[Aikido] Fix security issue in next via minor version upgrade from 15.4.8 to 15.5.21

[aikido-autofix]

Upgrade Next.js to fix SSRF in WebSocket requests and multiple DoS vulnerabilities in App Router endpoints via malicious deserialization.

✅ Code not affected by breaking changes.

✅ No breaking changes from the Next.js 15.4.8 → 15.5.16 upgrade affect this codebase. The demo application uses only stable, client-side Next.js features that remain unchanged in this version.

All breaking changes by upgrading next from version 15.4.8 to 15.5.21 (CHANGELOG)

Version	Description
15.5.0	refactor: rename experimental.dynamicIO to experimental.cacheComponents: #81562
15.5.0	Remove useMDXComponents argument: #80871
15.5.0	Remove experimental.strictNextHead: #81882
15.5.0	[Cache Components] Disallow sync access of cookies & headers at runtime: #82564
15.5.0	Turbopack: set window.next.turbopack instead: #82580
15.5.0	[Deprecation Warnings]: add amp deprecation warning: #82551
15.5.0	[Deprecation Warnings]: add unstable_rootParams deprecation warning: #82582
15.5.0	Stabilize node middleware support: #81907

✅ 6 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-44578	HIGH	[next] Self-hosted applications are vulnerable to server-side request forgery (SSRF) through crafted WebSocket upgrade requests, allowing attackers to proxy requests to arbitrary destinations and potentially expose internal services or cloud metadata. Vercel-hosted deployments are unaffected.
GHSA-mwv6-3258-q52c	HIGH	[next] A malicious HTTP request to App Router endpoints can cause server process hangs and excessive CPU consumption during deserialization, resulting in denial of service attacks.
GHSA-q4gf-8mx6-v5v3	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
GHSA-8h8q-6873-q5fj	HIGH	[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2026-44575	MEDIUM	[next] Authorization bypass in App Router allows unauthorized access to protected content through transport-specific route variants (.rsc and segment-prefetch URLs) that bypass middleware checks. Attackers can reach protected pages without proper authorization verification.
GHSA-w37m-7fhw-fmv9	MEDIUM	[next] A malicious HTTP request can expose compiled source code of Server Functions in affected React packages and frameworks, potentially revealing business logic through information disclosure.

🤖 Remediation details

Bump next to 15.5.21 to remediate multiple high/medium severity vulnerabilities

Short summary

This PR remediates several high- and medium-severity vulnerabilities in the next package by upgrading it from 15.4.8 to 15.5.21. The change is applied in two places: the root package.json (devDependencies) and the packages/demo-nextjs/package.json workspace manifest, with yarn.lock refreshed to reflect a single resolved instance at the new version.

next

next was declared as an exact-pinned direct dependency in both the root package.json (devDependencies) and the packages/demo-nextjs workspace manifest (dependencies), both at 15.4.8. Both pins were updated to 15.5.21 — the minimum version that satisfies all advisories in scope, including CVE-2026-64644 which requires ≥ 15.5.21 (superseding the intermediate 15.5.16 floor set by the other advisories). After both manifest edits, yarn install --ignore-engines --ignore-scripts was run from the lockfile root, collapsing the lockfile to a single next@15.5.21 entry.

Version changes

Package	From	To	Why updated
next	15.4.8	15.5.21	Direct CVE fix (root devDependencies + demo-nextjs workspace dependency)

[gitstream-cm]

🚨 gitStream Monthly Automation Limit Reached 🚨

Your organization has exceeded the number of pull requests allowed for automation with gitStream.
Monthly PRs automated: 250/250

To continue automating your PR workflows and unlock additional features, please contact LinearB.

[pr-auditor]

✅ Security Analysis Results

Great news! No security issues found in this pull request.

Analysis Summary:

• 📁 Files reviewed: 3
• ✅ No security vulnerabilities detected

---

💡 Trigger a new security scan by commenting @pr-auditor rescan on this PR.

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page