From 4a053b635f371182dcf5583a9285b2f1de146961 Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Fri, 23 Oct 2026 12:39:32 -0400 Subject: [PATCH] fix(deps): the nextjs agent to 0.0.167, which ships a patched Next.js MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The frontend and marketing services pinned the nextjs agent at 0.0.163. That agent pins the framework EXACTLY in `base/code` and `templates/factory/code`, and its `framework_version_test.go` holds the lockfile's resolved version equal to the declared one, so no service it builds can resolve past the agent's pin. Through 0.0.166 that pin was next 16.3.6, which carries three criticals: - unauthenticated RCE in the Image Optimization API when SVG files are used (GHSA-2464-fhr4-w9xw) - DoS in App Router using Server Actions (GHSA-p3m5-59mp-jv5r) - RCE in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr) 0.0.167 ships next 16.4.1 (service-nextjs#177), and with it Go 1.27.3 for GO-2026-6809 (#178) and typescript back to ^5 — the only major typescript-eslint@8 admits, so the scaffold's own lint runs again (#179). Verified against the release rather than the release notes: v0.0.167 is a published, non-draft GitHub Release with 9 assets (`agent.version` resolves a Release, not a tag — a tag-only version 404s and takes every integration suite with it), and the tag itself carries next 16.4.1, typescript ^5 and go 1.27.3. This is the durable half of the Next.js remediation. The application-side lockfiles were already patched on main by #1027; this moves the agent that builds them, so a future service scaffolded here does not start vulnerable. Classification: fix, at the place that owns the framework version. Co-Authored-By: Claude Opus 5 (1M context) --- module/services/frontend/service.codefly.yaml | 13 ++++++++++++- module/services/marketing/service.codefly.yaml | 5 ++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/module/services/frontend/service.codefly.yaml b/module/services/frontend/service.codefly.yaml index 3d86ff03c..57d6635bb 100644 --- a/module/services/frontend/service.codefly.yaml +++ b/module/services/frontend/service.codefly.yaml @@ -7,7 +7,18 @@ agent: # the release that ships the builder fix the content kit needs. 0.0.163 also # carries core v0.15.1's NewAPI fix (an endpoint keeps its exposure and # location) and the ConfigMap quoting fix. - version: 0.0.163 + # + # 0.0.167 is the security floor. The agent pins the framework EXACTLY in + # `base/code` and `templates/factory/code`, and its framework gate holds the + # lockfile's resolved version equal to the declared one, so no service built + # by it can resolve past the agent's pin. Through 0.0.166 that pin was + # next 16.3.6, which carries three criticals: unauthenticated RCE in the + # Image Optimization API via SVG (GHSA-2464-fhr4-w9xw), DoS in App Router + # Server Actions (GHSA-p3m5-59mp-jv5r), and RCE in `use cache` functions + # returning typed arrays (GHSA-673q-mjm6-r5xr). 0.0.167 ships next 16.4.1 + # (service-nextjs#177), and with it Go 1.27.3 for GO-2026-6809 (#178) and + # typescript back to ^5, the only major typescript-eslint@8 admits (#179). + version: 0.0.167 publisher: codefly.dev service-dependencies: - name: auth-gateway diff --git a/module/services/marketing/service.codefly.yaml b/module/services/marketing/service.codefly.yaml index f81aa4ff8..bf38982f6 100644 --- a/module/services/marketing/service.codefly.yaml +++ b/module/services/marketing/service.codefly.yaml @@ -7,7 +7,10 @@ description: | agent: kind: codefly:service name: nextjs - version: 0.0.163 + # 0.0.167 is the security floor: the agent pinned next 16.3.6 exactly through + # 0.0.166, and no service it builds can resolve past its pin. See frontend's + # manifest for the three advisories that pin cleared (service-nextjs#177). + version: 0.0.167 publisher: codefly.dev endpoints: - name: http