mirror of
https://github.com/supermemoryai/supermemory.git
synced 2026-10-28 06:24:40 +00:00
Clears the two critical Next.js RCE advisories (GHSA-p293-qw3h-jr36 / CVE-2026-75604 and GHSA-2xp9-vwfh-vxw4) for the production web app. apps/web pinned next ^16.0.11, which the root lock resolved to next@16.1.6 - inside the vulnerable range (>=16.0.0,<16.3.3) both advisories name. Bump the pin to ^16.3.3 (resolves to next@16.3.4, above both first_patched_version thresholds) and move the OpenNext Cloudflare adapter to ^1.20.6, whose peer range accepts next >=16.3.3. Co-authored-by: Dhravya Shah <dhravya@supermemory.com> |
||
|---|---|---|
| .. | ||
| app | ||
| public | ||
| .env.example | ||
| .gitignore | ||
| biome.json | ||
| console-origin.ts | ||
| middleware.ts | ||
| next.config.ts | ||
| open-next.config.ts | ||
| package.json | ||
| README.md | ||
| tsconfig.json | ||
| wrangler.jsonc | ||
@repo/web
Serves app.supermemory.ai. Every request is forwarded to the console: plugin and OAuth paths get an immediate redirect with the query string intact, and everything else shows a short notice before moving on.
Set NEXT_PUBLIC_CONSOLE_URL to point at a different console origin during local development.