fix(deps): pin next to ^16.3.1 (was open-ended >=16.3.1) - #68
Merged
Conversation
'next': '>=16.3.1' has no upper bound, so any future MAJOR release would be pulled silently on the next lockfile refresh — a framework major landing unreviewed in production. Pinned to the 16.x line. Context: filed while investigating two 46-minute admin production builds that errored on Vercel. The build itself is healthy — a clean local 'pnpm build' (next build --webpack) completes in 112s with exit 0 — so the 46-minute hangs are environmental (Vercel build-resource contention / stuck queued deployments), NOT a build-config defect. This pin is a separate, real supply-chain risk found during that investigation.
Changing package.json's next range without refreshing the lockfile left the two
out of sync, so 'pnpm install --frozen-lockfile' failed the CI jobs with:
specifiers in the lockfile don't match specifiers in package.json
- next (lockfile: >=16.3.1, manifest: ^16.3.1)
Regenerated with --lockfile-only. The RESOLVED version is unchanged (16.3.1) —
only the recorded specifier moves — so this carries no dependency-graph risk.
Verified: pnpm install --frozen-lockfile now succeeds.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
"next": ">=16.3.1"has no upper bound — any future major release gets pulled silently on the next lockfile refresh, landing a framework major in production unreviewed. Pinned to the 16.x line.Context (and a correction to the reported diagnosis)
Found while investigating the two 46-minute admin production builds that errored on Vercel.
The build is healthy. A clean local
pnpm build(next build --webpack) completes in 112s, exit 0. There is no hanging step in the build chain —devandtest:watchexist but are not invoked bybuild, and there are no build-time network fetches.So the 46-minute hangs are environmental (Vercel build-resource contention / stuck queued deployments — consistent with the report's own observation that two deployments were still Building at 20+ minutes while a newer one had already gone Ready), not a build-config defect. Adding a build timeout would mask the symptom rather than fix it; that belongs in Vercel-side investigation.
This pin is a separate, genuine supply-chain risk surfaced by that investigation.