Hold: Next 16.2.6 / React 19.2.6 bump (Shai-Hulud)

[tjpinder]

Status: HELD

package.json is intentionally pinned to:

• next@16.2.4 (latest is 16.2.6)
• react@19.2.5 (latest is 19.2.6)
• react-dom@19.2.5 (latest is 19.2.6)

These versions match package-lock.json. The minor bump is being held because regenerating the lockfile during the active Shai-Hulud supply-chain worm window (started 2026-05-12) means resolving arbitrary transitive package versions from a registry that is actively being attacked. ~170 packages were compromised May 11-12, 2026.

Re-apply criteria

Lift the hold when all of the following are true:

• Wiz / Snyk / Socket advisory feeds show no new Shai-Hulud-family compromises in the last 14 days
• The compromised packages (@tanstack/react-router, @mistralai/*, @opensearch-project/opensearch, @uipath/*, etc.) have been unpublished from npm or marked deprecated
• GitHub Advisory Database shows no active "supply-chain compromise" advisories for the npm ecosystem in the last 7 days
• The .claude/hooks/block-installs.js hook in the IdeaLogger repo has been removed (signal that the local environment is no longer in moratorium mode)

Re-apply procedure (once cleared)

1. In a clean checkout, run the package manager to regenerate package-lock.json against next@16.2.6 / react@19.2.6.
2. Verify the new lockfile only resolves expected packages — no surprise transitive additions.
3. Commit package.json + package-lock.json together. Do not commit one without the other.
4. Watch the first deploy carefully for any regression.

Daily watch

A central cron in Startvest-LLC/marketing-agent (.github/workflows/shai-hulud-watch.yml) posts to Discord once a day with the current advisory feed state. When that signal goes green for 14 consecutive days, this issue is the next thing to action.

Related

• TIF revert PR (when worm hit): fix: revert next/react bump to match lockfile (Shai-Hulud hold) #27
• AdaCompliance revert PR: https://github.com/Startvest-LLC/adacompliancedocs/pull/151
• IdeaLogger hook source: .claude/hooks/block-installs.js