Update lukevella/rallly Docker tag to v4.15.4 #91

Merged

jlab-renovate-bot merged 1 commits from renovate/lukevella-rallly-4.15.x into main 2026-10-06 11:26:32 +02:00

Conversation 1 Commits 1 Files Changed 1

+2 -2

jlab-renovate-bot commented 2026-10-06 11:04:11 +02:00

Member

Copy link

Copy source

This PR contains the following updates:

Package	Type	Update	Change
lukevella/rallly	app-version	patch	4.15.3 → 4.15.4

---

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

lukevella/rallly (lukevella/rallly)

v4.15.4

Compare Source

🔒 Critical security fix: remote code execution in poll preview images

This patch fixes a critical vulnerability in an upstream dependency. Please upgrade as soon as possible.

Rallly v4.8.0 through v4.15.3 ship a version of Next.js affected by GHSA-vcvr-r3jv-pc5j (critical, CVSS 9.5). The ImageResponse renderer from next/og can be made to execute code on the server when attacker-controlled text reaches the image it renders.

Rallly uses that renderer for poll link previews at /api/og-image-poll, and the poll title and author come straight from the query string. That endpoint needs no sign-in, so anyone who can reach your instance can send a crafted request.

This release upgrades Next.js from 16.3.3 to 16.3.8, which contains the fix. Nothing else changes.

If you can't upgrade right away, block /api/og-image-poll at your reverse proxy until you can. Shared poll links will show no preview image in the meantime; nothing else is affected.

What's Changed

• 🔒️ Upgrade Next.js to 16.3.8 to patch next/og RCE (#​3451)

Full Changelog: https://github.com/lukevella/rallly/compare/v4.15.3...v4.15.4

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [lukevella/rallly](https://github.com/lukevella/rallly) | app-version | patch | `4.15.3` → `4.15.4` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/4) for more information. --- ### Release Notes <details> <summary>lukevella/rallly (lukevella/rallly)</summary> ### [`v4.15.4`](https://github.com/lukevella/rallly/releases/tag/v4.15.4) [Compare Source](https://github.com/lukevella/rallly/compare/v4.15.3...v4.15.4) #### 🔒 Critical security fix: remote code execution in poll preview images *This patch fixes a critical vulnerability in an upstream dependency. Please upgrade as soon as possible.* Rallly v4.8.0 through v4.15.3 ship a version of Next.js affected by [GHSA-vcvr-r3jv-pc5j](https://github.com/advisories/GHSA-vcvr-r3jv-pc5j) (critical, CVSS 9.5). The `ImageResponse` renderer from `next/og` can be made to execute code on the server when attacker-controlled text reaches the image it renders. Rallly uses that renderer for poll link previews at `/api/og-image-poll`, and the poll title and author come straight from the query string. That endpoint needs no sign-in, so anyone who can reach your instance can send a crafted request. This release upgrades Next.js from 16.3.3 to 16.3.8, which contains the fix. Nothing else changes. **If you can't upgrade right away,** block `/api/og-image-poll` at your reverse proxy until you can. Shared poll links will show no preview image in the meantime; nothing else is affected. ##### What's Changed - 🔒️ Upgrade Next.js to 16.3.8 to patch next/og RCE ([#&#8203;3451](https://github.com/lukevella/rallly/issues/3451)) **Full Changelog**: <https://github.com/lukevella/rallly/compare/v4.15.3...v4.15.4> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzguMCIsInVwZGF0ZWRJblZlciI6IjQ0LjEzOC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhcHAtdmVyc2lvbiIsInJlbm92YXRlIl19-->

jlab-renovate-bot added the renovate label 2026-10-06 11:04:11 +02:00

jlab-renovate-bot added 1 commit 2026-10-06 11:04:11 +02:00

Update lukevella/rallly Docker tag to v4.15.4 40e29f7f72

jlab-renovate-bot scheduled this pull request to auto merge when all checks succeed 2026-10-06 11:04:12 +02:00

jklein approved these changes 2026-10-06 11:26:31 +02:00

jlab-renovate-bot merged commit 40e29f7f72 into main 2026-10-06 11:26:32 +02:00

jlab-renovate-bot deleted branch renovate/lukevella-rallly-4.15.x 2026-10-06 11:26:32 +02:00

Sign in to join this conversation.

Reviewers

No Reviewers

jklein

Labels

Clear labels

inhouse-chart

Inhouse-Chart aus der JLab-Git-Paketregistry

renovate

Von Renovate angelegt

No labels renovate

Milestone

No items

No Milestone

Assignees

Clear assignees

jklein (Justin Klein) jlab-bot (jlab-git-bot) jlab-renovate-bot (jlab-renovate-bot)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: jlab-cluster/helm-charts#91