Release v0.5.7

Merged
LC
1mo ago
+70-67

Release v0.5.7

Bumps version from 0.5.6 to 0.5.7. Promotes dev ā†’ main.

Changelog

Security

  • Next.js 16.3.8: the web app template requires next and eslint-config-next at ^16.3.8 and locks 16.3.8, past the critical remote-code-execution advisory in next/og's ImageResponse that affects Next.js 16.2.0 through 16.3.5 (GHSA-vcvr-r3jv-pc5j). The template does not import next/og, but a project made from it inherits the lock and could. The lock also takes the patched brace-expansion and fast-uri, so npm audit reports nothing.

Closes L-261001-2be22c

šŸ¤– Generated with Claude Code

https://claude.ai/code/session_01PCf9tysTErgWaFcPZW1vPY

Summary by cubic

Releases v0.5.7, promoting dev ā†’ main and bumping the version from 0.5.6 across all packages.

Security

  • Bumps next and eslint-config-next to ^16.3.8, past the critical remote-code-execution advisory in next/og's ImageResponse (GHSA-vcvr-r3jv-pc5j, affects 16.2.0ā€“16.3.5).
  • The template doesn't import next/og, but projects made from it inherit the lock and could.
  • Re-locks patched brace-expansion and fast-uri so npm audit reports nothing.

Removes the /wip/ entry from .gitignore; the planning notes it protected now live in the workspace's own wip repository.