General batch script that can be applied to remediate vulnerabilities from CVE-2025-66478

nextjs-rsc-rce.general.yaml

version: 2
name: nextjs-rsc-rce-remediation
description: Upgrade Next.js to patched versions for the React Server Components RCE-related vulnerability profile.

on:
  # Match any repo whose package.json has a vulnerable Next.js version
  # (15.x pre-patch, 16.0.x pre-patch, or 14.3.0-canary).
  - repositoriesMatchingQuery: >
      file:package.json
      patterntype:regexp
      "next":\s*"[~^]?(15\.0\.[0-4]|15\.1\.[0-8]|15\.2\.[0-5]|15\.3\.[0-5]|15\.4\.[0-7]|15\.5\.[0-6]|16\.0\.[0-6]|14\.3\.0-canary)"

steps:
  - run: |
      set -euo pipefail

      files="${{ join repository.search_result_paths " " }}"

      for file in $files; do
        echo "Patching $file"

        SG_FILE="$file" node -e '
          const fs = require("fs");
          const path = process.env.SG_FILE;
          if (!path) process.exit(0);

          const pkg = JSON.parse(fs.readFileSync(path, "utf8"));

          const getField = () => {
            if (pkg.dependencies && pkg.dependencies.next) return ["dependencies", pkg.dependencies.next];
            if (pkg.devDependencies && pkg.devDependencies.next) return ["devDependencies", pkg.devDependencies.next];
            return [null, null];
          };

          const stripRange = (v) => v.replace(/^[~^]/, "");

          const [section, current] = getField();
          if (!section || !current) {
            console.log(`No next dependency found in ${path}, skipping`);
            process.exit(0);
          }

          const v = stripRange(current);

          let target = null;

          // Map vulnerable ranges to patched versions.
          if (v.startsWith("15.0.")) target = "15.0.5";
          else if (v.startsWith("15.1.")) target = "15.1.9";
          else if (v.startsWith("15.2.")) target = "15.2.6";
          else if (v.startsWith("15.3.")) target = "15.3.6";
          else if (v.startsWith("15.4.")) target = "15.4.8";
          else if (v.startsWith("15.5.")) target = "15.5.7";
          else if (v.startsWith("16.0.")) target = "16.0.7";
          else if (v.startsWith("14.3.0-canary")) target = "14";
          else {
            console.log(`next version ${current} not in targeted range, leaving as-is`);
            process.exit(0);
          }

          pkg[section].next = target;
          fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + "\n");
        '
      done

      # Best-effort lockfile refresh per repo; tolerate failures.
      if [ -f package-lock.json ]; then
        npm install --package-lock-only || true
      elif [ -f pnpm-lock.yaml ]; then
        pnpm install --lockfile-only || true
      elif [ -f yarn.lock ]; then
        yarn install --mode update-lockfile || yarn install --mode update-lockfile || true
      fi
    container: node:22

changesetTemplate:
  title: "chore: upgrade Next.js for RSC-related RCE fixes"
  body: |
    Upgrade Next.js from vulnerable 15.x / 16.0.x / 14.3.0-canary versions
    to patched releases aligned with the React Server Components RCE fix.

    This batch change updates the "next" dependency in package.json to a
    safe version per-minor (e.g. 15.0.x → 15.0.5).
  branch: security/nextjs-rsc-rce-remediation
  commit:
    message: "chore: upgrade Next.js for RSC-related RCE fixes"