[cmelchior]

🔍 Description

What changed?

• Bump next in packages/core/realtime-js/example from ^16.3.8 to ^16.4.1 (lockfile resolves 16.4.2).

Why was this change needed?

pnpm audit --audit-level=high --prod in ci-core now fails on three next advisories (>=16.0.0 <=16.4.0, fixed in >=16.4.1):

• GHSA-2464-fhr4-w9xw (critical)
• GHSA-673q-mjm6-r5xr (critical)
• GHSA-p3m5-59mp-jv5r (high)

The only path is packages__core__realtime-js__example>next. The example app is private and not published, so no consumer is exposed, but the audit step blocks every PR and Dependabot update until it is fixed. After this lands, blocked PRs need a rebase onto master.

🔄 Breaking changes

• This PR contains no breaking changes

📋 Checklist

• I have read the Contributing Guidelines
• My PR title follows the conventional commit format: <type>(<scope>): <description>
• I have run pnpm nx format to ensure consistent code formatting
• I have added tests for new functionality (if applicable)
• I have updated documentation (if applicable)

📝 Additional notes

Verified locally: pnpm audit --audit-level=high --prod --registry https://registry.npmjs.org reports no known vulnerabilities after the bump. I did not run the example app's Playwright tests or next build; CI will cover those.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: dc32a4a5-69b1-452b-8ed9-ecd087ca686c

📥 Commits

Reviewing files that changed from the base of the PR and between 817c2c1 and 1df9885.

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 1

• packages/core/realtime-js/example/package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the Next.js version used by the example app.

The example app's next dependency range changed from ^16.3.8 to ^16.4.1.

Priority: ⬆️ High

Change: Other

Merge Risk: ⚪ Minimal · up to 1df98

The dependency update is mergeable with no actionable risk identified.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2787

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2787

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2787

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2787

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2787

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2787

commit: 1df9885

[PragTob]

[coveralls]

coverage: 82.263%. first build — fix/realtime-example-next-audit into master

[coveralls]

coverage: 82.263%. first build — fix/realtime-example-next-audit into master