Skip to content

build(deps): bump next from 14.2.35 to 15.5.21 - #28

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/next-15.5.21
Closed

build(deps): bump next from 14.2.35 to 15.5.21#28
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/next-15.5.21

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor

Bumps next from 14.2.35 to 15.5.21.

Release notes

Sourced from next's releases.

v15.5.21

This release contains security fixes for the following advisories:

High:

Moderate:

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

15.5.19

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [15.5.x] Don't drop FormData entries (#94244)

Other

Credits

Huge thanks to @​eps1lon for helping!

v15.5.18

This release contains security fixes for the following advisories:

High:

... (truncated)

Commits
  • e26f6ff v15.5.21
  • 7f5deeb [15.x] Improve performance of checking valid MPA form submissions
  • 57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
  • e3e5666 [15.x] Set correct origin for internal redirects in custom server
  • 35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
  • 062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
  • 577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
  • 530d4fa [15.x] fix(next/image): improve performance of detectContentType()
  • 8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
  • ff12a61 [15.x] Validate server reference IDs during manifest lookup
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 28, 2026
@vercel

vercel Bot commented Jul 28, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
v0--a1knrtgvnd4 Ready Ready Preview, Comment, Open in v0 Jul 28, 2026 2:03am
v0-mousegame Ready Ready Preview, Comment Jul 28, 2026 2:03am

Request Review

@netlify

netlify Bot commented Jul 28, 2026

Copy link
Copy Markdown

Deploy Preview for rococo-monstera-807791 ready!

Name Link
🔨 Latest commit ca7b6d7
🔍 Latest deploy log https://app.netlify.com/projects/rococo-monstera-807791/deploys/6a680da6347735000844fb1d
😎 Deploy Preview https://deploy-preview-28--rococo-monstera-807791.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Bumps [next](https://github.com/vercel/next.js) from 14.2.35 to 15.5.21.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v14.2.35...v15.5.21)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 15.5.21
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@CaCC-Lab

Copy link
Copy Markdown
Owner

#23 と同じ理由で close します。

  • next は 14.2.35(14系の最新パッチ)を維持する方針です
  • critical は fix: 依存パッケージの脆弱性を修正(critical 4件を解消) #27 で解消済みです
  • 15/16 系へのメジャーアップは App Router の破壊的変更への追従が必要なため見送っています
  • 14.2.35 で残る next の advisory 2件は self-hosted のサーバー実行が前提で、output: 'export' の静的サイトには該当しません

同種の PR が繰り返し作られるのを防ぐため、.github/dependabot.yml で 15 系以降を ignore する設定を別途追加します。14 系のパッチ更新は引き続き通知されます。

@CaCC-Lab CaCC-Lab closed this Jul 28, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/next-15.5.21 branch July 28, 2026 03:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant