3 people 6500b08d1a fix(scan): capture every chunk in next.js build manifest arrays (#345) ...

the manifest maps each route to an array of chunk paths, but the regex anchored on the opening bracket so only the first .js literal per array was captured, dropping the remaining chunks from the script list.

match each quoted chunk path instead, scoped to the relative static/ shape (literal or escaped slash) so non-chunk .js strings such as __rewrites destinations, which can be attacker-controlled absolute urls, are not pulled into the fetch list.

Co-authored-by: vmfunc <vmfunc.lc@gmail.com>

2026-07-22 21:54:46 +00:00

..

next_test.go

fix(scan): capture every chunk in next.js build manifest arrays (#345)

2026-07-22 21:54:46 +00:00

next.go

fix(scan): capture every chunk in next.js build manifest arrays (#345)

2026-07-22 21:54:46 +00:00

stdout_bypass_test.go

fix(store,logger,scan): concurrency-adjacent races and correctness fixes (#343)

2026-07-22 12:55:08 -07:00