From 883362a6f42d6988a9a5177259c6606f49946a14 Mon Sep 17 00:00:00 2001 From: alexander-sei Date: Fri, 23 Oct 2026 11:39:01 +0200 Subject: [PATCH] fix(create-sei): bump the template to next 15.5.28 and sharp 0.35.5 Five advisories published since October 6 cover the template's pinned next@15.5.25 and its sharp@0.35.4 override, so every generated app installed them. The worst is GHSA-2464-fhr4-w9xw, a critical unauthenticated RCE in Next's Image Optimization API. next 15.5.28 clears the four Next advisories and sharp 0.35.5 clears the librsvg one, both inside their pinned minors. Next 15.5.28 declares Sharp ^0.34.3 || ^0.35.5, so the image notes in the template README and next.config.mjs now name 0.35.5 as the advisory floor: the 0.34.x half of that range is inside both Sharp advisories. Co-authored-by: Cursor --- ...create-sei-next-sharp-october-advisories.md | 18 ++++++++++++++++++ .../templates/next-template/README.md | 2 +- .../templates/next-template/next.config.mjs | 7 ++++--- .../templates/next-template/package.json | 4 ++-- 4 files changed, 25 insertions(+), 6 deletions(-) create mode 100644 .changeset/fix-create-sei-next-sharp-october-advisories.md diff --git a/.changeset/fix-create-sei-next-sharp-october-advisories.md b/.changeset/fix-create-sei-next-sharp-october-advisories.md new file mode 100644 index 000000000..5736c51a9 --- /dev/null +++ b/.changeset/fix-create-sei-next-sharp-october-advisories.md @@ -0,0 +1,18 @@ +--- +'@sei-js/create-sei': patch +--- + +Bump the Next template's `next` and `sharp` pins to clear five newly published advisories. + +Five advisories landed against the pinned `next@15.5.25` and the `sharp@0.35.4` override, so every generated app installed them without any change to the template: + +- `GHSA-2464-fhr4-w9xw` — critical, unauthenticated remote code execution in the Image Optimization API, `>=10.0.0 <=15.5.27`. +- `GHSA-p3m5-59mp-jv5r` — high, denial of service in the App Router through Server Actions, `>=13.0.0 <=15.5.27`. +- `GHSA-mcj8-r9mp-w47p` and `GHSA-4jqv-mc3x-m676` — moderate, cache poisoning of SSG and ISR pages, `>=15.0.0 <15.5.27`. +- `GHSA-wq5f-xc86-pv6w` — high, a memory bug in Sharp's bundled librsvg (CVE-2026-96889) that can allow remote code execution on glibc-based Linux, `<0.35.5`. + +`next` moves `15.5.25` to `15.5.28` and the `sharp` override `0.35.4` to `0.35.5`, both inside their pinned minors. + +Next 15.5.28 declares Sharp `^0.34.3 || ^0.35.5`, so the override stays inside the range Next supports. The image notes in the template README and `next.config.mjs` now name `0.35.5` as the advisory floor, because the `0.34.x` half of Next's range is inside both Sharp advisories. + +The remaining `decode-uri-component` finding is moderate and does not block the smoke. diff --git a/packages/create-sei/templates/next-template/README.md b/packages/create-sei/templates/next-template/README.md index e2d77be9b..256da17d3 100644 --- a/packages/create-sei/templates/next-template/README.md +++ b/packages/create-sei/templates/next-template/README.md @@ -32,7 +32,7 @@ bun run build Next.js image optimization is disabled so the generated app needs no native Sharp build. Turning it on is a template choice rather than a security tradeoff. -The manifest's `sharp` override is a separate matter and has to stay. The pinned Next 15 line declares Sharp `^0.34.3 || ^0.35.4`, and the `0.34.x` half of that range is still inside [GHSA-rgj7-g3m4-5g8c](https://github.com/advisories/GHSA-rgj7-g3m4-5g8c), so `0.35.4` is the advisory floor. Loosening or removing the override reintroduces a high audit finding whether or not optimization is enabled. +The manifest's `sharp` override is a separate matter and has to stay. The pinned Next 15 line declares Sharp `^0.34.3 || ^0.35.5`, and the `0.34.x` half of that range is still inside [GHSA-rgj7-g3m4-5g8c](https://github.com/advisories/GHSA-rgj7-g3m4-5g8c) and [GHSA-wq5f-xc86-pv6w](https://github.com/advisories/GHSA-wq5f-xc86-pv6w), so `0.35.5` is the advisory floor. Loosening or removing the override reintroduces high audit findings whether or not optimization is enabled. ## Development bundler diff --git a/packages/create-sei/templates/next-template/next.config.mjs b/packages/create-sei/templates/next-template/next.config.mjs index 2bfbbc179..ee44cf948 100644 --- a/packages/create-sei/templates/next-template/next.config.mjs +++ b/packages/create-sei/templates/next-template/next.config.mjs @@ -7,9 +7,10 @@ const nextConfig = { images: { // Images stay unoptimized so the generated app needs no native Sharp // build. Keep the manifest's Sharp override: Next declares - // `^0.34.3 || ^0.35.4`, and the 0.34.x half is still inside - // GHSA-rgj7-g3m4-5g8c, so 0.35.4 is the advisory floor. Loosening that - // pin reintroduces a high finding even though this flag is off. + // `^0.34.3 || ^0.35.5`, and the 0.34.x half is still inside + // GHSA-rgj7-g3m4-5g8c and GHSA-wq5f-xc86-pv6w, so 0.35.5 is the + // advisory floor. Loosening that pin reintroduces high findings even + // though this flag is off. unoptimized: true, }, webpack: (config) => { diff --git a/packages/create-sei/templates/next-template/package.json b/packages/create-sei/templates/next-template/package.json index 221c62fe8..f50af063e 100644 --- a/packages/create-sei/templates/next-template/package.json +++ b/packages/create-sei/templates/next-template/package.json @@ -25,7 +25,7 @@ "@tailwindcss/postcss": "4.3.3", "@tanstack/react-query": "5.85.3", "ethers": "6.17.0", - "next": "15.5.25", + "next": "15.5.28", "pino-pretty": "13.1.3", "postcss": "8.5.26", "react": "19.1.2", @@ -46,7 +46,7 @@ "@metamask/sdk": "0.33.1", "@metamask/sdk-communication-layer": "0.33.1", "postcss": "8.5.26", - "sharp": "0.35.4", + "sharp": "0.35.5", "use-sync-external-store": "1.6.0", "uuid": "11.1.1", "ws": "8.21.3"