Skip to content

fix(deps): bump next to 15.5.27 for critical RCE advisories - #141

Open
nibzard wants to merge 1 commit into
mainfrom
fix/next-15.5.27-security
Open

nibzard wants to merge 1 commit into
mainfrom
fix/next-15.5.27-security

Conversation

@nibzard

@nibzard nibzard commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Fixes the two open critical Dependabot alerts (#83, #84) on next 15.5.21:

  • Unauthenticated RCE in the Image Optimization API when AVIF files are used (>= 10.0.0, < 15.5.24)
  • Unauthenticated RCE on Windows-hosted servers (>= 13.4.0, < 15.5.24)

Bumps next to 15.5.27, the latest 15.5 patch. The lockfile diff is only next and its @next/* platform packages.

The lockfile was regenerated with bun 1.4.2 to match CI. Older bun versions cannot parse this lockfile and re-resolve every dependency.

Verification

  • bun install --frozen-lockfile
  • bun run typecheck
  • bun test: 332 pass, 0 fail
  • bun run build: succeeds

@vercel

vercel Bot commented Oct 7, 2026 •

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs Ready Ready Preview Oct 7, 2026 9:47am UTC

Request Review

This branch was successfully deployed

1 active deployment
Preview — 7707ee5f Deployed Oct 7, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant