[Bug]: NextJS 15.2.4. Can you bump? https://security.snyk.io/package/npm/next/15.2.4

[dev-dude]

What happened?

[Bug]: NextJS 15.2.4. Can you bump? https://security.snyk.io/package/npm/next/15.2.4 to 15.2.6

[jbedard]

Note that rules_js doesn't ship with any specific version of nextjs. What is the reason you need it upgraded in rules_js?

[dev-dude]

Thanks. It's setting off scans as it's a critical vulnerability https://github.com/aspect-build/rules_js/blob/main/pnpm-lock.yaml#L3812C15-L3813C15. Will ignore but fyi

[jbedard]

I'll get it updated soon, but it doesn't ship with rules_js so rules_js consumers shouldn't be concerned. Is it being flagged somewhere as a concern?

[zdicesare]

I'll get it updated soon, but it doesn't ship with rules_js so rules_js consumers shouldn't be concerned. Is it being flagged somewhere as a concern?

FWIW, we got dinged by this because security tooling found and scanned the aspect rules_js pnpm-lock.yaml file in our CI machine's Bazel output base.

[jbedard]

@alexeagle this would be a reason to further trim what we ship in the bazel module. Today we exclude some stuff such as examples/* and e2e/* (except e2e/bzlmod) but we still ship the pnpm-lock.yaml which has a lot of stuff jsut for the examples.

[jbedard]

Bumped in #2591, my 16.x update is still stuck for now.

IMO it would still be nice to not include all this test data in the actual published module though.