build(deps): bump next from 14.2.35 to 15.5.21 in the npm_and_yarn group across 1 directory by dependabot[bot] · Pull Request #2 · DarkModder33/Hyperborea

dependabot · 2026-08-25T22:08:47Z

Bumps the npm_and_yarn group with 1 update in the / directory: next.

Updates next from 14.2.35 to 15.5.21

Release notes

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

sourcery-ai

Hey - I've found 15 security issues

Security issues:

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 (link)
LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
Apache-2.0 AND LGPL-3.0-or-later AND MIT: Open-source license can require releasing the entire application source (link)
Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)
Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source (link)

Fixed security issues:

next (link)

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="package-lock.json" line_range="1881-1925" />
<code_context>

</code_context>
<issue_to_address>
**security (GHSA-f88m-g3jw-g9cj):** sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

### Impact

A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.

Those processing untrusted input with versions of sharp prior to 0.35.0 are affected.

### Patches

#### Using prebuilt binaries provided by sharp?

Most people rely on the prebuilt binaries provided by sharp.

Please upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.

#### Using a globally-installed libvips?

Please ensure you are using the latest libvips 8.18.3.

### Workarounds
Add the following to your code to prevent sharp from decoding GIF, TIFF and VIPS images.
```js
sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] });
```

*Source: trivy*
</issue_to_address>

### Comment 2
<location path="package-lock.json" line_range="103-118" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-darwin-arm64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 3
<location path="package-lock.json" line_range="119-134" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-darwin-x64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 4
<location path="package-lock.json" line_range="135-153" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-arm):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 5
<location path="package-lock.json" line_range="154-172" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-arm64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 6
<location path="package-lock.json" line_range="173-191" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-ppc64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 7
<location path="package-lock.json" line_range="192-210" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-riscv64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 8
<location path="package-lock.json" line_range="211-229" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-s390x):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 9
<location path="package-lock.json" line_range="230-248" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linux-x64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 10
<location path="package-lock.json" line_range="249-267" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linuxmusl-arm64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 11
<location path="package-lock.json" line_range="268-286" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-libvips-linuxmusl-x64):** LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 12
<location path="package-lock.json" line_range="487-505" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-wasm32):** Apache-2.0 AND LGPL-3.0-or-later AND MIT: Open-source license can require releasing the entire application source

This `Apache-2.0 AND LGPL-3.0-or-later AND MIT` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 13
<location path="package-lock.json" line_range="506-524" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-win32-arm64):** Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `Apache-2.0 AND LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 14
<location path="package-lock.json" line_range="525-543" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-win32-ia32):** Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `Apache-2.0 AND LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

### Comment 15
<location path="package-lock.json" line_range="544-562" />
<code_context>

</code_context>
<issue_to_address>
**security (license/@img/sharp-win32-x64):** Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This `Apache-2.0 AND LGPL-3.0-or-later` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

*Source: trivy*
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

sourcery-ai · 2026-08-25T22:09:08Z

GHSA-f88m-g3jw-g9cj

+    "node_modules/sharp": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz",
+      "integrity": "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==",
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "@img/colour": "^1.0.0",
+        "detect-libc": "^2.1.2",
+        "semver": "^7.7.3"
+      },
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-darwin-arm64": "0.34.5",
+        "@img/sharp-darwin-x64": "0.34.5",
+        "@img/sharp-libvips-darwin-arm64": "1.2.4",
+        "@img/sharp-libvips-darwin-x64": "1.2.4",
+        "@img/sharp-libvips-linux-arm": "1.2.4",
+        "@img/sharp-libvips-linux-arm64": "1.2.4",
+        "@img/sharp-libvips-linux-ppc64": "1.2.4",
+        "@img/sharp-libvips-linux-riscv64": "1.2.4",
+        "@img/sharp-libvips-linux-s390x": "1.2.4",
+        "@img/sharp-libvips-linux-x64": "1.2.4",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4",
+        "@img/sharp-libvips-linuxmusl-x64": "1.2.4",
+        "@img/sharp-linux-arm": "0.34.5",
+        "@img/sharp-linux-arm64": "0.34.5",
+        "@img/sharp-linux-ppc64": "0.34.5",
+        "@img/sharp-linux-riscv64": "0.34.5",
+        "@img/sharp-linux-s390x": "0.34.5",
+        "@img/sharp-linux-x64": "0.34.5",
+        "@img/sharp-linuxmusl-arm64": "0.34.5",
+        "@img/sharp-linuxmusl-x64": "0.34.5",
+        "@img/sharp-wasm32": "0.34.5",
+        "@img/sharp-win32-arm64": "0.34.5",
+        "@img/sharp-win32-ia32": "0.34.5",
+        "@img/sharp-win32-x64": "0.34.5"
+      }
+    },


security (GHSA-f88m-g3jw-g9cj): sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

Impact

A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.

Those processing untrusted input with versions of sharp prior to 0.35.0 are affected.

Patches

Using prebuilt binaries provided by sharp?

Most people rely on the prebuilt binaries provided by sharp.

Please upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.

Using a globally-installed libvips?

Please ensure you are using the latest libvips 8.18.3.

Workarounds

Add the following to your code to prevent sharp from decoding GIF, TIFF and VIPS images.

sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] });

Source: trivy

sourcery-ai · 2026-08-25T22:09:08Z

+    "node_modules/@img/sharp-libvips-darwin-arm64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.2.4.tgz",
+      "integrity": "sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },


security (license/@img/sharp-libvips-darwin-arm64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

Source: trivy

sourcery-ai · 2026-08-25T22:09:08Z

+    "node_modules/@img/sharp-libvips-darwin-x64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.2.4.tgz",
+      "integrity": "sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },


security (license/@img/sharp-libvips-darwin-x64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

Source: trivy

sourcery-ai · 2026-08-25T22:09:08Z

+    "node_modules/@img/sharp-libvips-linux-arm": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.2.4.tgz",
+      "integrity": "sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==",
+      "cpu": [
+        "arm"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },


security (license/@img/sharp-libvips-linux-arm): LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

Source: trivy

sourcery-ai · 2026-08-25T22:09:08Z

+    "node_modules/@img/sharp-libvips-linux-arm64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.2.4.tgz",
+      "integrity": "sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },


security (license/@img/sharp-libvips-linux-arm64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

Source: trivy

sourcery-ai · 2026-08-25T22:09:08Z

+    "node_modules/@img/sharp-libvips-linuxmusl-x64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.2.4.tgz",
+      "integrity": "sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },


security (license/@img/sharp-libvips-linuxmusl-x64): LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

Source: trivy

sourcery-ai · 2026-08-25T22:09:08Z

+    "node_modules/@img/sharp-wasm32": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.34.5.tgz",
+      "integrity": "sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==",
+      "cpu": [
+        "wasm32"
+      ],
+      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/runtime": "^1.7.0"
+      },
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },


security (license/@img/sharp-wasm32): Apache-2.0 AND LGPL-3.0-or-later AND MIT: Open-source license can require releasing the entire application source

This Apache-2.0 AND LGPL-3.0-or-later AND MIT open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

Source: trivy

sourcery-ai · 2026-08-25T22:09:08Z

+    "node_modules/@img/sharp-win32-arm64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.5.tgz",
+      "integrity": "sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },


security (license/@img/sharp-win32-arm64): Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This Apache-2.0 AND LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

Source: trivy

sourcery-ai · 2026-08-25T22:09:09Z

+    "node_modules/@img/sharp-win32-ia32": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.5.tgz",
+      "integrity": "sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },


security (license/@img/sharp-win32-ia32): Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This Apache-2.0 AND LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

Source: trivy

sourcery-ai · 2026-08-25T22:09:09Z

+    "node_modules/@img/sharp-win32-x64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.5.tgz",
+      "integrity": "sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },


security (license/@img/sharp-win32-x64): Apache-2.0 AND LGPL-3.0-or-later: Open-source license can require releasing the entire application source

This Apache-2.0 AND LGPL-3.0-or-later open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed

Source: trivy

Bumps the npm_and_yarn group with 1 update in the / directory: [next](https://github.com/vercel/next.js). Updates `next` from 14.2.35 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v14.2.35...v15.5.21) --- updated-dependencies: - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-08-28T02:41:33Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	hyperborea	`194debe`	Aug 28 2026, 02:42 AM

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 25, 2026

sourcery-ai Bot reviewed Aug 25, 2026

View reviewed changes

dependabot Bot changed the title ~~Bump next from 14.2.35 to 15.5.21 in the npm_and_yarn group across 1 directory~~ build(deps): bump next from 14.2.35 to 15.5.21 in the npm_and_yarn group across 1 directory Aug 28, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-5988e9b934 branch from 0c59d44 to 194debe Compare August 28, 2026 02:41

Navigation Menu

build(deps): bump next from 14.2.35 to 15.5.21 in the npm_and_yarn group across 1 directory - #2

build(deps): bump next from 14.2.35 to 15.5.21 in the npm_and_yarn group across 1 directory#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-5988e9b934

dependabot Bot commented on behalf of github Aug 25, 2026 •

edited

Loading

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

sourcery-ai Bot Aug 25, 2026

Uh oh!

sourcery-ai Bot Aug 25, 2026

Uh oh!

sourcery-ai Bot Aug 25, 2026

Uh oh!

sourcery-ai Bot Aug 25, 2026

Uh oh!

sourcery-ai Bot Aug 25, 2026

Uh oh!

sourcery-ai Bot Aug 25, 2026

Uh oh!

sourcery-ai Bot Aug 25, 2026

Uh oh!

sourcery-ai Bot Aug 25, 2026

Uh oh!

sourcery-ai Bot Aug 25, 2026

Uh oh!

sourcery-ai Bot Aug 25, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v15.5.21

v15.5.20

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

sourcery-ai Bot Aug 25, 2026

Choose a reason for hiding this comment

Impact

Patches

Using prebuilt binaries provided by sharp?

Using a globally-installed libvips?

Workarounds

Uh oh!

sourcery-ai Bot Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

sourcery-ai Bot Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

sourcery-ai Bot Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

sourcery-ai Bot Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

sourcery-ai Bot Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

sourcery-ai Bot Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

sourcery-ai Bot Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

sourcery-ai Bot Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

sourcery-ai Bot Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 25, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Aug 28, 2026 •

edited

Loading