fix(agentex-ui): bump next 15.5.18 -> 15.5.21 (8 CVEs)

[scale-prodsec]

Summary

Bumps next from 15.5.18 → 15.5.21 in agentex-ui/ to remediate 8 Trivy findings on the golden/agentex-ui container image. next is a direct dependency; the fix stays on the 15.x major (avoids the 16.2.11 major bump) to minimize API drift — it is a patch-level upgrade within 15.5.x.

CVEs closed

• CVE-2026-64641 (HIGH) — DoS in App Router using Server Actions
• CVE-2026-64643 (MEDIUM) — Unauthenticated disclosure of internal Server Function endpoints
• CVE-2026-64644 (MEDIUM) — DoS in the Image Optimization API using SVGs
• CVE-2026-64645 (HIGH) — SSRF in rewrites via attacker-controlled destination hostname
• CVE-2026-64646 (MEDIUM) — Unbounded Server Action payload in Edge runtime
• CVE-2026-64647 (MEDIUM) — Cache confusion of response bodies (invalid UTF-8 byte sequences)
• CVE-2026-64648 (MEDIUM) — Cache confusion of response bodies for requests with bodies
• CVE-2026-64649 (HIGH) — SSRF in Server Actions on custom servers

Fixed by upstream Next.js v15.5.21 (advisory GHSA-m99w-x7hq-7vfj and related).

Changes

• agentex-ui/package.json: next pin 15.5.18 → 15.5.21 (exact-pin style preserved)
• agentex-ui/package-lock.json: re-locked via npm install --package-lock-only. Changed closure is exactly next, @next/env, and the 8 @next/swc-* platform binaries — all 15.5.18 → 15.5.21, all resolved from registry.npmjs.org. No other entries, no registry drift, lockfileVersion 3 preserved.

Verification

• python -m bot.version_gate --ecosystem node-pkg --package next --candidate 15.5.21 → 15.5.21 selected, zero known vulnerabilities.
• npm ci (immutable install, the CI gate) succeeds — package.json and package-lock.json agree.
• node node_modules/.bin/next --version → Next.js v15.5.21.
• npm audit no longer flags next for any of the 8 CVEs above.

Ticket

Resolves GFDVR-20748 (children: GFDVR-20749, GFDVR-20750, GFDVR-20751, GFDVR-20752, GFDVR-20753, GFDVR-20754, GFDVR-20755, GFDVR-20756).

🤖 Generated with Claude Code

Greptile Summary

Patches next from 15.5.18 → 15.5.21 (Maintenance LTS) in agentex-ui/ to remediate 8 high/moderate CVEs published by the Next.js team on 2026-07-21. The fix is a minimal, contained patch upgrade — only next, @next/env, and the 8 @next/swc-* platform binaries change in the lock file.

• agentex-ui/package.json: Exact pin updated from 15.5.18 to 15.5.21; no other dependency changes.
• agentex-ui/package-lock.json: All Next.js-owned packages re-locked to 15.5.21; 4 Linux SWC entries gain a new libc field (glibc/musl) — this is a metadata addition from the upstream package and improves platform binary selection by npm.
• The PR description lists 8 CVEs, but the official v15.5.21 release notes include a 9th advisory (CVE-2026-64642 / GHSA-6gpp-xcg3-4w24, High — Middleware/Proxy bypass with Turbopack + single locale); the version bump fixes all 9 regardless.

Confidence Score: 5/5

Safe to merge — a narrow, well-scoped patch that upgrades only the Next.js package family to close confirmed security advisories, with no other dependency changes.

The change touches only next, @next/env, and the 8 @next/swc-* optional platform binaries — all moving from 15.5.18 to 15.5.21. The lock file is consistent, the integrity hashes match the npm registry, and the upstream release is the official Maintenance LTS security patch for these CVEs. The new libc metadata fields on 4 Linux SWC entries are a benign addition introduced by the upstream package.

Files Needing Attention: No files require special attention.

Important Files Changed

Filename	Overview
agentex-ui/package.json	Single-line change: exact pin for next bumped from 15.5.18 to 15.5.21 to address confirmed CVEs
agentex-ui/package-lock.json	Lock file re-generated: next, @next/env, and all 8 @next/swc-* platform binaries updated from 15.5.18 to 15.5.21; 4 Linux SWC entries gained a libc field (new metadata in 15.5.21) — no other packages touched, lockfileVersion 3 preserved

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["package.json\nnext: 15.5.18 to 15.5.21"] --> B["npm install --package-lock-only"]
    B --> C["package-lock.json updated"]
    C --> D["next 15.5.21"]
    C --> E["@next/env 15.5.21"]
    C --> F["@next/swc-darwin-arm64 15.5.21"]
    C --> G["@next/swc-darwin-x64 15.5.21"]
    C --> H["@next/swc-linux-arm64-gnu 15.5.21 + libc glibc"]
    C --> I["@next/swc-linux-arm64-musl 15.5.21 + libc musl"]
    C --> J["@next/swc-linux-x64-gnu 15.5.21 + libc glibc"]
    C --> K["@next/swc-linux-x64-musl 15.5.21 + libc musl"]
    C --> L["@next/swc-win32-arm64-msvc 15.5.21"]
    C --> M["@next/swc-win32-x64-msvc 15.5.21"]
    D --> N["Fixes 9 CVEs: High 64641 64642 64645 64649\nModerate 64643 64644 64646 64647 64648"]

Loading

_{Reviews (3): Last reviewed commit: "Merge branch 'main' into prodsec/gfdvr-2..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​15.5.18 ⏵ 15.5.21		+31	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential vulnerability: npm next with risk level "medium" Location: Package overview From: agentex-ui/package-lock.json → npm/next@15.5.21 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@15.5.21. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report