e`) - chore: Remove unused Rust dependency declarations (#14268) (`40beaa7`) - refactor: Remove unused public Rust APIs (#14269) (`4228cf1`) - refactor: Use workspace Rust edition across crates (#14270) (`ba06e40`) - chore: Clean up Rust Clippy exceptions (#14271) (`d839f58`) - refactor: Group task-hash and uv generation context (#14279) (`937abd5`) - refactor: Remove unused global hash wrapper (#14281) (`dc04225`) - refactor: Remove unused file-hash telemetry argument (#14282) (`14ef7dd`) - refactor: Remove dead CLI code and crate-wide allowance (#14283) (`71f5689`) - refactor: Remove dead Microfrontends config code (#14284) (`f175cd9`) - refactor: Remove unused UI task types and dead-code allowance (#14286) (`0c74400`) - refactor: Remove unused Cache archive test helper and dead code allowance (#14287) (`0ec6610`) - chore: Narrow Run dead-code allowances (#14285) (`91d2df2`) - chore: Remove resolved TODO markers (#14288) (`ed9a3e9`) - fix: Use map_while for invariant text prefixes (#14289) (`7c37556`) - test: Cover globwalk parent traversal (#14290) (`81d92e0`) - fix: Wait for watcher setup with Tokio wait_for (#14292) (`3e7b084`) - test: Exercise SCM package hashing for symlinks (#14291) (`355fd86`) - fix: Reject empty tokens when reading token files (#14293) (`9b91670`) - test: Verify Yarn transparent workspace handling (#14294) (`4bbb6a9`) - fix: Format pnpm v5 package names (#14295) (`0cf7ad3`) - fix: Report package manager error source paths (#14296) (`6f7a147`) - fix: Resolve LSP task references with JSONC AST (#14298) (`06ffea4`) - chore: Remove stale package watcher TODO (#14299) (`007bd7e`) - fix: Validate scope selector glob bases (#14300) (`cc7adf0`) - fix: Add path context to globwatch errors (#14301) (`e4cfcaa`) - docs: Document wax pattern and walk semantics (#14302) (`9b16351`) - chore: Remove resolved filewatch input-set TODO (#14303) (`dbf46c4`) - docs: Document FSEvents event translation (#14305) (`504c6d3`) - refactor: Group run-cache task context (#14304) (`e0d8d5d`) - chore: Document package watcher task-input filtering (#14306) (`4df5a4f`) - chore: Remove stale const_format lint workaround (#14307) (`6d4cda1`) - refactor: Route regex groups through Grouping (#14308) (`6af1efe`) - perf: Parse character classes without compiling regex (#14310) (`6ee40f9`) - chore: Drop unused Biome dependencies from turbopath (#14311) (`2950a60`) - chore: Unify jsonc-parser versions (#14312) (`9e48922`) - chore: Remove error-only dependency edges (#14313) (`5d22e3e`) - perf: Emit casing flags only when they change (#14309) (`b571578`) - perf: Avoid formatting Bun lockfiles during parsing (#14314) (`9277ef3`) - test: Assert process manager stop postconditions (#14297) (`b06334b`) - perf: Serve a static GraphiQL page (#14315) (`14ddc92`) - perf: Upgrade serde_json to reduce CLI size (#14316) (`dc15bd0`) - perf: Upgrade Ratatui to reduce TUI allocations (#14317) (`1f0308d`) - fix: Restore TUI log streaming after Ratatui upgrade (#14318) (`9c53011`) - feat: Add version-matched agent guidance (#14250) (`1405272`) - fix: Restore Rust builds after agent guidance changes (#14319) (`956a35b`) - chore: Release Turborepo 2.11.5-canary.3 (#14320) (`c76ac66`) - docs: Update Turborepo schema URL example (#14321) (`d6b852c`) - feat: Publish versioned standalone turbo archives (#14322) (`7f57aa3`) - fix: Run standalone archive job on manual releases (#14323) (`8427e6e`) - chore: Release Turborepo 2.11.5-canary.4 (#14324) (`a46f82a`) - feat: Add standalone installers URLs for `curl | bash` (#14325) (`5108f6c`) - fix: Isolate installer test environment (#14326) (`8cb6766`) - fix: Pass repository to release asset commands (#14327) (`c9602f3`) - chore: Release Turborepo 2.11.5-canary.5 (#14328) (`a50ee65`) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remediate VULN-14141 by upgrading the factory app to the patched Next.js release. The lockfile reuses the existing 16.3.3 resolution and removes the unused 16.3.0 entries.