From 4ce8e3453517559322be3e4c572cf7e8b6de8228 Mon Sep 17 00:00:00 2001 From: Naseem Alnaji Date: Fri, 11 Sep 2026 18:21:51 +0000 Subject: [PATCH] fix(deps): bump next to 15.5.25 (GHSA-p293-qw3h-jr36, GHSA-2xp9-vwfh-vxw4) Raise the next specifier in examples/nextjs/package.json from ^15.5.23 to ^15.5.25 and move the lockfile resolution of next and its @next/env and @next/swc-* siblings from 15.5.23 to 15.5.25. No other packages changed. The root package.json and packages/webmcp-server do not depend on next. next < 15.5.24 is affected by two critical advisories: - GHSA-p293-qw3h-jr36 (CVE-2026-75604): unauthenticated remote code execution on Windows-hosted servers. - GHSA-2xp9-vwfh-vxw4: unauthenticated remote code execution in the Image Optimization API when AVIF files are used. Resolves Dependabot alerts #131 and #132. --- examples/nextjs/package.json | 2 +- pnpm-lock.yaml | 82 ++++++++++++++++++------------------ 2 files changed, 42 insertions(+), 42 deletions(-) diff --git a/examples/nextjs/package.json b/examples/nextjs/package.json index 004b425..30150da 100644 --- a/examples/nextjs/package.json +++ b/examples/nextjs/package.json @@ -6,7 +6,7 @@ "build": "next build" }, "dependencies": { - "next": "^15.5.23", + "next": "^15.5.25", "react": "^19.2.8", "react-dom": "^19.2.8", "webmcp-react": "workspace:*", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index ea57bef..232ee91 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -94,8 +94,8 @@ importers: examples/nextjs: dependencies: next: - specifier: ^15.5.23 - version: 15.5.23(@types/node@25.3.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) + specifier: ^15.5.25 + version: 15.5.25(@types/node@25.3.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) react: specifier: ^19.2.8 version: 19.2.8 @@ -1027,57 +1027,57 @@ packages: os: [linux] libc: [glibc] - '@next/env@15.5.23': - resolution: {integrity: sha512-Mv3Z9hVbFcPnoLevsZ6rnX1TBtyHb5E17yN7HTPDXSXxeNsGBjUFrdbjRXKKXIOhfth7/cg6Ay7PZ2UFawaWsQ==} + '@next/env@15.5.25': + resolution: {integrity: sha512-42h1lLr07vl4gawALP1hsgRZjHB1xYa58JfUfHwr0f7jG/zhPakh5GHkADHXOC9ZxUvlQFOPIrp7s6qX4DezPQ==} - '@next/swc-darwin-arm64@15.5.23': - resolution: {integrity: sha512-SrEwOROH/rhA03F59hHtdhgtfZMWGzr5duDBWgRQt2rS3mJhqMKOcnNx6txOd0/i3E3D3uFKYFvyHsEiwQxzag==} + '@next/swc-darwin-arm64@15.5.25': + resolution: {integrity: sha512-w+RR0v/QuApnWEjRGm1z6gcObKwGMb5YPA7V3bzBEVSBpMFUXprer0tS27UxjUcEnqbhL7Zuzohej79B6rYmBg==} engines: {node: '>= 10'} cpu: [arm64] os: [darwin] - '@next/swc-darwin-x64@15.5.23': - resolution: {integrity: sha512-f0FpFbG2EhDCuptBGcfrLcYMDuQAhe6m1QA4VVfXFrIBoFXvXt/olGbBkYkloKlXQtmhuzvtdYyuu/6zf07GIg==} + '@next/swc-darwin-x64@15.5.25': + resolution: {integrity: sha512-QiGGBUSakt8S1H4Lt9Ehsh6Ja87axiBnQQgysOObvCbI7iUfJnRGntF1P64S4/ijuHFnSB8KLsEddkY3nN26uw==} engines: {node: '>= 10'} cpu: [x64] os: [darwin] - '@next/swc-linux-arm64-gnu@15.5.23': - resolution: {integrity: sha512-WlNtfepUXKX2u2ZsJZ8c3c8+tJSRZqsYzoMwLOY72A8ucKCCgxgNhiePA3qzFYahVWrwcQd8jOeJmBinc+VFVQ==} + '@next/swc-linux-arm64-gnu@15.5.25': + resolution: {integrity: sha512-ehLos/66zo0d/mJCU5u96a/VDcr01aaUrX0o/i16UdInxz8qPTCDSxGtjk/Lps1sIr1RJFdiX3hxc0fxJo+cPA==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] libc: [glibc] - '@next/swc-linux-arm64-musl@15.5.23': - resolution: {integrity: sha512-W/6qKk7UG93mg14PmQC+2urt69MIdwTBLNQ6MJyeC4wOCIHCjz+VfgssvS1pK7mgYBtLC1g6VKNoHD9xB0WWGg==} + '@next/swc-linux-arm64-musl@15.5.25': + resolution: {integrity: sha512-ZVMrqLiJ7DiChgmbkQwFtdhAnUkSH/4p7tB29QY+giATb0Q/XGHNRSKAb/B8XGDHRUaA67NepOW5W8u3ZRJBAA==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] libc: [musl] - '@next/swc-linux-x64-gnu@15.5.23': - resolution: {integrity: sha512-vzefI32mi6VMk96RaTAyxApgfGbiFzQBXVsekEjsDv1fr48mlABTWx0sUYhaYCBHWqCalxmz3DxbxFcbFvzNtw==} + '@next/swc-linux-x64-gnu@15.5.25': + resolution: {integrity: sha512-UOewtDGkTMJTiODrEdeLZ50yGb59xCZSriNpXkfPMxRRgwDkGc7i8mLWqV5076wEdb+Ca/XN7MhJyM3CupyNyQ==} engines: {node: '>= 10'} cpu: [x64] os: [linux] libc: [glibc] - '@next/swc-linux-x64-musl@15.5.23': - resolution: {integrity: sha512-qppK/3dTGOTI+aoWWBZc3DshFIhrzgL8guATlaN9V6M1QJxbkP/rhEZ22tdICsQ/2WWXopMZ2Jokzj2u3uKY3Q==} + '@next/swc-linux-x64-musl@15.5.25': + resolution: {integrity: sha512-UBHwA8AhkCZgtRfU1aJpunuAJe/6gZv6jDESQe4p5MjTb5V0YEeJBWCdNqx15Vj3x+5jmauRfeMJSjfQj9HGFQ==} engines: {node: '>= 10'} cpu: [x64] os: [linux] libc: [musl] - '@next/swc-win32-arm64-msvc@15.5.23': - resolution: {integrity: sha512-Wc29KFOdT7XBcII3Vtmw7aoU8Uk3Mes/FNJfhFeSHdYBFJWMcR/DsI8U9BCPUhq/uycsUVuqSKGthW15tLsigA==} + '@next/swc-win32-arm64-msvc@15.5.25': + resolution: {integrity: sha512-QcFcPRr16djk5IqK5+e8O80eZfgWzIvVBXfitIq0tQ/uc+eyfdoZ0NmKc0cnbIJyfVwREapKuG97YcxWA9gcpA==} engines: {node: '>= 10'} cpu: [arm64] os: [win32] - '@next/swc-win32-x64-msvc@15.5.23': - resolution: {integrity: sha512-/C7wRW4fa9s/PKA18zGPPpVmx8ycgVpP8yOxro4gzGTzjPJdscbAP3ODeFvgiIovxD176Z2J/SXO9t8PJKHLeQ==} + '@next/swc-win32-x64-msvc@15.5.25': + resolution: {integrity: sha512-zREeykps3ndWr9egJgvJKqVkkDuaw6Zrrg23cYBos0ygydFkAWYU4+PaPVwXzP1eAYQJe53ShSK45iDM529BOg==} engines: {node: '>= 10'} cpu: [x64] os: [win32] @@ -1899,8 +1899,8 @@ packages: resolution: {integrity: sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==} engines: {node: '>= 0.6'} - next@15.5.23: - resolution: {integrity: sha512-Gvd2WKgvxIXCGotxcI1im/Uf3rS3J3oZGw0g/uskg6AVBZhyE3aAbujkYWzS3xLmEPEtTLfkaVQUKK0KMTSIkA==} + next@15.5.25: + resolution: {integrity: sha512-OMWNulIIqKM2ykvC2qMjIt0IoavB4UB2SCs4iXJ6z6847FvyH8jBmBWcvrF5iuhTu8Przh20Fo/aoszIdqx4PA==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -3096,30 +3096,30 @@ snapshots: '@napi-rs/lzma-linux-x64-gnu@1.5.1': optional: true - '@next/env@15.5.23': {} + '@next/env@15.5.25': {} - '@next/swc-darwin-arm64@15.5.23': + '@next/swc-darwin-arm64@15.5.25': optional: true - '@next/swc-darwin-x64@15.5.23': + '@next/swc-darwin-x64@15.5.25': optional: true - '@next/swc-linux-arm64-gnu@15.5.23': + '@next/swc-linux-arm64-gnu@15.5.25': optional: true - '@next/swc-linux-arm64-musl@15.5.23': + '@next/swc-linux-arm64-musl@15.5.25': optional: true - '@next/swc-linux-x64-gnu@15.5.23': + '@next/swc-linux-x64-gnu@15.5.25': optional: true - '@next/swc-linux-x64-musl@15.5.23': + '@next/swc-linux-x64-musl@15.5.25': optional: true - '@next/swc-win32-arm64-msvc@15.5.23': + '@next/swc-win32-arm64-msvc@15.5.25': optional: true - '@next/swc-win32-x64-msvc@15.5.23': + '@next/swc-win32-x64-msvc@15.5.25': optional: true '@rolldown/pluginutils@1.0.0-beta.27': {} @@ -3950,9 +3950,9 @@ snapshots: negotiator@1.0.0: {} - next@15.5.23(@types/node@25.3.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8): + next@15.5.25(@types/node@25.3.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8): dependencies: - '@next/env': 15.5.23 + '@next/env': 15.5.25 '@swc/helpers': 0.5.15 caniuse-lite: 1.0.30001809 postcss: 8.5.26 @@ -3960,14 +3960,14 @@ snapshots: react-dom: 19.2.8(react@19.2.8) styled-jsx: 5.1.6(react@19.2.8) optionalDependencies: - '@next/swc-darwin-arm64': 15.5.23 - '@next/swc-darwin-x64': 15.5.23 - '@next/swc-linux-arm64-gnu': 15.5.23 - '@next/swc-linux-arm64-musl': 15.5.23 - '@next/swc-linux-x64-gnu': 15.5.23 - '@next/swc-linux-x64-musl': 15.5.23 - '@next/swc-win32-arm64-msvc': 15.5.23 - '@next/swc-win32-x64-msvc': 15.5.23 + '@next/swc-darwin-arm64': 15.5.25 + '@next/swc-darwin-x64': 15.5.25 + '@next/swc-linux-arm64-gnu': 15.5.25 + '@next/swc-linux-arm64-musl': 15.5.25 + '@next/swc-linux-x64-gnu': 15.5.25 + '@next/swc-linux-x64-musl': 15.5.25 + '@next/swc-win32-arm64-msvc': 15.5.25 + '@next/swc-win32-x64-msvc': 15.5.25 sharp: 0.35.4(@types/node@25.3.0) transitivePeerDependencies: - '@babel/core'