chore(deps): bump next from 15.5.15 to 15.5.18

[dependabot]

Bumps next from 15.5.15 to 15.5.18.

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.16

This release contains security fixes for the following advisories:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Commits

• 9ff92ce v15.5.18
• 00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
• 62c97ab v15.5.17
• 423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
• fa78739 Turbopack: Fix middleware matcher suffix (#93590)
• 36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
• 36589b5 [backport][test] Pin package manager to patch versions (#93596)
• ad6fd4e v15.5.16
• 79d7dff Ignore malformed CSP nonce headers (#103)
• c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	docs-preview	acd63e9	Commit Preview URL Branch Preview URL	May 13 2026, 02:15 PM

[jrphilo]

Ralphie verified this — ready to merge.

Verification

• lint: ✓ (pre-existing no-img-element warning in src/components/Logo.tsx, unrelated to this bump)
• build: ✓ (Next.js type-check + bundle, 11/11 static pages, middleware 32.4 kB)
• check:links: ✓ (39 files, 3 internal links, 0 broken)

Changelog highlights

• Patch-series security release: 15.5.15 → 15.5.16 → 15.5.17 → 15.5.18.
• Bundle of fixes for App Router middleware/proxy bypass, RSC DoS, RSC cache poisoning, Image Optimization DoS, CSP-nonce XSS, beforeInteractive XSS, WebSocket SSRF, and Pages Router i18n bypass.
• Release notes — security advisories linked there.

Investigation

Elevated scrutiny applied: framework major (next). Bump is patch-within-minor (15.5.x), security-only.

• Ownership: ownership change flagged — Dependabot reports the release was pushed to npm by GitHub Actions rather than the prior personal account. Investigated → this is Vercel's move to npm trusted publishing via GitHub Actions OIDC; consistent with the security-release theme and an upgrade in supply-chain posture, not a takeover signal.
• Auth/secrets: none — no auth/secrets handling code in this repo (middleware deletes cookie/host on proxy, no token handling).
• Security advisory: 13 advisories fixed in this range (7 High, 4 Moderate, 2 Low). Investigated our exposure to each affected surface:
  • Middleware/proxy bypass (GHSA-267c-6grr-h53f, -26hh-7cqf-hhc6, -492v-c6pp-mqqv, -3g8h-86w9-wvmq): we ship src/middleware.ts which proxies /ingest/* to PostHog and sets X-Frame-Options / X-Robots-Tag. Fixes are internal to Next's request handling — beneficial for us.
  • Pages Router i18n bypass (GHSA-36qx-fr4f-26g5): we're App Router-only; no pages/ dir.
  • Cache Components DoS (GHSA-mg66-mrh9-m8jx): we don't enable cacheComponents.
  • WebSocket SSRF (GHSA-c4j6-fc7j-m34r): no WebSocket upgrades in this repo.
  • CSP nonces (GHSA-ffhc-5mcf-pf4q) + beforeInteractive XSS (GHSA-gx5p-jg67-6x7h): no custom CSP nonce handling and no beforeInteractive script usage (grep clean).
  • Image Optimization DoS (GHSA-h64f-5h5j-jqjh) + RSC cache poisoning/DoS: docs render mostly static; fixes are server-side hardening — net positive.
• Deprecations: next lint deprecation warning surfaces in the lint output but is pre-existing on main (introduced earlier in 15.5.x) — not introduced by this bump.
• Breaking API: none — patch series within 15.5.x.

Recommendation

Security-only patch bump on a framework we use surgically (one middleware file, no Pages Router, no Cache Components, no WebSockets). All three verification steps green; investigated exposure to each fixed advisory; supply-chain publisher change is in the safer direction (OIDC trusted publishing). Safe to merge.