[Aikido] Fix security issue in next via minor version upgrade from 15.4.8 to 15.5.21

[aikido-autofix]

Upgrade Next.js to fix SSRF via WebSocket requests, DoS attacks on Server Functions, authorization bypass in middleware, and source code disclosure vulnerabilities.

✅ Code not affected by breaking changes.

✅ No breaking changes from the Next.js 15.4.8 → 15.5.16 upgrade affect this codebase. The demo application uses standard Next.js features (Pages Router, App Router, useRouter, useSearchParams, Link) that remain unchanged. None of the deprecated or removed features (experimental.dynamicIO, useMDXComponents, experimental.strictNextHead, cookies()/headers() sync access, AMP, unstable_rootParams) are used in this codebase.

All breaking changes by upgrading next from version 15.4.8 to 15.5.21 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-44578	HIGH	[next] Self-hosted applications are vulnerable to server-side request forgery (SSRF) through crafted WebSocket upgrade requests, allowing attackers to proxy requests to arbitrary destinations and potentially expose internal services or cloud metadata. Vercel-hosted deployments are unaffected.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-44575	MEDIUM	[next] Authorization bypass in App Router allows unauthorized access to protected content through transport-specific route variants (.rsc and segment-prefetch URLs) that bypass middleware checks. Attackers can reach protected pages without proper authorization verification.
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.

🤖 Remediation details

Upgrade next to resolve multiple security vulnerabilities

Short summary

This PR fixes security vulnerabilities in the next package by upgrading it from 15.4.8 to 15.5.21 in both the root package.json (devDependencies) and the packages/demo-nextjs workspace member manifest (dependencies). The yarn.lock lockfile was refreshed accordingly, replacing the old resolved entry with the single patched version.

next

next was pinned at the exact version 15.4.8 in two places: the root package.json devDependencies and the packages/demo-nextjs workspace package.json dependencies. Both declarations were updated to the exact version 15.5.21, which is the minimum release in the 15.x line that satisfies all six advisories addressed by this task—including CVE-2026-64644, which required at least 15.5.21 and was introduced as a gap when an intermediate upgrade stopped at 15.5.16. After both manifest edits, yarn install --ignore-engines --ignore-scripts was run from the workspace root to produce a clean lockfile with a single next@15.5.21 entry and no stale 15.4.8 or 15.5.16 residuals.

Version changes

Package	From	To	Why updated
next	15.4.8	15.5.21	Direct CVE fix (root package.json devDependencies)
next	15.4.8	15.5.21	Direct CVE fix (packages/demo-nextjs dependencies)
@next/env	15.4.8	15.5.21	Lockfile refresh — companion package versioned with next
@next/swc-linux-x64-gnu	15.4.8	15.5.21	Lockfile refresh — optional companion package versioned with next
@next/swc-linux-x64-musl	15.4.8	15.5.21	Lockfile refresh — optional companion package versioned with next

[gitstream-cm]

🚨 gitStream Monthly Automation Limit Reached 🚨

Your organization has exceeded the number of pull requests allowed for automation with gitStream.
Monthly PRs automated: 250/250

To continue automating your PR workflows and unlock additional features, please contact LinearB.

[pr-auditor]

✅ Security Analysis Results

Great news! No security issues found in this pull request.

Analysis Summary:

• 📁 Files reviewed: 3
• ✅ No security vulnerabilities detected

---

💡 Trigger a new security scan by commenting @pr-auditor rescan on this PR.

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page