[FE-4532] chore: update next to 15.5.24 for the August 2026 security release - #102
Merged
Merged
Conversation
Picks up the fixes for the two critical RCEs in the August 2026 Next.js security release: the libheif/sharp AVIF image-optimization RCE (GHSA-2xp9-vwfh-vxw4) and the Windows-filesystem RCE (CVE-2026-75604). 15.5.24 is the patched Maintenance LTS, so this stays on the v15 line rather than jumping to v16. next-env.d.ts picks up the typed-routes reference that 15.5 generates.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes FE-4532 (docs half).
What
Bumps
nextfrom15.3.8to15.5.24.Why
The August 2026 Next.js security release patches two critical severity vulnerabilities.
15.5.24is the patched Maintenance LTS, so this stays on the v15 line rather than jumping to v16.sharp). The patch disables AVIF optimization until the upstream fix lands.next.config.mjssets noimagesconfig so AVIF was never in the defaultformats. Patched regardless.Scope
This crosses a minor (
15.3to15.5) because the patch only exists on the15.5maintenance line. Nextra is unaffected:nextra@4.6.1andnextra-theme-docs@4.6.1both declarenext: ">=14", and both resolve against15.5.24cleanly.Only
nextmoved inpackage.json. The lockfile diff isnext, its@next/swc-*binaries, and the peer-resolution strings fornextra/nextra-theme-docs/next-sitemap;@swc/counterdrops out asnext@15.5no longer depends on it.next-env.d.tsgains the./.next/types/routes.d.tsreference that 15.5 generates. That file is Next-generated and not hand-edited.Verification
All green locally on this branch:
pnpm install --frozen-lockfile(the CI lockfile gate)pnpm buildincluding the fullpostbuildchain: 130 static pages generated, Pagefind indexed 125 pages / 8280 words, sitemap generated,llms.txtwrote 122 pages across 21 sections, 122 markdown pages writtentsc --noEmit: no errorsThe
metadataBasewarnings during the build are pre-existing and unrelated to this bump.