fix(deps): bump next to 15.5.25 (GHSA-p293-qw3h-jr36, GHSA-2xp9-vwfh-vxw4) - #64
Merged
Conversation
…vxw4) Raise the next specifier in examples/nextjs/package.json from ^15.5.23 to ^15.5.25 and move the lockfile resolution of next and its @next/env and @next/swc-* siblings from 15.5.23 to 15.5.25. No other packages changed. The root package.json and packages/webmcp-server do not depend on next. next < 15.5.24 is affected by two critical advisories: - GHSA-p293-qw3h-jr36 (CVE-2026-75604): unauthenticated remote code execution on Windows-hosted servers. - GHSA-2xp9-vwfh-vxw4: unauthenticated remote code execution in the Image Optimization API when AVIF files are used. Resolves Dependabot alerts #131 and #132.
kashishhora
approved these changes
Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
examples/nextjs/package.json:nextdependency specifier^15.5.23->^15.5.25.pnpm-lock.yaml:next15.5.23 -> 15.5.25.pnpm-lock.yaml:@next/env15.5.23 -> 15.5.25.pnpm-lock.yaml:@next/swc-darwin-arm64,@next/swc-darwin-x64,@next/swc-linux-arm64-gnu,@next/swc-linux-arm64-musl,@next/swc-linux-x64-gnu,@next/swc-linux-x64-musl,@next/swc-win32-arm64-msvc,@next/swc-win32-x64-msvc15.5.23 -> 15.5.25.package.jsonandpackages/webmcp-serverdo not depend onnext, so nothing else needed a change. Nopnpm.overridesentry was added or left behind.Why
Fixes Dependabot alerts #131 and #132:
Advisories (both patched in
next>= 15.5.24; this PR resolves to 15.5.25, the latest 15.5.x):next>= 13.4.0, < 15.5.24).next>= 10.0.0, < 15.5.24).Verification
Run locally from a fresh worktree on Node v22.23.2 with pnpm 10.34.5 (
npx -y pnpm@10, matching CI'spnpm/action-setupversion 10). Allnode_modulesdirectories were deleted before the frozen install.npx -y pnpm@10 install(after editing the specifier)nextand@next/*15.5.23 -> 15.5.25.rm -rfeverynode_modules;npx -y pnpm@10 install --frozen-lockfilenpx -y pnpm@10 buildnpx -y pnpm@10 typechecknpx -y pnpm@10 lintnpx -y pnpm@10 testnpx -y pnpm@10 --filter webmcp-bridge-extension buildnpx -y pnpm@10 --filter webmcp-bridge-extension typechecknpx -y pnpm@10 buildinexamples/nextjs(next build, extra check not run by CI)grep -n "next@15" pnpm-lock.yamlnext@15.5.25ci (20)job.