From 282e303ef994faebf9d57b4bbbf67fe2dcffa817 Mon Sep 17 00:00:00 2001 From: alexander-sei Date: Fri, 11 Sep 2026 13:11:49 +0200 Subject: [PATCH 1/2] fix(create-sei): clear the new Next.js and sharp advisories The generated-app smoke audits every variant and fails on any high or critical finding. Three advisories landed against the pinned versions, so the check went red without any change to the template: GHSA-p293-qw3h-jr36 critical next >=13.4.0 <15.5.24 GHSA-2xp9-vwfh-vxw4 critical next >=10.0.0 <15.5.24 GHSA-rgj7-g3m4-5g8c high sharp <0.35.4 Both pins move inside their minor: next 15.5.21 to 15.5.25, and the sharp override 0.35.3 to 0.35.4. Next 15.5.25 also widened its own Sharp declaration to ^0.34.3 || ^0.35.4, so the pinned override now sits inside the range Next supports. The image notes in the template README and next.config.mjs asserted the opposite, so they are corrected: images stay unoptimized to avoid requiring a native Sharp build, which is a template choice rather than a security tradeoff. The remaining decode-uri-component finding is moderate and does not block. Co-authored-by: Cursor --- .../fix-create-sei-next-sharp-advisories.md | 15 +++++++++++++++ .../create-sei/templates/next-template/README.md | 4 ++-- .../templates/next-template/next.config.mjs | 6 ++++-- .../templates/next-template/package.json | 4 ++-- 4 files changed, 23 insertions(+), 6 deletions(-) create mode 100644 .changeset/fix-create-sei-next-sharp-advisories.md diff --git a/.changeset/fix-create-sei-next-sharp-advisories.md b/.changeset/fix-create-sei-next-sharp-advisories.md new file mode 100644 index 00000000..6f391940 --- /dev/null +++ b/.changeset/fix-create-sei-next-sharp-advisories.md @@ -0,0 +1,15 @@ +--- +'@sei-js/create-sei': patch +--- + +Bump the Next template's `next` and `sharp` pins to clear three newly published advisories. + +The generated-app smoke audits every variant and fails on any high or critical finding. Three advisories landed against the pinned versions, so the check went red without any change to the template: + +- `GHSA-p293-qw3h-jr36` — critical, unauthenticated RCE on Windows-hosted Next.js servers, `>=13.4.0 <15.5.24`. +- `GHSA-2xp9-vwfh-vxw4` — critical, unauthenticated RCE in the Image Optimization API when AVIF files are used, `>=10.0.0 <15.5.24`. +- `GHSA-rgj7-g3m4-5g8c` — high, heap overflow in Sharp's bundled libheif decoder, `<0.35.4`. + +`next` moves `15.5.21` to `15.5.25` and the `sharp` override `0.35.3` to `0.35.4`, both inside their pinned minors. Next 15.5.25 also widened its own Sharp declaration to `^0.34.3 || ^0.35.4`, so the pinned override now sits inside the range Next supports; the image notes in the template README and `next.config.mjs` said the opposite and are corrected. Images stay unoptimized, which is now a choice about not requiring a native Sharp build rather than a security tradeoff. + +The remaining `decode-uri-component` finding is moderate and does not block the smoke. diff --git a/packages/create-sei/templates/next-template/README.md b/packages/create-sei/templates/next-template/README.md index a3db7c8d..fd604508 100644 --- a/packages/create-sei/templates/next-template/README.md +++ b/packages/create-sei/templates/next-template/README.md @@ -30,11 +30,11 @@ bun run build ## Image handling -Next.js image optimization is disabled because Next 15.5.21 declares only vulnerable Sharp 0.34.x releases. The manifest resolves secure Sharp 0.35.x for audit safety, while images are served unoptimized until Next.js supports that Sharp line. +Next.js image optimization is disabled so the generated app needs no native Sharp build. Next 15.5.25 declares Sharp `^0.34.3 || ^0.35.4`, and the manifest pins `0.35.4`, the release that clears the libheif advisory in that range, so enabling optimization is a template choice rather than a security tradeoff. ## Development bundler -`bun run dev` uses the Next 15 webpack default. Do not add `--turbopack`: Next 15.5.21 cannot express the required `false` alias for MetaMask SDK's mobile-only storage import in Turbopack without adding a synthetic replacement module. The production build and smoke use the validated webpack alias in `next.config.mjs`. +`bun run dev` uses the Next 15 webpack default. Do not add `--turbopack`: the pinned Next 15 line cannot express the required `false` alias for MetaMask SDK's mobile-only storage import in Turbopack without adding a synthetic replacement module. The production build and smoke use the validated webpack alias in `next.config.mjs`. ## Sei brand diff --git a/packages/create-sei/templates/next-template/next.config.mjs b/packages/create-sei/templates/next-template/next.config.mjs index c307b7b1..c08f13dc 100644 --- a/packages/create-sei/templates/next-template/next.config.mjs +++ b/packages/create-sei/templates/next-template/next.config.mjs @@ -5,8 +5,10 @@ const nextConfig = { ignoreDuringBuilds: true, }, images: { - // Next 15.5.21 declares vulnerable Sharp 0.34.x. Keep the secure 0.35.x - // override for resolution, but do not rely on its unsupported optimizer API. + // Next 15.5.25 declares Sharp `^0.34.3 || ^0.35.4`, so the pinned 0.35.4 is + // inside its supported range. Images stay unoptimized so the generated app + // needs no native Sharp build; that is now a template choice, not a + // security constraint. unoptimized: true, }, webpack: (config) => { diff --git a/packages/create-sei/templates/next-template/package.json b/packages/create-sei/templates/next-template/package.json index 0c66fba3..221c62fe 100644 --- a/packages/create-sei/templates/next-template/package.json +++ b/packages/create-sei/templates/next-template/package.json @@ -25,7 +25,7 @@ "@tailwindcss/postcss": "4.3.3", "@tanstack/react-query": "5.85.3", "ethers": "6.17.0", - "next": "15.5.21", + "next": "15.5.25", "pino-pretty": "13.1.3", "postcss": "8.5.26", "react": "19.1.2", @@ -46,7 +46,7 @@ "@metamask/sdk": "0.33.1", "@metamask/sdk-communication-layer": "0.33.1", "postcss": "8.5.26", - "sharp": "0.35.3", + "sharp": "0.35.4", "use-sync-external-store": "1.6.0", "uuid": "11.1.1", "ws": "8.21.3" From 340b96302dcf5082e34924f9c8333298ec68b0be Mon Sep 17 00:00:00 2001 From: alexander-sei Date: Fri, 11 Sep 2026 13:39:36 +0200 Subject: [PATCH 2/2] docs(create-sei): record 0.35.4 as the Sharp advisory floor The previous wording said image handling is "a template choice, not a security constraint", which reads as if the Sharp override were optional too. It is not: Next declares ^0.34.3 || ^0.35.4, and the 0.34.x half is still inside GHSA-rgj7-g3m4-5g8c, so loosening the pin reintroduces a high finding whether or not optimization is enabled. Both notes now separate the two: images stay unoptimized to avoid a native Sharp build, while 0.35.4 is the advisory floor for the override. The README also no longer names an exact Next patch version, matching the dev-bundler note. That coupling is what made the previous text wrong. Co-authored-by: Cursor --- .changeset/fix-create-sei-next-sharp-advisories.md | 4 +++- packages/create-sei/templates/next-template/README.md | 4 +++- .../create-sei/templates/next-template/next.config.mjs | 9 +++++---- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.changeset/fix-create-sei-next-sharp-advisories.md b/.changeset/fix-create-sei-next-sharp-advisories.md index 6f391940..b1925881 100644 --- a/.changeset/fix-create-sei-next-sharp-advisories.md +++ b/.changeset/fix-create-sei-next-sharp-advisories.md @@ -10,6 +10,8 @@ The generated-app smoke audits every variant and fails on any high or critical f - `GHSA-2xp9-vwfh-vxw4` — critical, unauthenticated RCE in the Image Optimization API when AVIF files are used, `>=10.0.0 <15.5.24`. - `GHSA-rgj7-g3m4-5g8c` — high, heap overflow in Sharp's bundled libheif decoder, `<0.35.4`. -`next` moves `15.5.21` to `15.5.25` and the `sharp` override `0.35.3` to `0.35.4`, both inside their pinned minors. Next 15.5.25 also widened its own Sharp declaration to `^0.34.3 || ^0.35.4`, so the pinned override now sits inside the range Next supports; the image notes in the template README and `next.config.mjs` said the opposite and are corrected. Images stay unoptimized, which is now a choice about not requiring a native Sharp build rather than a security tradeoff. +`next` moves `15.5.21` to `15.5.25` and the `sharp` override `0.35.3` to `0.35.4`, both inside their pinned minors. + +Next also widened its own Sharp declaration to `^0.34.3 || ^0.35.4`, so the pinned override now sits inside the range Next supports. The image notes in the template README and `next.config.mjs` said the opposite and are corrected: images stay unoptimized to avoid requiring a native Sharp build, which is a template choice rather than a security tradeoff. The `sharp` override itself still is one, and both notes now say so — the `0.34.x` half of Next's range remains inside the advisory, making `0.35.4` the floor rather than a free upgrade. The remaining `decode-uri-component` finding is moderate and does not block the smoke. diff --git a/packages/create-sei/templates/next-template/README.md b/packages/create-sei/templates/next-template/README.md index fd604508..e2d77be9 100644 --- a/packages/create-sei/templates/next-template/README.md +++ b/packages/create-sei/templates/next-template/README.md @@ -30,7 +30,9 @@ bun run build ## Image handling -Next.js image optimization is disabled so the generated app needs no native Sharp build. Next 15.5.25 declares Sharp `^0.34.3 || ^0.35.4`, and the manifest pins `0.35.4`, the release that clears the libheif advisory in that range, so enabling optimization is a template choice rather than a security tradeoff. +Next.js image optimization is disabled so the generated app needs no native Sharp build. Turning it on is a template choice rather than a security tradeoff. + +The manifest's `sharp` override is a separate matter and has to stay. The pinned Next 15 line declares Sharp `^0.34.3 || ^0.35.4`, and the `0.34.x` half of that range is still inside [GHSA-rgj7-g3m4-5g8c](https://github.com/advisories/GHSA-rgj7-g3m4-5g8c), so `0.35.4` is the advisory floor. Loosening or removing the override reintroduces a high audit finding whether or not optimization is enabled. ## Development bundler diff --git a/packages/create-sei/templates/next-template/next.config.mjs b/packages/create-sei/templates/next-template/next.config.mjs index c08f13dc..2bfbbc17 100644 --- a/packages/create-sei/templates/next-template/next.config.mjs +++ b/packages/create-sei/templates/next-template/next.config.mjs @@ -5,10 +5,11 @@ const nextConfig = { ignoreDuringBuilds: true, }, images: { - // Next 15.5.25 declares Sharp `^0.34.3 || ^0.35.4`, so the pinned 0.35.4 is - // inside its supported range. Images stay unoptimized so the generated app - // needs no native Sharp build; that is now a template choice, not a - // security constraint. + // Images stay unoptimized so the generated app needs no native Sharp + // build. Keep the manifest's Sharp override: Next declares + // `^0.34.3 || ^0.35.4`, and the 0.34.x half is still inside + // GHSA-rgj7-g3m4-5g8c, so 0.35.4 is the advisory floor. Loosening that + // pin reintroduces a high finding even though this flag is off. unoptimized: true, }, webpack: (config) => {