Skip to content

Update Nissuer to alert for vulnerability reports #78417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Apr 29, 2025
Merged

Update Nissuer to alert for vulnerability reports #78417

merged 2 commits into from
Apr 29, 2025
+2 −0

Conversation

jackwilson323
Copy link
Contributor

What?

We use Nissuer to assist in triaging new GitHub Issues. This PR updates our Nissuer config to send alerts to a webhook endpoint if Nissuer detects a possible security report/responsible disclosure via a public GitHub Issue.

Why?

So we can be alerted in a timely manner to possible public disclosures of unresolved security issues in Next.js

How?

Nissuer performs keyword detection and sends an alert to a webhook if any keywords are detected in a newly-raised GitHub Issue.

Note: we must also set the appropriate NISSUER_WEBHOOK_URL and NISSUER_WEBHOOK_SECRET environmental variables on the repository for this to be effective.

@jackwilson323 jackwilson323 self-assigned this Apr 22, 2025
@ijjk
Copy link
Member

ijjk commented Apr 29, 2025

Failing test suites

Commit: fb92928

pnpm test-dev-turbo test/e2e/app-dir/actions/app-action.test.ts (turbopack)

  • app-dir action handling > should forward action request to a worker that contains the action handler (node)
  • app-dir action handling > should forward action request to a worker that contains the action handler (edge)
Expand output

● app-dir action handling › should forward action request to a worker that contains the action handler (node)

page.waitForSelector: Timeout 10000ms exceeded.
Call log:
  - waiting for locator('#other-page')

  454 |   waitForElementByCss(selector: string, timeout = 10_000) {
  455 |     return this.startChain(async () => {
> 456 |       const el = await page.waitForSelector(selector, {
      |                             ^
  457 |         timeout,
  458 |         state: 'attached',
  459 |       })

  at waitForSelector (lib/browsers/playwright.ts:456:29)
  at e2e/app-dir/actions/app-action.test.ts:892:7
  at Proxy._chain (lib/browsers/playwright.ts:568:23)
  at Proxy._chain (lib/browsers/playwright.ts:549:17)
  at Proxy.startChain (lib/browsers/playwright.ts:455:17)
  at waitForElementByCss (e2e/app-dir/actions/app-action.test.ts:895:10)

● app-dir action handling › should forward action request to a worker that contains the action handler (edge)

page.waitForSelector: Timeout 10000ms exceeded.
Call log:
  - waiting for locator('#other-page')

  454 |   waitForElementByCss(selector: string, timeout = 10_000) {
  455 |     return this.startChain(async () => {
> 456 |       const el = await page.waitForSelector(selector, {
      |                             ^
  457 |         timeout,
  458 |         state: 'attached',
  459 |       })

  at waitForSelector (lib/browsers/playwright.ts:456:29)
  at e2e/app-dir/actions/app-action.test.ts:892:7
  at Proxy._chain (lib/browsers/playwright.ts:568:23)
  at Proxy._chain (lib/browsers/playwright.ts:549:17)
  at Proxy.startChain (lib/browsers/playwright.ts:455:17)
  at waitForElementByCss (e2e/app-dir/actions/app-action.test.ts:895:10)

Read more about building and testing Next.js in contributing.md.

@ijjk ijjk merged commit f3f8416 into canary Apr 29, 2025
79 of 122 checks passed
@ijjk ijjk deleted the jackwilson323/add-nissuer-notifier branch April 29, 2025 17:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ijjk ijjk ijjk approved these changes

@balazsorban44 balazsorban44 Awaiting requested review from balazsorban44

Assignees

@jackwilson323 jackwilson323

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jackwilson323 @ijjk