security: bump 15 package(s) in npm#168
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Wiz Scan Summary
|
| Scanner | Findings |
|---|---|
 |
3     |
 |
- |
 |
- |
 |
- |
 |
- |
 |
- |
| Total | 3 |
To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.
![wiz-6cbc7756d1[bot]](https://avatars.githubusercontent.com/b/268422?s=60&v=4){kind=small}
| "@story-protocol/ipkit": "workspace:*", | ||
| "@tanstack/react-query": "^5.28.9", | ||
| "next": "14.2.35", | ||
| "next": "15.0.8", |
There was a problem hiding this comment.
The following vulnerabilities impact next versions <15.5.16: CVE-2024-56332, CVE-2025-29927, CVE-2025-32421, CVE-2025-48068, CVE-2025-49826, CVE-2025-55173, CVE-2025-57752, CVE-2025-57822, CVE-2025-59471, CVE-2026-23869, CVE-2026-23870, CVE-2026-27980, CVE-2026-29057, CVE-2026-44572, CVE-2026-44573, CVE-2026-44576, CVE-2026-44577, CVE-2026-44578, CVE-2026-44579, CVE-2026-44580, CVE-2026-44581, CVE-2026-44582.
These can be remediated by updating to version 15.5.16 or higher.
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
| "next": "15.0.8", | |
| "next": "15.5.16", |
| "@story-protocol/ipkit": "workspace:*", | ||
| "@tanstack/react-query": "^5.28.9", | ||
| "next": "14.2.35", | ||
| "next": "15.0.8", |
There was a problem hiding this comment.
The following vulnerabilities impact next versions <15.5.16: CVE-2024-56332, CVE-2025-29927, CVE-2025-32421, CVE-2025-48068, CVE-2025-49826, CVE-2025-55173, CVE-2025-57752, CVE-2025-57822, CVE-2025-59471, CVE-2026-23869, CVE-2026-23870, CVE-2026-27980, CVE-2026-29057, CVE-2026-44572, CVE-2026-44573, CVE-2026-44576, CVE-2026-44577, CVE-2026-44578, CVE-2026-44579, CVE-2026-44580, CVE-2026-44581, CVE-2026-44582.
These can be remediated by updating to version 15.5.16 or higher.
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
| "next": "15.0.8", | |
| "next": "15.5.16", |
| next@14.2.35: | ||
| resolution: {integrity: sha512-KhYd2Hjt/O1/1aZVX3dCwGXM1QmOV4eNM2UTacK5gipDdPN/oHHK/4oVGy7X8GMfPMsUTUEmGlsy0EY1YGAkig==} | ||
| engines: {node: '>=18.17.0'} | ||
| next@15.0.8: |
There was a problem hiding this comment.
More Details
Vulnerabilities [next:15.0.8]
| Name | Severity | Source | Fixed version | CVSS score | CVSS exploitability score | Has public exploit | Has CISA KEV exploit |
|---|---|---|---|---|---|---|---|
CVE-2024-56332 |
 |
https://github.com/advisories/GHSA-7m27-7ghc-44w9 |
15.1.2 |
5.3 | 3.9 | false | false |
CVE-2025-29927 |
 |
https://github.com/advisories/GHSA-f82v-jwr5-mffw |
15.2.3 |
9.1 | 3.9 | true | false |
CVE-2025-32421 |
 |
https://github.com/advisories/GHSA-qpjv-v59x-3qc4 |
15.1.6 |
3.7 | 2.2 | true | false |
CVE-2025-48068 |
|
https://github.com/advisories/GHSA-3h52-269p-cp9r |
15.2.2 |
2.3 | 2.8 | false | false |
CVE-2025-49826 |
 |
https://github.com/advisories/GHSA-67rr-84xm-4c7r |
15.1.8 |
7.5 | 3.9 | false | false |
CVE-2025-55173 |
|
https://github.com/advisories/GHSA-xv57-4mr9-wg8v |
15.4.5 |
4.3 | 2.8 | false | false |
CVE-2025-57752 |
|
https://github.com/advisories/GHSA-g5qg-72qw-gw5v |
15.4.5 |
6.2 | 2.5 | false | false |
CVE-2025-57822 |
|
https://github.com/advisories/GHSA-4342-x723-ch2f |
15.4.7 |
8.2 | 3.9 | true | false |
CVE-2025-59471 |
|
https://github.com/advisories/GHSA-9g9p-9gw9-jx7f |
15.5.10 |
7.5 | 3.9 | false | false |
CVE-2026-23869 |
|
https://github.com/advisories/GHSA-q4gf-8mx6-v5v3 |
15.5.15 |
7.5 | 3.9 | true | false |
CVE-2026-23870 |
|
https://github.com/advisories/GHSA-8h8q-6873-q5fj |
15.5.16 |
7.5 | 3.9 | true | false |
CVE-2026-27980 |
|
https://github.com/advisories/GHSA-3x4c-7xq6-9pq8 |
15.5.14 |
6.9 | 3.9 | false | false |
CVE-2026-29057 |
|
https://github.com/advisories/GHSA-ggv3-7p47-pfv8 |
15.5.13 |
6.3 | 3.9 | false | false |
CVE-2026-44572 |
|
https://github.com/advisories/GHSA-3g8h-86w9-wvmq |
15.5.16 |
5.9 | 2.2 | true | false |
CVE-2026-44573 |
|
https://github.com/advisories/GHSA-36qx-fr4f-26g5 |
15.5.16 |
7.5 | 3.9 | true | false |
CVE-2026-44576 |
|
https://github.com/advisories/GHSA-wfc6-r584-vfw7 |
15.5.16 |
5.4 | 2.2 | true | false |
CVE-2026-44577 |
|
https://github.com/advisories/GHSA-h64f-5h5j-jqjh |
15.5.16 |
5.9 | 2.2 | true | false |
CVE-2026-44578 |
|
https://github.com/advisories/GHSA-c4j6-fc7j-m34r |
15.5.16 |
8.6 | 3.9 | true | false |
CVE-2026-44579 |
|
https://github.com/advisories/GHSA-mg66-mrh9-m8jx |
15.5.16 |
7.5 | 3.9 | true | false |
CVE-2026-44580 |
|
https://github.com/advisories/GHSA-gx5p-jg67-6x7h |
15.5.16 |
6.1 | 2.8 | true | false |
CVE-2026-44581 |
|
https://github.com/advisories/GHSA-ffhc-5mcf-pf4q |
15.5.16 |
4.7 | 1.6 | true | false |
CVE-2026-44582 |
|
https://github.com/advisories/GHSA-vfv6-92ff-j949 |
15.5.16 |
3.7 | 2.2 | true | false |
To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason
If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate
1 participant
Security dependency upgrade
This PR was opened by depagent to address 15 security alert(s) in the
npmecosystem.Each package is pinned to exactly the patched version reported by Dependabot's
first_patched_version— not a range. To restore a range constraint (e.g.^x.y.z), edit the manifest after merge.Alerts addressed
nextnextnextnextnextnextnextnextnextnextnextnextnextnextnextNotes
pnpm.overrides/overrides/resolutions). The vulnerable package isn't declared directly in the manifest — the override pins it to the patched version across the entire dependency graph for that workspace.Generated by depagent —
storyprotocol/ipkit.