fix: patch critical Next.js and Auth.js advisories

Merged
KM
2d ago
+75-83

Summary

Bumps the dependencies flagged by eight open critical Dependabot alerts:

PackageFromToAdvisory
next (apps/web, apps/marketing)15.5.1815.5.27GHSA-2xp9-vwfh-vxw4 (RCE in image optimizer), GHSA-p293-qw3h-jr36 (Windows-only) — fixed in 15.5.24
next-auth4.24.144.24.15GHSA-7rqj-j65f-68wh
@auth/core (via @auth/prisma-adapter 2.11.3)0.41.20.41.3GHSA-7rqj-j65f-68wh

apps/web serves /_next/image publicly. remotePatterns only allows gravatar, which limits how the RCE could be reached, but the vulnerable code still ships in the deployed image until this lands. Railway installs with --frozen-lockfile, so the lockfile update is what changes the deployed version.

I picked 15.5.27 over 15.5.28 because 15.5.28 came out on 2026-10-14. That is inside pnpm 11's minimum release age, so installing it would need a minimumReleaseAgeExclude entry.

Found by Polylane (issue: Critical Next.js RCE unpatched in production useSend web app).

Migration notes

None. There are no schema or config changes.

Verification

  • pnpm install --frozen-lockfile: lockfile is consistent
  • pnpm --filter=web typecheck: passes
  • pnpm test:web:unit: 126 passed
  • pnpm test:web:trpc: 10 passed
  • pnpm test:web:api: 20 passed
  • Not run: full pnpm build and integration tests. Please check sign-in (magic link + OAuth) on a preview deploy before merging.

Follow-up

Dependabot security updates are disabled on this repo, which is why no automatic PR was opened for these alerts. Turning it on (or adding .github/dependabot.yml) would catch the next ones.

Summary by cubic

Patches three critical security advisories by bumping next to 15.5.27 (GHSA-2xp9-vwfh-vxw4, GHSA-p293-qw3h-jr36), next-auth to 4.24.15, and @auth/core to 0.41.3 via @auth/prisma-adapter 2.11.3 (GHSA-7rqj-j65f-68wh).

Notes

  • apps/web serves /_next/image publicly but remotePatterns only allows gravatar, limiting how the RCE could be reached; the vulnerable code still ships in the deployed image until this lands.
  • Railway installs with --frozen-lockfile, so the lockfile update is what changes the deployed version.
  • 15.5.27 was chosen over 15.5.28 because 15.5.28 falls inside pnpm 11's minimum release age.
  • No schema or config changes, and no migration is needed.
  • Dependabot security updates are disabled on this repo, so no automatic PR was opened.

Verification

  • pnpm install --frozen-lockfile, typecheck, and 156 unit tests pass.
  • Full pnpm build and integration tests were not run; please verify magic link and OAuth sign-in on a preview deploy before merging.

Summary by CodeRabbit

  • Chores
    • Updated application components as part of routine maintenance.
    • No user-facing features or behavior changes are included in this release.