[Camillebzd]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
monode	Ready	Preview, Comment	May 8, 2026 11:14am

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​16.0.10 ⏵ 16.2.6	+19	+30	+1	+1
	npm/​react@​19.2.1 ⏵ 19.2.4
	npm/​react-dom@​19.2.1 ⏵ 19.2.4

View full report

[greptile-apps]

Greptile Summary

This PR bumps three frontend dependencies to their latest releases: next from 16.0.10 → 16.2.6, and react/react-dom from 19.2.1 → 19.2.4. The lockfile is regenerated and pnpm-workspace.yaml is updated to exempt the freshly-published Next.js 16.2.6 packages from the 7-day minimum-release-age guard.

• next is upgraded two minor versions (16.0.10 → 16.2.6); all @next/swc-* platform binaries are correctly excluded from the minimumReleaseAge check in pnpm-workspace.yaml.
• react and react-dom receive a patch bump (19.2.1 → 19.2.4); their peer-dependency resolutions are updated throughout the lockfile.
• eslint-config-next remains at 16.0.6 while next is now 16.2.6 — this version skew was flagged in a previous review comment.

Confidence Score: 5/5

Safe to merge; changes are confined to dependency version bumps with no application logic modified.

The change bumps Next.js and React to newer patch/minor releases. The lockfile and workspace exclusions are consistent with the version changes. The only concern — eslint-config-next not being bumped alongside next — was already flagged in a prior review comment and does not affect runtime behavior.

frontend/package.json — the eslint-config-next version skew (16.0.6 vs next 16.2.6) noted in a previous comment is still present.

Important Files Changed

Filename	Overview
frontend/package.json	Bumps next from 16.0.10 → 16.2.6, react/react-dom from 19.2.1 → 19.2.4; eslint-config-next remains at 16.0.6 (mismatched with next 16.2.6, flagged in a previous comment)
frontend/pnpm-lock.yaml	Lock file regenerated to reflect updated react@19.2.4 and next@16.2.6 peer-dependency resolutions across all packages; no structural issues
frontend/pnpm-workspace.yaml	Adds next@16.2.6 and its @next/* SWC binaries to minimumReleaseAgeExclude, allowing the freshly-published Next.js version to bypass the 7-day minimum-release-age guard

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[package.json] -->|next 16.0.10 → 16.2.6| B[Next.js]
    A -->|react 19.2.1 → 19.2.4| C[React & React DOM]
    A -->|eslint-config-next stays 16.0.6| D[ESLint Config ⚠️ version skew]
    B --> E[pnpm-workspace.yaml]
    E -->|minimumReleaseAgeExclude| F["next@16.2.6 + @next/swc-* binaries\nexempted from 7-day age check"]
    A --> G[pnpm-lock.yaml]
    G -->|peer deps re-resolved| H[All packages updated to react@19.2.4]

Loading

_{Reviews (3): Last reviewed commit: "add all the deps" | Re-trigger Greptile}

[Im-Madhur-Gupta]

Added a comment Camille

[Im-Madhur-Gupta]

Code Review — Dependency bump: Next.js 16.0.10 → 16.2.6, React 19.2.1 → 19.2.4

Verdict: APPROVE — with one process note that should inform future bumps

---

Scope

3 files changed: frontend/package.json, frontend/pnpm-lock.yaml, frontend/pnpm-workspace.yaml.
No application source code was touched. This is a pure dependency version bump.

---

What this PR actually does

Package	Before	After
next	16.0.10	16.2.6
react	19.2.1	19.2.4
react-dom	19.2.1	19.2.4

The lockfile churn (280 additions, 224 deletions) is entirely mechanical — peer-dependency resolution strings updated from react@19.2.1 → react@19.2.4 across every Radix UI, framer-motion, recharts, lucide-react, and @vercel/analytics entry. This is expected and correct.

---

Security — this bump is non-optional

Next.js 16.2.6 is a security release addressing multiple High-severity CVEs:

• GHSA-8h8q-6873-q5fj — Denial of Service via Server Components
• GHSA-267c-6grr-h53f — Middleware / Proxy bypass in App Router via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6 — Middleware / Proxy bypass in App Router via segment-prefetch routes (variant)
• GHSA-mg66-mrh9-m8jx — Denial of Service via connection exhaustion in Cache Component

The middleware bypass advisories (GHSA-267c, GHSA-26hh) are particularly relevant for any App Router application that relies on middleware for auth or access control. If this app uses middleware.ts to gate routes, running 16.0.10 in production is a security exposure. This PR should be merged promptly.

---

Process note — minimumReleaseAgeExclude

pnpm-workspace.yaml adds hardcoded version excludes to bypass the 7-day release age gate:

minimumReleaseAgeExclude:
  - next@16.2.6
  - "@next/env@16.2.6"
  - "@next/swc-darwin-arm64@16.2.6"
  ... (8 more @next/swc-* variants)

This is the right call for a security patch — you correctly decided not to wait 7 days for a CVE fix. But these entries are now stale liabilities: they will accumulate across future security bumps unless actively pruned. The @next/swc-* platform binaries don't need individual entries since they're optional dependencies that only install for the matching platform — listing all 8 is noise.

Before the next bump, clean this up:

1. Remove the now-stale entries for 16.2.6 (they provide no ongoing benefit once you've moved past that version).
2. If you need to bypass the age gate in the future, a single next@<version> entry is sufficient; the SWC binaries follow automatically.

This is not a blocker for this PR — don't hold the security fix for housekeeping. File a follow-up task to prune the stale excludes after merge.

---

What's good

• The version pin in package.json is exact (no ^ or ~), which is the right choice for a monorepo frontend — reproducible installs across environments.
• The lockfile is fully regenerated, not hand-edited. Peer dependency chains are consistent throughout.
• react and react-dom versions are kept in sync (both 19.2.4). Mismatching these is a common mistake; it's correct here.
• Committing to address security advisories quickly is the right instinct.

---

Merge this. The security fixes alone justify it. Clean up the stale minimumReleaseAgeExclude entries in a follow-up.