Repository navigation
Raise next/MCP SDK pins and treat external pins as caret floors - #30
Conversation
- Treat external pins as caret floors in doctor - Raise Next.js and MCP SDK security floors
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2bc8c62881
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - **Hosted sign-in on the API host.** The API mounts the hosted pages from `@codelitdev/oauth-server-kit` (`createOAuthPagesRouter`). The web app's `/login` sends the browser to `<api>/login?redirect=<web URL>`. After sign-in the hosted page redirects back only to origins in `allowedRedirectOrigins`, which is the product's configured web origin. | ||
| - **Session cookie shared across subdomains.** Better Auth sets a product-specific `advanced.cookiePrefix` (`sendlit`, `frontlit`, `medialit`) and `crossSubDomainCookies` with `domain` taken from `AUTH_COOKIE_DOMAIN`, the shared parent domain. The cookie is HttpOnly, Secure, and SameSite=Lax. Without a cookie domain the cookie stays host-only on the API host and the web app never sees the session, so every deployment with separate API and web hostnames sets it. Local development leaves it unset because `localhost` cookies are not port-scoped. |
There was a problem hiding this comment.
Readers using the reference product or template would be directed to a flow the apps do not implement: apps/web/app/login/page.tsx renders an OTP form that calls /api/auth/* through the same-origin BFF, rather than redirecting to API-host /login, and referenceAuthOptions does not set the advanced cookie settings described here. This section therefore misstates the shipped auth behavior and may lead adopters to configure a cross-subdomain session flow the template does not provide; align the docs with the code or add the corresponding product-auth configuration.
AGENTS.md reference: AGENTS.md:L4-L4
Useful? React with 👍 / 👎.
# Conflicts: # bun.lock # packages/mcp-server-kit/package.json # packages/platform-cli/src/preset.json # templates/saas-product/apps/web/package.json
Fixes #14.
Why
doctorrequired external deps to match the preset pin exactly, so products that took security fixes (e.g.nextpast 16.3.6, codelitdev/sendlit#21, codelitdev/medialit#193) failed conformance until a new CLI release.What
doctortreats each external pin as a caret floor: at or above the pin on the same major (same minor while major is 0) passes; older or next-major fails asexternal_mismatch.createstill writes the exact pin.@modelcontextprotocol/sdkpreset floor 1.30.0 → 1.32.1 for products still on SDK v1. (nextis already 16.4.3 on main via fix(platform-cli): pin next 16.4.3 and Bun 1.4.4; let sync record a reconciled file #26;mcp-server-kitmoved to SDK 2 in Serve MCP 2026-07-28 statelessly from mcp-server-kit #15.)next^16.3.4→^16.4.1(resolves 16.4.5).platform-cli.Trade-off
Conformance no longer proves products run the exact externals the template was tested with; minor releases are trusted. When an advisory hits a pinned package, raise the template pin to exclude the vulnerable version.
Verification
bun run verifypasses after mergingmain.template:smokenot run.🤖 Generated with Claude Code