Ralksta 81ce886b01 release: v0.19.1 ...

Patch release for the Next.js advisory GHSA-vcvr-r3jv-pc5j (critical,
RCE in the Node.js `ImageResponse` from `next/og`).

- #743 — `next` and `eslint-config-next` 16.3.5 → 16.3.6
- #744 — prettier 3.9.8 → 3.9.9 (dev only)
- `chore(release): v0.19.1` — CHANGELOG, README "Latest" line, version

Folio uses `next/og` in `/api/og`. Title and subtitle are site-signed
since #767 and unsigned requests fall back to the site title, so
visitor-chosen text never reached the SVG. The upgrade is still the fix.

Checked on `dev` at 5dab342: `tsc --noEmit` clean, lint 0 errors,
`format:check` clean, 178 files / 2147 tests pass, `npm run build`
succeeds.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

2026-10-01 23:22:13 +02:00

196 KiB

Raw Blame History

View Raw