Update npm package `next` to v15.5.24 [SECURITY] - abandoned by hash-dependencies[bot] · Pull Request #9610 · hashintel/hash

hash-dependencies · 2026-09-09T07:26:07Z

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	`15.5.21` → `15.5.24`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

CVE-2026-75604 / GHSA-p293-qw3h-jr36

More information

Details

Impact

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

Workaround

There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.

Severity

CVSS Score: 9.0 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

GHSA-2xp9-vwfh-vxw4

More information

Details

A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.

Until a fix has propagated, optimization of AVIF files is disabled.

Severity

CVSS Score: 9.5 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vercel/next.js (next)

`v15.5.24`

Compare Source

This release contains security fixes for the following advisories:

Critical:

`v15.5.23`

Compare Source

What's Changed

[15.x] Port ReplyServer traversal guards to FlightClient @eps1lon in #96405

Full Changelog: vercel/next.js@v15.5.22...v15.5.23

`v15.5.22`

Compare Source

What's Changed

[15.5] Reject TypeScript >= 7.0 with an actionable error by @lukesandberg in #96110

Full Changelog: vercel/next.js@v15.5.21...v15.5.22

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

vercel · 2026-09-09T07:26:13Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hash	Ready	Preview	Sep 15, 2026 9:16am UTC

3 Skipped Deployments

Project	Deployment	Actions	Updated
hashdotdesign-tokens	Ignored	Preview	Sep 15, 2026 9:16am UTC
petrinaut	Skipped		Sep 15, 2026 9:16am UTC
petrinaut-docs	Skipped		Sep 15, 2026 9:16am UTC

hash-dependencies · 2026-09-09T07:26:14Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

➤ YN0000: · Yarn 4.16.0
➤ YN0000: ┌ Project validation
➤ YN0057: │ @apps/plugin-browser: 'nohoist' is deprecated, please use 'installConfig.hoistingLimits' instead
➤ YN0000: └ Completed
➤ YN0000: ┌ Resolution step
➤ YN0085: │ + next@npm:15.5.24, @next/env@npm:15.5.24, @next/swc-darwin-arm64@npm:15.5.24, @next/swc-darwin-x64@npm:15.5.24, @next/swc-linux-arm64-gnu@npm:15.5.24, and 5 more.
➤ YN0000: └ Completed in 2s 145ms
➤ YN0000: ┌ Post-resolution validation
➤ YN0060: │ @astrojs/markdown-remark is listed by your project with version 7.2.4 (ped3581), which doesn't satisfy what astro and other dependencies request (7.2.2).
➤ YN0060: │ @types/react is listed by your project with version 19.2.14 (p99e71d), which doesn't satisfy what react-remove-scroll (via @tldraw/tldraw) and other dependencies request (but they have non-overlapping ranges!).
➤ YN0060: │ eslint is listed by your project with version 9.39.4 (p88bec7), which doesn't satisfy what eslint-config-airbnb and other dependencies request (but they have non-overlapping ranges!).
➤ YN0060: │ eslint-plugin-react-hooks is listed by your project with version 7.0.1 (p699002), which doesn't satisfy what eslint-config-airbnb requests (^4.3.0).
➤ YN0060: │ graphology is listed by your project with version 0.26.0 (p418068), which doesn't satisfy what @react-sigma/core requests (~0.25.4).
➤ YN0060: │ react is listed by your project with version 19.2.6 (p297d1e), which doesn't satisfy what material-ui-popup-state and other dependencies request (but they have non-overlapping ranges!).
➤ YN0060: │ react is listed by your project with version 19.2.6 (p327a01), which doesn't satisfy what react-inspector (via @hashintel/ds-components) and other dependencies request (but they have non-overlapping ranges!).
➤ YN0060: │ react is listed by your project with version 19.2.6 (p53dd30), which doesn't satisfy what react-inspector (via @ladle/react) and other dependencies request (but they have non-overlapping ranges!).
➤ YN0060: │ react is listed by your project with version 19.2.6 (p5a9f3c), which doesn't satisfy what @apollo/client and other dependencies request (but they have non-overlapping ranges!).
➤ YN0060: │ react is listed by your project with version 19.2.6 (p656648), which doesn't satisfy what react-inspector (via @hashintel/ds-components) and other dependencies request (but they have non-overlapping ranges!).
➤ YN0060: │ react is listed by your project with version 19.2.6 (p9bfa18), which doesn't satisfy what react-inspector (via @hashintel/ds-components) and other dependencies request (but they have non-overlapping ranges!).
➤ YN0060: │ react is listed by your project with version 19.2.6 (pb2c0b1), which doesn't satisfy what @apollo/client and other dependencies request (but they have non-overlapping ranges!).
➤ YN0060: │ react-dom is listed by your project with version 19.2.6 (pbfb936), which doesn't satisfy what @apollo/client and other dependencies request (but they have non-overlapping ranges!).
➤ YN0060: │ react-hook-form is listed by your project with version 7.65.0 (pf60118), which doesn't satisfy what @hashintel/query-editor and other dependencies request (7.61.1).
➤ YN0060: │ storybook is listed by your project with version 9.1.19 (p14b1b3), which doesn't satisfy what eslint-plugin-storybook requests (^10.3.1).
➤ YN0060: │ storybook is listed by your project with version 9.1.19 (pa824a9), which doesn't satisfy what eslint-plugin-storybook requests (^10.3.1).
➤ YN0060: │ storybook is listed by your project with version 9.1.19 (pcf516a), which doesn't satisfy what eslint-plugin-storybook requests (^10.3.1).
➤ YN0060: │ storybook is listed by your project with version 9.1.19 (pf24719), which doesn't satisfy what eslint-plugin-storybook requests (^10.3.1).
➤ YN0060: │ type-fest is listed by your project with version 5.3.1 (pf96305), which doesn't satisfy what @pmmmwh/react-refresh-webpack-plugin requests (>=0.17.0 <5.0.0).
➤ YN0060: │ vitest is listed by your project with version 4.1.10 (p1105ba), which doesn't satisfy what @effect/vitest and other dependencies request (but they have non-overlapping ranges!).
➤ YN0060: │ zod is listed by your project with version 4.4.3 (p3cb446), which doesn't satisfy what zod-to-json-schema and other dependencies request (^3.25.0).
➤ YN0002: │ @apps/brunch-agent@workspace:apps/brunch-agent doesn't provide zod (p783fc3), requested by @anthropic-ai/sdk and other dependencies.
➤ YN0002: │ @apps/hash-ai-worker-ts@workspace:apps/hash-ai-worker-ts doesn't provide @llamaindex/core (p84f0aa), requested by @llamaindex/readers.
➤ YN0002: │ @apps/hash-ai-worker-ts@workspace:apps/hash-ai-worker-ts doesn't provide @llamaindex/env (p06d4a4), requested by @llamaindex/readers.
➤ YN0002: │ @apps/hash-ai-worker-ts@workspace:apps/hash-ai-worker-ts doesn't provide react (p686178), requested by @blockprotocol/core and other dependencies.
➤ YN0002: │ @apps/hash-api@workspace:apps/hash-api doesn't provide react (p7e58b9), requested by @blockprotocol/core and other dependencies.
➤ YN0002: │ @apps/hash-frontend@workspace:apps/hash-frontend doesn't provide @codemirror/view (pc99a9f), requested by @uiw/react-codemirror.
➤ YN0002: │ @apps/hash-frontend@workspace:apps/hash-frontend doesn't provide react-is (pe06c1b), requested by recharts.
➤ YN0002: │ @apps/hash-integration-worker@workspace:apps/hash-integration-worker doesn't provide react (p652198), requested by @blockprotocol/graph.
➤ YN0002: │ @apps/plugin-browser@workspace:apps/plugin-browser doesn't provide webpack-sources (p2d6859), requested by zip-webpack-plugin.
➤ YN0002: │ @blockprotocol/graph@workspace:libs/@blockprotocol/graph [da39f] doesn't provide @types/json-schema (p7740d4), requested by @apidevtools/json-schema-ref-parser.
➤ YN0002: │ @blockprotocol/graph@workspace:libs/@blockprotocol/graph [e419a] doesn't provide @types/json-schema (pa38d4c), requested by @apidevtools/json-schema-ref-parser.
➤ YN0002: │ @blockprotocol/graph@workspace:libs/@blockprotocol/graph doesn't provide @types/json-schema (p15605f), requested by @apidevtools/json-schema-ref-parser.
➤ YN0002: │ @blockprotocol/graph@workspace:libs/@blockprotocol/graph doesn't provide react (p975fc7), requested by @blockprotocol/core.
➤ YN0002: │ @hashintel/block-design-system@workspace:libs/@hashintel/block-design-system [482cc] doesn't provide prop-types (pdc545e), requested by react-type-animation.
➤ YN0002: │ @hashintel/block-design-system@workspace:libs/@hashintel/block-design-system [64938] doesn't provide prop-types (p520cec), requested by react-type-animation.
➤ YN0002: │ @hashintel/block-design-system@workspace:libs/@hashintel/block-design-system doesn't provide prop-types (pdf5207), requested by react-type-animation.
➤ YN0002: │ @hashintel/brunch-agent-transport-aisdk@workspace:libs/@hashintel/brunch-agent/packages/transport-aisdk doesn't provide zod (p91c509), requested by ai.
➤ YN0002: │ @hashintel/ds-components@workspace:libs/@hashintel/ds-components [482cc] doesn't provide esbuild (pdd3db9), requested by esbuild-plugin-svgr and other dependencies.
➤ YN0002: │ @hashintel/ds-components@workspace:libs/@hashintel/ds-components [482cc] doesn't provide playwright (pf22dae), requested by @vitest/browser-playwright.
➤ YN0002: │ @hashintel/ds-components@workspace:libs/@hashintel/ds-components [c2099] doesn't provide esbuild (p62400f), requested by esbuild-plugin-svgr and other dependencies.
➤ YN0002: │ @hashintel/ds-components@workspace:libs/@hashintel/ds-components [c2099] doesn't provide playwright (pe7944e), requested by @vitest/browser-playwright.
➤ YN0002: │ @hashintel/ds-components@workspace:libs/@hashintel/ds-components doesn't provide esbuild (pe4a1b8), requested by esbuild-plugin-svgr and other dependencies.
➤ YN0002: │ @hashintel/ds-components@workspace:libs/@hashintel/ds-components doesn't provide playwright (pe68d39), requested by @vitest/browser-playwright.
➤ YN0002: │ @hashintel/petrinaut@workspace:libs/@hashintel/petrinaut [482cc] doesn't provide zod (p3e879a), requested by ai.
➤ YN0002: │ @hashintel/petrinaut@workspace:libs/@hashintel/petrinaut [95a4e] doesn't provide zod (pe8cf49), requested by ai.
➤ YN0002: │ @hashintel/petrinaut@workspace:libs/@hashintel/petrinaut [c2099] doesn't provide zod (pe7c2dd), requested by ai.
➤ YN0002: │ @hashintel/petrinaut@workspace:libs/@hashintel/petrinaut doesn't provide zod (p3323f1), requested by ai.
➤ YN0002: │ @local/eslint@workspace:libs/@local/eslint doesn't provide eslint-plugin-jsx-a11y (p90ae76), requested by eslint-config-airbnb.
➤ YN0002: │ @local/eslint@workspace:libs/@local/eslint doesn't provide eslint-plugin-react (p47f64a), requested by eslint-config-airbnb.
➤ YN0002: │ @local/eslint@workspace:libs/@local/eslint doesn't provide storybook (p77c4dc), requested by eslint-plugin-storybook.
➤ YN0002: │ @local/harpc-client@workspace:libs/@local/harpc/client/typescript doesn't provide @effect/workflow (p5c866d), requested by @effect/cluster.
➤ YN0002: │ @local/hash-backend-utils@workspace:libs/@local/hash-backend-utils doesn't provide react (pe5f543), requested by @blockprotocol/core and other dependencies.
➤ YN0002: │ @local/hash-graph-sdk@workspace:libs/@local/graph/sdk/typescript doesn't provide react (p5e03d4), requested by @blockprotocol/graph.
➤ YN0002: │ @local/hash-isomorphic-utils@workspace:libs/@local/hash-isomorphic-utils doesn't provide react-dom (p3d46d6), requested by @apollo/client and other dependencies.
➤ YN0002: │ @local/repo-chores@workspace:libs/@local/repo-chores/node doesn't provide react (pe2fb17), requested by @blockprotocol/core.
➤ YN0002: │ @tests/hash-backend-integration@workspace:tests/hash-backend-integration doesn't provide graphql-request (p792347), requested by @graphql-codegen/typescript-graphql-request.
➤ YN0002: │ @tests/hash-backend-integration@workspace:tests/hash-backend-integration doesn't provide graphql-tag (pa67a63), requested by @graphql-codegen/typescript-graphql-request.
➤ YN0002: │ @tests/hash-backend-integration@workspace:tests/hash-backend-integration doesn't provide react (pec02bf), requested by @blockprotocol/graph.
➤ YN0002: │ @tests/hash-playwright@workspace:tests/hash-playwright doesn't provide react (p373b8b), requested by @blockprotocol/graph.
➤ YN0086: │ Some peer dependencies are incorrectly met by your project; run yarn explain peer-requirements <hash> for details, where <hash> is the six-letter p-prefixed code.
➤ YN0086: │ Some peer dependencies are incorrectly met by dependencies; run yarn explain peer-requirements for details.
➤ YN0000: └ Completed
➤ YN0000: ┌ Fetch step
➤ YN0013: │ 3 packages were added to the project (+ 271.35 MiB).
➤ YN0000: └ Completed in 4s 228ms
➤ YN0000: ┌ Link step
➤ YN0073: │ Skipped due to mode=update-lockfile
➤ YN0000: └ Completed
➤ YN0000: ┌ Post-install validation
➤ YN0001: │ Error: Cannot find module '@yarnpkg/types'
Require stack:
- /tmp/renovate/repos/github/hashintel/hash/yarn.config.cjs
- /home/runner/.cache/node/corepack/v1/yarn/4.16.0/yarn.js
    at Module._resolveFilename (node:internal/modules/cjs/loader:1564:15)
    at wrapResolveFilename (node:internal/modules/cjs/loader:1118:27)
    at defaultResolveImplForCJSLoading (node:internal/modules/cjs/loader:1142:10)
    at resolveForCJSWithHooks (node:internal/modules/cjs/loader:1169:12)
    at Module._load (node:internal/modules/cjs/loader:1341:5)
    at wrapModuleLoad (node:internal/modules/cjs/loader:261:19)
    at Module.require (node:internal/modules/cjs/loader:1674:12)
    at require (node:internal/modules/helpers:157:16)
    at Object.<anonymous> (/tmp/renovate/repos/github/hashintel/hash/yarn.config.cjs:7:26)
    at Module._compile (node:internal/modules/cjs/loader:1929:14)
➤ YN0000: └ Completed
➤ YN0000: · Failed with errors in 6s 843ms

cursor · 2026-09-09T07:26:16Z

PR Summary

Low Risk
Dependency-only patch bump with no application code changes; residual risk is standard Next.js patch regression or image-optimization behavior changes.

Overview
Bumps Next.js from 15.5.21 to 15.5.24 in apps/hash-frontend and libs/@local/hash-isomorphic-utils, with matching yarn.lock updates for next, @next/env, and platform @next/swc-* packages.

This is a security patch release (no app source changes). It addresses critical advisories including unauthenticated RCE on Windows-hosted servers and RCE via the Image Optimization API with AVIF; upstream may also change image-optimization behavior (e.g. AVIF handling) as part of the fix.

^{Reviewed by Cursor Bugbot for commit 076eae4. Bugbot is set up for automated code reviews on this repo. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 766ee0b. Configure here.}

codecov · 2026-09-15T09:09:10Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.89%. Comparing base (04db878) to head (076eae4).
⚠️ Report is 62 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9610      +/-   ##
==========================================
- Coverage   65.93%   65.89%   -0.04%     
==========================================
  Files        1886     1887       +1     
  Lines      198341   198443     +102     
  Branches     8236     8248      +12     
==========================================
+ Hits       130772   130773       +1     
- Misses      66039    66140     +101     
  Partials     1530     1530

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.99% <ø> (ø)`
apps.hash-api	`15.35% <ø> (-0.23%)`	⬇️
local.hash-backend-utils	`3.27% <ø> (ø)`
local.hash-isomorphic-utils	`12.22% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

hash-dependencies · 2026-09-15T09:23:58Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

hash-dependencies · 2026-09-15T10:23:38Z

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

claude · 2026-09-15T11:01:00Z

Superseded by #9701, which put next 15.5.25 on main; this PR targets 15.5.24, so it no longer delivers the fix (merging it would in fact downgrade next). Closing — the only remaining change against main is a yarn.lock conflict.

Generated by Claude Code

Update npm package next to v15.5.24 [SECURITY]

766ee0b

hash-dependencies Bot enabled auto-merge September 9, 2026 07:26

hash-dependencies Bot assigned CiaranMn Sep 9, 2026

vercel Bot had a problem deploying to Preview – hash September 9, 2026 07:26 Failure

hash-dependencies Bot had a problem deploying to pull-request September 9, 2026 07:27 Failure

cursor Bot reviewed Sep 9, 2026

View reviewed changes

Comment thread apps/hash-frontend/package.json

Regenerate yarn.lock for next 15.5.24

076eae4

vercel Bot temporarily deployed to Preview – petrinaut September 15, 2026 09:02 Inactive

vercel Bot temporarily deployed to Preview – petrinaut-docs September 15, 2026 09:02 Inactive

claude Bot deployed to pull-request September 15, 2026 09:03 Active

vercel Bot deployed to Preview – hash September 15, 2026 09:16 View deployment

CiaranMn approved these changes Sep 15, 2026

View reviewed changes

hash-dependencies Bot added this pull request to the merge queue Sep 15, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Sep 15, 2026

hash-dependencies Bot changed the title ~~Update npm package next to v15.5.24 [SECURITY]~~ Update npm package next to v15.5.24 [SECURITY] - abandoned Sep 15, 2026

claude Bot closed this Sep 15, 2026

Navigation Menu

Update npm package `next` to v15.5.24 [SECURITY] - abandoned - #9610

Update npm package `next` to v15.5.24 [SECURITY] - abandoned#9610
hash-dependencies[bot] wants to merge 2 commits into
mainfrom
deps/js/npm-next-vulnerability

hash-dependencies Bot commented Sep 9, 2026

Uh oh!

vercel Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

hash-dependencies Bot commented Sep 9, 2026

Uh oh!

cursor Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

codecov Bot commented Sep 15, 2026

Uh oh!

hash-dependencies Bot commented Sep 15, 2026

Uh oh!

hash-dependencies Bot commented Sep 15, 2026

Uh oh!

claude Bot commented Sep 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

hash-dependencies Bot commented Sep 9, 2026

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Details

Impact

Workaround

Severity

References

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Details

Severity

References

Release Notes

v15.5.24

v15.5.23

What's Changed

v15.5.22

What's Changed

Configuration

Uh oh!

vercel Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hash-dependencies Bot commented Sep 9, 2026

⚠️ Artifact update problem

File name: yarn.lock

Uh oh!

cursor Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov Bot commented Sep 15, 2026

Codecov Report

Uh oh!

hash-dependencies Bot commented Sep 15, 2026

Edited/Blocked Notification

Uh oh!

hash-dependencies Bot commented Sep 15, 2026

Autoclosing Skipped

Uh oh!

claude Bot commented Sep 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

`v15.5.24`

`v15.5.23`

`v15.5.22`

vercel Bot commented Sep 9, 2026 •

edited

Loading

cursor Bot commented Sep 9, 2026 •

edited

Loading