[dependabot]

Bumps next from 15.5.24 to 15.5.27.

Release notes

Sourced from next's releases.

v15.5.27

This release contains security fixes for the following advisories:

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

v15.5.26

This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026

v15.5.25

Follow-up release to v15.5.24 re-enabling AVIF Image Optimization when newer versions of sharp are installed (#97954).

Commits

• def7eff v15.5.27
• 52c94ab [lts-maintenance] Scope response cache keys to their source route (#219)
• 785f4c2 [lts-maintenance] Match Next data paths case-sensitively (#197)
• 7217d63 [lts-maintenance][webpack] Ensure dynamicParams is respected in `opengraph-...
• d5979ba [lts-maintenance][ci] Remove PR creation from deploy test workflow (#99093)
• 812ae7d [lts-maintenance][test] Adjust deploy assertions for platform drift and the e...
• 6936da5 v15.5.26
• b49b6ca [maintenance-lts] Harden next/og SVG serialization
• f391939 [15.5.x][test] Disable deploy tests triggering bot challenge (#98132)
• 013ee1d v15.5.25
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a4d86b6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5690a577-9975-403d-b91e-5e66a9fcb257

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[freshtonic]

The bump is correct, and it is a security fix. Merge it before #1197.

What I checked

• 15.5.27 fixes three medium advisories (App Router metadata-image information disclosure, and two SSG/ISR cache-poisoning issues). 15.5.26 adds next/og hardening.
• next is a catalog:security dev dependency of @cipherstash/nextjs. The peer range ^14 || ^15 does not change. Thus no changeset is necessary.
• The lockfile changes only next and the two packages that resolve it as a peer (@clerk/nextjs, evlog).

Why Drizzle v3 integration fails

Both cells fail only in lock-context.integration.test.ts, with getJwt rejected: Unauthorized. This PR changes no Clerk package and no Drizzle package. Thus the cause is the Clerk token in the Dependabot secrets, not this bump. #1197 and #988 fail the same way.

Merge order

#1197 also moves next to 15.5.27. git merge-tree gives a pnpm-lock.yaml conflict with #1197, #1151 and #988. Merge this PR first, because it is the smallest one. Then tell Dependabot to rebase the others.

Suggested follow-up PR

• The override in pnpm-workspace.yaml still says 'next@<15.5.24': '~15.5.24'. The catalog pin covers the direct dependency. But the override is what applies the advisory floor to any transitive next. Change the selector to next@<15.5.27 and update the comment above it.

[freshtonic]

Re-review of a4d86b69b. Dependabot rebased the PR onto main (141054f5e, after #1151). It is the same bump as b28dcc9c5.

Delta

git range-diff shows only rebase context. The lockfile changes only next, @next/env, the @next/swc-* binaries and the two peers that resolve next (@clerk/nextjs, evlog), from 15.5.24 to 15.5.27. pnpm-workspace.yaml changes only the catalog pin.

Status of earlier points

• Drizzle v3 integration failures (Clerk token): resolved. Both cells pass on this head (db=postgres, db=supabase). All other checks pass too.
• Merge order: still applies. git merge-tree with #1197 gives conflicts in pnpm-lock.yaml and pnpm-workspace.yaml. Merge this PR first. Then tell Dependabot to rebase #1197. (#988 is closed, so it is no longer a factor.)
• Suggested follow-up: still open. pnpm-workspace.yaml:77 still says 'next@<15.5.24': '~15.5.24'.

I found no new defect.

[freshtonic]

Approved. Merge this PR before #1197, because their lockfiles conflict.