Engineering
Next.js pulled its security release forward. Go patch, then check your lockfile.
Vercel moved the August Next.js release to the 25th and it now covers two critical vulnerabilities instead of one. Meanwhile a self-replicating npm worm chewed through keyv, flat-cache and cacheable. Two supply-chain fires in one week.
August 25, 20263 min readBhagath Krishna