)]}'
{
  "commit": "210dbf1246211e799f5fd495bce0fcf34f0656b5",
  "tree": "d511ff95ea1d2d5e16004e5d2854b3d72f424104",
  "parents": [
    "811bfabadcb1bb1a5f32b1a388d49de3595065ca"
  ],
  "author": {
    "name": "dependabot[bot]",
    "email": "49699333+dependabot[bot]@users.noreply.github.com",
    "time": "Fri Oct 02 15:10:52 2026 +0200"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Fri Oct 02 15:10:52 2026 +0200"
  },
  "message": "Bump next from 14.2.28 to 15.5.24 in /dashboard/client (#2845)\n\nBumps [next](https://github.com/vercel/next.js) from 14.2.28 to 15.5.24.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/vercel/next.js/releases\"\u003enext\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev15.5.24\u003c/h2\u003e\n\u003cp\u003eThis release contains security fixes for the following\nadvisories:\u003c/p\u003e\n\u003cp\u003eCritical:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36\"\u003eUnauthenticated\nRemote Code Execution on windows-hosted servers\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4\"\u003eUnauthenticated\nRemote Code Execution in Image Optimization API when AVIF files are\nused\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev15.5.23\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[15.x] Port ReplyServer traversal guards to FlightClient \u003ca\nhref\u003d\"https://github.com/eps1lon\"\u003e\u003ccode\u003e@​eps1lon\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/pull/96405\"\u003evercel/next.js#96405\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/vercel/next.js/compare/v15.5.22...v15.5.23\"\u003ehttps://github.com/vercel/next.js/compare/v15.5.22...v15.5.23\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev15.5.22\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[15.5] Reject TypeScript \u0026gt;\u003d 7.0 with an actionable error by \u003ca\nhref\u003d\"https://github.com/lukesandberg\"\u003e\u003ccode\u003e@​lukesandberg\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/pull/96110\"\u003evercel/next.js#96110\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/vercel/next.js/compare/v15.5.21...v15.5.22\"\u003ehttps://github.com/vercel/next.js/compare/v15.5.21...v15.5.22\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev15.5.21\u003c/h2\u003e\n\u003cp\u003eThis release contains security fixes for the following\nadvisories:\u003c/p\u003e\n\u003cp\u003eHigh:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj\"\u003eDenial\nof Service in App Router using Server Actions\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24\"\u003eMiddleware\n/ Proxy bypass in App Router applications using Turbopack and single\nlocale\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4\"\u003eServer-Side\nRequest Forgery in rewrites via attacker-controlled destination\nhostname\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x\"\u003eServer-Side\nRequest Forgery in Server Actions on custom servers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eModerate:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742\"\u003eCache\nconfusion of response bodies for requests with bodies\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q\"\u003eCache\nconfusion of response bodies for requests with bodies containing invalid\nUTF-8 byte sequences\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch\"\u003eDenial\nof Service in the Image Optimization API using SVGs\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp\"\u003eUnauthenticated\ndisclosure of internal Server Function endpoints\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3\"\u003eUnbounded\nServer Action payload in Edge runtime\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/b6c45b4042ff5c5b700831887115da3fc2bd2b1f\"\u003e\u003ccode\u003eb6c45b4\u003c/code\u003e\u003c/a\u003e\nv15.5.24\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3\"\u003e\u003ccode\u003eb0f3460\u003c/code\u003e\u003c/a\u003e\n[15.5.x] Fix ISR misses with backslashes in segments when deployed on\nWindows\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2\"\u003e\u003ccode\u003e409772e\u003c/code\u003e\u003c/a\u003e\n[15.5.x] [next/image]: disable avif image optimization\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/9c44b882b7a2adcc9a7b3ebe3c302ad8f7fe28f3\"\u003e\u003ccode\u003e9c44b88\u003c/code\u003e\u003c/a\u003e\n[15.x] support sharp 0.34 and 0.35\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/144fa5d4fdb0507770c4904905d66b2c205f1b3c\"\u003e\u003ccode\u003e144fa5d\u003c/code\u003e\u003c/a\u003e\n[15.5.x] Remove generated error codes (\u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/issues/97783\"\u003e#97783\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/ddd94f0ab8c12a8504a311e10f6c161d343785f4\"\u003e\u003ccode\u003eddd94f0\u003c/code\u003e\u003c/a\u003e\n[15.5.x] Authenticate Turborepo remote caching with OIDC instead of a\nstatic ...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/1da7a0a04975be60159e306d010054fac48502ca\"\u003e\u003ccode\u003e1da7a0a\u003c/code\u003e\u003c/a\u003e\n[15.5] [ci] Use OIDC tokens to read private preview builds (\u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/issues/97259\"\u003e#97259\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/70ab0fe6256d77a15e71c446cbcbbf5bf89b3b94\"\u003e\u003ccode\u003e70ab0fe\u003c/code\u003e\u003c/a\u003e\n[15.x] Default deploy e2e tests to the repo next version (\u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/issues/96899\"\u003e#96899\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/e57d564456b23ec1149a1bfeb297af40bf9d3f59\"\u003e\u003ccode\u003ee57d564\u003c/code\u003e\u003c/a\u003e\nv15.5.23\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/vercel/next.js/commit/c4914aa654e0748af49240d488285e2d745fdcdf\"\u003e\u003ccode\u003ec4914aa\u003c/code\u003e\u003c/a\u003e\n[15.x] Port ReplyServer traversal guards to FlightClient (\u003ca\nhref\u003d\"https://redirect.github.com/vercel/next.js/issues/96405\"\u003e#96405\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/vercel/next.js/compare/v14.2.28...v15.5.24\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eMaintainer changes\u003c/summary\u003e\n\u003cp\u003eThis version was pushed to npm by \u003ca\nhref\u003d\"https://www.npmjs.com/~GitHub%20Actions\"\u003eGitHub Actions\u003c/a\u003e, a new\nreleaser for next since your current version.\u003c/p\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dnext\u0026package-manager\u003dnpm_and_yarn\u0026previous-version\u003d14.2.28\u0026new-version\u003d15.5.24)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts\npage](https://github.com/bazelbuild/continuous-integration/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "df4e596b5f2a2a66b81c02ccd5ab912fea7e96c9",
      "old_mode": 33188,
      "old_path": "dashboard/client/package-lock.json",
      "new_id": "9d5de010716ccceb5ce8edd40d300bb7f2d8d0d7",
      "new_mode": 33188,
      "new_path": "dashboard/client/package-lock.json"
    },
    {
      "type": "modify",
      "old_id": "a63f2d7f17baab513243966b0838be380da339fb",
      "old_mode": 33188,
      "old_path": "dashboard/client/package.json",
      "new_id": "57474f595c9cefce09b574565d83058d5b163f6f",
      "new_mode": 33188,
      "new_path": "dashboard/client/package.json"
    }
  ]
}