[dennis0405]

Summary

• upgrade Next.js from 14.1.0 to maintenance LTS 15.5.21
• keep the Pages Router on React 18.2.0, which Next.js 15 officially supports, to avoid mixing React runtimes with the React Native workspace
• upgrade Axios to 1.19.0 and Swagger UI to 5.32.13
• pin patched Sharp, PostCSS, and Nanoid versions for the hoisted pnpm workspace
• move outputFileTracingRoot to the stable Next.js 15 config location

Security result

• before: 1 critical / 31 high production audit findings
• after: 0 critical / 5 high
• all remaining high findings are mobile-only, non-reachable paths:
  • undici: transitive Firebase web SDK WebSocket client under React Native Firebase; the app uses native Firebase modules
  • image-size: Metro build-time parser limited to trusted repository assets
• no reachable web critical/high finding remains

Verification

• pnpm verify — 6/6 tasks passed; web 43 tests, mobile 82 tests
• pnpm --dir apps/mobile run bundle:android
• pnpm --dir apps/mobile run bundle:ios
• pnpm --filter allclear-web build
• web peer dependency check: no bad/missing/conflicting peers
• Next.js 15.5.21, React/React DOM 18.2.0, Sharp 0.35.3 verified in the installed graph
• vulnerable overridden versions absent from pnpm-lock.yaml

References

• Next.js July 2026 security release: https://nextjs.org/blog
• Next.js 15 Pages Router React 18 compatibility: https://nextjs.org/blog/next-15
• pnpm scoped overrides: https://pnpm.io/settings/dependency-resolution#overrides
• Axios 1.19.0 changelog: https://github.com/axios/axios/blob/v1.x/CHANGELOG.md
• Sharp 0.35 changelog: https://sharp.pixelplumbing.com/changelog/v0.35.0/