Skip to content

chore(nextjs): Update dependency next to v15.5.14 [SECURITY]#8278

Open
renovate[bot] wants to merge 3 commits intomainfrom
renovate/npm-next-vulnerability
Open

chore(nextjs): Update dependency next to v15.5.14 [SECURITY]#8278
renovate[bot] wants to merge 3 commits intomainfrom
renovate/npm-next-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Apr 9, 2026

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
next (source) 15.5.13 → 15.5.14 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-27980

Summary

The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.

Impact

An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.

Patches

Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.

Workarounds

If upgrade is not immediately possible:

  • Periodically clean .next/cache/images.
  • Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)

Release Notes

vercel/next.js (next)

v15.5.14

Compare Source

Configuration

📅 Schedule: (in timezone GMT)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel
Copy link
Copy Markdown

vercel bot commented Apr 9, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
clerk-js-sandbox Ready Ready Preview, Comment Apr 9, 2026 1:49pm

Request Review

@renovate
Copy link
Copy Markdown
Contributor Author

renovate bot commented Apr 9, 2026 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

<--- Last few GCs --->

[917:0x33f2f000]    89780 ms: Mark-Compact (reduce) 1495.9 (1526.1) -> 1495.9 (1525.1) MB, pooled: 0 MB, 2056.30 / 0.00 ms  (+ 135.6 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 2250 ms) (average mu = 0.304, c[917:0x33f2f000]    94715 ms: Mark-Compact 1496.9 (1525.1) -> 1496.9 (1529.1) MB, pooled: 0 MB, 4900.86 / 0.00 ms  (average mu = 0.118, current mu = 0.007) allocation failure; scavenge might not succeed


<--- JS stacktrace --->

FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0xe42d60 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
 2: 0x121ded0 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
 3: 0x121e1a7 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.2/bin/node]
 4: 0x144d015  [/opt/containerbase/tools/node/22.22.2/bin/node]
 5: 0x14668a9 v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) [/opt/containerbase/tools/node/22.22.2/bin/node]
 6: 0x143afa8 v8::internal::HeapAllocator::AllocateRawWithLightRetrySlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
 7: 0x143bed5 v8::internal::HeapAllocator::AllocateRawWithRetryOrFailSlowPath(int, v8::internal::AllocationType, v8::internal::AllocationOrigin, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
 8: 0x14141fe v8::internal::Factory::AllocateRaw(int, v8::internal::AllocationType, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
 9: 0x1403034 v8::internal::FactoryBase<v8::internal::Factory>::AllocateRawWithImmortalMap(int, v8::internal::AllocationType, v8::internal::Tagged<v8::internal::Map>, v8::internal::AllocationAlignment) [/opt/containerbase/tools/node/22.22.2/bin/node]
10: 0x14044fe v8::internal::FactoryBase<v8::internal::Factory>::NewRawOneByteString(int, v8::internal::AllocationType) [/opt/containerbase/tools/node/22.22.2/bin/node]
11: 0x1579670 v8::internal::JsonParser<unsigned char>::MakeString(v8::internal::JsonString const&, v8::internal::Handle<v8::internal::String>) [/opt/containerbase/tools/node/22.22.2/bin/node]
12: 0x157f78e  [/opt/containerbase/tools/node/22.22.2/bin/node]
13: 0x1581cfd v8::internal::JsonParser<unsigned char>::ParseJson(v8::internal::Handle<v8::internal::Object>) [/opt/containerbase/tools/node/22.22.2/bin/node]
14: 0x129bda9 v8::internal::Builtin_JsonParse(int, unsigned long*, v8::internal::Isolate*) [/opt/containerbase/tools/node/22.22.2/bin/node]
15: 0x1dd5a36  [/opt/containerbase/tools/node/22.22.2/bin/node]
/usr/local/bin/node: line 18:   917 Aborted                 /opt/containerbase/tools/node/22.22.2/bin/node "$@"

@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Apr 9, 2026 •
edited
Loading

⚠️ No Changeset found

Latest commit: fd05491

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions github-actions bot added the nextjs label Apr 9, 2026
@renovate renovate bot force-pushed the renovate/npm-next-vulnerability branch from 8a0640d to 4c6585f Compare April 9, 2026 11:51
@renovate
Copy link
Copy Markdown
Contributor Author

renovate bot commented Apr 9, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new bot commented Apr 9, 2026

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8278

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8278

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8278

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8278

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8278

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8278

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8278

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8278

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8278

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8278

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8278

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8278

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8278

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8278

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8278

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8278

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8278

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8278

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8278

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8278

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8278

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8278

commit: fd05491

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

nextjs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko