Upgrade Next.js to 15.5.27 (critical RCE advisories)

[ralyodio]

Pins next to 15.5.27 in sites/sh1pt.com (was ^15.0.0, locked at 15.5.15). Stays on Next 15. sites/sh1pt.com is the only workspace package that declares next; the boilerplates/ templates are outside the pnpm workspace and unlocked, so they are left alone. pnpm-lock.yaml diff: next, @next/env, @next/swc-*, the next peer string in @profullstack/stack, and sharp (next's optional dep) now sharing the semver 7.8.5 already in the lock.

Advisories addressed:

• GHSA-2xp9-vwfh-vxw4: Image Optimization RCE (<15.5.24)
• GHSA-p293-qw3h-jr36 (Windows)
• GHSA-vcvr-r3jv-pc5j (next/og, 16.2.x only; not applicable to 15, listed for completeness)

Verified locally:

• pnpm install --frozen-lockfile, CI's package prebuild, pnpm test (735 files, 3946 passed, 2 skipped)
• bun --bun next build under Bun 1.4 (Next.js 15.5.27, lint + types pass). Note: mise.toml pins bun 1.1.0 locally, which lacks TextEncoderStream and fails the build; the image uses oven/bun:1.4.0
• Booted the way the image runs it (bun --bun node_modules/next/dist/bin/next start): /, /docs, /login, /blog, /blog/rss.xml, /robots.txt, /sitemap.xml 200 and the 404s matching live; same title as live

No tag: tags v* run release.yml, which publishes the npm CLI packages.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

[github-actions]

ThreatCrush Security Scan

53 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 17 | LOW: 35

Severity	Rule	Location
HIGH	js-host-header-trust	packages/bots/wechat/src/index.ts:405
MEDIUM	redos-nested-quantifier	packages/actions-fleet-core/src/action-pack/schema.ts:3
MEDIUM	redos-nested-quantifier	packages/core/src/setup-helpers.ts:583
MEDIUM	sql-template-interpolation	packages/migrate/src/engines/mysql.ts:133
MEDIUM	sql-template-interpolation	packages/migrate/src/engines/postgres.ts:276
MEDIUM	sql-template-interpolation	packages/migrate/src/transforms.ts:178
MEDIUM	redos-nested-quantifier	packages/policy/src/rules/bundle-id.ts:3
MEDIUM	sql-string-concatenation	packages/targets/deploy-wordpress/src/index.ts:154
MEDIUM	redos-nested-quantifier	packages/targets/desktop-linux/src/index.ts:19
MEDIUM	redos-nested-quantifier	packages/targets/desktop-mac/src/index.ts:15
MEDIUM	redos-nested-quantifier	packages/targets/desktop-steamos/src/index.ts:28
MEDIUM	redos-nested-quantifier	packages/targets/mobile-android/src/index.ts:9
MEDIUM	redos-nested-quantifier	packages/targets/mobile-ios/src/index.ts:11
MEDIUM	redos-nested-quantifier	packages/targets/tv-androidtv/src/index.ts:14
MEDIUM	redos-nested-quantifier	packages/targets/tv-firetv/src/index.ts:13
MEDIUM	redos-nested-quantifier	packages/targets/tv-tvos/src/index.ts:14
MEDIUM	redos-nested-quantifier	packages/targets/tv-webos/src/index.ts:26
MEDIUM	js-unescaped-html-sink	sites/sh1pt.com/app/blog/[slug]/page.tsx:76
LOW	secret-generic-credential	packages/affiliates/skimlinks/src/index.test.ts:25
LOW	secret-generic-credential	packages/affiliates/skimlinks/src/index.test.ts:71
LOW	secret-generic-api-key	packages/affiliates/sovrn/src/index.ts:28
LOW	secret-generic-credential	packages/agent-providers/opencode/src/__tests__/opencode.test.ts:99
LOW	js-nosql-injection	packages/ai/amazon-bedrock/src/index.test.ts:121
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:9
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:10
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:11
LOW	secret-generic-credential	packages/bridges/matrix/src/index.ts:58
LOW	secret-generic-credential	packages/bridges/matrix/src/index.ts:59
LOW	secret-generic-credential	packages/bridges/slack/src/index.test.ts:259
LOW	secret-generic-credential	packages/captcha/captchasolver/src/index.ts:34
LOW	secret-generic-credential	packages/cli/src/commands/secrets.ts:189
LOW	secret-generic-credential	packages/cloud/linode/src/index.ts:15
LOW	secret-generic-credential	packages/migrate/src/platforms/index.test.ts:116
LOW	secret-generic-credential	packages/observability/sentry/src/index.ts:15
LOW	secret-generic-credential	packages/outreach/producthunt/src/index.ts:103
LOW	secret-generic-credential	packages/promo/posthog/src/index.ts:23
LOW	secret-generic-credential	packages/scanners/threatcrush/test/scan-output.txt:35
LOW	secret-generic-credential	packages/scanners/threatcrush/test/scan-output.txt:40
LOW	secret-database-url	packages/scanners/threatcrush/test/scan-output.txt:54
LOW	secret-generic-credential	packages/security/snyk/src/index.ts:26
LOW	secret-generic-credential	packages/social/hashnode/src/index.ts:4
LOW	secret-generic-credential	packages/social/linkedin/src/index.ts:3
LOW	secret-generic-credential	packages/social/linkedin/src/index.ts:4
LOW	secret-generic-credential	packages/social/medium/src/index.ts:4
LOW	secret-generic-credential	packages/social/snapchat/src/index.ts:5
LOW	secret-generic-credential	packages/social/tiktok/src/index.ts:5
LOW	secret-generic-credential	packages/targets/plugin-vscode/src/index.test.ts:115
LOW	secret-generic-credential	packages/targets/registry-ans/src/index.test.ts:79
LOW	secret-generic-credential	packages/targets/registry-ans/src/index.ts:49
LOW	secret-generic-credential	packages/targets/sdk-pypi/src/index.test.ts:49

…and 3 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.