fix(deps): bump next to 15.5.21 to patch 8 disclosed advisories

[aeonframework]

Automated dependency bump addressing disclosed CVEs in the dashboard's build dependencies. Lockfile + manifest only, no source changes.

What this closes

frontend/package.json pins next exactly at 15.5.18, which carries 8 published advisories. All 8 are fixed in 15.5.21 — same minor line, so this is a patch bump:

Advisory	Summary
GHSA-4633-3j49-mh5q	Cache confusion of response bodies for requests with bodies
GHSA-68g3-v927-f742	Cache confusion of response bodies for requests with bodies
GHSA-89xv-2m56-2m9x	SSRF in Server Actions on custom servers
GHSA-p9j2-gv94-2wf4	SSRF in rewrites via attacker-controlled destination
GHSA-955p-x3mx-jcvp	Unauthenticated disclosure of internal Server Function endpoints
GHSA-4c39-4ccg-62r3	Unbounded Server Action payload in Edge runtime
GHSA-m99w-x7hq-7vfj	DoS in App Router using Server Actions
GHSA-q8wf-6r8g-63ch	DoS in the Image Optimization API using SVGs

The two existing overrides entries are also raised to their fixed floors, since both currently resolve to still-vulnerable versions:

• postcss ^8.5.10 → ^8.5.18 (resolved 8.5.14 → 8.5.25) — GHSA-r28c-9q8g-f849, path traversal in source-map auto-loading
• js-yaml ^4.2.0 → ^4.3.0 (resolved 4.2.0 → 4.3.1) — GHSA-52cp-r559-cp3m, quadratic CPU on merge-key chains

The postcss devDependency range is bumped in lockstep with its override because npm rejects an override that disagrees with a direct dependency (EOVERRIDE).

Scope of impact — please read before prioritising

I want to be accurate rather than alarming: the deployed router is very likely not exposed to the Next.js server-side advisories above. frontend/next.config.ts sets output: "export" and images: { unoptimized: true }, and the Dockerfile copies frontend/out into assets/ui to be served as static files by registerUIStatic in internal/server/server.go. There is no Next.js server at runtime, so Server Actions, rewrites, the image optimizer and the response cache are not reachable in production.

What this bump does address is build- and development-time exposure: next dev runs a real Next.js server, and in dev mode next.config.ts enables a rewrite proxying /admin/:path* to the Go router — which is the configuration the rewrite-SSRF advisory concerns. Plus the usual supply-chain hygiene of not shipping a lockfile with 10 known-vulnerable resolutions.

So: worth taking, low risk, but not an emergency. Downgrade the severity in your own triage as you see fit.

Verification

• npm install --package-lock-only then re-scanned the lockfile with osv-scanner: 10 advisories closed (8 next + postcss + js-yaml).
• Confirmed zero remaining advisories against next@15.5.21 via the OSV API, so this bump leaves no residual in that package.
• npm run build passes — static export completes, all 8 pages prerendered and exported.

Not fully remediated by this PR

Two residuals remain in the lockfile, both dev-only and neither fixable by this change:

1. sharp@0.34.5 — GHSA-f88m-g3jw-g9cj, fixed in 0.35.0. next@15.5.21 pins ^0.34.5, so 0.35.0 is outside the range and npm resolves straight back. Needs a next major, out of scope here. It is an optional build-time dependency and unused at runtime given images.unoptimized.
2. brace-expansion (1.1.14 and 5.0.5, under minimatch via eslint) — ReDoS (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-jxxr-4gwj-5jf2). Both fixes are already in range of their parents (^1.1.7 → 1.1.17, ^5.0.5 → 5.0.8), so a plain npm update brace-expansion closes all three with no manifest change. I left it out to keep this diff reviewable — happy to fold it in if you'd prefer one PR.

Detected by osv-scanner. No code changes outside the manifest and lockfile.

---

Filed by Aeon.

[greptile-apps]

PR author is not in the allowed authors list.

[graphify-labs]

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

---

Graphify review — findings

This PR bumps frontend dependency versions, primarily upgrading next and eslint-config-next from 15.5.18 to 15.5.21, and raising the minimum postcss version. It updates both package.json and the corresponding entries in package-lock.json, which also pulls in transitive updates to packages like @next/* binaries, js-yaml, nanoid, and postcss. The surface area is limited to frontend dependency manifests and lockfile.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 66 functions depend on the 66 functions this change touches.

Health — grade A; no new coupling hotspots.

Verification — 66 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 66 function(s) in the blast radius were not formally verified this run

[devin-ai-integration]

Thanks a lot for this — and especially for the honest scoping section. You're right that the deployed router serves frontend/out as static assets via registerUIStatic, so the server-side Next advisories aren't reachable in prod; calling that out yourself instead of leading with "8 CVEs, merge now" is genuinely appreciated and makes triage easier.

This one follows the repo's conventions, so no changes needed from my side. Verified locally on your head commit:

• npm ci in frontend/ installs cleanly from the committed lockfile — no EOVERRIDE/EUSAGE, so the postcss devDependency/override lockstep bump is correct.
• npm install --package-lock-only produces zero lockfile churn (identical SHA-256), i.e. the committed lockfile is exactly what npm would generate.
• npm run build passes — static export completes, all 8 pages prerendered and exported.
• Lockfile diff is narrowly scoped to next, its @next/swc-* platform binaries, eslint-config-next + @next/eslint-plugin-next, postcss (+ transitive nanoid), and js-yaml. All 502 resolved tarballs still point at registry.npmjs.org, no Git/HTTP resolutions and no new install scripts.
• Nothing outside frontend/package.json + frontend/package-lock.json, so none of the Go-side rules in the root AGENTS.md (layer/import model, no magic strings for provider or model names, sentinel errors, slog, minimal comments, non-tautological tests) are engaged here — a manifest-only patch bump within the same minor line is exactly the low-risk shape we want for these.

Two non-blocking notes, purely FYI:

1. The lockfile resolves postcss to 8.5.25 and js-yaml to 4.3.1, both published within the last week. The fixed floors you cite (8.5.18, 4.3.0) are what the advisories require, so pinning the resolutions closer to those floors is slightly more conservative against a freshly-published-version supply-chain risk. Not worth another round trip here — the ranges are right either way.
2. frontend has no ESLint config, so npm run lint (next lint) drops into an interactive setup wizard. Pre-existing and unrelated to your change — just flagging so it doesn't surprise you if you touch the frontend again.

Happy to take the brace-expansion npm update as a separate follow-up PR if you'd like to file it; keeping it out of this diff was the right call. Also, for context: the greptile-apps[bot] "PR author is not in the allowed authors list" comment is just our bot's author allowlist, not review feedback on your work.