[dependabot]

Bumps next from 14.1.1 to 15.5.28.

Release notes

Sourced from next's releases.

v15.5.28

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v15.5.27

This release contains security fixes for the following advisories:

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

v15.5.26

This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026

v15.5.25

Follow-up release to v15.5.24 re-enabling AVIF Image Optimization when newer versions of sharp are installed (#97954).

Commits

• 195cd6a v15.5.28
• 1b53604 [cd] Allow branch to get published
• 5e3b687 [lts-maintenance][next/image] Bump sharp (#232)
• a2021b3 [lts-maintenance][react] Improve Server Component transport protocol (#194)
• a836b53 [lts-maintenance] Fix google tag manager e2e test, assume GTM 200s instead of...
• 9c1c1b1 [lts-maintenance][ci] Wire preview builds variables consistently (#99325)
• def7eff v15.5.27
• 52c94ab [lts-maintenance] Scope response cache keys to their source route (#219)
• 785f4c2 [lts-maintenance] Match Next data paths case-sensitively (#197)
• 7217d63 [lts-maintenance][webpack] Ensure dynamicParams is respected in `opengraph-...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Samples Checklist

✅ All good!

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1749e6cd-babd-4396-b2e1-0a7d3a16966d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}