Remove out of date / unused next package version from lockfile#1305
Merged
Remove out of date / unused next package version from lockfile#1305
next package version from lockfile#1305Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Contributor
size-limit report 📦
|
1egoman
changed the title
pnpm dedupe on lockfilenext package version from lockfile
lukasIO
approved these changes
Mar 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
After merging #1304, a few CVE alerts didn't go away relating to
next@15.4.6even though I upgradednextin the example, and it looks like it was because there were some old (now unused) entries in thepnpm-lock.yamlfile which pnpm didn't cleanup after that upgrade.After runningpnpm dedupe, those old entries went away, and this is the result, but theapi-documenterbuild seems to have broken because of some deep missing transitive dependency... 🤔Taking a different path - I just removed the old
next@15.4.6lockfile section manually, and I'm hoping that will be enough to clear the alerts 🤞 .