chore(web/personas-open-source): remediate Dependabot vulns (#7327)

[mdmohsin7]

Part of #7327. Branched from fresh main.

Result (option 2 — non-breaking only)

npm audit: 17 → 5. 2 of 3 CRITICALs cleared non-breaking: form-data, protobufjs (+ flatted/minimatch/picomatch transitive). net diff vs main: package-lock.json only (package.json unchanged).

Deferred residual — the next CRITICAL (runtime-test finding)

Initially this PR also bumped next 15.0.3 → 15.5.18 to clear the next CRITICAL. Runtime testing caught a regression: with next 15.5.18, mixpanel-browser 2.56.0 (version unchanged) throws an uncaught client TypeError: Cannot read properties of undefined (reading 'load_prop') on / and /chat — reproducible, and absent on the next 15.0.3 baseline under identical env (npm build/npm audit did not surface it; only next start + a route walkthrough did).

Per decision, the next bump was reverted (commit f94750edd). The next CRITICAL is a flagged, deferred residual — its only fix (next 15.5.18) introduces the mixpanel breakage, which needs a Next-15.5 + mixpanel-init code fix (out of scope for a deps PR). Tracked separately.

Remaining 5 (1C next + 3H/1M) are all gated behind the same next-15.5/16 + eslint-config-next majors — consistent with the other web apps' deferred next-major decision.

Validation

next build (next 15.0.3) → exit 0. next start route walkthrough (/, /chat, /login, /u/[username]) → 0 page errors, 0 5xx — identical to the unmodified next 15.0.3 baseline (the mixpanel regression is gone with the next bump reverted).

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR remediates Dependabot security findings in web/personas-open-source by upgrading next from 15.0.3 to ^15.5.18 and bumping several transitive dependencies (flatted, form-data, @protobufjs/*, minimatch, picomatch, @img/sharp-*) in the lockfile. The audit score drops from 17 (3 critical) to 5 (0 critical) vulnerabilities.

• next is updated from a pinned exact version to a caret range (^15.5.18), clearing the critical next CVE while staying within the 15.x minor track.
• eslint-config-next intentionally remains at ^14.2.6 (resolved to 14.2.35), creating a documented major-version gap with next@15.x that is deferred to a future next-16/eslint-9 migration.

Confidence Score: 4/5

Safe to merge — all critical CVEs are cleared, the build passes, and the remaining five vulnerabilities are deliberately deferred with documented justification.

The next bump is a well-contained intra-major upgrade (15.0.3 → 15.5.18) validated by a successful next build. The only notable concern is the lingering eslint-config-next@14.x / next@15.x mismatch, which can cause lint rules to silently miss Next.js 15-specific issues, but this is explicitly acknowledged as a deferral decision rather than an oversight.

package.json — the eslint-config-next version gap deserves a follow-up tracking item to keep it from widening further as Next.js minor releases accumulate.

Important Files Changed

Filename	Overview
web/personas-open-source/package.json	Single meaningful change: next bumped from exact pin 15.0.3 to semver range ^15.5.18. eslint-config-next remains at ^14.2.6, creating a major-version mismatch with the upgraded Next.js — acknowledged as a deliberate deferral in the PR description.
web/personas-open-source/package-lock.json	Lockfile updated to reflect next@15.5.18, flatted@3.4.2, form-data@4.0.5, @protobufjs/* sub-packages, minimatch@3.1.5, picomatch@2.3.2, and @img/sharp-*@0.34.5. All changes are consistent with the stated audit remediation.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[npm audit before\n17 vulns: 3C / 6H / 8M] --> B{Remediable without\nbreaking changes?}
    B -- Yes --> C[Bump next 15.0.3 → 15.5.18\nform-data, protobufjs,\nflatted, minimatch, picomatch]
    B -- No --> D[Deferred — requires\nnext major 16 +\neslint 8→9 migration]
    C --> E[npm audit after\n5 vulns: 0C / 3H / 2M]
    D --> F[eslint-config-next stays at 14.x\npostcss vulnerability remains]
    E --> G[next build → exit 0\nvia --legacy-peer-deps]

Loading

Comments Outside Diff (1)

1. web/personas-open-source/package.json, line 48 (link)

   eslint-config-next major version mismatch with Next.js

   eslint-config-next is pinned to ^14.2.6 (resolved to 14.2.35 in the lockfile), while next is now ^15.5.18. The eslint-config-next package is designed to be version-matched with your Next.js installation — the 14.x config does not know about Next.js 15 conventions (e.g. App Router stabilization, turbo config changes, updated Server Actions rules). In practice this means next lint may miss real Next.js 15 lint issues or emit stale warnings. The PR description documents this as a deliberate hold pending the next-16/eslint-9 migration, which is reasonable — just worth tracking explicitly so the version gap doesn't widen further.

_{Reviews (1): Last reviewed commit: "chore(web/personas-open-source): remedia..." | Re-trigger Greptile}

[mdmohsin7]

Follow-up: the deferred next residual from this PR (option 2 reverted next→15.0.3 because next 15.5 triggered the mixpanel load_prop SSR crash) is now resolved in #7399 — root-caused to module-scope mixpanel.init() executing during App-Router SSR, fixed with lazy browser-only init (public API unchanged). #7399 lands next@15.5.18 and clears all 27 personas alerts (2 critical + 8 high included); runtime-validated with a regression-isolation diff vs unmodified main (identical error profile, zero load_prop).