chore(deps)(deps): bump next from 15.5.16 to 15.5.18

[dependabot]

Bumps next from 15.5.16 to 15.5.18.

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Commits

• 9ff92ce v15.5.18
• 00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
• 62c97ab v15.5.17
• 423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
• fa78739 Turbopack: Fix middleware matcher suffix (#93590)
• 36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
• 36589b5 [backport][test] Pin package manager to patch versions (#93596)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Labels

The following labels could not be found: area:libs. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Repo Manager PR Triage

Risk level: High

Applied or recommended labels:

• area:frontend
• area:security
• kind:chore
• priority:high
• status:ready

Applied or recommended milestone:

• none

Related issues:

• No strong issue match found from title/body/scope.

Required checks:

• CI for dependency update (install/build/test) should pass before merge.

Recommended reviewers / owner areas:

• Frontend and security maintainers.

Notes:

• This PR upgrades next to a security-fix release (15.5.18) and updates lockfile state.
• Dependabot reported a repository label mismatch (area:libs not found). A repo-manager report issue was opened for maintainers to fix label sync/config consistency.

Generated by Helix AI Repo Manager for issue #294 · ◷

[github-actions]

Dependency Manager Security Review

This appears to be a security-related dependency update for next in apps/frontend plus lockfile regeneration.

Risk level: High

Recommended next action:

• Review the Next.js advisories/changelog impact for your app routes and middleware usage.
• Run full CI/security validation and proceed once required checks are green.
• Keep this PR out of auto-merge until checks are confirmed and maintainer review is complete.

Auto-merge was not enabled for this PR.

Note

🔒 Integrity filter blocked 78 items

The following items were blocked because they don't meet the GitHub integrity level.

• #236 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #235 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #229 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #217 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #216 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #211 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #210 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #208 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #203 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• core-11.1.9.tgz: 2 vulnerabilities (highest severity is: 7.5) #253 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• config-0.0.1.tgz: 1 vulnerabilities (highest severity is: 4.3) #251 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• react-11.14.0.tgz: 1 vulnerabilities (highest severity is: 4.3) #250 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• common-11.1.9.tgz: 2 vulnerabilities (highest severity is: 5.3) #249 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• axios-1.13.2.tgz: 1 vulnerabilities (highest severity is: 7.5) #246 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• next-16.0.7.tgz: 7 vulnerabilities (highest severity is: 6.5) #245 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• db-0.0.1.tgz: 7 vulnerabilities (highest severity is: 10.0) #243 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 62 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Helix AI Dependency Manager · ◷

[dependabot]

Superseded by #314.