Update npm package next to v15.5.27 [SECURITY]

[hash-dependencies]

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	15.5.25 → 15.5.27

---

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

CVE-2026-94484 / GHSA-mcj8-r9mp-w47p

More information

Details

Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p
• https://nvd.nist.gov/vuln/detail/CVE-2026-94484
• https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8
• https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52
• https://github.com/vercel/next.js/releases/tag/v15.5.27
• https://github.com/vercel/next.js/releases/tag/v16.3.8
• https://github.com/advisories/GHSA-mcj8-r9mp-w47p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

CVE-2026-94543 / GHSA-4jqv-mc3x-m676

More information

Details

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676
• https://nvd.nist.gov/vuln/detail/CVE-2026-94543
• https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8
• https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52
• https://github.com/vercel/next.js/releases/tag/v15.5.27
• https://github.com/vercel/next.js/releases/tag/v16.3.8
• https://github.com/advisories/GHSA-4jqv-mc3x-m676

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v15.5.27

Compare Source

This release contains security fixes for the following advisories:

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

v15.5.26

Compare Source

This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hash	Ready	Preview	Oct 13, 2026 3:45am UTC

3 Skipped Deployments

Project	Deployment	Actions	Updated
hashdotdesign-tokens	Ignored	Preview	Oct 13, 2026 3:45am UTC
petrinaut	Skipped		Oct 13, 2026 3:45am UTC
petrinaut-docs	Skipped		Oct 13, 2026 3:45am UTC

[cursor]

PR Summary

Low Risk
Version-only change with no app logic edits; patch release reduces known Next.js security exposure with typical low regression risk for a minor bump.

Overview
Bumps the next dependency from 15.5.25 to 15.5.27 in apps/hash-frontend and libs/@local/hash-isomorphic-utils, with matching yarn.lock updates for next and its @next/env / @next/swc-* packages.

This is a patch-level framework upgrade to pick up Next.js security fixes (including SSG/ISR cache-poisoning and related advisories noted in the PR). No application source changes—only manifest and lockfile versions.

^{Reviewed by Cursor Bugbot for commit 50027a1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.98%. Comparing base (7acbf0b) to head (50027a1).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10016      +/-   ##
==========================================
- Coverage   67.98%   67.98%   -0.01%     
==========================================
  Files        1945     1946       +1     
  Lines      201674   201768      +94     
  Branches     8286     8314      +28     
==========================================
+ Hits       137105   137164      +59     
- Misses      62950    62979      +29     
- Partials     1619     1625       +6     

Flag	Coverage Δ
apps.hash-ai-worker-ts	2.04% <ø> (ø)
apps.hash-api	15.33% <ø> (ø)
local.hash-backend-utils	6.01% <ø> (+2.70%)	⬆️
local.hash-isomorphic-utils	12.05% <ø> (-0.17%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.