Bump next from 15.5.19 to 15.5.21 in the npm_and_yarn group across 1 directory - #37
Bump next from 15.5.19 to 15.5.21 in the npm_and_yarn group across 1 directory#37dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the npm_and_yarn group with 1 update in the / directory: [next](https://github.com/vercel/next.js). Updates `next` from 15.5.19 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.19...v15.5.21) --- updated-dependencies: - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
We could not run your PR Review. We noticed that you are part of an Org. We require everyone who is part of an Org to SignUp via GitHub so we can track your individual usage and maximize on your usage capacity. Enroll into CodeSherlock system by signing up via GitHub using the SignUp link. Also, please note — every user pays for their own usage. |
|
Review changes with Changed Files
|
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
❌ Deploy Preview for larme failed.
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
|
🤖 Review skipped: reviews for bot-created pull requests are not allowed on free accounts. Upgrade to a paid plan to enable bot reviews. |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
airmerge | 0b35a65 | Jul 28 2026, 11:05 AM |
|
View changes in DiffLens |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
PR Summary
|
|
View changes in DiffLens |
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
LlamaPReview — Verification needed
Whether the Workers Builds: airmerge failure (check_run:the cited check) is caused by the Next.js 15.5.21 version bump or is a pre-existing issue.
Owner action: Inspect the Cloudflare Workers build logs at https://dash.cloudflare.com/6b3ac940a05caf6f636ded39a36f3b1c/workers/services/view/airmerge/production/builds/a96a6e4a-e76d-4b7e-b645-8687d7c15d96 and compare with a build on the base branch.
1 further check in details.
Review details and evidence
| Priority | File | Finding | Evidence |
|---|---|---|---|
| P2 | package.json |
Next.js 15.5.21 includes behavioral security fixes; application compatibility with affected features is unverified | needs verification |
Finding details
P2 · Next.js 15.5.21 includes behavioral security fixes; application compatibility with affected features is unverified
package.json
The PR updates Next.js from 15.5.19 to 15.5.21. The release notes describe security fixes that alter runtime behavior for: Server Actions (enforced body size limits in Edge runtime and replay protection), rewrites (SSRF fix via destination hostname validation), middleware (bypass fix for single-locale App Router), custom servers (correct internal redirect origin), fetch caching (key construction for requests with bodies and non-UTF-8 payloads), and image optimization (SVG DoS fix). Repository searches for use server, middleware, and explicit fetch cache directives returned no hits on the default branch, but the application's source code and next.config.js were not retrieved. If the application uses any affected feature, the update could silently alter behavior. Maintainers should confirm the application does not depend on the patched behaviors, or verify through integration testing that affected features continue to work with 15.5.21.
Verification boundary: needs verification; scope: changed region.
Material unknowns
- The application uses one or more Next.js features affected by the 15.5.21 security fixes (Server Actions, rewrites with dynamic hostnames, middleware with single locale, custom servers, fetch caching with request bodies, or image optimization with SVGs).
- Check: Inspect application source code and next.config.js for usage of these features, or run integration tests against the PR branch.
- Whether the Workers Builds: airmerge failure (check_run:the cited check) is caused by the Next.js 15.5.21 version bump or is a pre-existing issue.
- Whether the Netlify deploy preview failures (Redirect rules, Header rules, Pages changed - all for larme) are caused by the Next.js 15.5.21 version bump or are pre-existing.
- Check: Examine the Netlify deploy logs at https://app.netlify.com/projects/larme/deploys/6a688cdcc479860007d4a756 and compare with a deploy on the base branch.
LlamaPReview checks
- Reviewed changed regions in
package.json. - Reviewed changed regions in
pnpm-lock.yaml. - Reviewed changed regions in
yarn.lock.
Automated review by LlamaPReview · Free for public open-source projects.
Bumps the npm_and_yarn group with 1 update in the / directory: next.
Updates
nextfrom 15.5.19 to 15.5.21Release notes
Sourced from next's releases.
Commits
e26f6ffv15.5.217f5deeb[15.x] Improve performance of checking valid MPA form submissions57c31f7[15.x] EnforceserverActions.bodySizeLimitfor Server Actions in Edge runtimee3e5666[15.x] Set correct origin for internal redirects in custom server35f5013[15.x] Ensure exotic rewrite param values are properly encoded062f667[15.x] fix(fetch-cache): key fetch(Request, init) by the effective request577c9dc[15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies530d4fa[15.x] fix(next/image): improve performance of detectContentType()8fabaf3[15.x] Performance improvements when decoding React Server function payloadsff12a61[15.x] Validate server reference IDs during manifest lookupDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Upgrade
nextto 15.5.21 to address multiple high/moderate security advisories (DoS, SSRF, middleware bypass) and small performance improvements in caching and image optimization. Only dependency files were updated (package.jsonand lockfiles); no app code changes required.Written for commit 0b35a65. Summary will update on new commits.