fix(agentex-ui): bump next 15.5.18 -> 15.5.21 (8 CVEs)

[scale-prodsec]

Summary

Bumps next from 15.5.18 → 15.5.21 in agentex-ui/ to remediate 8 Trivy findings on the golden/agentex-ui container image. next is a direct dependency; the fix stays on the 15.x major (avoids the 16.2.11 major bump) to minimize API drift — it is a patch-level upgrade within 15.5.x.

CVEs closed

• CVE-2026-64641 (HIGH) — DoS in App Router using Server Actions
• CVE-2026-64643 (MEDIUM) — Unauthenticated disclosure of internal Server Function endpoints
• CVE-2026-64644 (MEDIUM) — DoS in the Image Optimization API using SVGs
• CVE-2026-64645 (HIGH) — SSRF in rewrites via attacker-controlled destination hostname
• CVE-2026-64646 (MEDIUM) — Unbounded Server Action payload in Edge runtime
• CVE-2026-64647 (MEDIUM) — Cache confusion of response bodies (invalid UTF-8 byte sequences)
• CVE-2026-64648 (MEDIUM) — Cache confusion of response bodies for requests with bodies
• CVE-2026-64649 (HIGH) — SSRF in Server Actions on custom servers

Fixed by upstream Next.js v15.5.21 (advisory GHSA-m99w-x7hq-7vfj and related).

Changes

• agentex-ui/package.json: next pin 15.5.18 → 15.5.21 (exact-pin style preserved)
• agentex-ui/package-lock.json: re-locked via npm install --package-lock-only. Changed closure is exactly next, @next/env, and the 8 @next/swc-* platform binaries — all 15.5.18 → 15.5.21, all resolved from registry.npmjs.org. No other entries, no registry drift, lockfileVersion 3 preserved.

Verification

• python -m bot.version_gate --ecosystem node-pkg --package next --candidate 15.5.21 → 15.5.21 selected, zero known vulnerabilities.
• npm ci (immutable install, the CI gate) succeeds — package.json and package-lock.json agree.
• node node_modules/.bin/next --version → Next.js v15.5.21.
• npm audit no longer flags next for any of the 8 CVEs above.

Ticket

Resolves GFDVR-20748 (children: GFDVR-20749, GFDVR-20750, GFDVR-20751, GFDVR-20752, GFDVR-20753, GFDVR-20754, GFDVR-20755, GFDVR-20756).

🤖 Generated with Claude Code

Greptile Summary

This PR bumps Next.js from 15.5.18 to 15.5.21 in agentex-ui/ to close 8 CVEs, staying within the 15.5.x patch range to avoid API drift.

• agentex-ui/package.json: exact version pin updated from 15.5.18 → 15.5.21.
• agentex-ui/package-lock.json: next, @next/env, and all 8 @next/swc-* platform binaries re-locked to 15.5.21; Linux platform entries gained an explicit libc field (glibc/musl) which is normal new metadata added by npm for this release. No other closure entries change and lockfileVersion 3 is preserved.

Confidence Score: 5/5

Safe to merge — this is a targeted patch-level upgrade that closes 8 high/medium CVEs with no other dependency changes.

Only Next.js and its own sub-packages change. The lock file closure is minimal and correct: next, @next/env, and the 8 optional SWC platform binaries all move to 15.5.21 with updated integrity hashes, and nothing else shifts. The new libc metadata on Linux entries is normal for this npm release and carries no risk. No application code is touched.

No files require special attention.

Important Files Changed

Filename	Overview
agentex-ui/package.json	Single-line exact version pin change: next 15.5.18 → 15.5.21. No other dependencies touched.
agentex-ui/package-lock.json	Re-locked closure for next, @next/env, and all 8 @next/swc-* binaries to 15.5.21 with updated integrity hashes; Linux entries now include a libc field (expected new metadata). No other package entries changed.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Trivy scan: 8 CVEs on agentex-ui container] --> B[Root package: next 15.5.18]
    B --> C[Upgrade to next 15.5.21 on 15.5.x patch track]
    C --> D[package.json pin updated]
    C --> E[package-lock.json re-locked]
    E --> F[next/env 15.5.21]
    E --> G[8 platform swc binaries 15.5.21]
    E --> H[No other closure changes]
    D & F & G & H --> I[npm ci succeeds, npm audit clean, 8 CVEs closed]

Loading

_{Reviews (1): Last reviewed commit: "fix(agentex-ui): bump next 15.5.18 -> 15..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​15.5.18 ⏵ 15.5.21		+31	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential vulnerability: npm next with risk level "medium" Location: Package overview From: agentex-ui/package-lock.json → npm/[email protected] ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report