Skip to content

Conversation

@Wajahat43
Copy link
Collaborator

  • Upgrade Next to 15.1.9
  • Add pin-versions.js script to sync package.json with installed versions
  • Pin all dependencies to exact versions (remove caret ranges)

Description

Upgraded to NextJs 15.1.9 because of a severe vulnerability in SSR (Security Advisory).
This also adds a utility script to pin dependency versions and updates the project to use exact version numbers instead of caret ranges. This ensures reproducible builds across different environments by locking dependencies to the exact versions currently installed. It also saves us from vulnerability attacks in NPM in the future.

Type of Change

  • 🐛 Bug fix (non-breaking change that fixes an issue)
  • ✨ New feature (non-breaking change that adds functionality)
  • 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • 📝 Documentation update
  • 🎨 Style/UI update
  • ♻️ Code refactor (no functional changes)
  • ⚡ Performance improvement
  • 🔧 Configuration change
  • 🧪 Test update

Changes Made

  • Added scripts/pin-versions.js utility script to sync dependency versions from node_modules to package.json
  • Pinned all dependencies in package.json to exact versions (removed ^ caret ranges)
  • Updated package-lock.json to reflect the pinned versions
  • Added .DS_Store to .gitignore to exclude macOS system files

Test Environment

  • OS: MAC
  • Browser: Chrome
  • Node.js Version: 24

Test Steps

  1. Run npm install to ensure dependencies are installed
  2. Run node scripts/pin-versions.js to verify the script works correctly
  3. Verify that npm run build completes successfully with pinned versions
  4. Verify that npm run lint passes without errors

Checklist

Code Quality

  • My code follows the project's coding style and conventions
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • My changes generate no new warnings or errors

Testing

  • I have tested my changes locally
  • Existing tests pass with my changes
  • I have added tests for new functionality (if applicable)

Documentation

  • I have updated the documentation accordingly (if applicable)
  • I have updated the README if needed

Build & Lint

  • npm run build completes successfully
  • npm run lint passes without errors

Security

  • No sensitive data (API keys, passwords, etc.) is committed
  • Security implications have been considered

Additional Notes

Please pull and test locally before merging.


By submitting this pull request, I confirm that my contribution is made under the terms of the project's license.

- Add pin-versions.js script to sync package.json with installed versions
- Pin all dependencies to exact versions (remove caret ranges)
@junaiddshaukat junaiddshaukat merged commit 0327376 into devweekends:main Dec 6, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants