ahmed/anwar-pi-website
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 3 Wiki Activity

fix: revert to next 15.4.11 (payload peer ceiling), record CVE risk acceptance

Browse Source 
@payloadcms/next@3.90.2 peer-requires next <15.5.0; 15.5.27 was an
unsupported combo. Owner chose the pin + documented risk (SECURITY.md
§8). Transitive overrides (undici/sharp/postcss/sass) stay.
Gate skipped: parallel session WIP still in tree.
This commit is contained in:
AHMED
2026-10-13 06:02:15 +03:00
parent e35d908672
commit 26d662ed7c
4 changed files with 72 additions and 290 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ARCHITECTURE.md
+12 -12
View File
@@ -4,18 +4,18 @@
## 1. Stack (pinned 2026-10-11)
| Layer | Choice | Version |
| ----------------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| Framework | Next.js App Router (server components first) | next@15.5.27 (CVE-driven bump from 15.4.11, owner-approved 2026-10-13) |
| CMS / API / admin | Payload 3 (Next-native, Lexical rich text) | ^3.60.0 |
| Database | PostgreSQL | postgres:16 (container) |
| DB adapter | @payloadcms/db-postgres (Drizzle migrations) | ^3.60.0 |
| UI runtime | React | ^19.2.0 |
| Styling | Hand-rolled CSS (`src/app/design.css` + per-route CSS). No Tailwind, no component library. | — |
| Payments | stripe | ^18.5.0 (scaffolded, gated by `billingEnabled()`) |
| Email | Cloudflare Email REST API (ADR-0003) — **never SMTP** | — |
| Language | TypeScript strict | ^5.9.0 |
| Deploy | Docker Compose on VPS `root@147.79.102.201:/root/anwarpi`, Traefik proxy network, apex anwarpy.ai (www 308) | — |
| Layer | Choice | Version |
| ----------------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| Framework | Next.js App Router (server components first) | next@15.4.11 — ceiling of `@payloadcms/next` peer support; known CVEs risk-accepted (SECURITY.md §8) |
| CMS / API / admin | Payload 3 (Next-native, Lexical rich text) | ^3.60.0 |
| Database | PostgreSQL | postgres:16 (container) |
| DB adapter | @payloadcms/db-postgres (Drizzle migrations) | ^3.60.0 |
| UI runtime | React | ^19.2.0 |
| Styling | Hand-rolled CSS (`src/app/design.css` + per-route CSS). No Tailwind, no component library. | — |
| Payments | stripe | ^18.5.0 (scaffolded, gated by `billingEnabled()`) |
| Email | Cloudflare Email REST API (ADR-0003) — **never SMTP** | — |
| Language | TypeScript strict | ^5.9.0 |
| Deploy | Docker Compose on VPS `root@147.79.102.201:/root/anwarpi`, Traefik proxy network, apex anwarpy.ai (www 308) | — |
## 2. Repository layout