Skip to content

Chore(deps): Bump next from 15.5.18 to 15.5.21 - #7

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/next-15.5.21
Open

Chore(deps): Bump next from 15.5.18 to 15.5.21#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/next-15.5.21

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubJul 23, 2026•
edited
Loading

Copy link
Copy Markdown

Bumps next from 15.5.18 to 15.5.21.

Release notes

Sourced from next's releases.

v15.5.21

This release contains security fixes for the following advisories:

High:

Moderate:

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

Commits
  • e26f6ff v15.5.21
  • 7f5deeb [15.x] Improve performance of checking valid MPA form submissions
  • 57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
  • e3e5666 [15.x] Set correct origin for internal redirects in custom server
  • 35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
  • 062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
  • 577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
  • 530d4fa [15.x] fix(next/image): improve performance of detectContentType()
  • 8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
  • ff12a61 [15.x] Validate server reference IDs during manifest lookup
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 23, 2026
@dependabotdependabotBot changed the title chore(deps): bump next from 15.5.18 to 15.5.21build(deps): bump next from 15.5.18 to 15.5.21Aug 18, 2026
@dependabot
dependabotBotforce-pushed the dependabot/npm_and_yarn/next-15.5.21 branch from 417962a to 74253bcCompareAugust 18, 2026 23:51
0xHexE pushed a commit that referenced this pull request Aug 21, 2026
@eric8810Sol-Boy@multica-agent
MUL-5959: feat(agent): add Dim (DimCode) ACP runtime (multica-ai#6675)
e1be162
* feat(agent): add Dim (DimCode) ACP runtime
Add Dim (dimcode, the `dim` CLI) as a first-party agent runtime, driven
over the ACP (Agent Client Protocol) transport via `dim acp`.
Key integration points:
- New dim backend (pkg/agent/dim.go): spawns `dim acp`, performs the
ACP initialize/session/new handshake, and raises the runtime's
hardcoded read-only permission preset to full-access (plus agent mode)
via session/set_config_option before the first prompt — without it every
file write is denied by a capability rule. Model override uses
session/set_model; the model catalog is read from session/new.
- Session resume is intentionally skipped: Dim binds sessions to the
creating process, so a later process's session/load is rejected with
"held by another process" even after a clean session/close. The backend
always starts a fresh session and reports ResumeRejected so the daemon
classifies the run correctly. A best-effort session/close keeps Dim's
own session list free of orphaned entries.
- Registration: SupportedTypes whitelist, New() factory, launch header,
daemon probe (MULTICA_DIM_PATH / MULTICA_DIM_MODEL), default agent
command name, protocol_family CHECK migration (255), model discovery,
MCP config support, metrics label, and runtime display.
- Docs/UI: provider logo, landing i18n (en/zh/ja/ko), providers and
install-agent-runtime docs, README, CLI_AND_DAEMON, SELF_HOSTING.
- Tests: dim backend unit tests (fresh session + resume behavior), shared
ACP deliverable case, logo and MCP-support tests.
* feat(views): use official DimCode app icon for Dim provider logo
Replace the placeholder inline SVG with the official DimCode desktop
client app icon (from /opt/DimAgent/resources/build/icon.png, resized
to 128px), imported as a static asset the same way the Qwen Code mark
is handled.
* test(agent): add real dim ACP smoke tests (agentintegration)
Two gated tests behind MULTICA_RUN_REAL_AGENT_SMOKE=1:
- TestDimRealACPSmoke: full end-to-end against real `dim acp` —
initialize, session/new, set_config_option (permission/mode), prompt,
and assert completed output.
- TestDimRealResumeRejected: pass a fake ResumeSessionID, assert the
backend starts a fresh session (no session/load), and reports
ResumeRejected=true so the daemon classifies the run correctly.
Verified against dimcode 0.3.2 and 0.3.8.
* fix: renumber dim migration 265 → 271 (upstream added 265-270)
* fix: renumber dim migration to 272 (upstream added 271)
* fix(agent): dim cross-run resume via session/load + review fixes
Address review feedback on the Dim ACP runtime:
- #1 Deliver runtime brief to Dim: add dim to the AGENTS.md provider
list (verified dim 0.3.8+ reads AGENTS.md from the session cwd).
- #2 Cross-run session continuity: dim 0.3.10+ releases its per-process
session lock ~5s after the owning process exits, so resume now goes
through the standard ACP session/load (same as traecli/kiro/grok)
instead of always starting fresh. A loaded session retains its
permission/mode, so set_config_option runs only on fresh sessions.
Add a two-run regression (TestDimRealCrossRunResume) proving run B
recalls context established only in run A.
- #3 Process lifecycle races: the deferred cleanup now cancels the run
context before cmd.Wait (a child ignoring stdin EOF no longer hangs
Result delivery) with a bounded force-kill fallback; the success path
waits for the final prompt notification with a grace window instead
of a non-blocking read that could miss the last message.
- #4 Isolate model discovery by executable path (discoveryCacheKey).
- #6 Real smoke test now writes a sentinel file to prove full-access is
effective; a best-effort session/close is sent before teardown.
- #7 gofmt.
* test(agent): add dim process-lifecycle regressions (review #3)
- TestDimCleanupKillsHangingChild: a child that ignores stdin EOF and
SIGTERM after an early failure is force-killed within
dimProcessWaitTimeout, so Result still closes.
- TestDimPromptMissingNotificationStillCompletes: when session/prompt
returns without stopReason (onPromptDone never fires), the bounded
final-notification wait falls through and Result completes instead of
hanging.
* fix(migrations): renumber dim runtime_profile migration 272 → 273 (upstream added 272)
* fix(agent): review round 2 — process tree, quiescence, fail-closed, version check
Address all remaining blockers from the second review:
- #1 Require dim >= 0.3.10 (version check at initialize); bounded retry
on session/load when the lock is not yet released instead of silently
starting fresh; integration test no longer sleeps before resume.
- #2 Process-tree cleanup: configureProcessGroup + signalProcessGroup +
waitProcessGroupGone; cmd.Cancel returns nil so we own all signalling;
regression asserts the descendant PID is gone.
- #3 Notification quiescence: onActivity + waitForACPNotificationQuiescence
(same as hermes); Dim equivalent of the late-final-notification test.
- #4 Permission fail-closed: set_config_option runs on BOTH fresh and
resumed sessions; on config failure, session/close is sent before
returning so a partially configured session is not resumed; regression.
- #5 Migration renumbered 273 → 274 (upstream added 273).
- #6 AGENTS.md mapping regression, two-executable cache isolation test,
session/close unit assertion, smoke test now executes a command.
- #7 README.md + CLI_AND_DAEMON.md updated with 22 CLIs including Dim.
* chore: remove temporary review actions doc (not for PR)
* fix(migrations): renumber dim migration 274 → 310 (upstream added 274-309)
* review: fix retry break scope, dedup isACPSessionNotFound comment, update stale notes
* fix(agent): pass *exec.Cmd to signalProcessGroup/waitProcessGroupGone (upstream signature change)
* fix(agent): close session on set_model failure + resume regression test
Audit-found gaps from self-review:
- set_model failure now sends session/close before returning (same as
set_config_option failure) — reviewer #4 said 'permission, mode, or
model'.
- Add TestDimConfigFailThenResumeReestablishes: run A config fails →
session/close sent → run B resumes and re-applies set_config_option
(fail-closed), completing successfully.
- Fix two stale comments that contradicted the code (config block now
runs on both fresh and resumed sessions).
* fix(agent): add WaitDelay, use labeled break in retry loop
Self-audit improvements:
- Add cmd.WaitDelay=10s for consistency with claude.go (hard backstop
if a process somehow survives SIGKILL).
- Use labeled break (break loadRetry) so runCtx cancellation during the
retry delay exits the for loop directly, not just the select.
- Update PR description: migration 273→310, set_config_option now
re-applied on both fresh and resumed sessions.
* fix(migrations): renumber dim migration 310 → 313 (upstream added 310-312)
* fix(migrations): remove stale 313 dim migration (replaced by 314 after upstream added dsh at 313)
* fix: DSH compatibility + thinking levels + reviewer round 3
Systematic fix of all 39 items from the compatibility gap analysis:
Rebase + migration:
- Rebase to latest upstream/main (resolves all DSH conflicts)
- Migration 314_runtime_profile_add_dim (whitelist includes both dsh + dim)
- Remove stale 313 dim migration
DSH + Dim coexistence (provider lists, counts, docs):
- SupportedTypes, config.go, metrics labels: both dsh + dim
- i18n (4 files): count 23, lists include DSH + Dim + Oh-My-Pi
- README.md/README.zh.md: count 23
- CLI_AND_DAEMON.md: 23-row table
- environment-variables.mdx (4 langs): MULTICA_DIM_PATH/MODEL callout
- display.ts, mcp-support.ts, types/agent.ts, provider-logo.tsx: both dsh+dim
Thinking levels (was MISSING — dim supports thought_level):
- dim.go: call applyACPEffortOption after set_model
- thinking.go: add dim to acpCatalogThinkingProviders
- dim.go: retain sessionResult for effort option
Reviewer round 3:
- Version check fail-closed: empty/malformed → reject (not allow)
- Cache test through ListModels call site with fake executables
- set_model failure regression test
- Test companions: sidecar_manifest_test, runtime_config_test add dim
Code quality:
- agent.go: fix unreachable duplicate return (rebase artifact)
- dim.go: labeled break in retry loop, WaitDelay, session/close on set_model fail
* fix: deliverable test fake version + provider-logo rebase artifact
* fix(migrations): renumber dim migration 314 → 315 (upstream added 314_workspace_mcp_config)
* fix(migrations): renumber dim migration 315 → 319 (upstream added 315-318)
* fix: Windows process tree, MinVersions, retry tests, migration 327
Address all 5 remaining blockers from review round 4:
1. Windows process-tree ownership: use startOwnedProcessTree instead of
cmd.Start(), releaseProcessGroup in cleanup defer. This attaches the
child to a Job Object on Windows (no-op on Unix), ensuring descendants
are captured and terminated.
2. Migration renumbered 319 → 327 (upstream added 319-326).
3. Add dim: 0.3.10 to MinVersions in version.go so the daemon registers
old Dim binaries as offline and refuses triggers (defense in depth on
top of the ACP agentInfo.version check in dim.go).
4. Session-lock retry contract tests: success after bounded retries,
exhaustion without falling through to session/new. Fake script
supports DIM_LOAD_HELD_N (held for N calls then succeed) and
DIM_LOAD_HELD_ALWAYS (always held).
5. README.md:206 20→23 runtimes. PR description updated.
* test: add missing reviewer-requested regressions (round 4)
- Windows Job Object regression: dim_windows_test.go proves the Dim
backend captures and terminates descendants via startOwnedProcessTree
(Windows-only build tag; companion to TestStartOwnedProcessTree).
- MinVersions registration: add dim test cases to TestCheckMinVersion
(0.3.10 ok, 0.3.9 rejected, invalid rejected).
- Retry cancellation: TestDimSessionLoadRetryCancelled cancels the
context during the retry delay, asserts no session/new fallback.
* fix: sync upstream Command signature changes + restore dim additions
Upstream changed ListModels/discoverXxxModels/detectCLIVersion to accept
Command (struct with Path+Prefix) instead of string. The previous rebase
kept our old-signature versions, causing widespread compile failures.
Restored all affected files from upstream, then re-applied dim-specific
additions:
- agent.go: dim in SupportedTypes, New(), launchHeaders
- hermes.go: isACPHeldByProcess + -32002 in isACPSessionNotFound
- thinking.go: dim in acpCatalogThinkingProviders
- models.go: dim case in ListModels + discoverDimModels
- version.go: dim in MinVersions
- All dim test files preserved (dim_test.go, dim_integration_test.go,
dim_windows_test.go, models_test.go dim cache test)
* fix: rebase to latest main, migration 327→341, resolve DetectVersion conflict
* fix: remove unused os/exec import in dim_windows_test.go
* fix(migrations): renumber dim migration 341 → 342 (upstream added 341)
* fix: use Command.exec instead of exec.CommandContext (upstream GH multica-ai#7046)
Upstream's TestOnlyLaunchGoSpawnsRuntimeProcesses requires all backends
to build processes through Command.exec (launch.go), so a custom runtime's
fixed_args are carried into the subprocess. Dim was the only backend still
using exec.CommandContext directly.
* fix: launch prefix policy + remove empty test files + deterministic retry tests
Address all 4 findings from review round 5:
1. Add "dim": dimBlockedArgs to launchPrefixBlockedArgs so protocol-breaking
flags (--help/--auth-setup/--remote) are filtered from fixed_args.
2. Remove 77 zero-byte *_test.go files accidentally added at repo root.
3. Make retry tests deterministic: TestDimSessionLoadRetryCancelled waits
for the first session/load request before cancelling (no fixed sleep);
TestDimSessionLoadRetryExhausted asserts exactly 4 load attempts.
4. PR description will be updated separately.
* fix: rebase to latest main, migration 342→343 (upstream added mcode at 342)
* chore: trigger CI
* chore: refresh PR
* fix: restore mcode that was lost during merge conflict resolution
Merge took 'ours' side which predated mcode. Restore mcode in:
- SupportedTypes, New() factory, launchHeaders
- agent_supported_types_test.go want map
- metrics/labels.go
- config.go defaultAgentCommandNames
- migration 343 up/down whitelists
* fix: restore mcode probe in agents_probe.go + agent-cli-command-names.txt
* fix: restore all remaining mcode references lost during merge
Files fixed:
- README.md: mcode row in runtimes table
- mcp-support.test.ts: mcode assertion
- config.go: mcode in Agents comment + error message
- runtime_config.go: mcode in AGENTS.md case
- version.go: mcode in MinVersions
- version_test.go: mcode test cases
Verified: no file has fewer mcode references than upstream.
* fix: restore mcode in environment-variables docs + CLI_AND_DAEMON ACP list
- environment-variables.{mdx,ja,ko,zh}: restored 'MiniMax Code' in the
QwenPaw model-variable sentence
- CLI_AND_DAEMON.md: added MiniMax Code to ACP-family list + loadSession
fallback description
Verified: every changed file now has >= mcode references vs upstream.
* fix(migrations): renumber dim migration 343 → 344 (upstream added 343)
* fix(migrations): renumber dim migration 344 → 348 (upstream added 344-347 plugin migrations)
* fix(migrations): update down migration comment 344 → 348
* chore: retrigger CI (flaky TestOpenclawDiscoveryCacheConcurrentPreparations — upstream test, passes locally x5)
* fix(migrations): renumber dim migration 348 → 352 (upstream added 348-351)
* fix: Dim launch-prefix regression test + version.go comment repair (review #6)
- Add TestDimLaunchPrefixFiltersBlockedFlags: proves allowed prefix
reaches command before acp, and --help/--auth-setup/--remote/-h are
stripped from Dim's launch prefix.
- Add dim to TestLaunchPrefixReachesACPFamilies family list.
- Repair version.go: dim's cross-run session/load comment was appended
to mcode entry during a rebase conflict; restore two independent
accurate comments.
* fix(migrations): update down migration comment 348 → 352
* chore: retrigger CI (backend-tests stuck 50+ min)
* fix(migrations): renumber dim migration 352 → 362 (upstream added 352-361)
* fix: use logAgentCommand for dim argv logging (upstream redaction requirement)
Upstream's TestOnlyLaunchGoLogsAgentCommandArgs enforces that all
runtime argv logging goes through Config.logAgentCommand so sensitive
args are redacted. dim.go was still using Logger.Info directly.
* fix(migrations): renumber dim migration to 370
Co-authored-by: multica-agent <github@multica.ai>
---------
Co-authored-by: Sol-Boy <sol-boy@multica-ai.local>
Co-authored-by: multica-agent <github@multica.ai>
@dependabot
Chore(deps): Bump next from 15.5.18 to 15.5.21
ac7c9c3
Bumps [next](https://github.com/vercel/next.js) from 15.5.18 to 15.5.21.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v15.5.18...v15.5.21)
---
updated-dependencies:
- dependency-name: next
dependency-version: 15.5.21
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot changed the title build(deps): bump next from 15.5.18 to 15.5.21Chore(deps): Bump next from 15.5.18 to 15.5.21Aug 21, 2026
@dependabot
dependabotBotforce-pushed the dependabot/npm_and_yarn/next-15.5.21 branch from 74253bc to ac7c9c3CompareAugust 21, 2026 23:56
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants