Possible fix(deps): 17 vulnerable dependencies in package-lock.json

[begininvoke]

I think there may be a problem in package-lock.json around line 4649.

The project uses Next.js 15.5.6, which includes vulnerable React Server Components that deserialize attacker‑controlled data in Server Function endpoints. An unauthenticated attacker can craft a malicious HTTP request that triggers remote code execution on the server, leading to full compromise of the application and its environment. This is a pre‑authentication RCE with a CVSS score in the critical range, so the risk level is CRITICAL and immediate remediation is required.

Something like this might fix it:

*** Begin Patch
*** Update File: package.json
@@
-  "next": "15.5.6",
+  "next": "15.5.7",
*** End Patch
*** Begin Patch
*** Update File: package-lock.json
@@
-        "version": "15.5.6",
-        "resolved": "https://registry.npmjs.org/next/-/next-15.5.6.tgz",
-        "integrity": "sha512-OLD_HASH==",
+        "version": "15.5.7",
+        "resolved": "https://registry.npmjs.org/next/-/next-15.5.7.tgz",
+        "integrity": "sha512-NEW_HASH==",
*** End Patch
*** End Patch

For reference: rule CVE-2025-55182. Rated critical.

I may be wrong about this one — closing it costs you nothing if so.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.