fix(agentex-ui): bump next 15.5.18 -> 15.5.21 (8 CVEs) (#375)

## Summary
Bumps `next` from **15.5.18 → 15.5.21** in `agentex-ui/` to remediate 8
Trivy findings on the `golden/agentex-ui` container image. `next` is a
direct dependency; the fix stays on the 15.x major (avoids the 16.2.11
major bump) to minimize API drift — it is a patch-level upgrade within
15.5.x.

## CVEs closed
- CVE-2026-64641 (HIGH) — DoS in App Router using Server Actions
- CVE-2026-64643 (MEDIUM) — Unauthenticated disclosure of internal
Server Function endpoints
- CVE-2026-64644 (MEDIUM) — DoS in the Image Optimization API using SVGs
- CVE-2026-64645 (HIGH) — SSRF in rewrites via attacker-controlled
destination hostname
- CVE-2026-64646 (MEDIUM) — Unbounded Server Action payload in Edge
runtime
- CVE-2026-64647 (MEDIUM) — Cache confusion of response bodies (invalid
UTF-8 byte sequences)
- CVE-2026-64648 (MEDIUM) — Cache confusion of response bodies for
requests with bodies
- CVE-2026-64649 (HIGH) — SSRF in Server Actions on custom servers

Fixed by upstream Next.js v15.5.21 (advisory GHSA-m99w-x7hq-7vfj and
related).

## Changes
- `agentex-ui/package.json`: `next` pin `15.5.18` → `15.5.21` (exact-pin
style preserved)
- `agentex-ui/package-lock.json`: re-locked via `npm install
--package-lock-only`. Changed closure is exactly `next`, `@next/env`,
and the 8 `@next/swc-*` platform binaries — all `15.5.18` → `15.5.21`,
all resolved from registry.npmjs.org. No other entries, no registry
drift, `lockfileVersion` 3 preserved.

## Verification
- `python -m bot.version_gate --ecosystem node-pkg --package next
--candidate 15.5.21` → `15.5.21` selected, zero known vulnerabilities.
- `npm ci` (immutable install, the CI gate) succeeds — package.json and
package-lock.json agree.
- `node node_modules/.bin/next --version` → `Next.js v15.5.21`.
- `npm audit` no longer flags `next` for any of the 8 CVEs above.

## Ticket
Resolves GFDVR-20748 (children: GFDVR-20749, GFDVR-20750, GFDVR-20751,
GFDVR-20752, GFDVR-20753, GFDVR-20754, GFDVR-20755, GFDVR-20756).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- greptile_comment -->

<h3>Greptile Summary</h3>

This PR bumps `next` from 15.5.18 → 15.5.21 (a patch-level upgrade
within the 15.5.x line) to remediate 8 CVEs confirmed in the July 2026
Next.js security release, including two HIGH-severity issues (DoS via
Server Actions and SSRF in Server Actions on custom servers).

- **`agentex-ui/package.json`**: Single-line exact-pin update from
`15.5.18` to `15.5.21`.
- **`agentex-ui/package-lock.json`**: `next`, `@next/env`, and all 8
`@next/swc-*` platform binaries updated consistently; linux SWC entries
now include `libc` metadata fields (`glibc`/`musl`) that were added
upstream in 15.5.21 — this is expected and benign. No other dependency
entries were touched and `lockfileVersion: 3` is preserved.

<details><summary><h3>Confidence Score: 5/5</h3></summary>

Safe to merge — this is a minimal, well-scoped patch upgrade that closes
8 confirmed CVEs with no API-breaking changes.

The change touches only `next` and its tightly-coupled sub-packages
(`@next/env`, `@next/swc-*`), all bumped consistently to 15.5.21. The
upgrade is patch-level within 15.5.x, Next.js 15.5.21 is a confirmed
upstream release with documented security fixes, and the lockfile diff
contains no unexpected dependency additions or registry changes.

**Files Needing Attention:** No files require special attention.
</details>

<details><summary><h3>Important Files Changed</h3></summary>

| Filename | Overview |
|----------|----------|
| agentex-ui/package.json | Single-line change bumping `next` exact pin
from 15.5.18 → 15.5.21; no other dependencies modified. |
| agentex-ui/package-lock.json | Lockfile updated to match: `next`,
`@next/env`, and 8 `@next/swc-*` platform binaries all bumped 15.5.18 →
15.5.21. Linux SWC entries gain new `libc` fields (glibc/musl) that were
absent in 15.5.18 — this is legitimate metadata added upstream. No other
entries changed, lockfileVersion 3 preserved. |

</details>

<details><summary><h3>Sequence Diagram</h3></summary>

```mermaid
sequenceDiagram
    participant Trivy as Trivy Scanner
    participant CI as CI / npm ci
    participant NPM as registry.npmjs.org
    participant App as agentex-ui (container)

    Trivy->>App: "Detect next@15.5.18 (8 CVEs)"
    Note over Trivy,App: CVE-2026-64641 DoS, CVE-2026-64645/64649 SSRF, etc.

    Note over CI,NPM: PR: bump next 15.5.18 → 15.5.21
    CI->>NPM: "Resolve next@15.5.21 + @next/env + 8 swc binaries"
    NPM-->>CI: Packages resolved, integrity hashes verified
    CI->>App: npm ci (immutable install)
    App-->>Trivy: Re-scan → 0 known CVEs on next
```
</details>

<sub>Reviews (2): Last reviewed commit: ["Merge remote-tracking branch
&#39;origin/mai..."](cdfde9c)
| [Re-trigger
Greptile](https://app.greptile.com/api/retrigger?id=46646635)</sub>

<!-- /greptile_comment -->

Co-authored-by: scale-prodsec[bot] <262621375+scale-prodsec[bot]@users.noreply.github.com>
Co-authored-by: Brandon Allen <brandon.allen@scale.com>

Author: scale-prodsec[bot]

agentex-ui/package-lock.json

@@ -40,7 +40,7 @@
     "framer-motion": "^12.23.24",
     "jose": "^6.0.0",
     "lucide-react": "^0.525.0",
-    "next": "15.5.18",
+    "next": "15.5.21",
     "next-auth": "^5.0.0-beta.32",
     "next-themes": "^0.4.6",
     "react": "^19.1.1",