fix: update Next and harden the standalone runtime image #201

2026-10-29T21:41:49Z

KofTwentyTwo commented

2026-10-29 21:41:49 +00:00

(Migrated from github.com)

The local container qualification failed its HIGH/CRITICAL gate on the Debian base, bundled npm, and Next 16.3.8. Upgrade Next and eslint-config-next to 16.4.1, use the same digest-pinned Alpine Node 22 image for build and runtime, and remove build-only package managers from the standalone runtime. Exclude the pnpm cache from Docker context transfers.

Windows qualification also exposed two path assumptions and a cold lazy-module transform consuming the first developer-view DOM wait. Use platform paths, retain Unix mode-bit checks in an explicit Unix-only test, and compile the real lazy component in test setup. Application behavior, assertions, timeouts and coverage thresholds remain unchanged.

Validation on head 13899a73f1:

Full Windows suite: 338 files passed; 3,651 tests passed and one Unix-only permission test skipped. Coverage gate passed: 93.16% statements, 86.98% branches, 94.87% functions, 94.89% lines.
Hosted typecheck/lint/unit coverage, mocked Chromium E2E, Storybook, bundle budget, CodeQL and AMD64/ARM64 image builds passed. Collaboration E2E passed; four real-backend acceptance shards are still running.
Exact locally built image has zero HIGH/CRITICAL findings with Trivy 0.76.0. Nonroot, capabilities-dropped, network-isolated runtime passed homepage/login/callback HTML and CSP smoke checks.
Dedicated Gitea Linux run49/job75 passed all tests, runtime checks, Trivy 0.76.1 and artifact upload for image-change commit aa88dfd (before test-only follow-ups). Artifact6 independently verified with zero HIGH/CRITICAL findings; OCI manifest d6413bef9d70c8b8e2d2102534714a6724ef3a5bda75bfbf73b33856fd033c2e. Runner cleanup passed.

Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr. No vulnerability suppression or release-gate waiver is included. Latest commits are GitHub verified; initial aa88dfd is signed but reports no_user for its previous email. History has not been rewritten.

The local container qualification failed its HIGH/CRITICAL gate on the Debian base, bundled npm, and Next 16.3.8. Upgrade Next and eslint-config-next to 16.4.1, use the same digest-pinned Alpine Node 22 image for build and runtime, and remove build-only package managers from the standalone runtime. Exclude the pnpm cache from Docker context transfers. Windows qualification also exposed two path assumptions and a cold lazy-module transform consuming the first developer-view DOM wait. Use platform paths, retain Unix mode-bit checks in an explicit Unix-only test, and compile the real lazy component in test setup. Application behavior, assertions, timeouts and coverage thresholds remain unchanged. Validation on head 13899a73f1f5cd44f6a79a23931668687f809723: - Full Windows suite: 338 files passed; 3,651 tests passed and one Unix-only permission test skipped. Coverage gate passed: 93.16% statements, 86.98% branches, 94.87% functions, 94.89% lines. - Hosted typecheck/lint/unit coverage, mocked Chromium E2E, Storybook, bundle budget, CodeQL and AMD64/ARM64 image builds passed. Collaboration E2E passed; four real-backend acceptance shards are still running. - Exact locally built image has zero HIGH/CRITICAL findings with Trivy 0.76.0. Nonroot, capabilities-dropped, network-isolated runtime passed homepage/login/callback HTML and CSP smoke checks. - Dedicated Gitea Linux run49/job75 passed all tests, runtime checks, Trivy 0.76.1 and artifact upload for image-change commit aa88dfd (before test-only follow-ups). Artifact6 independently verified with zero HIGH/CRITICAL findings; OCI manifest d6413bef9d70c8b8e2d2102534714a6724ef3a5bda75bfbf73b33856fd033c2e. Runner cleanup passed. Upstream fix: https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr. No vulnerability suppression or release-gate waiver is included. Latest commits are GitHub verified; initial aa88dfd is signed but reports no_user for its previous email. History has not been rewritten.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-frontend-next#201