Daily security sweep — backlog

[benfrank241]

Running log from the daily security sweep of items that could not be shipped as part of a bundle, or that block verification. Newest entries appended at the bottom.

---

2026-08-26 — npm run build / npm run lint fails on main (pre-existing, blocks bundle verification)

Not caused by a dependency bump. Recorded here because it makes npm run build exit non-zero for every PR, so the sweep cannot use a green build as its signal in this repo.

• Repo: vectorize-io/test-vectorize-connect-sdk
• Step: npm run build (next build runs ESLint before emitting) and npm run lint
• Reproduces on: unmodified main @ ffc649b, and identically on the sweep branch chore/security-daily-20260826-test-vectorize-connect-sdk-npm-root — byte-identical output on both, so the bundle in chore(security): daily sweep 2026-08-26 — bundle 20 Dependabot fixes (npm, root package-lock.json) #16 introduces no lint delta.

Exact signature:

Failed to compile.

./src/app/api/createSourceConnector/route.ts
116:19  Error: Unexpected any. Specify a different type.  @typescript-eslint/no-explicit-any

./src/app/api/manage-oauth-user/[connectorId]/route.ts
16:34  Error: Unexpected any. Specify a different type.  @typescript-eslint/no-explicit-any

Plus 4 non-fatal @typescript-eslint/no-unused-vars warnings in src/app/api/getVectorizeConfig/route.ts:9, src/app/api/googleDrive/getGoogleOAuthConfig/route.ts:8, src/app/dropbox/page.tsx:44, src/app/googleDrive/page.tsx:44.

TypeScript itself is clean (npx tsc --noEmit exits 0), and the Next.js compile step succeeds — it is only the ESLint gate that fails.

Suggested fix: type the two any values, or add targeted // eslint-disable-next-line @typescript-eslint/no-explicit-any comments. Two-line change.

Also noted: next lint prints `next lint` is deprecated and will be removed in Next.js 16 — this repo will need the ESLint CLI migration (npx @next/codemod@canary next-lint-to-eslint-cli .) before any Next 16 upgrade.

---

2026-08-26 — PR #14 is stale and should be closed

Not a verification failure, but it needs a human decision.

#14 ("upgrade Next.js to 15.5.9 to patch CVE-2025-55184 and CVE-2025-55183", opened 2025-12-12) moves next from ^15.5.7 → ^15.5.9. main has been on ^15.5.18 since #15 landed, so #14 is now a downgrade and GitHub already reports it as CONFLICTING / DIRTY. Neither CVE-2025-55184 nor CVE-2025-55183 appears in the current open-alert set, and 15.5.9 cannot close any of the 8 open next alerts, which all require ≥ 15.5.21.

Recommend closing #14 as superseded by #16, which takes next to 15.5.24.

---

2026-08-26 — no other backlog items

All 20 open Dependabot alerts were bundled into #16 and verified. Nothing was dismissed, and nothing had to be dropped for a conflict or an ERESOLVE.

[benfrank241]

2026-09-02 sweep — pre-existing lint failure still reproduces (still not a bundle blocker)

Confirming the npm run build / npm run lint entry above is unchanged as of today's sweep, now on main @ d6f92b2.

The same 2 errors and 4 warnings reproduce byte-identically on unmodified main and on the sweep branch chore/security-daily-20260902-test-vectorize-connect-sdk-npm-root (PR #18) — normalized signature sets diff empty, so that bundle introduces no lint delta either.

To keep a real verification signal despite the broken gate, both sides were also built with the ESLint gate bypassed locally (temporary, uncommitted next.config.ts edit, reverted afterwards):

• both builds exit 0
• emitted stylesheet is byte-identical between the two dependency sets (.next/static/css/aad988ea4aad36b6.css, 12974 bytes)

The suggested two-line fix in the entry above still applies and would restore npm run build as a usable check for this repo.