Fix high and critical npm advisories for next, sharp, js-yaml and svgo

[brionmario]

Purpose

Resolves the high and critical advisories reported by pnpm audit --audit-level=high, which was failing CI with exit code 1.

Severity	Package	Advisory	Patched
critical	next	GHSA-p293-qw3h-jr36 — unauthenticated RCE on Windows-hosted servers	>=15.5.24
critical	next	GHSA-2xp9-vwfh-vxw4 — unauthenticated RCE in the Image Optimization API via AVIF	>=15.5.24
high	sharp	GHSA-rgj7-g3m4-5g8c — inherits libheif GHSA-g89c-p67h-r497 / GHSA-2jg2-4ch7-h545	>=0.35.4
high	js-yaml	GHSA-2883-xcg3-v3hh — maxTotalMergeKeys does not bound CPU for empty merge sources	>=4.3.2
high	svgo	GHSA-w27v-7q3p-w38r — removeScripts bypass via namespaces and control characters	>=4.1.0

After this change pnpm audit --audit-level=high exits 0. What remains is below the threshold: 4 moderate and 1 low that is already in auditConfig.ignoreGhsas.

Approach

All four advisories had a fix published on the major line already in use, so no major upgrades were needed.

next — head dependency updated. The only case where upstream had shipped a release we could simply take:

• packages/nextjs: 15.5.23 → 15.5.25 (devDependency)
• samples/nextjs/quickstart: ^15.5.23 → ^15.5.25
• samples/integrations/better-auth/nextjs: ^15.5.23 → ^15.5.25

Only one next instance exists in the tree, so this closed all 5 audit paths, including the better-auth > next ones.

sharp, js-yaml, svgo — existing overrides raised. These were not new advisories against unpinned packages. pnpm-workspace.yaml already carried an override for each, and each had since become vulnerable at the version it was pinned to:

Override	Was	Now
sharp	0.35.0	0.35.4
js-yaml	4.3.1	4.3.2
svgo	4.0.2	4.1.0

Two deliberate decisions here:

1. The new advisory is appended to each JUSTIFICATION comment rather than replacing the original rationale — the older flaws still apply, so the comment needs to explain both.
2. No new tracking issues were filed. The repo's override path normally pairs a new override with a tracking issue, but these are established pins being bumped, not new overrides, and the existing entries carry no tracking URLs. Happy to file them if preferred.

Every new pin sits inside the range its parent already declares (@eslint/eslintrc wants ^4.3.0, postcss-svgo wants ^4.0.2), so nothing is forced against an incompatible constraint.

Lockfile drift. Re-resolving moved a few transitives beyond the four targets, worth a look when reviewing pnpm-lock.yaml: css-select 5.2.2 → 6.0.0 and css-what 6.2.2 → 7.0.0 (major bumps, but they are svgo 4.1.0's own declared dependencies), sax 1.6.0 → 1.6.1, a dropped caniuse-lite, and an @emnapi/runtime patch under rolldown.

Not changed. packages/nextjs still declares "next": ">=15.5.18" as a peer dependency, which permits vulnerable versions in consumer apps. Raising that floor to >=15.5.24 is a breaking change for SDK consumers, so it is left for a future major rather than folded into a security patch.

Related Issues

• N/A

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
  • pnpm audit --audit-level=high → exit 0
  • pnpm --filter @thunderid/nextjs run build → passes
  • pnpm --filter @thunderid/nuxt run build → passes (exercises the svgo CSS pipeline)
  • pnpm --filter @thunderid/nextjs run test → 30/30 passing
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: fc1875ff-fc95-4197-9cfa-a3ea57a3abe5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}