[cursor]

Description

Vanta reports six open findings on the javascript repository. This PR patches the Next.js findings. The other three dependencies have no compatible patched release on the line their dependents accept.

Next.js 15.5.28 → 15.5.29 (KNO-16649)

Example apps and the @knocklabs/react devDependency pin Next.js exactly. Those pins move to 15.5.29, the 15.5 patch from the November 2026 security release.

• AIKIDO-2026-187031 (medium): Edge routes that set cookies with NextResponse.cookies.set() expose them on x-middleware-set-cookie. GHSA-f3mh-rxg3-f5g2. Remediate by 2026-12-04.
• AIKIDO-2026-53139 / CVE-2026-119347 (medium): Image Optimization can treat an SVG as AVIF and bypass images.dangerouslyAllowSVG: false. GHSA-7qx7-33qx-rqx2. Remediate by 2026-12-04.
• AIKIDO-2026-634910 / CVE-2026-119348 (medium): self-hosted apps can forward decompressed bodies with compressed framing headers. GHSA-pc58-hwjq-p385. Remediate by 2026-12-04.

Still open, not changed in this PR

• minimatch 9.0.9, CVE-2026-118764 (medium), remediate by 2026-12-01. KNO-16440. The fix is 11.0.1. There is no 9.x or 10.x patch. Minimatch 11 removes makeRe(), which glob@10 still calls.
• glob 13.0.6, CVE-2026-118773 (low), remediate by 2026-12-16. KNO-16489. The fix is 14.0.2. Expo and rimraf still request glob@^13.
• yargs 17.7.2, AIKIDO-2026-922647 (low), remediate by 2026-12-12. KNO-16335. The fix is 18.1.0. Metro and React Native codegen still request yargs@^17.6.2.

ajv 6.12.6 (CVE-2025-69873) is no longer in the scan after #1103.

Checklist

• Tests have been added for new features or major refactors to existing features.

  

[changeset-bot]

🦋 Changeset detected

Latest commit: 1c86a24

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@knocklabs/react	Patch
ms-teams-connect-example	Patch
nextjs-app-dir-example	Patch
nextjs-example	Patch
slack-connect-example	Patch
slack-kit-example	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
javascript-ms-teams-connect-example	Ready	Preview	Nov 5, 2026 12:14pm UTC
javascript-nextjs-example	Ready	Preview	Nov 5, 2026 12:14pm UTC
javascript-slack-connect-example	Ready	Preview	Nov 5, 2026 12:14pm UTC
javascript-slack-kit-example	Ready	Preview	Nov 5, 2026 12:14pm UTC

[linear-code]

KNO-16649

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.48%. Comparing base (ca39f68) to head (1c86a24).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1105   +/-   ##
=======================================
  Coverage   78.48%   78.48%           
=======================================
  Files         140      140           
  Lines        4508     4508           
  Branches     1314     1314           
=======================================
  Hits         3538     3538           
  Misses        873      873           
  Partials       97       97           

[cursor]

Could not approve: GitHub blocks this automation from approving its own pull request. This is a Next.js 15.5.28 → 15.5.29 dependency update with green CI, but human review is needed and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: SDK approver}

[cursor]

Approval criteria are met (patch Next.js 15.5.28 → 15.5.29 with green CI), but GitHub blocked this agent from approving its own pull request. Human review is needed to approve and merge; no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Depdency updates (control, switchboard, CLI, javascript, telegraph)}