Update Next.js to 15.2.5 to address security advisory

[vannputh]

Motivation

• Vercel build output reported a vulnerable Next.js version (15.2.4) (security advisory CVE referenced), so the dependency needs to be bumped to a patched release.

Description

• Bumped next from 15.2.4 to 15.2.5 in package.json.
• Updated pnpm-lock.yaml entries to align the lockfile (including @next/* and SWC optional packages) to 15.2.5.
• Committed the updated files and opened the PR titled "Update Next.js to address security advisory".

Testing

• The project previously ran a Vercel build which completed but emitted an automated warning/error about the vulnerable Next.js version; this motivated the update.
• An attempt to run pnpm up next@15.2.5 in this environment failed due to registry authentication (403), so the lockfile was updated in-place and committed instead.
• No further automated tests or CI/builds were run against the updated dependency in this rollout.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
spotinyl	Error		Jan 26, 2026 8:21am